Function at 0x14007b4d0
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
push rbp
push r15
lea rbp, [rsp - 0x4f]
sub rsp, 0x98
xor edx, edx
mov r15, rcx
call fcn.140024c30
mov edx, eax
shr edx, 0x1f
test dl, dl
jne 0x14007b76c
mov ecx, 0xce4
mov dword [r15 + 0xa30], 0xce4
call fcn.1400b609c
mov qword [r15 + 0x270], rax
test rax, rax
jne 0x14007b528
mov eax, 0x80040202
add rsp, 0x98
pop r15
pop rbp
ret
mov eax, dword [r15 + 0x260]
lea r9, [rbp + 0x6f]
mov rcx, qword [r15 + 0x38]
lea rdx, [rbp - 0x19]
mov qword [rsp + 0xb0], rbx
xor ebx, ebx
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x78], r13
lea r8d, [rbx + 0xc]
mov qword [rsp + 0x70], r14
lea r13d, [rbx + 1]
mov qword [r15 + 0xa28], rbx
lea r12d, [rbx + 2]
mov qword [rbp + 0x77], 0x61746164
mov dword [rbp - 9], 0x74636166
mov qword [rbp - 5], 4
mov dword [rbp + 7], 0x20746d66
mov dword [rbp + 0xb], send
mov dword [rbp + 0xf], 0x10303
mov dword [rbp + 0x13], eax
mov dword [rbp + 0x17], 0x7d0
mov dword [rbp + 0x1b], 0x20001
mov word [rbp + 0x1f], bx
mov qword [rbp - 0x19], 0x46464952
mov dword [rbp - 0x11], 0x45564157
mov dword [rbp + 0x6f], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [r15 + 0x38]
lea r9, [rbp + 0x6f]
lea r8d, [rbx + 0x1c]
mov dword [rbp + 0x6f], ebx
lea rdx, [rbp + 7]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [r15 + 0x38]
lea r9, [rbp + 0x6f]
lea r8d, [rbx + 0xc]
mov dword [rbp + 0x6f], ebx
lea rdx, [rbp - 9]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [r15 + 0x38]
lea r9, [rbp + 0x6f]
lea r8d, [rbx + 8]
mov dword [rbp + 0x6f], ebx
lea rdx, [rbp + 0x77]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [r15 + 0x38]
lea r8, [rbp + 0x6f]
mov r9d, r13d
mov qword [rbp + 0x6f], rbx
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rsi, 0xffffffffffffffff
lea rcx, [r15 + 0x298]
test eax, eax
movzx edx, r13b
cmovne rsi, qword [rbp + 0x6f]
call fcn.140037160
mov rcx, r15
call fcn.1400246e0
lea rcx, [r15 + 0x298]
mov r14d, eax
call fcn.140038fc0
mov rcx, qword [r15 + 0x270]
call fcn.1400b60a4
mov rcx, qword [r15 + 0x38]
lea r9, [rbp + 0x6f]
mov r8d, r12d
mov qword [r15 + 0x270], rbx
lea rdx, [0x140148be0]
mov dword [rbp + 0x6f], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r9d, r13d
mov qword [rbp + 0x6f], rbx
lea r8, [rbp + 0x6f]
mov rcx, qword [r15 + 0x38]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov ecx, 0xffffffff
mov edx, ebx
test eax, eax
cmovne ecx, dword [rbp + 0x6f]
xor r9d, r9d
sub ecx, esi
xor r8d, r8d
mov dword [rbp + 0x7b], ecx
lea eax, [rcx + 0x34]
mov rcx, qword [r15 + 0x38]
mov dword [rbp - 0x15], eax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [r15 + 0x38]
lea r9, [rbp + 0x6f]
lea r8d, [rbx + 0xc]
mov dword [rbp + 0x6f], ebx
lea rdx, [rbp - 0x19]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [r15 + 0x38]
lea edx, [rbx + 0x28]
mov r9d, r13d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [r15 + 0x38]
lea r9, [rbp + 0x6f]
lea r8d, [rbx + 8]
mov dword [rbp + 0x6f], ebx
lea rdx, [rbp + 0x77]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r13, qword [rsp + 0x78]
mov eax, r14d
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0xb0]
add rsp, 0x98
pop r15
pop rbp
ret