Function at 0x140044830
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp + 0x17], rax
xor r14b, r14b
mov rsi, r8
cmp qword [rcx + 0xf8], 0
mov r15, rdx
mov rbx, rcx
jne 0x14004490d
cmp qword [rcx + 0x100], 0
jne 0x14004490d
lea rcx, [rbp + 7]
call fcn.14004fc40
lea rdx, [rbx + 0xb20]
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x19], xmm0
cmp byte [rbx + 0xc35], r14b
jne 0x14004490d
mov byte [rbx + 0xc35], 1
test rdx, rdx
je 0x14004490d
movups xmm0, xmmword [rbx + 0xb40]
mov rcx, qword [rbp - 0x19]
movq rax, xmm0
movaps xmmword [rbp - 9], xmm0
sub rcx, rax
movabs rax, 0x8637bd05af6
cmp rcx, rax
jl 0x1400448db
movabs rcx, 0x7fffffffffffffff
jmp 0x14004490a
movabs rax, 0xfffff79c842fa50a
cmp rcx, rax
jle 0x140044905
movsxd rax, dword [rbp - 1]
imul rcx, rcx, 0xf4240
sub rcx, rax
movsxd rax, dword [rbp - 0x11]
add rcx, rax
cmp rcx, 1
jge 0x14004490a
mov ecx, 1
add qword [rdx], rcx
or dword [rsi], 2
xor r12d, r12d
mov rcx, qword [rbx + 0x1a0]
mov edi, r12d
test rcx, rcx
je 0x140044970
mov eax, dword [rbx + 0x6e8]
shr rax, 5
cmp rcx, rax
jge 0x140044b86
cmp byte [rbx + 0x1c8], dil
jne 0x140044b86
cmp byte [rbx + 0x1c3], dil
jne 0x140044b86
mov rax, qword [rbx + 0x100]
sub rax, qword [rbx + 0x118]
add rax, rcx
cmp rax, qword [rbx + 0x10e0]
je 0x140044b86
mov rdi, rcx
mov rax, qword [rbx + 0xc80]
test rax, rax
jne 0x140044998
mov ecx, dword [rbx + 0x6e8]
call qword [fcn.14006bcf0]
mov qword [rbx + 0xc80], rax
test rax, rax
je 0x140044adc
mov rcx, rax
test rdi, rdi
je 0x1400449bb
mov rdx, qword [rbx + 0x1a8]
cmp rdx, rax
je 0x1400449bb
mov r8, rdi
call fcn.140062140
mov rcx, qword [rbx + 0xc80]
mov qword [rbx + 0x1a8], rcx
cmp byte [rbx + 0x1c3], r12b
jne 0x140044f3a
cmp dword [rbx + 0x170], 2
mov rdx, qword [rbx + 0x1b0]
jne 0x140044a26
cmp dword [rdx + 0x200], 2
jne 0x140044a26
and dword [rbx + 0x15c], 0xfffffffd
lea rcx, [rbp - 0x19]
mov dword [rbx + 0x170], 1
call fcn.14004fc40
xor r8d, r8d
mov rcx, rbx
movups xmm0, xmmword [rax]
movups xmmword [rbx + 0x160], xmm0
and dword [rsi], 0xfffffffd
movsxd rdx, dword [rbx + 0xa18]
call fcn.14002aef0
jmp 0x140044f63
mov rax, qword [r15 + 0x408]
test dword [rax + 0x84], 0x40003
je 0x140044a44
cmp dword [rdx + 0x200], 1
sete r14b
lea rax, [rcx + rdi]
mov rcx, rbx
mov qword [rbx + 0x1a8], rax
lea r8, [rbp - 0x21]
mov edx, dword [rbx + 0x6e8]
sub rdx, rdi
call fcn.140043870
sub qword [rbx + 0x1a8], rdi
test eax, eax
jne 0x140044f65
mov rsi, qword [rbp - 0x21]
add rsi, rdi
je 0x140044f3a
test rsi, rsi
jle 0x140044f43
mov qword [rbx + 0x1a0], rsi
test r14b, r14b
jne 0x140044b86
cmp byte [rbx + 0xa64], r12b
je 0x140044b86
mov rax, qword [rbx + 0xd38]
test rax, rax
jne 0x140044ae6
mov eax, dword [rbx + 0x6e8]
lea ecx, [rax + rax]
call qword [fcn.14006bcf0]
mov qword [rbx + 0xd38], rax
test rax, rax
jne 0x140044ae6
lea rdx, str.Failed_to_alloc_scratch_buffer
mov rcx, rbx
call fcn.14002b570
mov eax, 0x1b
jmp 0x140044f65
test rdi, rdi
je 0x140044afd
mov rdx, qword [rbx + 0x1a8]
mov r8, rdi
mov rcx, rax
call fcn.140062140
mov rcx, rdi
cmp rdi, rsi
jge 0x140044b6c
nop word [rax + rax]
mov rax, qword [rbx + 0x1a8]
mov rdx, qword [rbx + 0xd38]
movzx r8d, byte [rdi + rax]
cmp r8b, 0xa
jne 0x140044b5d
mov byte [rdx + rcx], 0xd
inc rcx
mov rax, qword [rbx + 0xd38]
mov byte [rcx + rax], r8b
cmp byte [rbx + 0xa64], r12b
jne 0x140044b61
mov rax, qword [rbx + 0x10e0]
cmp rax, 0xffffffffffffffff
je 0x140044b61
inc rax
mov qword [rbx + 0x10e0], rax
jmp 0x140044b61
mov byte [rdx + rcx], r8b
inc rdi
inc rcx
cmp rdi, rsi
jl 0x140044b10
cmp rcx, rsi
je 0x140044b86
mov rax, qword [rbx + 0xd38]
mov qword [rbx + 0x1a8], rax
mov qword [rbx + 0x1a0], rcx
mov r10, qword [rbx + 0x18]
mov ecx, r12d
mov r9, qword [rbx + 0x1a0]
mov r8, qword [rbx + 0x1a8]
mov dword [rbp - 0x29], r12d
mov rax, qword [r10 + 0x1f8]
cmp qword [r15 + 0x430], rax
sete cl
mov eax, ecx
lea rcx, [rbp - 0x29]
mov qword [rsp + 0x20], rcx
mov edx, eax
mov rcx, rbx
call qword [r10 + rax*8 + 0x228]
mov rdi, rax
test rax, rax
jns 0x140044bec
mov eax, dword [rbp - 0x29]
test eax, eax
je 0x140044f33
cmp eax, 0x51
je 0x140044be9
test eax, eax
je 0x140044bec
jmp 0x140044f65
mov rdi, r12
mov rsi, qword [r15 + 0x430]
lea rcx, [rbp - 9]
mov word [rbp - 7], 0x5f32
mov word [rbp - 4], 0x2e32
mov word [rbp - 9], 0x7357
mov word [rbp - 1], 0x6c6c
mov byte [rbp - 5], 0x33
mov byte [rbp + 1], r12b
mov byte [rbp - 2], 0x64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x140044c39
lea rcx, [rbp - 9]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x140044cee
lea rdx, [rbp + 7]
mov dword [rbp + 9], 0x636f4941
mov rcx, rax
mov word [rbp + 7], 0x5357
mov word [rbp + 0xe], 0x6c
mov byte [rbp + 0xd], 0x74
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140044cee
mov qword [rsp + 0x40], r12
lea rcx, [rbp - 0x21]
mov qword [rsp + 0x38], r12
xor r9d, r9d
mov qword [rsp + 0x30], rcx
xor r8d, r8d
lea rcx, [rbp - 0x25]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rcx
mov edx, 0x4004747b
mov rcx, rsi
call rax
test eax, eax
jne 0x140044cee
call fcn.140024690
test rax, rax
je 0x140044cee
lea rdx, [rbp - 0x19]
mov dword [rbp - 0x12], 0x74706f
mov rcx, rax
mov dword [rbp - 0x19], 0x73746573
mov word [rbp - 0x15], 0x636f
mov byte [rbp - 0x13], 0x6b
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140044cee
lea r9, [rbp - 0x25]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rsi
call rax
mov r14, qword [rbx + 0x118]
test r14, r14
je 0x140044dec
mov rsi, qword [rbx + 0x1a8]
cmp r14, rdi
cmovge r14, rdi
cmp byte [rbx + 0xa76], r12b
je 0x140044ddd
cmp qword [rbx + 0x270], r12
je 0x140044da9
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x140044d3e
mov rax, qword [rbx + 0xd0]
test rax, rax
je 0x140044d45
mov byte [rax + 0x182], 1
mov rax, qword [rbx + 0x1d8]
mov r9, r14
mov r8, rsi
mov qword [rsp + 0x20], rax
mov edx, 2
mov rcx, rbx
call qword [rbx + 0x270]
mov rax, qword [rbx + 0xd8]
test rax, rax
je 0x140044d87
mov byte [rax + 0x182], r12b
mov rsi, rdi
sub qword [rbx + 0x118], r14
sub rsi, r14
jmp 0x140044def
mov rax, qword [rbx + 0xd0]
test rax, rax
je 0x140044ddd
mov byte [rax + 0x182], r12b
mov rsi, rdi
sub qword [rbx + 0x118], r14
sub rsi, r14
jmp 0x140044def
mov r9, qword [rbx + 0x1d0]
lea rcx, [0x1400b92ae]
mov edx, 2
lea r8d, [rdx - 1]
call fcn.14006b43c
mov r9, qword [rbx + 0x1d0]
mov r8d, 1
mov rdx, r14
mov rcx, rsi
call fcn.14006b43c
sub qword [rbx + 0x118], r14
mov rsi, rdi
sub rsi, r14
jmp 0x140044def
mov rsi, rdi
test rsi, rsi
je 0x140044e87
mov r8, rdi
sub r8, rsi
add r8, qword [rbx + 0x1a8]
cmp byte [rbx + 0xa76], r12b
je 0x140044e72
cmp qword [rbx + 0x270], r12
je 0x140044e72
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x140044e2f
mov rax, qword [rbx + 0xd0]
test rax, rax
je 0x140044e36
mov byte [rax + 0x182], 1
mov rax, qword [rbx + 0x1d8]
mov r9, rsi
mov edx, 4
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [rbx + 0x270]
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x140044e6b
mov rax, qword [rbx + 0xd0]
test rax, rax
je 0x140044e72
mov byte [rax + 0x182], r12b
add qword [rbx + 0x100], rsi
mov rax, qword [rbx + 0x100]
mov qword [rbx + 0xad0], rax
cmp byte [rbx + 0x1c8], r12b
je 0x140044e99
cmp byte [rbx + 0x1ca], r12b
je 0x140044eb0
mov rax, qword [rbx + 0x10e0]
cmp qword [rbx + 0x100], rax
jne 0x140044eb0
mov byte [rbx + 0x1c3], 1
mov rax, qword [rbx + 0x1a0]
cmp rax, rdi
je 0x140044ed2
sub rax, rdi
add qword [rbx + 0x1a8], rdi
mov qword [rbx + 0x1a0], rax
jmp 0x140044f63
mov rax, qword [rbx + 0xc80]
test rax, rax
jne 0x140044efa
mov ecx, dword [rbx + 0x6e8]
call qword [fcn.14006bcf0]
mov qword [rbx + 0xc80], rax
test rax, rax
je 0x140044adc
mov qword [rbx + 0x1a8], rax
mov qword [rbx + 0x1a0], r12
cmp byte [rbx + 0x1c3], r12b
je 0x140044f63
mov rax, qword [rbx + 0x18]
and dword [rbx + 0x15c], 0xfffffffd
cmp byte [rax + 0x3d5], r12b
je 0x140044f63
mov rcx, rbx
call fcn.140043d50
test eax, eax
je 0x140044f63
jmp 0x140044f65
mov eax, 0x37
jmp 0x140044f65
test byte [rbx + 0x15c], 0x20
jne 0x140044f63
mov rax, qword [rbx + 0x18]
and dword [rbx + 0x15c], 0xfffffffd
cmp byte [rax + 0x3d5], r12b
je 0x140044f63
mov rcx, rbx
call fcn.140043d50
test eax, eax
jne 0x140044f65
xor eax, eax
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret