Function at 0x14001167c
Capabilities:
Capture process snapshot data
Check if file exists
Contain obfuscated stackstrings
Create directory
Get file attributes
Inspect section memory permissions
Write file on windows

Disassembly:
jmp 0x14001c200
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x308
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x82
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x328]
mov rax, qword [0x140036040]
xor rax, rbp
mov qword [rbp + 0x2b0], rax
lea rcx, [0x14003d0ff]
call fcn.140011a05
mov dword [rbp + 4], 0
mov rcx, qword [rbp + 0x2e0]
call fcn.140011681
mov qword [0x1400364c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [0x1400364c0]
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [0x1400364c8], rax
mov eax, 0x44
mov word [rbp + 0x28], ax
mov eax, 0x62
mov word [rbp + 0x2a], ax
mov eax, 0x67
mov word [rbp + 0x2c], ax
mov eax, 0x68
mov word [rbp + 0x2e], ax
mov eax, 0x65
mov word [rbp + 0x30], ax
mov eax, 0x6c
mov word [rbp + 0x32], ax
mov eax, 0x70
mov word [rbp + 0x34], ax
mov eax, 0x2e
mov word [rbp + 0x36], ax
mov eax, 0x64
mov word [rbp + 0x38], ax
mov eax, 0x6c
mov word [rbp + 0x3a], ax
mov eax, 0x6c
mov word [rbp + 0x3c], ax
xor eax, eax
mov word [rbp + 0x3e], ax
mov byte [rbp + 0x58], 0x4d
mov byte [rbp + 0x59], 0x69
mov byte [rbp + 0x5a], 0x6e
mov byte [rbp + 0x5b], 0x69
mov byte [rbp + 0x5c], 0x44
mov byte [rbp + 0x5d], 0x75
mov byte [rbp + 0x5e], 0x6d
mov byte [rbp + 0x5f], 0x70
mov byte [rbp + 0x60], 0x57
mov byte [rbp + 0x61], 0x72
mov byte [rbp + 0x62], 0x69
mov byte [rbp + 0x63], 0x74
mov byte [rbp + 0x64], 0x65
mov byte [rbp + 0x65], 0x44
mov byte [rbp + 0x66], 0x75
mov byte [rbp + 0x67], 0x6d
mov byte [rbp + 0x68], 0x70
mov byte [rbp + 0x69], 0
lea rcx, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, [rbp + 0x58]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x88], rax
mov r8d, 0x10
xor edx, edx
lea rcx, [rbp + 0xa8]
call fcn.1400117ad
lea rax, [0x140011a3c]
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xd8], 0
mov edx, 4
mov ecx, 1
call fcn.140011988
mov edx, 8
mov ecx, eax
call fcn.140011988
mov edx, 0x10
mov ecx, eax
call fcn.140011988
mov edx, 0x20
mov ecx, eax
call fcn.140011988
mov edx, 0x40
mov ecx, eax
call fcn.140011988
mov edx, 0x80
mov ecx, eax
call fcn.140011988
mov edx, 0x100
mov ecx, eax
call fcn.140011988
mov edx, 0x200
mov ecx, eax
call fcn.140011988
mov edx, 0x8000000
mov ecx, eax
call fcn.140011988
mov edx, 0x4000000
mov ecx, eax
call fcn.140011988
mov edx, 0x20000000
mov ecx, eax
call fcn.140011988
mov edx, 0x80000000
mov ecx, eax
call fcn.140011988
mov dword [rbp + 0xf4], eax
lea r9, [rbp + 0xd8]
mov r8d, 0x10001f
mov edx, dword [rbp + 0xf4]
mov rcx, qword [rbp + 0x2e0]
call fcn.140011a55
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0xd8]
call qword [rbp + 0x88]
mov dword [rbp + 4], eax
mov rdx, qword [rbp + 0xd8]
mov rcx, 0xffffffffffffffff
call fcn.140011474
cmp dword [rbp + 4], 0
je 0x14001c5b9
mov rcx, qword [0x1400364c8]
call fcn.140011811
lea rax, str.C:_tempdebug.dmp
mov qword [rbp + 0x118], rax
lea rcx, str.C:_temp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rbp + 0x134], eax
cmp dword [rbp + 0x134], 0xffffffff
jne 0x14001c4f9
xor edx, edx
lea rcx, str.C:_temp
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14001c4f9
lea rcx, str.Create_C:_temp_first_n
call fcn.1400114d8
mov eax, 1
jmp 0x14001c5f6
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x158], rax
mov dword [rbp + 0x174], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x174]
mov r8d, dword [0x1400364d0]
mov rdx, qword [0x1400364c8]
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rbp + 0x194], eax
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [0x1400364c0]
mov rcx, qword [0x1400364c8]
call fcn.14001172b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [0x1400364c8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdx, qword [rbp + 0x118]
lea rcx, str.Run__restoresig.py__on__s_n
call fcn.140011050
jmp 0x14001c5f3
lea rcx, [rbp + 0x278]
call fcn.140011537
mov qword [rbp + 0x2a8], rax
mov rcx, qword [rbp + 0x2a8]
call fcn.14001136b
mov rdx, rax
lea rcx, str.Failed___s
call fcn.140011050
lea rcx, [rbp + 0x278]
call fcn.1400118cf
mov eax, dword [rbp + 4]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14002f1d0]
call fcn.140011870
mov rax, rdi
mov rcx, qword [rbp + 0x2b0]
xor rcx, rbp
call fcn.1400114fb
lea rsp, [rbp + 0x2c8]
pop rdi
pop rbp
ret