Function at 0x14000eec0
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x980
mov qword [rsp + 0x9b8], rdx
mov qword [rsp + 0x9c0], r8
mov qword [rsp + 0x9c8], r9
mov rax, qword [0x1400503c8]
xor rax, rsp
mov qword [rsp + 0x978], rax
cmp qword [0x1400503a8], 0xffffffffffffffff
je 0x14000f3f3
mov rsi, rcx
lea rax, [rsp + 0x9b8]
mov qword [rsp + 0x40], rax
lea rdi, [rsp + 0x170]
mov r8d, 0x800
mov rcx, rdi
xor edx, edx
call fcn.140033e10
mov r8, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.USER32.dll_wvsprintfW]
test eax, eax
jle 0x14000f3f3
mov r14d, eax
mov byte [rsp + 0x70], 0
mov byte [rsp + 0x71], gethostname
mov byte [rsp + 0x72], 0x57
mov byte [rsp + 0x73], 3
mov byte [rsp + 0x74], 0x57
mov byte [rsp + 0x75], 0x57
mov byte [rsp + 0x76], 0x57
mov al, byte [rsp + 0x70]
test al, 1
jne 0x14000f1e2
mov al, byte [rsp + 0x71]
movzx eax, al
lea eax, [rax + rax*4]
lea ecx, [rax + rax*2]
lea eax, [rax + rax*2]
add eax, 0xfffffae7
cwde
imul eax, eax, 0xffff8103
shr eax, 0x10
add eax, ecx
add eax, 0xfffffae7
movzx eax, ax
mov edx, eax
shr edx, 0xf
shr eax, 6
add eax, edx
mov edx, eax
shl edx, 7
sub eax, edx
add eax, ecx
add eax, 0xfffffae7
add al, 0x7f
movzx eax, al
lea ecx, [rax + rax*2]
shr ecx, 8
mov edx, eax
sub dl, cl
shr dl, 1
add dl, cl
shr dl, 6
movzx ecx, dl
mov edx, ecx
shl edx, 7
sub edx, ecx
sub al, dl
mov byte [rsp + 0x71], al
mov al, byte [rsp + 0x72]
movzx eax, al
lea eax, [rax + rax*4]
lea ecx, [rax + rax*2]
lea eax, [rax + rax*2]
add eax, 0xfffffae7
cwde
imul eax, eax, 0xffff8103
shr eax, 0x10
add eax, ecx
add eax, 0xfffffae7
movzx eax, ax
mov edx, eax
shr edx, 0xf
shr eax, 6
add eax, edx
mov edx, eax
shl edx, 7
sub eax, edx
add eax, ecx
add eax, 0xfffffae7
add al, 0x7f
movzx eax, al
lea ecx, [rax + rax*2]
shr ecx, 8
mov edx, eax
sub dl, cl
shr dl, 1
add dl, cl
shr dl, 6
movzx ecx, dl
mov edx, ecx
shl edx, 7
sub edx, ecx
sub al, dl
mov byte [rsp + 0x72], al
mov al, byte [rsp + 0x73]
movzx eax, al
lea eax, [rax + rax*4]
lea ecx, [rax + rax*2]
lea eax, [rax + rax*2]
add eax, 0xfffffae7
cwde
imul eax, eax, 0xffff8103
shr eax, 0x10
add eax, ecx
add eax, 0xfffffae7
movzx eax, ax
mov edx, eax
shr edx, 0xf
shr eax, 6
add eax, edx
mov edx, eax
shl edx, 7
sub eax, edx
add eax, ecx
add eax, 0xfffffae7
add al, 0x7f
movzx eax, al
lea ecx, [rax + rax*2]
shr ecx, 8
mov edx, eax
sub dl, cl
shr dl, 1
add dl, cl
shr dl, 6
movzx ecx, dl
mov edx, ecx
shl edx, 7
sub edx, ecx
sub al, dl
mov byte [rsp + 0x73], al
mov al, byte [rsp + 0x74]
movzx eax, al
lea eax, [rax + rax*4]
lea ecx, [rax + rax*2]
lea eax, [rax + rax*2]
add eax, 0xfffffae7
cwde
imul eax, eax, 0xffff8103
shr eax, 0x10
add eax, ecx
add eax, 0xfffffae7
movzx eax, ax
mov edx, eax
shr edx, 0xf
shr eax, 6
add eax, edx
mov edx, eax
shl edx, 7
sub eax, edx
add eax, ecx
add eax, 0xfffffae7
add al, 0x7f
movzx eax, al
lea ecx, [rax + rax*2]
shr ecx, 8
mov edx, eax
sub dl, cl
shr dl, 1
add dl, cl
shr dl, 6
movzx ecx, dl
mov edx, ecx
shl edx, 7
sub edx, ecx
sub al, dl
mov byte [rsp + 0x74], al
mov al, byte [rsp + 0x75]
movzx eax, al
lea eax, [rax + rax*4]
lea ecx, [rax + rax*2]
lea eax, [rax + rax*2]
add eax, 0xfffffae7
cwde
imul eax, eax, 0xffff8103
shr eax, 0x10
add eax, ecx
add eax, 0xfffffae7
movzx eax, ax
mov edx, eax
shr edx, 0xf
shr eax, 6
add eax, edx
mov edx, eax
shl edx, 7
sub eax, edx
add eax, ecx
add eax, 0xfffffae7
add al, 0x7f
movzx eax, al
lea ecx, [rax + rax*2]
shr ecx, 8
mov edx, eax
sub dl, cl
shr dl, 1
add dl, cl
shr dl, 6
movzx ecx, dl
mov edx, ecx
shl edx, 7
sub edx, ecx
sub al, dl
mov byte [rsp + 0x75], al
mov al, byte [rsp + 0x76]
movzx eax, al
lea eax, [rax + rax*4]
lea ecx, [rax + rax*2]
lea eax, [rax + rax*2]
add eax, 0xfffffae7
cwde
imul eax, eax, 0xffff8103
shr eax, 0x10
add eax, ecx
add eax, 0xfffffae7
movzx eax, ax
mov edx, eax
shr edx, 0xf
shr eax, 6
add eax, edx
mov edx, eax
shl edx, 7
sub eax, edx
add eax, ecx
add eax, 0xfffffae7
add al, 0x7f
movzx eax, al
lea ecx, [rax + rax*2]
shr ecx, 8
mov edx, eax
sub dl, cl
shr dl, 1
add dl, cl
shr dl, 6
movzx ecx, dl
mov edx, ecx
shl edx, 7
sub edx, ecx
sub al, dl
mov byte [rsp + 0x76], al
lea rcx, [0x140051e60]
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_GetLocalTime]
movzx ebp, word [rsp + 0x3c]
movzx r9d, word [rsp + 0x3a]
movzx r8d, word [rsp + 0x38]
mov byte [rsp + 0x48], 0
lea rdx, [rsp + 0x49]
mov byte [rsp + 0x49], 0x26
mov byte [rsp + 0x4a], gethostname
mov byte [rsp + 0x4b], 0xe
mov byte [rsp + 0x4c], gethostname
mov byte [rsp + 0x4d], 0x21
mov byte [rsp + 0x4e], gethostname
mov byte [rsp + 0x4f], gethostbyname
mov byte [rsp + 0x50], gethostname
mov byte [rsp + 0x51], 0x2a
mov byte [rsp + 0x52], gethostname
mov byte [rsp + 0x53], WSAGetLastError
mov byte [rsp + 0x54], gethostname
mov byte [rsp + 0x55], 0xe
mov byte [rsp + 0x56], gethostname
mov byte [rsp + 0x57], 0x21
mov byte [rsp + 0x58], gethostname
mov byte [rsp + 0x59], gethostbyname
mov byte [rsp + 0x5a], gethostname
mov byte [rsp + 0x5b], 0x2a
mov byte [rsp + 0x5c], gethostname
mov byte [rsp + 0x5d], WSAGetLastError
mov byte [rsp + 0x5e], gethostname
mov byte [rsp + 0x5f], 0xe
mov byte [rsp + 0x60], gethostname
mov byte [rsp + 0x61], 0x21
mov byte [rsp + 0x62], gethostname
mov byte [rsp + 0x63], gethostbyname
mov byte [rsp + 0x64], gethostname
mov byte [rsp + 0x65], 0x2a
mov byte [rsp + 0x66], gethostname
mov byte [rsp + 0x67], gethostname
mov byte [rsp + 0x68], gethostname
mov byte [rsp + 0x69], 0x28
mov byte [rsp + 0x6a], gethostname
mov byte [rsp + 0x6b], gethostname
mov byte [rsp + 0x6c], gethostname
mov cl, byte [rsp + 0x48]
test cl, 1
jne 0x14000f35c
mov ecx, 1
nop dword [rax + rax]
movzx ebx, byte [rsp + rcx + 0x48]
movzx edi, bl
mov ebx, edi
shl ebx, 5
lea esi, [rbx + rdi*2]
lea ebx, [rbx + rdi*2]
add ebx, 0xfffff8d4
movsx ebx, bx
imul ebx, ebx, 0xffff8103
shr ebx, 0x10
add ebx, esi
add ebx, 0xfffff8d4
movzx ebx, bx
mov edi, ebx
shr edi, 0xf
shr ebx, 6
add ebx, edi
mov edi, ebx
shl edi, 7
sub ebx, edi
add ebx, esi
add ebx, 0xfffff8d4
add bl, 0x7f
movzx ebx, bl
lea edi, [rbx + rbx*2]
shr edi, 8
mov eax, ebx
sub al, dil
shr al, 1
add al, dil
shr al, 6
movzx edi, al
mov eax, edi
shl eax, 7
sub eax, edi
sub bl, al
mov byte [rsp + rcx + 0x48], bl
add rcx, 1
cmp rcx, 0x25
jne 0x14000f2e0
lea rdi, [rsp + 0x71]
add r14d, r14d
mov dword [rsp + 0x20], ebp
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
test eax, eax
je 0x14000f39c
add eax, eax
mov rcx, qword [0x1400503a8]
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x70]
lea r9, [rsp + 0x48]
mov r8d, eax
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rcx, qword [0x1400503a8]
mov qword [rsp + 0x20], 0
mov rsi, qword [sym.imp.KERNEL32.DLL_WriteFile]
lea rdx, [rsp + 0x170]
lea rbx, [rsp + 0x48]
mov r8d, r14d
mov r9, rbx
call rsi
mov rcx, qword [0x1400503a8]
mov qword [rsp + 0x20], 0
mov rdx, rdi
mov r8d, 4
mov r9, rbx
call rsi
lea rcx, [0x140051e60]
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov rcx, qword [rsp + 0x978]
xor rcx, rsp
call fcn.140031ee0
nop
add rsp, 0x980
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret