Function at 0x14003035c
Capabilities:
Contain obfuscated stackstrings
Create directory
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2f8]
sub rsp, 0x3d0
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0x104
call fcn.14000c2a0
mov eax, 0x79
mov dword [rsp + 0x40], 0x23303716
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x4c], al
mov dword [rsp + 0x44], 0x1332171f
mov dword [rsp + 0x48], 0x193f1634
call fcn.140002278
mov rcx, qword [rax]
call fcn.1400107b4
lea rcx, [rbp - 0x50]
mov ebx, 1
sub rcx, rbx
mov r8, rax
xor edi, edi
add rcx, rbx
cmp byte [rcx], dil
jne 0x1400303d7
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x1400303e1
movdqa xmm0, xmmword [0x140044390]
lea rcx, [rsp + 0x40]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0xe142b14
mov dword [rsp + 0x54], 0x25030d25
mov byte [rsp + 0x58], 0x78
call fcn.1400021c8
lea rcx, [rbp - 0x50]
sub rcx, rbx
add rcx, rbx
cmp byte [rcx], dil
jne 0x140030423
mov r8, qword [rax]
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x140030430
xor edx, edx
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor edx, edx
lea rcx, [rbp + 0xc0]
mov r8d, 0x208
call fcn.14000c2a0
mov eax, 0x79
mov dword [rsp + 0x40], 0x370016
lea rcx, [rsp + 0x40]
mov word [rsp + 0x58], ax
mov dword [rsp + 0x44], 0x230030
mov dword [rsp + 0x48], 0x17001f
mov dword [rsp + 0x4c], 0x130032
mov dword [rsp + 0x50], 0x160034
mov dword [rsp + 0x54], 0x19003f
call fcn.140001f6c
mov rcx, qword [rax]
call fcn.1400107ac
lea rcx, [rbp + 0xc0]
mov r8, rax
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x1400304b8
xor edx, edx
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
inc rdx
test ax, ax
jne 0x1400304c3
mov eax, 0x45
mov dword [rsp + 0x5a], 0x350006
lea rcx, [rsp + 0x5a]
mov word [rbp - 0x5a], ax
mov dword [rsp + 0x5e], 0x1001a
mov dword [rsp + 0x62], 0x390021
mov dword [rsp + 0x66], 0x2c0011
mov dword [rsp + 0x6a], 0x230016
mov dword [rsp + 0x6e], 0xf0037
mov dword [rsp + 0x72], 0xb0010
mov dword [rsp + 0x76], 0x210027
mov dword [rsp + 0x7a], 0x2b0014
mov dword [rsp + 0x7e], 0xe0014
mov dword [rbp - 0x7e], 0xd0025
mov dword [rbp - 0x7a], 0x250003
mov dword [rbp - 0x76], 0x320024
mov dword [rbp - 0x72], 0x380026
mov dword [rbp - 0x6e], 0x4002f
mov dword [rbp - 0x6a], 0x1b0021
mov dword [rbp - 0x66], 0x140039
mov dword [rbp - 0x62], 0x5005d
mov dword [rbp - 0x5e], 0x24003f
call fcn.1400023a0
lea rdx, [rbp + 0xc0]
sub rdx, 2
lea rdx, [rdx + 2]
cmp word [rdx], di
jne 0x140030581
mov r8, qword [rax]
xor ecx, ecx
movzx eax, word [r8 + rcx*2]
mov word [rdx + rcx*2], ax
inc rcx
test ax, ax
jne 0x14003058f
mov qword [rsp + 0x30], rdi
lea rcx, [rbp + 0xc0]
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea r9, [rbp + 0x300]
mov qword [rsp + 0x20], rdi
mov rcx, rax
lea rdx, [0x14004ac20]
mov r8d, 0x155b4
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x3d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret