Function at 0x1800079e0
Capabilities:
Contain obfuscated stackstrings
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x810
mov rax, qword [0x18002b028]
xor rax, rsp
mov qword [rsp + 0x800], rax
mov r14d, 1
mov esi, edx
mov rbp, rcx
cmp edx, r14d
jae 0x180007a20
xor eax, eax
jmp 0x1800080e2
mov rcx, rsi
call fcn.1800129d0
mov r8, rsi
xor edx, edx
mov rcx, rax
mov rbx, rax
mov qword [rsp + 0x48], rax
call fcn.180015e20
mov r8d, esi
mov rdx, rbx
mov rcx, rbp
call fcn.1800066d4
xor r13d, r13d
cmp eax, r13d
jne 0x180007a5d
mov rcx, rbx
call fcn.180012990
jmp 0x180007a19
or r15, 0xffffffffffffffff
cmp rbx, r13
je 0x180007a80
lea r8, str.48d426ca6d45496e7413cf435516af06
lea rcx, [rsp + 0x48]
mov edx, esi
call fcn.180003830
mov rbx, qword [rsp + 0x48]
jmp 0x180007a83
mov eax, r15d
mov r8d, 0x130
cmp eax, r8d
jne 0x180007a53
lea rcx, [rsp + 0x60]
mov rdx, rbx
call fcn.180012b70
mov rcx, rbx
call fcn.180012990
mov edi, 0x103
lea rcx, [rsp + 0x1e1]
mov r8, rdi
xor edx, edx
mov byte [rsp + 0x1e0], r13b
call fcn.180015e20
mov qword [rsp + 0x50], r13
mov byte [rsp + 0x1b8], 0x7b
mov byte [rsp + 0x1b9], reloc.WS2_32.dll_gethostbyname
mov byte [rsp + 0x1ba], gethostname
mov byte [rsp + 0x1bb], 0x61
mov byte [rsp + 0x1bc], 0x65
mov byte [rsp + 0x1bd], 0x64
mov byte [rsp + 0x1be], 0x63
mov byte [rsp + 0x1bf], gethostname
mov byte [rsp + 0x1c0], gethostname
mov byte [rsp + 0x1c1], gethostbyname
mov byte [rsp + 0x1c2], gethostname
mov byte [rsp + 0x1c3], gethostbyname
mov byte [rsp + 0x1c4], gethostname
mov byte [rsp + 0x1c5], gethostname
mov byte [rsp + 0x1c6], gethostbyname
mov byte [rsp + 0x1c7], reloc.WS2_32.dll_gethostbyname
mov byte [rsp + 0x1c8], gethostbyname
mov byte [rsp + 0x1c9], 0x66
mov byte [rsp + 0x1ca], 0x64
mov byte [rsp + 0x1cb], gethostbyname
mov byte [rsp + 0x1cc], 0x62
mov byte [rsp + 0x1cd], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0x1ce], 0x61
mov byte [rsp + 0x1cf], gethostname
mov byte [rsp + 0x1d0], gethostbyname
mov byte [rsp + 0x1d1], gethostbyname
mov byte [rsp + 0x1d2], 0x63
mov byte [rsp + 0x1d3], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0x1d4], gethostname
mov byte [rsp + 0x1d5], gethostname
mov byte [rsp + 0x1d6], 0x66
mov byte [rsp + 0x1d7], 0x65
mov byte [rsp + 0x1d8], 0x61
mov byte [rsp + 0x1d9], 0x62
mov byte [rsp + 0x1da], 0x65
mov byte [rsp + 0x1db], 0x63
mov byte [rsp + 0x1dc], gethostbyname
mov byte [rsp + 0x1dd], 0x7d
mov byte [rsp + 0x1de], r13b
mov byte [rsp + 0x1a0], 0x53
mov byte [rsp + 0x1a1], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x1a2], 0x66
mov byte [rsp + 0x1a3], 0x74
mov byte [rsp + 0x1a4], 0x77
mov byte [rsp + 0x1a5], 0x61
mov byte [rsp + 0x1a6], WSAStartup
mov byte [rsp + 0x1a7], 0x65
mov byte [rsp + 0x1a8], 0x5c
mov byte [rsp + 0x1a9], 0x43
mov byte [rsp + 0x1aa], WSAStartup
mov byte [rsp + 0x1ab], 0x61
mov byte [rsp + 0x1ac], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x1ad], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x1ae], 0x65
mov byte [rsp + 0x1af], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x1b0], 0x5c
mov byte [rsp + 0x1b1], 0x43
mov byte [rsp + 0x1b2], 0x4c
mov byte [rsp + 0x1b3], 0x53
mov byte [rsp + 0x1b4], 0x49
mov byte [rsp + 0x1b5], 0x44
mov byte [rsp + 0x1b6], r13b
mov byte [rsp + 0x190], 0x49
mov byte [rsp + 0x191], WSAStartup
mov byte [rsp + 0x192], WSAStartup
mov byte [rsp + 0x193], WSAStartup
mov byte [rsp + 0x194], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x195], 0x63
mov byte [rsp + 0x196], 0x53
lea rcx, [rsp + 0x401]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x197], 0x65
mov byte [rsp + 0x198], WSAStartup
mov byte [rsp + 0x199], 0x76
mov byte [rsp + 0x19a], 0x65
mov byte [rsp + 0x19b], WSAStartup
mov byte [rsp + 0x19c], gethostname
mov byte [rsp + 0x19d], gethostname
mov byte [rsp + 0x19e], r13b
mov byte [rsp + 0x400], r13b
call fcn.180015e20
lea rdx, [rsp + 0x190]
lea rax, [rsp + 0x1b8]
mov qword [rsp + 0x28], rdx
lea r9, [rsp + 0x1a0]
lea r8, str._s_s_s
lea rcx, [rsp + 0x400]
mov edx, 0x400
mov qword [rsp + 0x20], rax
call fcn.180012f48
lea rdx, [rsp + 0x50]
mov r9d, 0x20019
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x400]
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [0x1800305a8]
cmp eax, r13d
jne 0x180007a19
lea rcx, [rsp + 0x2f1]
mov r8, rdi
xor edx, edx
mov byte [rsp + 0x2f0], r13b
call fcn.180015e20
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x44]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f0]
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x44], 0x104
call qword [0x1800305d8]
mov rcx, qword [rsp + 0x50]
cmp eax, r13d
je 0x180007e19
call qword [0x1800305a0]
jmp 0x180007a19
call qword [0x1800305a0]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x2f0]
lea rcx, [rsp + 0x1e0]
call qword [0x180030230]
mov qword [rsp + 0x30], r13
lea rcx, [rsp + 0x1e0]
xor r9d, r9d
mov r8d, r14d
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [0x180030358]
mov rdi, rax
cmp rax, r15
je 0x180007a19
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r9d, r9d
xor edx, edx
mov esi, eax
lea r8d, [r9 + 4]
mov rcx, rdi
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbx, rax
mov rcx, rdi
cmp rax, r13
jne 0x180007eb2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180007a19
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
cmp rax, r13
jne 0x180007edd
mov rcx, rbx
jmp 0x180007ea7
add esi, 0xfffffe68
mov rcx, rax
mov dword [rsp + 0x40], 0x198
mov r12d, r13d
mov ebp, r13d
mov eax, r13d
cmp esi, r13d
jbe 0x180007f15
cmp dword [rcx], 0x76ee38bb
jne 0x180007f0b
lea r12d, [rax + 4]
mov ebp, r14d
add eax, r14d
add rcx, r14
cmp eax, esi
jb 0x180007efc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp ebp, r13d
je 0x180007a19
mov eax, dword [rsp + 0x60]
mov ecx, dword [0x18002fe70]
lea rdi, [rsp + 0x170]
cmp eax, r13d
lea rsi, [0x18002fe70]
cmovne ecx, eax
mov eax, dword [rsp + 0x64]
mov dword [0x18002fe70], ecx
mov ecx, dword [0x18002fe74]
cmp eax, r13d
cmovne ecx, eax
xor eax, eax
mov dword [0x18002fe74], ecx
mov rcx, r15
repne scasb al, byte [rdi]
not rcx
cmp rcx, r14
je 0x180007f93
mov rcx, r13
mov al, byte [rsp + rcx + 0x170]
mov byte [rcx + rsi + 0x178], al
add rcx, r14
cmp al, r13b
jne 0x180007f7d
xor eax, eax
lea rdi, [rsp + 0x70]
mov rcx, r15
repne scasb al, byte [rdi]
not rcx
cmp rcx, r14
je 0x180007fba
mov rcx, r13
mov al, byte [rsp + rcx + 0x70]
mov byte [rcx + rsi + 0x18], al
add rcx, r14
cmp al, r13b
jne 0x180007faa
mov eax, dword [rsp + 0x68]
mov ecx, dword [0x18002fe80]
cmp eax, r13d
cmovne ecx, eax
mov eax, dword [rsp + 0x6c]
mov dword [0x18002fe80], ecx
mov ecx, dword [0x18002fe84]
cmp eax, r13d
cmovne ecx, eax
mov dword [0x18002fe84], ecx
mov ecx, dword [rsp + 0x40]
call fcn.1800129d0
mov r8d, dword [rsp + 0x40]
mov rdx, rsi
mov rcx, rax
mov rbx, rax
mov qword [rsp + 0x48], rax
call fcn.180012b70
cmp rbx, r13
je 0x180008023
mov edx, dword [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.180003964
mov rbx, qword [rsp + 0x48]
mov esi, eax
jmp 0x180008026
mov esi, r15d
cmp esi, r14d
jb 0x180007a53
mov ecx, esi
add rcx, 4
call fcn.1800129d0
mov r8d, esi
mov rdx, rbx
lea rcx, [rax + 4]
mov rbp, rax
mov dword [rax], esi
call fcn.180012b70
mov rcx, rbx
call fcn.180012990
mov qword [rsp + 0x30], r13
lea rcx, [rsp + 0x1e0]
xor r9d, r9d
mov r8d, r14d
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [0x180030358]
mov rdi, rax
cmp rax, r15
jne 0x180008094
mov rcx, rbp
jmp 0x180007a56
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r8d, [rsi + 4]
lea r9, [rsp + 0x40]
mov rdx, rbp
mov rcx, rdi
mov dword [rsp + 0x40], r13d
mov qword [rsp + 0x20], r13
call qword [0x180030360]
mov rcx, rdi
cmp eax, r13d
je 0x180007ea7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call fcn.180012990
mov eax, r14d
mov rcx, qword [rsp + 0x800]
xor rcx, rsp
call fcn.180012970
mov rbx, qword [rsp + 0x860]
add rsp, 0x810
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret