Function at 0x1800fcca0
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xc98
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x226
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xcb8]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0xc40], rax
lea rcx, [rbp + 0x10]
call fcn.1800c83c0
movzx eax, al
test eax, eax
jne 0x1800fccf4
xor al, al
jmp 0x1800fd25c
mov rdx, qword [rbp + 0xc70]
lea rcx, [rbp + 0x10]
call fcn.1800c28a0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x238], rax
cmp qword [rbp + 0x238], 0xffffffffffffffff
jne 0x1800fcd4d
xor al, al
jmp 0x1800fd25c
xor ecx, ecx
call fcn.1800fdc60
mov qword [rbp + 0x258], rax
lea rdx, [rbp + 0x258]
lea rcx, [rbp + 0x278]
call fcn.1800fdc20
lea r8, [rbp + 0x278]
lea rdx, str.__d__m__Y__T__schema_dump_n_n
lea rcx, [rbp + 0x2c0]
call fcn.1800d4a30
lea rcx, [rbp + 0x2c0]
call fcn.1800d5300
mov dword [rbp + 0xc24], eax
lea rcx, [rbp + 0x2c0]
call fcn.1800d4b30
mov qword [rbp + 0xc28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, dword [rbp + 0xc24]
mov rdx, qword [rbp + 0xc28]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rdx, str.client.dll
mov rcx, qword [0x180378c68]
call fcn.1800fc8c0
mov qword [rbp + 0x318], rax
cmp qword [rbp + 0x318], 0
jne 0x1800fcdff
xor al, al
jmp 0x1800fd25c
mov rax, qword [rbp + 0x318]
add rax, 0x5b8
mov rcx, rax
call fcn.1800fc7e0
mov dword [rbp + 0x334], eax
mov byte [rbp + 0xba8], 0x5b
mov byte [rbp + 0xba9], 0x73
mov byte [rbp + 0xbaa], 0x63
mov byte [rbp + 0xbab], 0x68
mov byte [rbp + 0xbac], 0x65
mov byte [rbp + 0xbad], 0x6d
mov byte [rbp + 0xbae], 0x61
mov byte [rbp + 0xbaf], 0x2e
mov byte [rbp + 0xbb0], 0x63
mov byte [rbp + 0xbb1], 0x70
mov byte [rbp + 0xbb2], 0x70
mov byte [rbp + 0xbb3], 0x3a
mov byte [rbp + 0xbb4], 0x35
mov byte [rbp + 0xbb5], 0x33
mov byte [rbp + 0xbb6], 0x5d
mov byte [rbp + 0xbb7], 0x20
mov byte [rbp + 0xbb8], 0
lea rcx, [rbp + 0xba8]
call fcn.1800df250
mov r8, rax
mov dl, 1
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0xc28], rax
lea rdx, str.found__
mov rcx, qword [rbp + 0xc28]
call fcn.18015e890
mov qword [rbp + 0xc30], rax
mov edx, dword [rbp + 0x334]
mov rcx, qword [rbp + 0xc30]
call fcn.1800faba0
mov qword [rbp + 0xc38], rax
lea rdx, str.__schema_classes_in_module
mov rcx, qword [rbp + 0xc38]
call fcn.18015e890
mov eax, dword [rbp + 0x334]
inc eax
mov eax, eax
mov qword [rbp + 0xc28], rax
mov eax, 8
mov rcx, qword [rbp + 0xc28]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.180160d50
mov qword [rbp + 0xbd8], rax
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0x358], rax
mov rax, qword [rbp + 0x318]
add rax, 0x5b8
mov qword [rbp + 0xc28], rax
mov r9, qword [rbp + 0x358]
mov r8d, dword [rbp + 0x334]
xor edx, edx
mov rcx, qword [rbp + 0xc28]
call fcn.1800fc900
mov dword [rbp + 0x374], eax
mov dword [rbp + 0x394], 0
jmp 0x1800fcf93
mov eax, dword [rbp + 0x394]
inc eax
mov dword [rbp + 0x394], eax
mov eax, dword [rbp + 0x374]
cmp dword [rbp + 0x394], eax
jge 0x1800fd233
movsxd rax, dword [rbp + 0x394]
mov rcx, qword [rbp + 0x358]
mov rax, qword [rcx + rax*8]
mov qword [rbp + 0x3b8], rax
cmp qword [rbp + 0x3b8], 0
jne 0x1800fcfca
jmp 0x1800fcf85
mov rax, qword [rbp + 0x318]
add rax, 0x5b8
mov qword [rbp + 0xc28], rax
mov rdx, qword [rbp + 0x3b8]
mov rcx, qword [rbp + 0xc28]
call fcn.1800fc570
mov rax, qword [rax]
mov qword [rbp + 0x3d8], rax
cmp qword [rbp + 0x3d8], 0
jne 0x1800fd00a
jmp 0x1800fcf85
mov rax, qword [rbp + 0x3d8]
mov r8, qword [rax + 8]
lea rdx, [rbp + 0x3f8]
mov rcx, qword [rbp + 0x318]
call fcn.1800fc870
cmp qword [rbp + 0x3f8], 0
jne 0x1800fd037
jmp 0x1800fcf85
mov rax, qword [rbp + 0x3f8]
movsx eax, word [rax + 0x1c]
test eax, eax
jne 0x1800fd04b
jmp 0x1800fcf85
mov rax, qword [rbp + 0x3f8]
mov r8, qword [rax + 8]
lea rdx, str.class__s_n
lea rcx, [rbp + 0x420]
call fcn.1800fc0e0
lea rcx, [rbp + 0x420]
call fcn.1800f1040
mov dword [rbp + 0xc24], eax
lea rcx, [rbp + 0x420]
call fcn.1800fc840
mov qword [rbp + 0xc28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, dword [rbp + 0xc24]
mov rdx, qword [rbp + 0xc28]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rbp + 0x544], 0
jmp 0x1800fd0cf
mov eax, dword [rbp + 0x544]
inc eax
mov dword [rbp + 0x544], eax
mov rax, qword [rbp + 0x3f8]
movsx eax, word [rax + 0x1c]
cmp dword [rbp + 0x544], eax
jge 0x1800fd22e
mov rax, qword [rbp + 0x3f8]
mov rax, qword [rax + 0x28]
mov qword [rbp + 0x568], rax
movsxd rax, dword [rbp + 0x544]
imul rax, rax, 0x20
mov rcx, qword [rbp + 0x568]
mov r9, qword [rcx + rax]
mov rax, qword [rbp + 0x3d8]
mov r8, qword [rax + 8]
lea rdx, str._s___s
lea rcx, [rbp + 0x590]
call fcn.1800fc0e0
lea rcx, [rbp + 0x590]
call fcn.1800fc840
movabs rdx, 0xcbf29ce484222325
mov rcx, rax
call fcn.1800d4f90
mov qword [rbp + 0xbf8], rax
movsxd rax, dword [rbp + 0x544]
imul rax, rax, 0x20
mov rcx, qword [rbp + 0x568]
lea rax, [rcx + rax + 0x10]
mov r8, rax
lea rdx, [rbp + 0xbf8]
lea rcx, [0x180379138]
call fcn.1800fbfa0
movsxd rax, dword [rbp + 0x544]
imul rax, rax, 0x20
movsxd rcx, dword [rbp + 0x544]
imul rcx, rcx, 0x20
movsxd rdx, dword [rbp + 0x544]
imul rdx, rdx, 0x20
mov r8, qword [rbp + 0x568]
mov rdx, qword [r8 + rdx + 8]
mov r8, qword [rbp + 0x568]
mov eax, dword [r8 + rax + 0x10]
mov dword [rsp + 0x20], eax
mov rax, qword [rbp + 0x568]
mov r9, qword [rax + rcx]
mov r8, qword [rdx + 8]
lea rdx, str._____s__s__0x_X_n
lea rcx, [rbp + 0x6c0]
call fcn.1800fc0e0
lea rcx, [rbp + 0x6c0]
call fcn.1800f1040
mov dword [rbp + 0xc24], eax
lea rcx, [rbp + 0x6c0]
call fcn.1800fc840
mov qword [rbp + 0xc28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, dword [rbp + 0xc24]
mov rdx, qword [rbp + 0xc28]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1800fd0c1
jmp 0x1800fcf85
mov rax, qword [rbp + 0x358]
mov qword [rbp + 0xc18], rax
mov rcx, qword [rbp + 0xc18]
call fcn.180160d80
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x18025e540]
call fcn.180225a10
mov rax, rdi
mov rcx, qword [rbp + 0xc40]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0xc58]
pop rdi
pop rbp
ret