Function at 0x140199f74
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f]
sub rsp, 0xe0
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov r13, r9
mov rdi, r8
mov r14, rdx
mov rbx, rcx
xor esi, esi
mov qword [rbp - 0x71], rsi
mov dword [rbp + 0x7f], esi
mov dword [rbp + 0x77], esi
mov r15d, esi
mov dword [rbp + 0x57], esi
cmp byte [rcx + 3], sil
je 0x140199fd1
mov edx, 0x8000b
mov r8d, 0x900
jmp 0x14019a502
test r14, r14
je 0x14019a4f7
test rdi, rdi
je 0x14019a4f7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [rbx + 0x409], sil
jne 0x14019a09f
test r13, r13
je 0x14019a046
mov rax, r13
shr rax, 0x20
mov dword [rbp + 0x77], eax
xor r9d, r9d
lea r8, [rbp + 0x77]
mov edx, r13d
mov rcx, qword [rbx + 0x400]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r15d, eax
cmp eax, 0xffffffff
je 0x14019a030
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14019a046
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x91f
mov edx, eax
mov rcx, rbx
jmp 0x14019a502
cmp byte [rbx + 0x409], sil
jne 0x14019a0ad
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x7f]
mov r8d, edi
mov rdx, r14
mov rcx, qword [rbx + 0x400]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x400], rsi
jne 0x14019a4e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14019a4e6
mov eax, dword [rbp + 0x7f]
cmp rdi, rax
je 0x14019a486
mov edx, 0x80007
mov r8d, 0x994
jmp 0x14019a03e
mov r15d, dword [rbx + 0x470]
mov qword [rbx + 0x470], r13
cmp byte [rbx + 4], sil
je 0x14019a04f
mov rcx, qword [rbx + 0x470]
mov rdx, qword [rbx + 0x3f0]
add rdx, rcx
mov qword [rbp - 0x21], rdx
mov r12, qword [rbx + 0x478]
add r12, rcx
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1402d4668], eax
jle 0x14019a37d
lea rcx, [0x1402d4668]
call fcn.14027b540
or rsi, 0xffffffffffffffff
cmp dword [0x1402d4668], esi
jne 0x14019a37b
lea rax, [rbp - 0x41]
mov qword [rbp - 0x49], rax
mov byte [rsp + 0x40], 0x5b
mov byte [rsp + 0x41], 0x76
mov byte [rsp + 0x42], 0x6d
mov byte [rsp + 0x43], 0x78
mov byte [rsp + 0x44], 0x69
mov byte [rsp + 0x45], 0x54
mov byte [rsp + 0x46], 0x76
mov byte [rsp + 0x47], 0x73
mov byte [rsp + 0x48], 0x67
mov byte [rbp - 0x80], 0x69
mov byte [rbp - 0x7f], 0x77
mov byte [rbp - 0x7e], 0x77
mov byte [rbp - 0x7d], 0x51
mov byte [rbp - 0x7c], 0x69
mov byte [rbp - 0x7b], 0x71
mov byte [rbp - 0x7a], 0x73
mov byte [rbp - 0x79], 0x76
mov byte [rbp - 0x78], 0x7d
xor edx, edx
mov byte [rbp - 0x77], dl
mov al, byte [rsp + 0x40]
mov ecx, edx
mov al, byte [rsp + rcx + 0x40]
sub al, 4
mov byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0x12
jb 0x14019a172
mov qword [rbp - 0x41], rdx
mov qword [rbp - 0x31], rdx
mov qword [rbp - 0x29], 0xf
lea rax, [rsp + 0x40]
mov r14, rsi
inc r14
cmp byte [rax + r14], dl
jne 0x14019a19d
lea rcx, [rbp - 0x41]
cmp r14, 0xf
ja 0x14019a1ca
mov qword [rbp - 0x31], r14
mov r8, r14
lea rdx, [rsp + 0x40]
call qword [sym.imp.VCRUNTIME140.dll_memmove]
mov byte [rbp + r14 - 0x41], 0
jmp 0x14019a1d8
lea r9, [rsp + 0x40]
mov rdx, r14
call fcn.1400ada10
nop
mov dword [rsp + 0x30], 0x2b
mov eax, dword [rsp + 0x30]
xor al, 0x6b
mov byte [rsp + 0x34], al
mov eax, dword [rsp + 0x30]
inc al
xor al, 0x65
mov byte [rsp + 0x35], al
mov eax, dword [rsp + 0x30]
add al, 2
xor al, 0x72
mov byte [rsp + 0x36], al
mov eax, dword [rsp + 0x30]
add al, 3
xor al, 0x6e
mov byte [rsp + 0x37], al
mov eax, dword [rsp + 0x30]
add al, 4
xor al, 0x65
mov byte [rsp + 0x38], al
mov eax, dword [rsp + 0x30]
add al, 5
xor al, 0x6c
mov byte [rsp + 0x39], al
mov eax, dword [rsp + 0x30]
add al, 6
xor al, 0x33
mov byte [rsp + 0x3a], al
mov eax, dword [rsp + 0x30]
add al, 7
xor al, 0x32
mov byte [rsp + 0x3b], al
xor eax, eax
mov byte [rsp + 0x3c], al
mov al, byte [rsp + 0x34]
xor r14d, r14d
mov edx, r14d
mov al, byte [rsp + rdx + 0x34]
mov ecx, dword [rsp + 0x30]
add cl, dl
xor cl, al
mov byte [rsp + rdx + 0x34], cl
inc rdx
cmp rdx, 8
jb 0x14019a24e
mov byte [rsp + 0x3c], r14b
mov qword [rbp - 0x69], r14
mov qword [rbp - 0x59], r14
mov qword [rbp - 0x51], 0xf
mov byte [rbp - 0x69], r14b
lea rax, [rsp + 0x34]
inc rsi
cmp byte [rax + rsi], r14b
jne 0x14019a285
lea rcx, [rbp - 0x69]
cmp rsi, 0xf
ja 0x14019a2b1
mov qword [rbp - 0x59], rsi
mov r8, rsi
lea rdx, [rsp + 0x34]
call qword [sym.imp.VCRUNTIME140.dll_memmove]
mov byte [rbp + rsi - 0x69], r14b
jmp 0x14019a2bf
lea r9, [rsp + 0x34]
mov rdx, rsi
call fcn.1400ada10
nop
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 9]
call fcn.1401a82ac
nop
xor esi, esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rbp - 0x41]
mov rdx, rax
lea rcx, [0x1402d4420]
call fcn.1401a13d0
nop
mov rdx, qword [rbp - 0x51]
cmp rdx, 0x10
jb 0x14019a329
inc rdx
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019a324
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019a324
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14027b384
mov qword [rbp - 0x59], rsi
mov qword [rbp - 0x51], 0xf
mov byte [rbp - 0x69], sil
xor edx, edx
lea r8d, [rdx + 9]
lea rcx, [rsp + 0x34]
call qword [sym.imp.VCRUNTIME140.dll_memset]
nop
xor edx, edx
lea r8d, [rdx + 0x13]
lea rcx, [rsp + 0x40]
call qword [sym.imp.VCRUNTIME140.dll_memset]
lea rcx, [0x14028eda8]
call fcn.14027b36c
nop
lea rcx, [0x1402d4668]
call fcn.14027b4e0
mov r14, qword [rbp + 0x5f]
jmp 0x14019a37d
xor esi, esi
mov rcx, qword [rbx + 0x478]
cmp r12, rcx
ja 0x14019a396
add rcx, qword [rbx + 0x68]
cmp r12, rcx
jae 0x14019a44f
lea rax, [rbp + 0x57]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, rdi
mov rdx, r12
mov rcx, rbx
call fcn.1401995b4
cmp byte [rbx + 0x48a], sil
je 0x14019a3d4
mov r8, rdi
mov rdx, r14
mov rcx, r12
call qword [sym.imp.VCRUNTIME140.dll_memcpy]
mov qword [rbp - 0x71], rdi
mov sil, 1
jmp 0x14019a3fa
lea rax, [rbp - 0x71]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov r9, r14
mov r8, r12
mov rdx, qword [rbx + 0x400]
call fcn.1401a1a4c
test eax, eax
setne sil
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x49], eax
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x57]
mov r8, rdi
mov rdx, r12
mov rcx, rbx
call fcn.1401995b4
test sil, sil
jne 0x14019a431
mov r8d, 0x97a
mov edx, dword [rbp - 0x49]
jmp 0x14019a03e
cmp rdi, qword [rbp - 0x71]
je 0x14019a447
mov edx, 0x80006
mov r8d, 0x97e
jmp 0x14019a03e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8, qword [rbx + 0x3f0]
mov rcx, qword [rbp - 0x21]
cmp rcx, r8
ja 0x14019a46b
mov rdx, qword [rbx + 0x68]
add rdx, r8
cmp rcx, rdx
jae 0x14019a484
cmp r8, qword [rbx + 0x478]
je 0x14019a480
mov r8, rdi
mov rdx, r14
call qword [sym.imp.VCRUNTIME140.dll_memcpy]
mov qword [rbp - 0x71], rdi
xor esi, esi
cmp byte [rbx + 0x409], sil
jne 0x14019a4cb
test r13, r13
je 0x14019a4d5
xor r9d, r9d
lea r8, [rbp + 0x77]
mov edx, r15d
mov rcx, qword [rbx + 0x400]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x14019a4ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14019a4d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x9a1
jmp 0x14019a03c
mov ecx, r15d
mov qword [rbx + 0x470], rcx
cmp byte [rbx + 4], sil
je 0x14019a4e2
add qword [rbx + 0x470], rdi
mov al, 1
jmp 0x14019a509
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x990
jmp 0x14019a03c
mov edx, 0x57
mov r8d, 0x905
call fcn.140196c24
xor al, al
mov rbx, qword [rsp + 0x130]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret