Function at 0x1800186c0
Capabilities:
Delete file
Encode data using xor
Get common file path
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x278], rbx
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov r13, r8
mov rsi, rdx
mov r12, rcx
xor r14d, r14d
cmp qword [r8 + 0x10], r14
jne 0x180018785
mov ecx, 0x800
call fcn.180033ee0
mov rdi, rax
mov ecx, 0x800
call fcn.180033ee0
mov rbx, rax
mov rdx, rdi
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov r9, rbx
xor r8d, r8d
lea rdx, [0x1800589c8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp word [rbx], r14w
jne 0x180018757
mov r8d, r14d
jmp 0x18001876a
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rbx + r8*2], r14w
jne 0x180018760
mov rdx, rbx
mov rcx, r13
call fcn.180005ff0
mov rcx, rdi
call fcn.180033ed8
mov rcx, rbx
call fcn.180033ed8
xor eax, eax
mov qword [rbp + 0x68], rax
mov dword [rbp + 0x68], r14d
mov dword [rbp + 0x6c], 0x400
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp + 0x60], rax
mov qword [rbp + 0xa8], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0xa0], r14
mov byte [rbp + 0x90], 0
movups xmm0, xmmword [0x180058dc8]
movups xmmword [rbp + 0xe0], xmm0
movups xmm1, xmmword [0x180058dd8]
movups xmmword [rbp + 0xf0], xmm1
movsd xmm0, qword [0x180058de8]
movsd qword [rbp + 0x100], xmm0
movzx eax, word [0x180058df0]
mov word [rbp + 0x108], ax
movzx eax, byte [0x180058df2]
mov byte [rbp + 0x10a], al
mov ecx, 0x29
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0xdf]
xor byte [rbp + rcx + 0xe0], al
dec rcx
test rcx, rcx
jg 0x180018820
xor byte [rbp + 0xe0], 0xae
jne 0x180018845
mov r8, r14
jmp 0x18001885a
lea rax, [rbp + 0xe0]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180018850
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x90]
call fcn.180006140
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp + 0x90]
call fcn.180006290
movsd xmm0, qword [0x180058df8]
movsd qword [rbp + 0xb0], xmm0
movzx eax, word [0x180058e00]
mov word [rbp + 0xb8], ax
movzx eax, byte [0x180058e02]
mov byte [rbp + 0xba], al
movzx eax, byte [rbp + 0xb8]
xor byte [rbp + 0xb9], al
movzx ecx, byte [rbp + 0xb7]
xor al, cl
mov byte [rbp + 0xb8], al
movzx eax, byte [rbp + 0xb6]
xor cl, al
mov byte [rbp + 0xb7], cl
movzx ecx, byte [rbp + 0xb5]
xor al, cl
mov byte [rbp + 0xb6], al
movzx eax, byte [rbp + 0xb4]
xor cl, al
mov byte [rbp + 0xb5], cl
movzx ecx, byte [rbp + 0xb3]
xor al, cl
mov byte [rbp + 0xb4], al
movzx eax, byte [rbp + 0xb2]
xor cl, al
mov byte [rbp + 0xb3], cl
movzx ecx, byte [rbp + 0xb1]
xor al, cl
mov byte [rbp + 0xb2], al
movzx eax, byte [rbp + 0xb0]
xor cl, al
mov byte [rbp + 0xb1], cl
xor al, 0x52
mov byte [rbp + 0xb0], al
jne 0x180018942
mov r8, r14
jmp 0x18001895a
lea rax, [rbp + 0xb0]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180018950
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x90]
call fcn.180006140
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], r14
call fcn.18000f420
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x38], r14
mov qword [rbp + 0x40], r14
call fcn.18000f420
mov qword [rbp + 0x38], rax
mov dword [rsp + 0x70], r14d
lea rdx, [rbp + 0x50]
call fcn.18001af60
movsd xmm0, qword [0x180058e08]
movsd qword [rbp + 0xc0], xmm0
movzx eax, word [0x180058e10]
mov word [rbp + 0xc8], ax
movzx eax, byte [0x180058e12]
mov byte [rbp + 0xca], al
movzx eax, byte [rbp + 0xc8]
xor byte [rbp + 0xc9], al
movzx ecx, byte [rbp + 0xc7]
xor al, cl
mov byte [rbp + 0xc8], al
movzx eax, byte [rbp + 0xc6]
xor cl, al
mov byte [rbp + 0xc7], cl
movzx ecx, byte [rbp + 0xc5]
xor al, cl
mov byte [rbp + 0xc6], al
movzx eax, byte [rbp + 0xc4]
xor cl, al
mov byte [rbp + 0xc5], cl
movzx ecx, byte [rbp + 0xc3]
xor al, cl
mov byte [rbp + 0xc4], al
movzx eax, byte [rbp + 0xc2]
xor cl, al
mov byte [rbp + 0xc3], cl
movzx ecx, byte [rbp + 0xc1]
xor al, cl
mov byte [rbp + 0xc2], al
movzx edx, byte [rbp + 0xc0]
xor cl, dl
mov byte [rbp + 0xc1], cl
xor dl, 0x3e
mov byte [rbp + 0xc0], dl
movsd xmm0, qword [str.OO_]
movsd qword [rbp + 0xb0], xmm0
movzx eax, word [0x180058e20]
mov word [rbp + 0xb8], ax
movzx eax, byte [0x180058e22]
mov byte [rbp + 0xba], al
movzx eax, byte [rbp + 0xb8]
xor byte [rbp + 0xb9], al
movzx ecx, byte [rbp + 0xb7]
xor al, cl
mov byte [rbp + 0xb8], al
movzx eax, byte [rbp + 0xb6]
xor cl, al
mov byte [rbp + 0xb7], cl
movzx ecx, byte [rbp + 0xb5]
xor al, cl
mov byte [rbp + 0xb6], al
movzx eax, byte [rbp + 0xb4]
xor cl, al
mov byte [rbp + 0xb5], cl
movzx ecx, byte [rbp + 0xb3]
xor al, cl
mov byte [rbp + 0xb4], al
movzx eax, byte [rbp + 0xb2]
xor cl, al
mov byte [rbp + 0xb3], cl
movzx ecx, byte [rbp + 0xb1]
xor al, cl
mov byte [rbp + 0xb2], al
movzx eax, byte [rbp + 0xb0]
xor cl, al
mov byte [rbp + 0xb1], cl
xor al, 0x24
mov byte [rbp + 0xb0], al
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x60], r14
mov byte [rsp + 0x50], 0
test dl, dl
jne 0x180018b2a
mov r8, r14
jmp 0x180018b3f
lea rax, [rbp + 0xc0]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180018b35
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x50]
call fcn.1800020b0
nop
mov rsi, qword [rbp + 0x50]
mov rdi, qword [rsi + 8]
mov rbx, rsi
cmp byte [rdi + 0x19], 0
jne 0x180018b9d
lea rdx, [rdi + 0x20]
lea r8, [rsp + 0x50]
call fcn.18000c790
test al, al
je 0x180018b7a
mov rdi, qword [rdi + 0x10]
jmp 0x180018b80
mov rbx, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], 0
je 0x180018b62
cmp rbx, rsi
je 0x180018b9d
lea r8, [rbx + 0x20]
lea rdx, [rsp + 0x50]
call fcn.18000c790
test al, al
je 0x180018bd0
lea rax, [rsp + 0x50]
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x80]
lea rcx, [rbp + 0x50]
call fcn.1800156a0
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x50]
call fcn.180015710
mov rbx, qword [rbp - 0x80]
cmp byte [rbp + 0xb0], 0
jne 0x180018bde
mov r8, r14
jmp 0x180018bfa
lea rax, [rbp + 0xb0]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180018bf0
lea rcx, [rbx + 0x40]
lea rdx, [rbp + 0xb0]
call fcn.1800020b0
nop
mov rax, qword [rsp + 0x68]
cmp rax, 0x10
jb 0x180018c63
inc rax
mov rcx, qword [rsp + 0x50]
cmp rax, 0x1000
jb 0x180018c5e
test cl, 0x1f
je 0x180018c31
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180018c40
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x180018c4f
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x180018c5b
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
mov dword [rsp + 0x78], r14d
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x58], 0xffffffffffffffff
mov r15d, r14d
mov dword [rsp + 0x74], r14d
nop dword [rax]
mov edi, r15d
shl rdi, 0x14
mov qword [rbp - 0x38], rdi
mov eax, dword [0x180058e24]
mov dword [rbp + 0xd0], eax
movzx eax, word [0x180058e28]
mov word [rbp + 0xd4], ax
movzx eax, byte [rbp + 0xd3]
xor byte [rbp + 0xd4], al
movzx ecx, byte [rbp + 0xd2]
xor al, cl
mov byte [rbp + 0xd3], al
movzx eax, byte [rbp + 0xd1]
xor cl, al
mov byte [rbp + 0xd2], cl
movzx edx, byte [rbp + 0xd0]
xor al, dl
mov byte [rbp + 0xd1], al
xor dl, 0x5e
mov byte [rbp + 0xd0], dl
mov eax, dword [0x180058e2c]
mov dword [rbp + 0xc0], eax
movzx eax, word [0x180058e30]
mov word [rbp + 0xc4], ax
movzx eax, byte [0x180058e32]
mov byte [rbp + 0xc6], al
movzx eax, byte [rbp + 0xc4]
xor byte [rbp + 0xc5], al
movzx ecx, byte [rbp + 0xc3]
xor al, cl
mov byte [rbp + 0xc4], al
movzx eax, byte [rbp + 0xc2]
xor cl, al
mov byte [rbp + 0xc3], cl
movzx ecx, byte [rbp + 0xc1]
xor al, cl
mov byte [rbp + 0xc2], al
movzx eax, byte [rbp + 0xc0]
xor cl, al
mov byte [rbp + 0xc1], cl
xor al, 0x1c
mov byte [rbp + 0xc0], al
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x60], r14
mov byte [rsp + 0x50], 0
test dl, dl
jne 0x180018d7c
mov r8, r14
jmp 0x180018d9a
lea rax, [rbp + 0xd0]
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180018d90
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x50]
call fcn.1800020b0
nop
lea rdx, [rdi + 0xfffff]
lea rcx, [rbp + 0xe0]
call fcn.180015ca0
mov rbx, rax
mov rdx, rdi
lea rcx, [rbp + 0x10]
call fcn.180015ca0
nop
mov r8, rax
lea rdx, [rbp + 0xc0]
lea rcx, [rbp - 0x10]
call fcn.180006900
nop
lea r8, [0x180058d90]
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.180006ce0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.180006ad0
mov r15, rax
mov rsi, qword [rbp + 0x50]
mov rdi, qword [rsi + 8]
mov rbx, rsi
cmp byte [rdi + 0x19], 0
jne 0x180018e5b
nop word [rax + rax]
lea rdx, [rdi + 0x20]
lea r8, [rsp + 0x50]
call fcn.18000c790
test al, al
je 0x180018e38
mov rdi, qword [rdi + 0x10]
jmp 0x180018e3e
mov rbx, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], 0
je 0x180018e20
cmp rbx, rsi
je 0x180018e5b
lea r8, [rbx + 0x20]
lea rdx, [rsp + 0x50]
call fcn.18000c790
test al, al
je 0x180018e8e
lea rax, [rsp + 0x50]
mov qword [rbp - 0x50], rax
lea r8, [rbp - 0x50]
lea rcx, [rbp + 0x50]
call fcn.1800156a0
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x50]
call fcn.180015710
mov rbx, qword [rbp - 0x48]
lea rcx, [rbx + 0x40]
mov rdx, r15
call fcn.1800091e0
nop
mov rax, qword [rbp - 0x60]
cmp rax, 0x10
jb 0x180018ee9
inc rax
mov rcx, qword [rbp - 0x78]
cmp rax, 0x1000
jb 0x180018ee4
test cl, 0x1f
jne 0x180019a05
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1800199ff
sub rcx, rax
cmp rcx, 8
jb 0x1800199f9
cmp rcx, 0x27
ja 0x1800199f3
mov rcx, rax
call fcn.180033ed0
mov qword [rbp - 0x60], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x68], r14
mov byte [rbp - 0x78], 0
mov rax, qword [rbp - 0x18]
cmp rax, 0x10
jb 0x180018f47
inc rax
mov rcx, qword [rbp - 0x30]
cmp rax, 0x1000
jb 0x180018f42
test cl, 0x1f
jne 0x180019a1d
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x180019a17
sub rcx, rax
cmp rcx, 8
jb 0x180019a11
cmp rcx, 0x27
ja 0x180019a0b
mov rcx, rax
call fcn.180033ed0
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x20], r14
mov byte [rbp - 0x30], 0
mov rax, qword [rbp + 8]
cmp rax, 0x10
jb 0x180018fa5
inc rax
mov rcx, qword [rbp - 0x10]
cmp rax, 0x1000
jb 0x180018fa0
test cl, 0x1f
jne 0x180019a35
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x180019a2f
sub rcx, rax
cmp rcx, 8
jb 0x180019a29
cmp rcx, 0x27
ja 0x180019a23
mov rcx, rax
call fcn.180033ed0
mov qword [rbp + 8], reloc.WS2_32.dll_ntohs
mov qword [rbp], r14
mov byte [rbp - 0x10], 0
mov rax, qword [rbp + 0x28]
cmp rax, 0x10
jb 0x180019003
inc rax
mov rcx, qword [rbp + 0x10]
cmp rax, 0x1000
jb 0x180018ffe
test cl, 0x1f
jne 0x180019a4d
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x180019a47
sub rcx, rax
cmp rcx, 8
jb 0x180019a41
cmp rcx, 0x27
ja 0x180019a3b
mov rcx, rax
call fcn.180033ed0
mov qword [rbp + 0x28], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x20], r14
mov byte [rbp + 0x10], 0
mov rax, qword [rbp + 0xf8]
cmp rax, 0x10
jb 0x180019067
inc rax
mov rcx, qword [rbp + 0xe0]
cmp rax, 0x1000
jb 0x180019062
test cl, 0x1f
jne 0x180019a65
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x180019a5f
sub rcx, rax
cmp rcx, 8
jb 0x180019a59
cmp rcx, 0x27
ja 0x180019a53
mov rcx, rax
call fcn.180033ed0
mov qword [rbp + reloc.WS2_32.dll_ntohs8], 0xf
mov qword [rbp + 0xf0], r14
mov byte [rbp + 0xe0], 0
mov rax, qword [rsp + 0x68]
cmp rax, 0x10
jb 0x1800190d1
inc rax
mov rcx, qword [rsp + 0x50]
cmp rax, 0x1000
jb 0x1800190cb
test cl, 0x1f
jne 0x180019a7d
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x180019a77
sub rcx, rax
cmp rcx, 8
jb 0x180019a71
cmp rcx, 0x27
ja 0x180019a6b
mov rcx, rax
call fcn.180033ed0
nop
mov rax, qword [rbp + 0x38]
mov rsi, qword [rax + 8]
mov rdi, rsi
cmp byte [rsi + 0x19], 0
jne 0x180019119
mov rdx, qword [rdi + 0x10]
lea rcx, [rbp + 0x38]
call fcn.18000ee60
mov rdi, qword [rdi]
lea rcx, [rsi + 0x40]
call fcn.180001e50
lea rcx, [rsi + 0x20]
call fcn.180001e50
mov rcx, rsi
call fcn.180033ed0
mov rsi, rdi
cmp byte [rdi + 0x19], 0
je 0x1800190e2
mov rax, qword [rbp + 0x38]
mov qword [rax + 8], rax
mov rax, qword [rbp + 0x38]
mov qword [rax], rax
mov rax, qword [rbp + 0x38]
mov qword [rax + 0x10], rax
mov qword [rbp + 0x40], r14
mov qword [rbp - 0x60], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x68], r14
mov byte [rbp - 0x78], 0
mov r8d, 3
lea rdx, [0x180058ba4]
lea rcx, [rbp - 0x78]
call fcn.1800020b0
nop
lea rdx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0x10
cmovae rdx, qword [rbp + 0x90]
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x60], r14
mov byte [rsp + 0x50], 0
cmp byte [rdx], 0
jne 0x18001918b
mov r8, r14
jmp 0x18001919a
or r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x180019190
lea rcx, [rsp + 0x50]
call fcn.1800020b0
nop
lea rax, [rbp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [r12 + 8]
call fcn.1800124b0
mov ebx, eax
mov rax, qword [rsp + 0x68]
cmp rax, 0x10
jb 0x18001923a
inc rax
mov rcx, qword [rsp + 0x50]
cmp rax, 0x1000
jb 0x180019235
test cl, 0x1f
jne 0x180019a95
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x180019a8f
sub rcx, rax
cmp rcx, 8
jb 0x180019a89
cmp rcx, 0x27
ja 0x180019a83
mov rcx, rax
call fcn.180033ed0
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x60], r14
mov byte [rsp + 0x50], 0
mov rax, qword [rbp - 0x60]
cmp rax, 0x10
jb 0x18001929b
inc rax
mov rcx, qword [rbp - 0x78]
cmp rax, 0x1000
jb 0x180019296
test cl, 0x1f
jne 0x180019aad
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x180019aa7
sub rcx, rax
cmp rcx, 8
jb 0x180019aa1
cmp rcx, 0x27
ja 0x180019a9b
mov rcx, rax
call fcn.180033ed0
mov edi, r14d
nop
test ebx, ebx
je 0x18001944c
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbp - 0x60], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x68], r14
mov byte [rbp - 0x78], 0
mov r8d, 3
lea rdx, [0x180058ba4]
lea rcx, [rbp - 0x78]
call fcn.1800020b0
nop
lea rdx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0x10
cmovae rdx, qword [rbp + 0x90]
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x60], r14
mov byte [rsp + 0x50], 0
cmp byte [rdx], 0
jne 0x18001930e
mov r8, r14
jmp 0x18001931c
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x180019312
lea rcx, [rsp + 0x50]
call fcn.1800020b0
nop
lea rax, [rbp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [r12 + 8]
call fcn.1800124b0
mov ebx, eax
mov rax, qword [rsp + 0x68]
cmp rax, 0x10
jb 0x1800193bc
inc rax
mov rcx, qword [rsp + 0x50]
cmp rax, 0x1000
jb 0x1800193b7
test cl, 0x1f
jne 0x180019ac5
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x180019abf
sub rcx, rax
cmp rcx, 8
jb 0x180019ab9
cmp rcx, 0x27
ja 0x180019ab3
mov rcx, rax
call fcn.180033ed0
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x60], r14
mov byte [rsp + 0x50], 0
mov rax, qword [rbp - 0x60]
cmp rax, 0x10
jb 0x18001941d
inc rax
mov rcx, qword [rbp - 0x78]
cmp rax, 0x1000
jb 0x180019418
test cl, 0x1f
jne 0x180019add
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x180019ad7
sub rcx, rax
cmp rcx, 8
jb 0x180019ad1
cmp rcx, 0x27
ja 0x180019acb
mov rcx, rax
call fcn.180033ed0
inc edi
cmp edi, 3
jl 0x1800192a0
test ebx, ebx
je 0x18001944c
cmp ebx, 2
je 0x180019b04
cmp ebx, 4
je 0x180019b04
lea eax, [rbx - 1]
test eax, 0xfffffffd
je 0x180019ae3
movsd xmm0, qword [0x180058e38]
movsd qword [rbp + 0xb0], xmm0
mov eax, dword [0x180058e40]
mov dword [rbp + 0xb8], eax
movzx eax, word [0x180058e44]
mov word [rbp + 0xbc], ax
lea r8, [rbp + 0xbb]
mov r9d, 2
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r8]
xor byte [r8 + 1], cl
movzx eax, byte [r8 - 1]
xor al, cl
mov byte [r8], al
movzx eax, byte [r8 - 2]
xor byte [r8 - 1], al
movzx eax, byte [r8 - 3]
xor byte [r8 - 2], al
movzx eax, byte [r8 - 4]
xor byte [r8 - 3], al
movzx eax, byte [r8 - 5]
xor byte [r8 - 4], al
lea r8, [r8 - 6]
sub r9, 1
jne 0x180019490
xor byte [rbp + 0xb0], 0x84
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x60], r14
mov byte [rsp + 0x50], r9b
jne 0x1800194f1
mov r8, r14
jmp 0x18001950a
lea rax, [rbp + 0xb0]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180019500
lea rdx, [rbp + 0xb0]
lea rcx, [rsp + 0x50]
call fcn.1800020b0
mov rsi, qword [rbp + 0x38]
mov rdi, qword [rsi + 8]
mov rbx, rsi
cmp byte [rdi + 0x19], 0
jne 0x18001956b
nop dword [rax]
lea rdx, [rdi + 0x20]
lea r8, [rsp + 0x50]
call fcn.18000c790
test al, al
je 0x180019548
mov rdi, qword [rdi + 0x10]
jmp 0x18001954e
mov rbx, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], 0
je 0x180019530
cmp rbx, rsi
je 0x18001956b
lea r8, [rbx + 0x20]
lea rdx, [rsp + 0x50]
call fcn.18000c790
test al, al
je 0x18001956e
mov rbx, rsi
mov rax, qword [rsp + 0x68]
cmp rax, 0x10
jb 0x1800195c2
inc rax
mov rcx, qword [rsp + 0x50]
cmp rax, 0x1000
jb 0x1800195b9
test cl, 0x1f
jne 0x180019b37
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x180019b31
sub rcx, rax
cmp rcx, 8
jb 0x180019b2b
cmp rcx, 0x27
ja 0x180019b25
mov rcx, rax
call fcn.180033ed0
mov rsi, qword [rbp + 0x38]
mov qword [rbp + 0x88], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x80], r14
mov byte [rbp + 0x70], 0
mov dword [rbp + 0x48], r14d
cmp rbx, rsi
je 0x18001971c
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x60], r14
mov byte [rsp + 0x50], 0
cmp byte [rbp + 0xb0], 0
jne 0x180019606
mov r8, r14
jmp 0x18001961b
lea rax, [rbp + 0xb0]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180019611
lea rdx, [rbp + 0xb0]
lea rcx, [rsp + 0x50]
call fcn.1800020b0
nop
mov rsi, qword [rbp + 0x38]
mov rdi, qword [rsi + 8]
mov rbx, rsi
cmp byte [rdi + 0x19], 0
jne 0x18001967b
nop
lea rdx, [rdi + 0x20]
lea r8, [rsp + 0x50]
call fcn.18000c790
test al, al
je 0x180019658
mov rdi, qword [rdi + 0x10]
jmp 0x18001965e
mov rbx, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], 0
je 0x180019640
cmp rbx, rsi
je 0x18001967b
lea r8, [rbx + 0x20]
lea rdx, [rsp + 0x50]
call fcn.18000c790
test al, al
je 0x1800196ae
lea rax, [rsp + 0x50]
mov qword [rbp - 0x50], rax
lea r8, [rbp - 0x50]
lea rcx, [rbp + 0x38]
call fcn.1800156a0
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x38]
call fcn.180015710
mov rbx, qword [rbp - 0x40]
lea rdx, [rbx + 0x40]
lea rax, [rbp + 0x70]
cmp rax, rdx
je 0x1800196cc
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp + 0x70]
call fcn.1800021e0
nop
mov rax, qword [rsp + 0x68]
cmp rax, 0x10
jb 0x18001971c
inc rax
mov rcx, qword [rsp + 0x50]
cmp rax, 0x1000
jb 0x180019717
test cl, 0x1f
jne 0x180019b4f
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x180019b49
sub rcx, rax
cmp rcx, 8
jb 0x180019b43
cmp rcx, 0x27
ja 0x180019b3d
mov rcx, rax
call fcn.180033ed0
mov r9d, 6
xor r8d, r8d
lea rdx, str.bytes
lea rcx, [rbp + 0x70]
call fcn.18000de20
mov r8, rax
mov eax, dword [rsp + 0x70]
add eax, 0xffffff38
cmp eax, 0x63
ja 0x1800199ac
cmp r8, 0xffffffffffffffff
je 0x1800199ac
add r8, 6
or r9, 0xffffffffffffffff
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x70]
call fcn.18000be20
mov rbx, rax
lea rax, [rbp + 0x70]
cmp rax, rbx
je 0x1800197ec
mov rax, qword [rbp + 0x88]
cmp rax, 0x10
jb 0x1800197c9
inc rax
mov rcx, qword [rbp + 0x70]
cmp rax, 0x1000
jb 0x1800197c4
test cl, 0x1f
jne 0x180019b67
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x180019b61
sub rcx, rax
cmp rcx, 8
jb 0x180019b5b
cmp rcx, 0x27
ja 0x180019b55
mov rcx, rax
call fcn.180033ed0
mov qword [rbp + 0x88], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x80], r14
mov byte [rbp + 0x70], 0
mov rdx, rbx
lea rcx, [rbp + 0x70]
call fcn.1800063c0
nop
lea rcx, [rbp + 0xe0]
call fcn.180001e50
xor r8d, r8d
mov dl, 0x2f
lea rcx, [rbp + 0x70]
call fcn.18001b5c0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180019847
lea r8, [rax + 1]
or r9, 0xffffffffffffffff
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x70]
call fcn.18000be20
mov rcx, rax
call fcn.180001ff0
mov rcx, rax
call fcn.18003b8f8
mov qword [rbp - 0x80], rax
lea rcx, [rbp + 0xe0]
call fcn.180001e50
mov r15d, dword [rsp + 0x74]
mov rsi, qword [rbp - 0x58]
test r15d, r15d
jne 0x18001989d
cmp rsi, 0xffffffffffffffff
jne 0x18001989d
mov rcx, r13
call fcn.18000bd40
mov rcx, rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
mov qword [rbp - 0x58], rax
cmp rax, 0xffffffffffffffff
je 0x180019b6d
mov r9, rbx
xor r8d, r8d
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x70]
call fcn.18000be20
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.1800091e0
lea rcx, [rbp + 0xe0]
call fcn.180001e50
xor r8d, r8d
lea rdx, [0x180058d90]
lea rcx, [rbp + 0x70]
call fcn.18000dcd0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800199b1
mov r9, rax
xor r8d, r8d
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x70]
call fcn.18000be20
mov rcx, rax
call fcn.180001ff0
mov rcx, rax
call fcn.18003b8f8
mov rdi, rax
lea rcx, [rbp + 0xe0]
call fcn.180001e50
cmp qword [rbp - 0x38], rdi
jne 0x1800199b1
lea r8, [rbx + 1]
or r9, 0xffffffffffffffff
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x70]
call fcn.18000be20
mov rcx, rax
call fcn.180001ff0
mov rcx, rax
call fcn.18003b8f8
mov rbx, rax
lea rcx, [rbp + 0xe0]
call fcn.180001e50
mov dword [rbp + 0x48], r14d
mov rcx, rbx
sub rcx, rdi
inc rcx
mov r8d, dword [rbp + 0x68]
cmp rcx, r8
jne 0x1800199b1
mov rax, qword [rbp - 0x80]
dec rax
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x48]
mov rdx, qword [rbp + 0x60]
mov rcx, rsi
cmp rax, rbx
je 0x180019b77
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x78], r14d
inc r15d
mov dword [rsp + 0x74], r15d
jmp 0x1800199d8
mov r15d, dword [rsp + 0x74]
mov dword [r12], 4
mov ebx, dword [rsp + 0x78]
inc ebx
mov dword [rsp + 0x78], ebx
cmp ebx, 3
ja 0x180019ba3
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rbp + 0x70]
call fcn.180001e50
cmp r15d, 0x400000
jae 0x180019b97
jmp 0x180018c80
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
mov dword [r12], 1
cmp qword [r13 + 0x18], 8
jb 0x180019af6
mov r13, qword [r13]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x180019bec
mov dword [r12], 3
cmp qword [r13 + 0x18], 8
jb 0x180019b17
mov r13, qword [r13]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x180019bec
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
mov dword [r12], 7
jmp 0x180019bd0
mov dword [r12], r14d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x68], r14d
lea rcx, [rbp + 0x70]
call fcn.180001e50
mov dword [r12], r14d
mov r14d, 1
jmp 0x180019bec
mov dword [rbp + 0x68], r14d
cmp qword [r13 + 0x10], 0
je 0x180019bd0
cmp qword [rbp - 0x58], 0xffffffffffffffff
jne 0x180019bd0
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call fcn.18000bd40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, r13
call fcn.18000bd40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rbp + 0x70]
call fcn.180001e50
nop
lea rcx, [rbp + 0x38]
call fcn.18000d2d0
nop
lea rcx, [rbp + 0x50]
call fcn.18000d2d0
nop
lea rcx, [rbp + 0x90]
call fcn.180001e50
nop
lea rcx, [rbp + 0x60]
call fcn.18000a630
mov eax, r14d
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.180033e70
mov rbx, qword [rsp + 0x278]
add rsp, 0x220
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret