Function at 0x1400018b0
Capabilities:
Read file on windows
Terminate process
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x140005010]
xor rax, rsp
mov qword [rsp + 0x160], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14000190e
mov r9d, 0x10
lea r8, str.Shiba
lea rdx, str.You_suck_:_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xbabeface
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rcx, str.Yellow_and_White_Shiba_want_to_play_guessing_game_with_you__if_you_can_get_all_16_correct_answer_of_the_sequence__they_will_encrypt_a_flag_for_you_n
call fcn.140001090
xor esi, esi
mov edi, 1
mov ebx, esi
nop dword [rax]
nop word [rax + rax]
mov edx, edi
lea rcx, str.Woof_Woof__d____
call fcn.140001090
lea rdx, [rsp + 0x38]
lea rcx, [0x1400034cc]
call fcn.1400010f0
movzx eax, byte [rsp + 0x38]
mov byte [rsp + rbx + 0x20], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov byte [rsp + rbx + 0x40], al
inc edi
inc rbx
cmp rbx, 0x10
jl 0x140001930
mov rcx, rsi
movzx eax, byte [rsp + rcx + 0x40]
cmp byte [rsp + rcx + 0x20], al
jne 0x140001c75
inc rcx
cmp rcx, 0x10
jl 0x140001970
mov qword [rsp + 0x180], rbp
lea rcx, str.Correct_____n
mov qword [rsp + 0x188], r14
call fcn.140001090
movsx eax, byte [0x1400056d0]
lea rcx, str.Nai_xu__couple_shiba_will_do_some_magic_to_your_flag_now_:D_n
movdqu xmm0, xmmword [rsp + 0x20]
movd xmm1, eax
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
xorps xmm1, xmm0
movdqu xmmword [rsp + 0x40], xmm1
call fcn.140001090
lea rdx, [0x1400035c0]
lea rcx, str.shibacouple.jpg
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rdi, rax
test rax, rax
jne 0x140001a10
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Tao_1_file_couple_shiba_tren_may_di_ban_ey._n
call fcn.140001040
jmp 0x140001b40
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
movsxd rbx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, rbx
mov rbp, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
jne 0x140001a73
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Not_flag:_https:__shorturl.at_ryUX6_n
call fcn.140001040
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x140001b40
mov r9, rdi
mov r8, rbp
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r8d, esi
lea rcx, [rsp + 0x60]
mov eax, esi
nop word [rax + rax]
mov byte [rcx], al
lea rcx, [rcx + 1]
inc eax
cmp eax, 0x100
jl 0x140001aa0
mov r9d, esi
lea r10, [rsp + 0x60]
nop word [rax + rax]
movzx r11d, byte [r10]
mov eax, r9d
and eax, 0xf
movzx ecx, byte [rsp + rax + 0x40]
add r8d, ecx
add r8d, r11d
and r8d, 0x800000ff
jge 0x140001aeb
dec r8d
or r8d, 0xffffff00
inc r8d
movsxd rax, r8d
lea rcx, [rsp + 0x60]
add rcx, rax
inc r9d
movzx eax, byte [rcx]
mov byte [r10], al
inc r10
mov byte [rcx], r11b
cmp r9d, 0x100
jl 0x140001ac0
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x140001b7a
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Flag:_https:__bit.ly_KhongPhaiRickRollDauTinToi_n
call fcn.140001040
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, 1
mov rbp, qword [rsp + 0x180]
mov r14, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140001e80
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov edx, esi
test ebx, ebx
jle 0x140001bfa
mov r11, r14
mov r10, rdi
sub r11, rdi
nop dword [rax]
lea eax, [rsi + 1]
and eax, 0x800000ff
jge 0x140001ba3
dec eax
or eax, 0xffffff00
inc eax
movsxd rsi, eax
lea r8, [rsp + 0x60]
movzx r9d, byte [r8 + rsi]
add edx, r9d
and edx, 0x800000ff
jge 0x140001bc5
dec edx
or edx, 0xffffff00
inc edx
movsxd rax, edx
lea rcx, [rsp + 0x60]
add rcx, rax
movzx eax, byte [rcx]
mov byte [r8 + rsi], al
mov byte [rcx], r9b
movzx ecx, byte [r8 + rsi]
add rcx, r9
movzx eax, cl
movzx ecx, byte [rsp + rax + 0x60]
xor cl, byte [r11 + r10]
mov byte [r10], cl
inc r10
sub rbx, 1
jne 0x140001b90
lea rdx, [0x14000357c]
lea rcx, str.shibacouple.enc
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
test rax, rax
jne 0x140001c3f
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Flag_real:_https:__bit.ly_linkchuanflaghere_n
call fcn.140001040
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
jmp 0x140001b3a
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
jmp 0x140001b45
lea rcx, str.Wrongg_____You_suck_:__n
call fcn.140001090
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3