Function at 0x14000a490
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime
Write file on windows

Disassembly:
push rbp
push rbx
push r14
lea rbp, [rsp - 0x1ad0]
mov eax, 0x1bd0
call fcn.140033940
sub rsp, rax
mov rax, qword [0x1400a3158]
xor rax, rsp
mov qword [rbp + 0x1aa0], rax
movdqa xmm0, xmmword [0x14007a9f0]
movdqa xmm1, xmmword [0x14007a9a0]
movdqu xmmword [rbp + 0x40], xmm0
mov qword [rbp - 0x38], rcx
lea rcx, [rbp - 0x30]
movdqa xmm0, xmmword [0x14007a9e0]
movdqu xmmword [rbp + 0x58], xmm0
mov qword [rsp + 0x40], rdx
movdqa xmm0, xmmword [0x14007a9b0]
movdqu xmmword [rbp + 0x28], xmm0
mov dword [rbp - 0x30], 0x686e6977
movdqa xmm0, xmmword [str.WinHttpReadData]
movdqu xmmword [rbp + 0x88], xmm0
mov dword [rbp - 0x2c], 0x2e707474
mov dword [rbp - 0x28], 0x6c6c64
mov dword [rbp - 0x20], 0x486e6957
mov dword [rbp - 0x1c], 0x4f707474
mov dword [rbp - 0x18], 0x6e6570
mov dword [rbp - 0x10], 0x486e6957
mov dword [rbp - 0xc], 0x43707474
mov dword [rbp - 8], 0x656e6e6f
mov word [rbp - 4], 0x7463
mov byte [rbp - 2], 0
mov word [rbp + 0x50], 0x7473
mov byte [rbp + 0x52], 0
mov word [rbp + 0x68], 0x7473
mov byte [rbp + 0x6a], 0
mov dword [rbp + 0x38], 0x6e6f7073
mov word [rbp + 0x3c], 0x6573
mov byte [rbp + 0x3e], 0
movdqu xmmword [rbp + 0x70], xmm1
mov word [rbp + 0x80], 0x656c
mov byte [rbp + 0x82], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ebx, ebx
test rax, rax
je 0x14000a5a9
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
jmp 0x14000a5ac
mov r14, rbx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x1bc0], r12
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14000a5d5
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
jmp 0x14000a5d8
mov r12, rbx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x1bc8], rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14000a601
lea rdx, [rbp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
jmp 0x14000a604
mov rdi, rbx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x1bb8], r13
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14000a62d
lea rdx, [rbp + 0x58]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
jmp 0x14000a630
mov r13, rbx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x1c00], rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14000a659
lea rdx, [rbp + 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
jmp 0x14000a65c
mov rsi, rbx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x1bb0], r15
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14000a688
lea rdx, [rbp + 0x88]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
jmp 0x14000a68b
mov r15, rbx
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14000a6aa
lea rdx, [rbp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
xor eax, eax
mov dword [rbp], 0x650053
xor r9d, r9d
mov dword [rsp + 0x20], eax
xor r8d, r8d
mov dword [rbp + 4], 0x750063
xor edx, edx
mov dword [rbp + 8], 0x650072
lea rcx, [rbp]
mov dword [rbp + 0xc], 0x690057
mov dword [rbp + 0x10], 0x48006e
mov dword [rbp + 0x14], 0x540054
mov dword [rbp + 0x18], 0x2f0050
mov dword [rbp + 0x1c], 0x2e0031
mov dword [rbp + 0x20], 0x30
call r14
mov r14, rax
test rax, rax
je 0x14000a836
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x68]
call fcn.1400516a0
mov rcx, qword [rbp - 0x38]
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x68], rax
lea r9, [rsp + 0x50]
lea rax, [rbp + 0x2a0]
mov dword [rsp + 0x50], 0x68
xor r8d, r8d
mov qword [rbp - 0x68], rax
xor edx, edx
mov dword [rsp + 0x70], 0x100
mov dword [rbp - 0x60], 0x400
call qword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
movzx r8d, word [rsp + 0x74]
lea rdx, [rbp + 0xa0]
xor r9d, r9d
mov rcx, r14
call r12
mov r12, rax
test rax, rax
je 0x14000a831
xor edx, edx
lea r8, [rbp + 0x2a0]
cmp dword [rsp + 0x64], 2
mov eax, edx
mov ecx, 0x800000
cmove eax, ecx
xor r9d, r9d
mov dword [rsp + 0x30], eax
mov rcx, r12
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rdx
lea rdx, [0x14007a688]
call rdi
mov rdi, rax
test rax, rax
je 0x14000a82c
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov dword [rsp + 0x28], eax
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x20], eax
call r13
test eax, eax
setne r13b
test eax, eax
je 0x14000a7ef
xor edx, edx
mov rcx, rdi
call rsi
test eax, eax
setne r13b
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000a83a
mov rcx, rdi
call rbx
mov rcx, r12
call rbx
mov rcx, r14
call rbx
xor al, al
jmp 0x14000a89f
test r13b, r13b
je 0x14000a883
nop
lea r9, [rbp - 0x40]
mov r8d, 0x1000
lea rdx, [rbp + 0xaa0]
mov rcx, rdi
call r15
test eax, eax
je 0x14000a883
mov r8d, dword [rbp - 0x40]
test r8d, r8d
je 0x14000a883
lea r9, [rbp - 0x38]
mov qword [rsp + 0x20], 0
lea rdx, [rbp + 0xaa0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x14000a840
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call rbx
mov rcx, r12
call rbx
mov rcx, r14
call rbx
movzx eax, r13b
mov r15, qword [rsp + 0x1bb0]
mov r13, qword [rsp + 0x1bb8]
mov r12, qword [rsp + 0x1bc0]
mov rdi, qword [rsp + 0x1bc8]
mov rsi, qword [rsp + 0x1c00]
mov rcx, qword [rbp + 0x1aa0]
xor rcx, rsp
call fcn.1400332c0
add rsp, 0x1bd0
pop r14
pop rbx
pop rbp
ret