Function at 0x14000e390
Capabilities:
Clear file content
Contain obfuscated stackstrings
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov r14, rcx
mov rax, qword [0x1400503c8]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rcx, qword [rcx + 8]
mov rax, qword [r14 + 0x10]
mov qword [r14 + 0x2068], rax
mov byte [r14 + 0x2070], 0x24
mov qword [r14 + 0x2078], rdx
xor esi, esi
xor edx, edx
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
test eax, eax
je 0x14000e721
lea r12, [r14 + 0x2068]
mov rdi, qword [r14 + 8]
mov dword [rsp + 0x28], 0
mov ebx, 0x68
lea r15, [rsp + 0x28]
mov r13, qword [sym.imp.KERNEL32.DLL_WriteFile]
xor ebp, ebp
nop word [rax + rax]
mov edx, esi
add rdx, r12
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov r8d, ebx
mov r9, r15
call r13
test eax, eax
je 0x14000e9cd
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x14000e9cd
add esi, eax
add ebp, eax
sub ebx, eax
cmp ebp, 0x68
jne 0x14000e420
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.DLL_SetEndOfFile]
mov rcx, qword [r14 + 8]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
mov esi, eax
test eax, eax
jne 0x14000ec80
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rdx, qword [r14]
mov byte [rsp + 0x28], 0
lea rcx, [rsp + 0x29]
mov byte [rsp + 0x29], 0x4f
mov byte [rsp + 0x2a], gethostname
mov byte [rsp + 0x2b], 4
mov byte [rsp + 0x2c], gethostname
mov byte [rsp + 0x2d], 0x23
mov byte [rsp + 0x2e], gethostname
mov byte [rsp + 0x2f], reloc.WS2_32.dll_shutdown
mov byte [rsp + 0x30], gethostname
mov byte [rsp + 0x31], shutdown
mov byte [rsp + 0x32], gethostname
mov byte [rsp + 0x33], 0x67
mov byte [rsp + 0x34], gethostname
mov byte [rsp + 0x35], 0x4c
mov byte [rsp + 0x36], gethostname
mov byte [rsp + 0x37], 0x19
mov byte [rsp + gethostname], 0x38
mov byte [rsp + 0x39], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x3a], gethostname
mov byte [rsp + 0x3b], shutdown
mov byte [rsp + 0x3c], gethostname
mov byte [rsp + 0x3d], 0x79
mov byte [rsp + 0x3e], gethostname
mov byte [rsp + 0x3f], 0x67
mov byte [rsp + 0x40], gethostname
mov byte [rsp + 0x41], 0x6a
mov byte [rsp + 0x42], gethostname
mov byte [rsp + 0x43], 0x79
mov byte [rsp + 0x44], gethostname
mov byte [rsp + 0x45], 0x47
mov byte [rsp + 0x46], gethostname
mov byte [rsp + 0x47], 0x67
mov byte [rsp + 0x48], gethostname
mov byte [rsp + 0x49], gethostname
mov byte [rsp + 0x4a], gethostname
mov byte [rsp + 0x4b], 0x60
mov byte [rsp + 0x4c], gethostname
mov byte [rsp + 0x4d], 0x19
mov byte [rsp + 0x4e], gethostname
mov byte [rsp + 0x4f], 0x67
mov byte [rsp + 0x50], gethostname
mov byte [rsp + 0x51], gethostname
mov byte [rsp + 0x52], gethostname
mov byte [rsp + 0x53], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x54], gethostname
mov byte [rsp + 0x55], 0x28
mov byte [rsp + 0x56], gethostname
mov byte [rsp + 0x57], 0x79
mov byte [rsp + 0x58], gethostname
mov byte [rsp + 0x59], 0x67
mov byte [rsp + 0x5a], gethostname
mov byte [rsp + 0x5b], 0x1b
mov byte [rsp + 0x5c], gethostname
mov byte [rsp + 0x5d], 0x56
mov byte [rsp + 0x5e], gethostname
mov byte [rsp + 0x5f], 0x44
mov byte [rsp + 0x60], gethostname
mov byte [rsp + 0x61], 0x67
mov byte [rsp + 0x62], gethostname
mov byte [rsp + 0x63], 0x45
mov byte [rsp + 0x64], gethostname
mov byte [rsp + 0x65], 0x79
mov byte [rsp + 0x66], gethostname
mov byte [rsp + 0x67], shutdown
mov byte [rsp + 0x68], gethostname
mov byte [rsp + 0x69], pe_nt_image_headers64
mov byte [rsp + 0x6a], gethostname
mov byte [rsp + 0x6b], 4
mov byte [rsp + 0x6c], gethostname
mov byte [rsp + 0x6d], 0x56
mov byte [rsp + 0x6e], gethostname
mov byte [rsp + 0x6f], shutdown
mov byte [rsp + 0x70], gethostname
mov byte [rsp + 0x71], 0x4a
mov byte [rsp + 0x72], gethostname
mov byte [rsp + 0x73], 0x19
mov byte [rsp + 0x74], gethostname
mov byte [rsp + 0x75], 0x19
mov byte [rsp + 0x76], gethostname
mov byte [rsp + 0x77], 0x60
mov byte [rsp + 0x78], gethostname
mov byte [rsp + 0x79], 0x19
mov byte [rsp + 0x7a], gethostname
mov byte [rsp + 0x7b], 0x67
mov byte [rsp + 0x7c], gethostname
mov byte [rsp + 0x7d], 0x5e
mov byte [rsp + 0x7e], gethostname
mov byte [rsp + 0x7f], 0x67
mov byte [rsp + 0x80], gethostname
mov byte [rsp + 0x81], 0x1b
mov byte [rsp + 0x82], gethostname
mov byte [rsp + 0x83], 0x28
mov byte [rsp + 0x84], gethostname
mov byte [rsp + 0x85], 0x51
mov byte [rsp + 0x86], gethostname
mov byte [rsp + 0x87], gethostname
mov byte [rsp + 0x88], gethostname
mov bl, byte [rsp + 0x28]
test bl, 1
jne 0x14000ec76
mov ebp, 1
nop
movzx ebx, byte [rsp + rbp + 0x28]
movzx ebx, bl
lea ebx, [rbx + rbx*4]
lea edi, [rbx + rbx*4]
lea ebx, [rbx + rbx*4]
add ebx, 0xfffffa88
movsx ebx, bx
imul ebx, ebx, 0xffff8103
shr ebx, 0x10
add ebx, edi
add ebx, 0xfffffa88
movzx ebx, bx
mov esi, ebx
shr esi, 0xf
shr ebx, 6
add ebx, esi
mov esi, ebx
shl esi, 7
sub ebx, esi
add ebx, edi
add ebx, 0xfffffa88
add bl, 0x7f
movzx esi, bl
lea edi, [rsi + rsi*2]
shr edi, 8
mov ebx, esi
sub bl, dil
shr bl, 1
add bl, dil
shr bl, 6
movzx edi, bl
mov ebx, edi
shl ebx, 7
sub ebx, edi
sub sil, bl
mov byte [rsp + rbp + 0x28], sil
add rbp, 1
cmp rbp, 0x61
jne 0x14000e6a0
jmp 0x14000ec76
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rdx, qword [r14]
mov byte [rsp + 0x28], 0
lea rcx, [rsp + 0x29]
mov byte [rsp + 0x29], 0x51
mov byte [rsp + 0x2a], 0x7a
mov byte [rsp + 0x2b], 0x26
mov byte [rsp + 0x2c], 0x7a
mov byte [rsp + 0x2d], gethostbyname
mov byte [rsp + 0x2e], 0x7a
mov byte [rsp + 0x2f], 0x1c
mov byte [rsp + 0x30], 0x7a
mov byte [rsp + 0x31], 0xf
mov byte [rsp + 0x32], 0x7a
mov byte [rsp + 0x33], WSAGetLastError
mov byte [rsp + 0x34], 0x7a
mov byte [rsp + 0x35], 0x7d
mov byte [rsp + 0x36], 0x7a
mov byte [rsp + 0x37], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x38], 0x7a
mov byte [rsp + 0x39], 0x23
mov byte [rsp + 0x3a], 0x7a
mov byte [rsp + 0x3b], 0xf
mov byte [rsp + 0x3c], 0x7a
mov byte [rsp + 0x3d], 0x64
mov byte [rsp + 0x3e], 0x7a
mov byte [rsp + 0x3f], WSAGetLastError
mov byte [rsp + 0x40], 0x7a
mov byte [rsp + 0x41], 0x42
mov byte [rsp + 0x42], 0x7a
mov byte [rsp + 0x43], 0x64
mov byte [rsp + 0x44], 0x7a
mov byte [rsp + 0x45], 0x1d
mov byte [rsp + 0x46], 0x7a
mov byte [rsp + 0x47], WSAGetLastError
mov byte [rsp + 0x48], 0x7a
mov byte [rsp + 0x49], reloc.WS2_32.dll_gethostbyname
mov byte [rsp + 0x4a], 0x7a
mov byte [rsp + 0x4b], 1
mov byte [rsp + 0x4c], 0x7a
mov byte [rsp + 0x4d], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x4e], 0x7a
mov byte [rsp + 0x4f], WSAGetLastError
mov byte [rsp + 0x50], 0x7a
mov byte [rsp + 0x51], reloc.WS2_32.dll_gethostbyname
mov byte [rsp + 0x52], 0x7a
mov byte [rsp + 0x53], 0x23
mov byte [rsp + 0x54], 0x7a
mov byte [rsp + 0x55], shutdown
mov byte [rsp + 0x56], 0x7a
mov byte [rsp + 0x57], 0x64
mov byte [rsp + 0x58], 0x7a
mov byte [rsp + 0x59], WSAGetLastError
mov byte [rsp + 0x5a], 0x7a
mov byte [rsp + 0x5b], 0x7c
mov byte [rsp + 0x5c], 0x7a
mov byte [rsp + 0x5d], 0x3f
mov byte [rsp + 0x5e], 0x7a
mov byte [rsp + 0x5f], 0x49
mov byte [rsp + 0x60], 0x7a
mov byte [rsp + 0x61], WSAGetLastError
mov byte [rsp + 0x62], 0x7a
mov byte [rsp + 0x63], 0x10
mov byte [rsp + 0x64], 0x7a
mov byte [rsp + 0x65], 0x64
mov byte [rsp + 0x66], 0x7a
mov byte [rsp + 0x67], 0xf
mov byte [rsp + 0x68], 0x7a
mov byte [rsp + 0x69], 0x1e
mov byte [rsp + 0x6a], 0x7a
mov byte [rsp + 0x6b], 0x26
mov byte [rsp + 0x6c], 0x7a
mov byte [rsp + 0x6d], 0x3f
mov byte [rsp + 0x6e], 0x7a
mov byte [rsp + 0x6f], 0xf
mov byte [rsp + 0x70], 0x7a
mov byte [rsp + 0x71], WSACleanup
mov byte [rsp + 0x72], 0x7a
mov byte [rsp + 0x73], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x74], 0x7a
mov byte [rsp + 0x75], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x76], 0x7a
mov byte [rsp + 0x77], 1
mov byte [rsp + 0x78], 0x7a
mov byte [rsp + 0x79], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x7a], 0x7a
mov byte [rsp + 0x7b], WSAGetLastError
mov byte [rsp + 0x7c], 0x7a
mov byte [rsp + 0x7d], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x7e], 0x7a
mov byte [rsp + 0x7f], WSAGetLastError
mov byte [rsp + 0x80], 0x7a
mov byte [rsp + 0x81], 0x7c
mov byte [rsp + 0x82], 0x7a
mov byte [rsp + 0x83], shutdown
mov byte [rsp + 0x84], 0x7a
mov byte [rsp + 0x85], 0x5e
mov byte [rsp + 0x86], 0x7a
mov byte [rsp + 0x87], 0x7a
mov byte [rsp + 0x88], 0x7a
mov bl, byte [rsp + 0x28]
test bl, 1
jne 0x14000ec76
mov ebp, 1
nop word cs:[rax + rax]
nop dword [rax + rax]
movzx ebx, byte [rsp + rbp + 0x28]
movzx ebx, bl
imul ebx, ebx, 0xffffffd3
mov edi, ebx
add edi, 0x1572
movsx edi, di
imul edi, edi, 0xffff8103
shr edi, 0x10
add edi, ebx
add edi, 0x1572
movzx edi, di
mov esi, edi
shr esi, 0xf
shr edi, 6
add edi, esi
mov esi, edi
shl esi, 7
sub edi, esi
add ebx, edi
add ebx, 0x1572
add bl, 0x7f
movzx esi, bl
lea edi, [rsi + rsi*2]
shr edi, 8
mov ebx, esi
sub bl, dil
shr bl, 1
add bl, dil
shr bl, 6
movzx edi, bl
mov ebx, edi
shl ebx, 7
sub ebx, edi
sub sil, bl
mov byte [rsp + rbp + 0x28], sil
add rbp, 1
cmp rbp, 0x61
jne 0x14000e950
jmp 0x14000ec76
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rdx, qword [r14]
mov byte [rsp + 0x28], 0
lea rcx, [rsp + 0x29]
mov byte [rsp + 0x29], gethostname
mov byte [rsp + 0x2a], 0x75
mov byte [rsp + 0x2b], 0x56
mov byte [rsp + 0x2c], 0x75
mov byte [rsp + 0x2d], shutdown
mov byte [rsp + 0x2e], 0x75
mov byte [rsp + 0x2f], 0x2b
mov byte [rsp + 0x30], 0x75
mov byte [rsp + 0x31], 0x4c
mov byte [rsp + 0x32], 0x75
mov byte [rsp + 0x33], 0x28
mov byte [rsp + 0x34], 0x75
mov byte [rsp + 0x35], 0x29
mov byte [rsp + 0x36], 0x75
mov byte [rsp + 0x37], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0x38], 0x75
mov byte [rsp + 0x39], 0x23
mov byte [rsp + 0x3a], 0x75
mov byte [rsp + 0x3b], 0x4c
mov byte [rsp + 0x3c], 0x75
mov byte [rsp + 0x3d], 0x7c
mov byte [rsp + 0x3e], 0x75
mov byte [rsp + 0x3f], 0x28
mov byte [rsp + 0x40], 0x75
mov byte [rsp + 0x41], 0x49
mov byte [rsp + 0x42], 0x75
mov byte [rsp + 0x43], 0x7c
mov byte [rsp + 0x44], 0x75
mov byte [rsp + 0x45], 0x4c
mov byte [rsp + 0x46], 0x75
mov byte [rsp + 0x47], 0x56
mov byte [rsp + 0x48], 0x75
mov byte [rsp + 0x49], 0x28
mov byte [rsp + 0x4a], 0x75
mov byte [rsp + 0x4b], 0x46
mov byte [rsp + 0x4c], 0x75
mov byte [rsp + 0x4d], 0x5c
mov byte [rsp + 0x4e], 0x75
mov byte [rsp + 0x4f], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0x50], 0x75
mov byte [rsp + 0x51], 0x28
mov byte [rsp + 0x52], 0x75
mov byte [rsp + 0x53], 0x46
mov byte [rsp + 0x54], 0x75
mov byte [rsp + 0x55], 0x23
mov byte [rsp + 0x56], 0x75
mov byte [rsp + 0x57], 0
mov byte [rsp + 0x58], 0x75
mov byte [rsp + 0x59], 0x7c
mov byte [rsp + 0x5a], 0x75
mov byte [rsp + 0x5b], 0x28
mov byte [rsp + 0x5c], 0x75
mov byte [rsp + 0x5d], 0x18
mov byte [rsp + 0x5e], 0x75
mov byte [rsp + 0x5f], 3
mov byte [rsp + 0x60], 0x75
mov byte [rsp + 0x61], 0x2e
mov byte [rsp + 0x62], 0x75
mov byte [rsp + 0x63], 0x28
mov byte [rsp + 0x64], 0x75
mov byte [rsp + 0x65], 0x5d
mov byte [rsp + 0x66], 0x75
mov byte [rsp + 0x67], 0x7c
mov byte [rsp + 0x68], 0x75
mov byte [rsp + 0x69], 0x4c
mov byte [rsp + 0x6a], 0x75
mov byte [rsp + 0x6b], 0x4d
mov byte [rsp + 0x6c], 0x75
mov byte [rsp + 0x6d], 0x56
mov byte [rsp + 0x6e], 0x75
mov byte [rsp + 0x6f], 3
mov byte [rsp + 0x70], 0x75
mov byte [rsp + 0x71], 0x4c
mov byte [rsp + 0x72], 0x75
mov byte [rsp + 0x73], 0x4a
mov byte [rsp + 0x74], 0x75
mov byte [rsp + 0x75], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0x76], 0x75
mov byte [rsp + 0x77], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0x78], 0x75
mov byte [rsp + 0x79], 0x5c
mov byte [rsp + 0x7a], 0x75
mov byte [rsp + 0x7b], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0x7c], 0x75
mov byte [rsp + 0x7d], 0x28
mov byte [rsp + 0x7e], 0x75
mov byte [rsp + 0x7f], 0x7d
mov byte [rsp + 0x80], 0x75
mov byte [rsp + 0x81], 0x28
mov byte [rsp + 0x82], 0x75
mov byte [rsp + 0x83], 0x18
mov byte [rsp + 0x84], 0x75
mov byte [rsp + 0x85], 0
mov byte [rsp + 0x86], 0x75
mov byte [rsp + 0x87], reloc.WS2_32.dll_shutdown
mov byte [rsp + 0x88], 0x75
mov byte [rsp + 0x89], 0x75
mov byte [rsp + 0x8a], 0x75
mov bl, byte [rsp + 0x28]
test bl, 1
jne 0x14000ec76
mov ebp, 1
nop dword [rax]
movzx ebx, byte [rsp + rbp + 0x28]
movzx ebx, bl
shl ebx, 3
lea ebx, [rbx + rbx*4]
mov edi, 0x1248
sub edi, ebx
movsx esi, di
imul esi, esi, 0xffff8103
shr esi, 0x10
add esi, edi
movzx esi, si
mov edi, esi
shr edi, 0xf
shr esi, 6
add esi, edi
mov edi, esi
shl edi, 7
add edi, ebx
sub esi, edi
add esi, 0x1248
add sil, 0x7f
movzx esi, sil
lea edi, [rsi + rsi*2]
shr edi, 8
mov ebx, esi
sub bl, dil
shr bl, 1
add bl, dil
shr bl, 6
movzx edi, bl
mov ebx, edi
shl ebx, 7
sub ebx, edi
sub sil, bl
mov byte [rsp + rbp + 0x28], sil
add rbp, 1
cmp rbp, 0x63
jne 0x14000ec00
mov r8d, eax
call fcn.14000eec0
xor esi, esi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140031ee0
mov eax, esi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret