Function at 0x1800083e0
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
test r8, r8
je 0x1800089b8
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rsi
push rdi
push r12
lea rbp, [rsp - 0x1440]
mov eax, 0x1540
call sub.ntdll.dll___chkstk
sub rsp, rax
xor r12d, r12d
movzx edi, cl
mov ebx, r12d
mov r9, rdx
cmp dword [section..bss], ebx
mov esi, ecx
je 0x1800089ab
lea rax, [rbp + 0x1488]
mov qword [rsp + 0x1530], r14
mov qword [rbp - 0x60], rax
mov r8d, 1
mov qword [rsp + 0x1528], r15
lock xadd dword [0x180039220], r8d
inc r8d
bt ecx, 0xd
jb 0x180008762
lea r14, [rbp + 0x420]
bt ecx, 0xa
jae 0x180008530
rdtsc
shl rdx, 0x20
or rax, rdx
mov qword [rsp + 0x68], rax
mov rax, qword [0x180039228]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
cmp rax, rcx
mov rax, qword [rsp + 0x60]
jbe 0x1800084b3
mov rcx, qword [rsp + 0x68]
lock cmpxchg qword [0x180039228], rcx
mov rcx, qword [0x180039228]
mov rdx, qword [0x180039228]
movdqa xmm0, xmmword [0x180043820]
movdqa xmm1, xmmword [0x180043830]
movdqu xmmword [rbp - 0x80], xmm0
movdqu xmmword [rbp - 0x70], xmm1
test rdx, rdx
je 0x180008515
mov r10d, r12d
lea rcx, [rbp + 0x42f]
cmp r10d, 0x10
jge 0x1800084fe
mov rax, rdx
shr rdx, 4
and eax, 0xf
inc r10d
movzx r11d, byte [rbp + rax - 0x80]
jmp 0x180008501
mov r11b, 0x30
mov byte [rcx], r11b
lea rax, [rbp + 0x420]
dec rcx
cmp rcx, rax
jae 0x1800084e3
jmp 0x180008524
movdqa xmm0, xmmword [str.00000000000000000123456789ABCDEF0123456789abcdeftrue]
movups xmmword [rbp + 0x420], xmm0
mov byte [rbp + 0x430], 0x20
mov ebx, setsockopt
movabs r15, 0x3030303030303030
bt esi, 0xc
jae 0x1800085af
movdqa xmm0, xmmword [0x180043820]
lea r11, [rbp + 0x420]
movdqa xmm1, xmmword [0x180043830]
mov eax, ebx
add r11, rax
movdqu xmmword [rbp - 0x28], xmm0
movdqu xmmword [rbp - 0x18], xmm1
test r8d, r8d
je 0x18000859f
lea rdx, [r11 + 7]
mov r10d, r12d
cmp rdx, r11
jb 0x1800085a2
cmp r10d, 8
jge 0x180008591
mov eax, r8d
shr r8d, 4
and eax, 0xf
inc r10d
movzx eax, byte [rbp + rax - 0x28]
jmp 0x180008593
mov al, 0x30
mov byte [rdx], al
dec rdx
cmp rdx, r11
jae 0x180008577
jmp 0x1800085a2
mov qword [r11], r15
add ebx, 8
mov byte [rbp + rbx + 0x420], 0x20
inc ebx
bt esi, 0xb
jae 0x18000863d
movdqa xmm0, xmmword [0x180043820]
lea r11, [rbp + 0x420]
movdqa xmm1, xmmword [0x180043830]
mov eax, ebx
add r11, rax
mov rax, qword gs:[0x30]
movdqu xmmword [rbp - 8], xmm0
movdqu xmmword [rbp + 8], xmm1
mov r10d, dword [rax + 0x48]
test r10d, r10d
je 0x180008628
lea rdx, [r11 + 5]
mov r8d, r12d
cmp rdx, r11
jb 0x180008630
nop dword [rax]
cmp r8d, 8
jge 0x18000861a
mov eax, r10d
shr r10d, 4
and eax, 0xf
inc r8d
movzx eax, byte [rbp + rax - 8]
jmp 0x18000861c
mov al, 0x30
mov byte [rdx], al
dec rdx
cmp rdx, r11
jae 0x180008600
jmp 0x180008630
mov dword [r11], r15d
mov word [r11 + 4], r15w
add ebx, 6
mov byte [rbp + rbx + 0x420], 0x20
inc ebx
bt esi, 0xe
jae 0x1800086bc
mov eax, ebx
lea rcx, [rbp + 0x420]
add rcx, rax
cmp edi, 1
jne 0x18000865c
mov dword [rcx], 0x4c494146
jmp 0x1800086af
cmp edi, 2
jne 0x180008669
mov dword [rcx], 0x52525245
jmp 0x1800086af
cmp edi, 3
jne 0x180008676
mov dword [rcx], 0x4e524157
jmp 0x1800086af
cmp edi, 4
jne 0x180008683
mov dword [rcx], 0x45544f4e
jmp 0x1800086af
cmp edi, 5
jne 0x180008690
mov dword [rcx], 0x4f464e49
jmp 0x1800086af
cmp edi, 6
jne 0x18000869d
mov dword [rcx], 0x47424544
jmp 0x1800086af
cmp edi, 7
mov eax, 0x454e4f4e
mov edx, 0x45435254
cmove eax, edx
mov dword [rcx], eax
add ebx, 4
mov byte [rbp + rbx + 0x420], 0x20
inc ebx
test r9, r9
je 0x1800086f3
bt esi, 9
jae 0x1800086f3
movzx ecx, byte [r9]
test cl, cl
je 0x1800086e7
nop
mov eax, ebx
lea r9, [r9 + 1]
inc ebx
mov byte [rbp + rax + 0x420], cl
movzx ecx, byte [r9]
test cl, cl
jne 0x1800086d0
mov eax, ebx
inc ebx
mov byte [rbp + rax + 0x420], 0x20
test ebx, ebx
je 0x180008717
mov eax, ebx
inc ebx
mov byte [rbp + rax + 0x420], gethostbyaddr
mov byte [rbp + rbx + 0x420], 0x3e
inc ebx
mov byte [rbp + rbx + 0x420], 0x20
inc ebx
mov r9, qword [rbp - 0x60]
lea rdx, [rbp + 0x420]
mov rcx, qword [rbp + 0x1480]
mov r8d, 0xffd
mov eax, ebx
sub r8d, ebx
add rdx, rax
call fcn.1800077c0
add ebx, eax
bt esi, 8
jae 0x180008758
mov byte [rbp + rbx + 0x420], reloc.WS2_32.dll_listen
inc ebx
mov byte [rbp + rbx + 0x420], 0xa
inc ebx
mov byte [rbp + rbx + 0x420], r12b
jmp 0x180008789
mov r14, qword [rbp + 0x1480]
test r9, r9
je 0x180008773
mov ebx, r9d
jmp 0x180008789
cmp byte [r14], bl
je 0x180008789
nop dword [rax + rax]
inc rbx
cmp byte [rbx + r14], r12b
jne 0x180008780
test sil, sil
je 0x18000879a
cmp edi, dword [reloc.WS2_32.dll_htons]
jge 0x18000899b
mov eax, dword [section..bss]
test al, 4
je 0x1800087b8
mov r8d, edi
mov edx, ebx
mov rcx, r14
call qword [0x18004a2c0]
mov eax, dword [section..bss]
test al, 1
je 0x180008939
mov rcx, qword [0x180039008]
test rcx, rcx
jne 0x1800088f8
lea edx, [rcx + 0x5c]
mov qword [rsp + 0x1538], r13
test al, 8
mov word [rbp + 0x34], dx
xorps xmm0, xmm0
mov dword [rbp - 0x54], r12d
lea edi, [rcx + 0xb]
mov dword [rbp - 0x3c], r12d
mov r13d, 3
mov dword [rbp + 0x20], 0x3f005c
mov r15d, 5
mov dword [rbp + 0x24], 0x5c003f
cmovne r15d, r13d
mov dword [rbp + 0x28], 0x6c0047
xor edx, edx
mov dword [rbp + 0x2c], 0x62006f
mov r8d, 0x3ea
mov dword [rbp + 0x30], 0x6c0061
lea rcx, [rbp + 0x36]
lea rsi, [0x180039010]
movups xmmword [rbp - 0x80], xmm0
call fcn.180008e20
movzx ecx, word [0x180039010]
test cx, cx
je 0x180008865
nop word [rax + rax]
mov eax, edi
lea rsi, [rsi + 2]
inc edi
mov word [rbp + rax*2 + 0x20], cx
movzx ecx, word [rsi]
test cx, cx
jne 0x180008850
mov dword [rsp + 0x50], r12d
lea rax, [rbp + 0x20]
mov qword [rsp + 0x48], r12
lea r9, [rbp - 0x80]
mov dword [rsp + 0x40], 0x60
lea r8, [rbp - 0x58]
mov dword [rsp + 0x38], r15d
lea rcx, [0x180039008]
add di, di
mov qword [rsp + 0x78], rax
mov word [rsp + 0x70], di
lea rax, [rsp + 0x70]
mov dword [rsp + 0x30], r13d
xorps xmm0, xmm0
add di, 2
mov dword [rsp + 0x28], 0x80
mov edx, 0x100004
mov qword [rsp + 0x20], r12
mov word [rsp + 0x72], di
mov dword [rbp - 0x58], gethostbyaddr
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], rax
mov dword [rbp - 0x40], 0x40
movdqu xmmword [rbp - 0x38], xmm0
call qword [sym.imp.ntdll.dll_NtCreateFile]
mov r13, qword [rsp + 0x1538]
test eax, eax
jne 0x180008933
mov rcx, qword [0x180039008]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
mov dword [rsp + 0x30], ebx
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], r14
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov qword [rsp + 0x70], r12
movups xmmword [rbp - 0x80], xmm0
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov eax, dword [section..bss]
test al, 2
je 0x18000899b
mov rcx, qword [0x180039218]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
test rcx, rcx
jne 0x18000896c
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x20]
mov rcx, qword [rax + 0x28]
mov qword [0x180039218], rcx
cmp ecx, 7
je 0x18000899b
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], r12
xor r9d, r9d
mov dword [rsp + 0x30], ebx
xor r8d, r8d
mov qword [rsp + 0x28], r14
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov r14, qword [rsp + 0x1530]
mov r15, qword [rsp + 0x1528]
add rsp, 0x1540
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret