Function at 0x140071ce0
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
push rbp
push rdi
lea rbp, [rsp - 0x4f]
sub rsp, 0x98
xor edx, edx
mov rdi, rcx
call fcn.140024c30
mov edx, eax
shr edx, 0x1f
test dl, dl
jne 0x140072016
mov qword [rsp + 0xb0], rbx
lea rcx, [rdi + 0x28]
mov qword [rsp + 0x90], rsi
mov esi, 2
mov qword [rsp + 0x88], r12
mov edx, esi
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x70], r15
call fcn.140025da0
mov rbx, 0xffffffffffffffff
lea r9, [0x140146f88]
mov rdx, rbx
mov r8, rax
nop dword [rax]
movzx ecx, word [r8 + rdx*2 + 2]
mov r12d, 4
lea r15d, [r12 - 1]
cmp cx, word [r9 + rdx*2 + 2]
jne 0x140071d82
add rdx, rsi
cmp rdx, 0x15
je 0x140071e0b
movzx eax, word [r8 + rdx*2]
cmp ax, word [r9 + rdx*2]
je 0x140071d50
mov edx, esi
lea rcx, [rdi + 0x28]
call fcn.140025da0
mov r8, rax
lea r9, [0x140146fb8]
mov rdx, rbx
nop word [rax + rax]
movzx ecx, word [r8 + rdx*2 + 2]
cmp cx, word [r9 + rdx*2 + 2]
jne 0x140071dc3
add rdx, rsi
cmp rdx, 0x15
je 0x140071e13
movzx eax, word [r8 + rdx*2]
cmp ax, word [r9 + rdx*2]
je 0x140071da0
mov edx, esi
lea rcx, [rdi + 0x28]
call fcn.140025da0
mov rdx, rax
lea r8, [0x140146fe8]
nop dword [rax + rax]
movzx ecx, word [rdx + rbx*2 + 2]
cmp cx, word [r8 + rbx*2 + 2]
jne 0x140071e01
add rbx, rsi
cmp rbx, 0x15
je 0x140071e1f
movzx eax, word [rdx + rbx*2]
cmp ax, word [r8 + rbx*2]
je 0x140071de0
mov eax, 0x80040208
jmp 0x140071ff4
mov dword [rdi + 0x308], esi
jmp 0x140071e29
mov dword [rdi + 0x308], r15d
mov esi, r15d
jmp 0x140071e29
mov dword [rdi + 0x308], r12d
mov esi, r12d
mov ecx, dword [rdi + 0x260]
xor ebx, ebx
mov qword [rsp + 0x80], r13
mov r14d, ebx
cmp ecx, 0x1c20
je 0x140071e88
mov ecx, 0x178
call fcn.1400b6058
test rax, rax
je 0x140071e67
mov edx, 0x1c20
lea r8d, [rbx + 5]
mov rcx, rax
call fcn.14002a530
mov r14, rax
mov rdx, r14
mov rcx, rdi
call fcn.140025eb0
xor edx, edx
mov rcx, rdi
call fcn.140024c30
mov ecx, dword [rdi + 0x260]
mov esi, dword [rdi + 0x308]
mov r13d, 1
mov dword [rbp + 0x13], ecx
mov eax, esi
mov dword [rbp + 7], 0x20746d66
imul eax, ecx
lea r9, [rbp + 0x6f]
mov rcx, qword [rdi + 0x38]
lea rdx, [rbp - 0x19]
lea r8d, [r13 + 0xb]
mov dword [rbp + 0xb], socket
mov dword [rbp + 0xf], 0x10300
mov word [rbp + 0x1d], si
add eax, 7
mov word [rbp + 0x1f], r12w
shr eax, 3
mov dword [rbp + 0x17], eax
cmp esi, r15d
mov eax, dword [rdi + 0x250]
cmovne r15w, r13w
mov dword [rbp + 0x21], r13d
mov word [rbp + 0x1b], r15w
mov dword [rbp - 9], 0x74636166
mov dword [rbp - 5], r12d
mov dword [rbp - 1], eax
mov qword [rbp + 0x7f], 0x61746164
mov dword [rbp - 0x19], 0x46464952
mov dword [rbp - 0x15], 0x36
mov dword [rbp - 0x11], 0x45564157
mov dword [rbp + 0x6f], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbp + 0xb]
lea r9, [rbp + 0x6f]
mov rcx, qword [rdi + 0x38]
lea rdx, [rbp + 7]
add eax, 8
mov dword [rbp + 0x6f], ebx
mov r8d, eax
mov dword [rbp + 0x77], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rdi + 0x38]
lea r9, [rbp + 0x6f]
lea r8d, [r13 + 0xb]
mov dword [rbp + 0x6f], ebx
lea rdx, [rbp - 9]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rdi + 0x38]
lea r9, [rbp + 0x6f]
lea r8d, [r13 + 7]
mov dword [rbp + 0x6f], ebx
lea rdx, [rbp + 0x7f]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rdi + 0x38]
lea r8, [rbp + 0x6f]
mov r9d, r13d
mov qword [rbp + 0x6f], rbx
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov edx, dword [rdi + 0x308]
lea rcx, [rdi + 0x298]
test eax, eax
mov r12d, 0xffffffff
mov r13d, r12d
cmovne r13d, dword [rbp + 0x6f]
call fcn.140048fa0
mov r9d, dword [rdi + 0x264]
lea rcx, [rdi + 0x2e0]
imul r9d, dword [rdi + 0x308]
lea r8, [rdi + 0x270]
lea rdx, [rdi + 0x38]
shr r9d, 3
call fcn.140022bf0
test al, al
jne 0x140072020
mov eax, 0x80040202
mov r13, qword [rsp + 0x80]
mov r14, qword [rsp + 0x78]
mov r12, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0xb0]
mov r15, qword [rsp + 0x70]
add rsp, 0x98
pop rdi
pop rbp
ret
mov rcx, rdi
call fcn.1400246e0
lea rcx, [rdi + 0x2e0]
mov esi, eax
call fcn.140023c30
lea rcx, [rdi + 0x298]
call fcn.140049540
mov ecx, esi
shr ecx, 0x1f
test cl, cl
je 0x14007204f
mov eax, esi
jmp 0x140071fec
lea rcx, [rdi + 0x38]
call fcn.14004cf00
mov rsi, rax
sub esi, r13d
test sil, 1
je 0x140072089
mov rcx, qword [rdi + 0x38]
lea r9, [rbp + 0x6f]
mov r8d, 1
mov dword [rbp + 0x6f], ebx
lea rdx, [0x1401a912e]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
inc esi
mov rcx, qword [rdi + 0x38]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [rdi + 0x38]
lea r9, [rbp + 0x6f]
add dword [rbp - 0x15], esi
lea rdx, [rbp - 0x19]
mov r8d, recv
mov dword [rbp + 0x6f], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [rbp + 0x77]
mov r9d, 1
mov rcx, qword [rdi + 0x38]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rax, qword [rdi + 0x268]
lea r9, [rbp + 0x6f]
mov rcx, qword [rdi + 0x38]
lea rdx, [rbp - 9]
cmp rax, r12
mov dword [rbp + 0x6f], ebx
mov r8d, recv
mov qword [rsp + 0x20], rbx
cmovl r12d, eax
mov dword [rbp - 1], r12d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rdi + 0x38]
lea r9, [rbp + 0x6f]
mov r8d, 8
mov dword [rbp + 0x83], esi
lea rdx, [rbp + 0x7f]
mov dword [rbp + 0x6f], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r14, r14
je 0x14007213f
mov rax, qword [r14]
mov edx, 1
mov rcx, r14
call qword [rax]
xor eax, eax
jmp 0x140071fec