Function at 0x18000ce60
Capabilities:
Encode data using xor
Get file version info

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1530]
mov eax, 0x1630
call fcn.18019b750
sub rsp, rax
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x1668], rbx
mov qword [rsp + 0x1670], rsi
mov qword [rsp + 0x1678], rdi
mov rax, qword [0x1802678f0]
xor rax, rsp
mov qword [rbp + 0x1520], rax
mov rdi, rcx
call fcn.180014af0
xor edx, edx
mov r8d, 0x88
lea rcx, [rbp]
call fcn.18019d020
lea rcx, [rbp]
call fcn.180013ddc
nop
lea rax, vtable.CCommandLineInfoEx.0
mov qword [rbp], rax
mov edx, 0xa
lea rcx, [rbp + 0x48]
call fcn.1800136fc
call fcn.18000fc98
mov rcx, rax
test rax, rax
je 0x18000d972
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x80], rax
lea rdx, [rbp]
mov rcx, rdi
call fcn.180014d50
lea r8, [rdi + 0x1e0]
lea rdx, str.sourcefile
lea rcx, [rbp + 0x48]
call fcn.180013a30
lea r8, [rdi + 0x1e8]
lea rdx, str.destination
lea rcx, [rbp + 0x48]
call fcn.180013a30
lea r8, [rdi + 0x1f0]
lea rdx, str.tracker
lea rcx, [rbp + 0x48]
call fcn.180013a30
lea r8, [rdi + 0x1f8]
lea rdx, str.comment
lea rcx, [rbp + 0x48]
call fcn.180013a30
mov rax, qword [rdi + 0x1e0]
mov rbx, 0xffffffffffffffff
cmp dword [rax - 0x10], 0
jle 0x18000cfd9
mov rax, qword [rdi + 0x1e8]
cmp dword [rax - 0x10], 0
jle 0x18000cfd9
mov rax, qword [rdi + 0x1f0]
cmp dword [rax - 0x10], 0
jle 0x18000cfd9
mov rax, qword [rdi + 0x1f8]
cmp dword [rax - 0x10], 0
jne 0x18000cfd9
lea rdx, str.http:__shareaza.sourceforge.net_
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000cfc0
mov r8d, eax
lea rcx, [rdi + 0x1f8]
call fcn.180002e50
xor r14d, r14d
mov dword [rbp - 0x18], r14d
mov qword [rdi + 0x188], r14
mov r8d, 0x104
lea rdx, [rbp + 0x1100]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x18000d040
lea rcx, [rdi + 0x178]
lea rdx, [rbp + 0x1100]
mov rax, rbx
inc rax
cmp word [rdx + rax*2], r14w
jne 0x18000d011
mov r8d, eax
lea rdx, [rbp + 0x1100]
call fcn.180002e50
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x1100]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [rbp - 0x18], eax
jmp 0x18000d043
mov eax, dword [rbp - 0x18]
test eax, eax
je 0x18000d0bf
mov ecx, eax
call fcn.18000eb04
mov rsi, rax
mov r9, rax
mov r8d, dword [rbp - 0x18]
xor edx, edx
lea rcx, [rbp + 0x1100]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x18000d0b7
lea r9, [rbp - 0x18]
lea r8, [rbp - 0x10]
lea rdx, [0x1802290ac]
mov rcx, rsi
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x18000d0b7
mov rcx, qword [rbp - 0x10]
movzx eax, word [rcx + 0xa]
mov word [rdi + 0x188], ax
movzx eax, word [rcx + 8]
mov word [rdi + 0x18a], ax
movzx eax, word [rcx + 0xe]
mov word [rdi + 0x18c], ax
movzx eax, word [rcx + 0xc]
mov word [rdi + 0x18e], ax
mov rcx, rsi
call fcn.18000eafc
movzx eax, word [rdi + 0x18e]
movzx edx, word [rdi + 0x18c]
movzx r9d, word [rdi + 0x18a]
movzx r8d, word [rdi + 0x188]
lea rcx, [rdi + 0x180]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edx
lea rdx, str._i._i._i._i
call fcn.180003b70
lea rsi, [0x18022bcd0]
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x60], r14d
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 0x190
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx - 0xb]
call qword [sym.imp.GDI32.dll_CreateFontW]
mov rdx, rax
lea rcx, [rdi + 0x190]
call fcn.180010a5c
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x60], r14d
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 0x2bc
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx - 0xb]
call qword [sym.imp.GDI32.dll_CreateFontW]
mov rdx, rax
lea rcx, [rdi + 0x1a0]
call fcn.180010a5c
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x60], r14d
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 0x190
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx - 0xb]
call qword [sym.imp.GDI32.dll_CreateFontW]
mov rdx, rax
lea rcx, [rdi + 0x1b0]
call fcn.180010a5c
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x60], r14d
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 0x190
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx - 9]
call qword [sym.imp.GDI32.dll_CreateFontW]
mov rdx, rax
lea rcx, [rdi + 0x1d0]
call fcn.180010a5c
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x60], r14d
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x190
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx - 0x1c]
call qword [sym.imp.GDI32.dll_CreateFontW]
mov rdx, rax
lea rcx, [rdi + 0x1c0]
call fcn.180010a5c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.1801a90e4
xor edx, edx
mov r8d, 0x1b0
lea rcx, [rbp + 0x90]
call fcn.18019d020
lea rcx, [rbp + 0x90]
call fcn.180016194
nop
lea rax, vtable.CWizardSheet.0
mov qword [rbp + 0x90], rax
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x220], xmm0
mov qword [rbp + 0x238], r14
lea rax, vtable.CBitmap.0
mov qword [rbp + 0x230], rax
call fcn.180026b64
mov edx, 0x82
mov rcx, qword [rax + 0x18]
call qword [sym.imp.USER32.dll_LoadBitmapW]
mov rdx, rax
lea rcx, [rbp + 0x230]
call fcn.180010a5c
and dword [rbp + 0x17c], 0xffffffdf
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x18022a5a0]
lea rcx, [rbp + 0x90]
call fcn.180016a5c
or dword [rbp + 0x17c], 0x20
xor edx, edx
mov r8d, 0x180
lea rcx, [rbp + 0x560]
call fcn.18019d020
lea rcx, [rbp + 0x560]
call fcn.180008f80
nop
xor edx, edx
mov r8d, 0x188
lea rcx, [rbp + 0x3d0]
call fcn.18019d020
lea rcx, [rbp + 0x3d0]
call fcn.180007be0
nop
xor edx, edx
mov r8d, 0x350
lea rcx, [rbp + 0x950]
call fcn.18019d020
lea rcx, [rbp + 0x950]
call fcn.1800068e0
nop
xor edx, edx
mov r8d, 0x270
lea rcx, [rbp + 0x6e0]
call fcn.18019d020
lea rcx, [rbp + 0x6e0]
call fcn.1800085c0
nop
xor edx, edx
mov r8d, 0x188
lea rcx, [rbp + 0x240]
call fcn.18019d020
lea rcx, [rbp + 0x240]
call fcn.180003e70
nop
xor edx, edx
mov r8d, 0x458
lea rcx, [rbp + 0xca0]
call fcn.18019d020
lea rcx, [rbp + 0xca0]
call fcn.180004ab0
nop
lea rax, [rbp + 0x90]
mov qword [rdi + 0x200], rax
lea rdx, [rbp + 0x560]
lea rcx, [rbp + 0x90]
call fcn.1800163e0
lea rdx, [rbp + 0x3d0]
lea rcx, [rbp + 0x90]
call fcn.1800163e0
lea rdx, [rbp + 0x950]
lea rcx, [rbp + 0x90]
call fcn.1800163e0
lea rdx, [rbp + 0x6e0]
lea rcx, [rbp + 0x90]
call fcn.1800163e0
lea rdx, [rbp + 0xca0]
lea rcx, [rbp + 0x90]
call fcn.1800163e0
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x90]
call fcn.1800163e0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1310]
call fcn.18019d020
mov dword [rbp - 0x60], 0xa229a20d
mov dword [rbp - 0x5c], 0xa22ea238
mov dword [rbp - 0x58], 0xa238a220
mov dword [rbp - 0x54], 0xa261a261
mov dword [rbp - 0x50], 0xa231a27a
mov dword [rbp - 0x4c], 0xa23ba23a
xor eax, eax
mov word [rbp - 0x48], ax
mov edx, r14d
mov edi, 0x5db4
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x60]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, di
xor word [rcx], ax
inc edx
cmp edx, 0xc
jb 0x18000d500
mov word [rbp - 0x48], r14w
mov rax, qword [0x1802958d0]
test rax, rax
jne 0x18000d53f
xor edx, edx
mov ecx, 0x41b1eab9
call fcn.18000c8d0
mov qword [0x1802958d0], rax
lea rcx, [rbp - 0x60]
call rax
mov rax, qword [0x1802958d8]
test rax, rax
jne 0x18000d564
xor edx, edx
mov ecx, 0xa3fbd5fb
call fcn.18000c8d0
mov qword [0x1802958d8], rax
mov r8d, 0x104
lea rdx, [rbp + 0x1310]
xor ecx, ecx
call rax
mov dword [rbp - 0x40], 0xa235a229
mov dword [rbp - 0x3c], 0xa223a23e
mov dword [rbp - 0x38], 0xa223a23f
mov dword [rbp - 0x34], 0xa221a237
mov dword [rbp - 0x30], 0xa230a27a
mov dword [rbp - 0x2c], 0xa232a22e
xor eax, eax
mov word [rbp - 0x28], ax
mov edx, r14d
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x40]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, di
xor word [rcx], ax
inc edx
cmp edx, 0xc
jb 0x18000d5b0
mov word [rbp - 0x28], r14w
lea rax, [rbp + 0x1310]
lea r8, [rbp - 0x40]
sub r8, rax
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x18000d5f4
add rax, 2
test ecx, ecx
jne 0x18000d5e0
test edx, edx
je 0x18000d6d1
mov dword [rsp + 0x70], 0xa23da23f
mov dword [rsp + 0x74], 0xa220a221
mov dword [rsp + 0x78], 0xa222a23c
mov dword [rsp + 0x7c], 0xa27da224
mov dword [rbp - 0x80], 0xa22da231
mov dword [rbp - 0x7c], 0xa233
mov edx, r14d
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x70]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, di
xor word [rcx], ax
inc edx
cmp edx, 0xb
jb 0x18000d630
mov word [rbp - 0x7a], r14w
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x1310]
call fcn.18019c95c
test rax, rax
je 0x18000d66e
call fcn.18000da60
jmp 0x18000d6d1
mov dword [rbp - 0x78], 0xa222a202
mov dword [rbp - 0x74], 0xa22aa23a
mov dword [rbp - 0x70], 0xa230a220
mov dword [rbp - 0x6c], 0xa27da236
mov dword [rbp - 0x68], 0xa22da231
mov dword [rbp - 0x64], 0xa233
mov eax, r14d
nop dword [rax + rax]
movsxd rcx, eax
lea rdx, [rbp - 0x78]
lea rdx, [rdx + rcx*2]
movzx ecx, ax
sub cx, di
xor word [rdx], cx
inc eax
cmp eax, 0xb
jb 0x18000d6a0
mov word [rbp - 0x62], r14w
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x1310]
call fcn.18019c95c
nop
lea rcx, [rbp + 0xca0]
call fcn.180004c90
nop
mov rdx, qword [rbp + 0x3c0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000d6fe
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rbp + 0x3b8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000d71e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdi, vtable.CBrush.0
mov qword [rbp + 0x3a8], rdi
lea rcx, [rbp + 0x3a8]
call fcn.1800045d0
mov rdx, qword [rbp + 0x398]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000d758
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0x240]
call fcn.18001621c
nop
lea rcx, [rbp + 0x868]
call fcn.180024c24
mov rdx, qword [rbp + 0x858]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000d791
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rbp + 0x848], rdi
lea rcx, [rbp + 0x848]
call fcn.1800045d0
mov rdx, qword [rbp + 0x838]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000d7c4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0x6e0]
call fcn.18001621c
nop
lea rcx, [rbp + 0xbb0]
call fcn.18002532c
lea rcx, [rbp + 0xac8]
call fcn.180024bf4
mov qword [rbp + 0xab8], rdi
lea rcx, [rbp + 0xab8]
call fcn.1800045d0
mov rdx, qword [rbp + 0xaa8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000d81c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0x950]
call fcn.18001621c
nop
mov rdx, qword [rbp + 0x550]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000d849
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rbp + 0x548]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000d869
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rbp + 0x538], rdi
lea rcx, [rbp + 0x538]
call fcn.1800045d0
mov rdx, qword [rbp + 0x528]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000d89c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0x3d0]
call fcn.18001621c
nop
mov qword [rbp + 0x6c8], rdi
lea rcx, [rbp + 0x6c8]
call fcn.1800045d0
mov rdx, qword [rbp + 0x6b8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000d8dc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0x560]
call fcn.18001621c
nop
lea rax, vtable.CBitmap.0
mov qword [rbp + 0x230], rax
lea rcx, [rbp + 0x230]
call fcn.1800045d0
lea rcx, [rbp + 0x90]
call fcn.1800162ec
nop
mov rdx, qword [rbp + 0x80]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x18000d92e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0x48]
call fcn.180013734
lea rcx, [rbp]
call fcn.1800140d0
xor eax, eax
mov rcx, qword [rbp + 0x1520]
xor rcx, rsp
call fcn.18019ab50
lea r11, [rsp + 0x1630]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.180003260
int3