Function at 0x1800ff3d0
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xce8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x23a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xd08]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0xc90], rax
lea rcx, [rbp + 0x10]
call fcn.1800c78e0
movzx eax, al
test eax, eax
jne 0x1800ff424
xor al, al
jmp 0x1800ffac6
mov rdx, qword [rbp + 0xcc0]
lea rcx, [rbp + 0x10]
call fcn.1800c1850
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x238], rax
cmp qword [rbp + 0x238], 0xffffffffffffffff
jne 0x1800ff47d
xor al, al
jmp 0x1800ffac6
xor ecx, ecx
call fcn.1801004d0
mov qword [rbp + 0x258], rax
lea rdx, [rbp + 0x258]
lea rcx, [rbp + 0x278]
call fcn.180100490
lea r8, [rbp + 0x278]
lea rdx, str.__d__m__Y__T__schema_dump_n_n
lea rcx, [rbp + 0x2c0]
call fcn.1800d4590
lea rcx, [rbp + 0x2c0]
call fcn.1800d4e60
mov dword [rbp + 0xc54], eax
lea rcx, [rbp + 0x2c0]
call fcn.1800d4690
mov qword [rbp + 0xc58], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, dword [rbp + 0xc54]
mov rdx, qword [rbp + 0xc58]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rdx, str.client.dll
mov rcx, qword [0x180377d98]
call fcn.1800fefb0
mov qword [rbp + 0x318], rax
cmp qword [rbp + 0x318], 0
jne 0x1800ff52f
xor al, al
jmp 0x1800ffac6
mov rax, qword [rbp + 0x318]
add rax, 0x500
mov rcx, rax
call fcn.1800feed0
mov dword [rbp + 0x334], eax
mov byte [rbp + 0xba8], 0x5b
mov byte [rbp + 0xba9], 0x73
mov byte [rbp + 0xbaa], 0x63
mov byte [rbp + 0xbab], 0x68
mov byte [rbp + 0xbac], 0x65
mov byte [rbp + 0xbad], 0x6d
mov byte [rbp + 0xbae], 0x61
mov byte [rbp + 0xbaf], 0x2e
mov byte [rbp + 0xbb0], 0x63
mov byte [rbp + 0xbb1], 0x70
mov byte [rbp + 0xbb2], 0x70
mov byte [rbp + 0xbb3], 0x3a
mov byte [rbp + 0xbb4], 0x35
mov byte [rbp + 0xbb5], 0x33
mov byte [rbp + 0xbb6], 0x5d
mov byte [rbp + 0xbb7], 0x20
mov byte [rbp + 0xbb8], 0
lea rcx, [rbp + 0xba8]
call fcn.1800df7e0
mov r8, rax
mov dl, 1
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0xc58], rax
lea rdx, str.found__
mov rcx, qword [rbp + 0xc58]
call fcn.18015de80
mov qword [rbp + 0xc60], rax
mov edx, dword [rbp + 0x334]
mov rcx, qword [rbp + 0xc60]
call fcn.1800fcec0
mov qword [rbp + 0xc68], rax
lea rdx, str.__schema_classes_in_module
mov rcx, qword [rbp + 0xc68]
call fcn.18015de80
mov eax, dword [rbp + 0x334]
inc eax
mov eax, eax
mov qword [rbp + 0xc58], rax
mov eax, 8
mov rcx, qword [rbp + 0xc58]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.18015fcb0
mov qword [rbp + 0xbd8], rax
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0x358], rax
mov rax, qword [rbp + 0x318]
add rax, 0x500
mov qword [rbp + 0xc58], rax
mov r9, qword [rbp + 0x358]
mov r8d, dword [rbp + 0x334]
xor edx, edx
mov rcx, qword [rbp + 0xc58]
call fcn.1800feff0
mov dword [rbp + 0x374], eax
mov dword [rbp + 0x394], 0
jmp 0x1800ff6c3
mov eax, dword [rbp + 0x394]
inc eax
mov dword [rbp + 0x394], eax
mov eax, dword [rbp + 0x374]
cmp dword [rbp + 0x394], eax
jge 0x1800ffa9d
movsxd rax, dword [rbp + 0x394]
mov rcx, qword [rbp + 0x358]
mov rax, qword [rcx + rax*8]
mov qword [rbp + 0x3b8], rax
cmp qword [rbp + 0x3b8], 0
jne 0x1800ff6fa
jmp 0x1800ff6b5
mov rax, qword [rbp + 0x318]
add rax, 0x500
mov qword [rbp + 0xc58], rax
mov rdx, qword [rbp + 0x3b8]
mov rcx, qword [rbp + 0xc58]
call fcn.1800fec60
mov rax, qword [rax]
mov qword [rbp + 0x3d8], rax
cmp qword [rbp + 0x3d8], 0
jne 0x1800ff73a
jmp 0x1800ff6b5
mov rax, qword [rbp + 0x3d8]
mov r8, qword [rax + 8]
lea rdx, [rbp + 0x3f8]
mov rcx, qword [rbp + 0x318]
call fcn.1800fef60
cmp qword [rbp + 0x3f8], 0
jne 0x1800ff767
jmp 0x1800ff6b5
mov rax, qword [rbp + 0x3f8]
movsx eax, word [rax + 0x1c]
test eax, eax
jne 0x1800ff77b
jmp 0x1800ff6b5
mov rax, qword [rbp + 0x3f8]
mov r8, qword [rax + 8]
lea rdx, str.class__s_n
lea rcx, [rbp + 0x420]
call fcn.1800fe7d0
lea rcx, [rbp + 0x420]
call fcn.1800f1dc0
mov dword [rbp + 0xc54], eax
lea rcx, [rbp + 0x420]
call fcn.1800fef30
mov qword [rbp + 0xc58], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, dword [rbp + 0xc54]
mov rdx, qword [rbp + 0xc58]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rbp + 0x544], 0
jmp 0x1800ff7ff
mov eax, dword [rbp + 0x544]
inc eax
mov dword [rbp + 0x544], eax
mov rax, qword [rbp + 0x3f8]
movsx eax, word [rax + 0x1c]
cmp dword [rbp + 0x544], eax
jge 0x1800ff95e
mov rax, qword [rbp + 0x3f8]
mov rax, qword [rax + 0x28]
mov qword [rbp + 0x568], rax
movsxd rax, dword [rbp + 0x544]
imul rax, rax, 0x20
mov rcx, qword [rbp + 0x568]
mov r9, qword [rcx + rax]
mov rax, qword [rbp + 0x3d8]
mov r8, qword [rax + 8]
lea rdx, str._s___s
lea rcx, [rbp + 0x590]
call fcn.1800fe7d0
lea rcx, [rbp + 0x590]
call fcn.1800fef30
movabs rdx, 0xcbf29ce484222325
mov rcx, rax
call fcn.1800d4af0
mov qword [rbp + 0xbf8], rax
movsxd rax, dword [rbp + 0x544]
imul rax, rax, 0x20
mov rcx, qword [rbp + 0x568]
lea rax, [rcx + rax + 0x10]
mov r8, rax
lea rdx, [rbp + 0xbf8]
lea rcx, [0x180378278]
call fcn.1800fe690
movsxd rax, dword [rbp + 0x544]
imul rax, rax, 0x20
movsxd rcx, dword [rbp + 0x544]
imul rcx, rcx, 0x20
movsxd rdx, dword [rbp + 0x544]
imul rdx, rdx, 0x20
mov r8, qword [rbp + 0x568]
mov rdx, qword [r8 + rdx + 8]
mov r8, qword [rbp + 0x568]
mov eax, dword [r8 + rax + 0x10]
mov dword [rsp + 0x20], eax
mov rax, qword [rbp + 0x568]
mov r9, qword [rax + rcx]
mov r8, qword [rdx + 8]
lea rdx, str._____s__s__0x_X_n
lea rcx, [rbp + 0x6c0]
call fcn.1800fe7d0
lea rcx, [rbp + 0x6c0]
call fcn.1800f1dc0
mov dword [rbp + 0xc54], eax
lea rcx, [rbp + 0x6c0]
call fcn.1800fef30
mov qword [rbp + 0xc58], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, dword [rbp + 0xc54]
mov rdx, qword [rbp + 0xc58]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1800ff7f1
mov byte [rbp + 0xc18], 0x5b
mov byte [rbp + 0xc19], 0x73
mov byte [rbp + 0xc1a], 0x63
mov byte [rbp + 0xc1b], 0x68
mov byte [rbp + 0xc1c], 0x65
mov byte [rbp + 0xc1d], 0x6d
mov byte [rbp + 0xc1e], 0x61
mov byte [rbp + 0xc1f], 0x2e
mov byte [rbp + 0xc20], 0x63
mov byte [rbp + 0xc21], 0x70
mov byte [rbp + 0xc22], 0x70
mov byte [rbp + 0xc23], 0x3a
mov byte [rbp + 0xc24], 0x39
mov byte [rbp + 0xc25], 0x34
mov byte [rbp + 0xc26], 0x5d
mov byte [rbp + 0xc27], 0x20
mov byte [rbp + 0xc28], 0
lea rcx, [rbp + 0xc18]
call fcn.1800df7e0
mov r8, rax
mov dl, 1
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0xc58], rax
lea rdx, str.dumped__
mov rcx, qword [rbp + 0xc58]
call fcn.18015de80
mov qword [rbp + 0xc60], rax
mov rax, qword [rbp + 0x3f8]
mov rax, qword [rax + 8]
mov qword [rbp + 0xc68], rax
mov rdx, qword [rbp + 0xc68]
mov rcx, qword [rbp + 0xc60]
call fcn.18015de80
mov qword [rbp + 0xc70], rax
lea rdx, str.___total:
mov rcx, qword [rbp + 0xc70]
call fcn.18015de80
mov qword [rbp + 0xc78], rax
mov rax, qword [rbp + 0x3f8]
movzx eax, word [rax + 0x1c]
mov word [rbp + 0xc80], ax
movzx edx, word [rbp + 0xc80]
mov rcx, qword [rbp + 0xc78]
call fcn.1800fccd0
mov qword [rbp + 0xc88], rax
lea rdx, str._fields_
mov rcx, qword [rbp + 0xc88]
call fcn.18015de80
jmp 0x1800ff6b5
mov rax, qword [rbp + 0x358]
mov qword [rbp + 0xc48], rax
mov rcx, qword [rbp + 0xc48]
call fcn.18015fce0
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x18025dde0]
call fcn.180224a80
mov rax, rdi
mov rcx, qword [rbp + 0xc90]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0xca8]
pop rdi
pop rbp
ret