Function at 0x18000f050
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
sub rsp, 0x210
mov rax, qword [0x180059640]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x40], rsp
xor r12d, r12d
mov byte [rsp + 0x48], r12b
xor eax, eax
mov word [rsp + 0x49], ax
mov byte [rsp + 0x4b], al
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
lea r8d, [r12 + 3]
mov dword [rsp + 0x20], r8d
xor r9d, r9d
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
mov qword [rsp + 0x58], rax
cmp rax, 0xffffffffffffffff
jne 0x18000f0cc
xor eax, eax
jmp 0x18000f7e6
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x60]
mov r8d, 4
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x18000f109
lea rdx, [0x18000f102]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
xor eax, eax
jmp 0x18000f7e6
mov ax, word [rsp + 0x48]
cmp ax, word [0x18004606c]
jne 0x18000f7d1
mov word [rsp + 0x1a0], r12w
xor edx, edx
lea r8d, [rdx + 0x3e]
lea rcx, [rsp + 0x1a2]
call fcn.180026210
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
or r13d, 0xffffffff
cmp eax, r13d
jne 0x18000f16b
lea rdx, [0x18000f164]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
xor eax, eax
jmp 0x18000f7e6
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, 0x40
lea rdx, [rsp + 0x1a0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x18000f1ab
lea rdx, [0x18000f1a4]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
xor eax, eax
jmp 0x18000f7e6
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x1dc]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, r13d
jne 0x18000f1e0
lea rdx, [0x18000f1d9]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
xor eax, eax
jmp 0x18000f7e6
mov dword [rsp + 0x70], r12d
xor edx, edx
mov r8d, 0xf4
lea rcx, [rsp + 0x74]
call fcn.180026210
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, 0xf8
lea rdx, [rsp + 0x70]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x18000f234
lea rdx, [0x18000f22d]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
xor eax, eax
jmp 0x18000f7e6
movzx eax, word [rsp + 0x76]
lea edx, [rax + rax*4]
lea edx, [rdx*8 - 0x28]
mov r9d, 1
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, r13d
jne 0x18000f274
lea rdx, [0x18000f26d]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
xor eax, eax
jmp 0x18000f7e6
mov byte [rsp + 0x170], r12b
xor eax, eax
mov dword [rsp + 0x171], eax
mov word [rsp + 0x175], ax
mov byte [rsp + 0x177], al
xor edx, edx
lea r8d, [rax + 0x20]
lea rcx, [rsp + 0x178]
call fcn.180026210
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, 0x28
lea rdx, [rsp + 0x170]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x18000f2e7
lea rdx, [0x18000f2e0]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
xor eax, eax
jmp 0x18000f7e6
mov esi, dword [rsp + 0x180]
mov eax, dword [rsp + 0x184]
add esi, eax
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, r13d
jne 0x18000f327
lea rdx, [0x18000f320]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
xor eax, eax
jmp 0x18000f7e6
mov byte [rsp + 0x4c], r12b
xor eax, eax
mov word [rsp + 0x4d], ax
mov byte [rsp + 0x4f], al
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
lea r8d, [rax + 4]
lea rdx, [rsp + 0x4c]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x18000f372
lea rdx, [0x18000f36b]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
xor eax, eax
jmp 0x18000f7e6
mov eax, dword [rsp + 0x4c]
cmp eax, r12d
jne 0x18000f4ee
mov byte [rsp + 0x1e0], 0xef
mov byte [rsp + 0x1e1], 0xbe
mov byte [rsp + 0x1e2], 0xad
mov byte [rsp + 0x1e3], 0xde
mov byte [rsp + 0x1e4], 0x4e
mov byte [rsp + 0x1e5], 0x75
mov byte [rsp + 0x1e6], 0x6c
mov byte [rsp + 0x1e7], 0x6c
mov byte [rsp + 0x1e8], 0x73
mov byte [rsp + 0x1e9], 0x6f
mov byte [rsp + 0x1ea], 0x66
mov byte [rsp + 0x1eb], 0x74
mov byte [rsp + 0x1ec], 0x49
mov byte [rsp + 0x1ed], 0x6e
mov byte [rsp + 0x1ee], 0x73
mov byte [rsp + 0x1ef], 0x74
mov byte [rsp + 0x1f0], r12b
xor eax, eax
mov qword [rsp + 0x1f1], rax
mov dword [rsp + 0x1f9], eax
mov word [rsp + 0x1fd], ax
mov byte [rsp + 0x1ff], al
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
lea r8d, [rax + 0x10]
lea rdx, [rsp + 0x1f0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x18000f465
lea rdx, [0x18000f45e]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
xor eax, eax
jmp 0x18000f7e6
cmp dword [rsp + 0x50], 0x10
je 0x18000f486
lea rdx, [0x18000f47f]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
xor eax, eax
jmp 0x18000f7e6
lea rax, [rsp + 0x1e0]
lea rcx, [rsp + 0x1f0]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x18000f4ad
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + 8]
jne 0x18000f4ad
mov eax, r12d
jmp 0x18000f4b2
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r12d
jne 0x18000f4d4
lea rdx, [0x18000f4ca]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
mov eax, 0xc
jmp 0x18000f7e6
lea rdx, [0x18000f4e7]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
xor eax, eax
jmp 0x18000f7e6
cmp eax, dword [0x180046070]
jne 0x18000f513
lea rdx, [0x18000f509]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
mov eax, 4
jmp 0x18000f7e6
movzx edx, word [rsp + 0x4c]
cmp dx, word [0x180046078]
jne 0x18000f53e
lea rdx, [0x18000f534]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
mov eax, 8
jmp 0x18000f7e6
cmp dx, word [0x18004607c]
jne 0x18000f564
lea rdx, [0x18000f55a]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
mov eax, 6
jmp 0x18000f7e6
cmp eax, dword [0x180046080]
jne 0x18000f589
lea rdx, [0x18000f57f]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
mov eax, 0xc
jmp 0x18000f7e6
mov ax, dx
cmp dx, word [0x180046088]
jne 0x18000f5b2
lea rdx, [0x18000f5a8]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
mov eax, 0xe
jmp 0x18000f7e6
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, r13d
jne 0x18000f5e2
lea rdx, [0x18000f5db]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
xor eax, eax
jmp 0x18000f7e6
mov dword [rsp + 0x54], r12d
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, 4
lea rdx, [rsp + 0x54]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x18000f624
lea rdx, [0x18000f61d]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
xor eax, eax
jmp 0x18000f7e6
mov eax, dword [rsp + 0x54]
lea edx, [rax + rsi + 4]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, r13d
jne 0x18000f65a
lea rdx, [0x18000f653]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
xor eax, eax
jmp 0x18000f7e6
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x64]
mov r8d, 4
lea rdx, [rsp + 0x4c]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x18000f697
lea rdx, [0x18000f690]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
xor eax, eax
jmp 0x18000f7e6
lea rax, [rsp + 0x4c]
lea r8, [0x180000000]
mov dx, word [rax]
cmp dx, word [r8 + 0x4608c]
jne 0x18000f6c1
mov dl, byte [rax + 2]
cmp dl, byte [r8 + 0x4608e]
jne 0x18000f6c1
mov eax, r12d
jmp 0x18000f6c6
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r12d
jne 0x18000f6e8
lea rdx, [0x18000f6de]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
mov eax, 2
jmp 0x18000f7e6
lea rax, [rsp + 0x48]
mov dx, word [rax]
cmp dx, word [r8 + 0x46090]
jne 0x18000f70b
mov dl, byte [rax + 2]
cmp dl, byte [r8 + 0x46092]
jne 0x18000f70b
mov eax, r12d
jmp 0x18000f710
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r12d
jne 0x18000f732
lea rdx, [0x18000f728]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
mov eax, 1
jmp 0x18000f7e6
mov eax, dword [rsp + 0x48]
cmp eax, dword [str.Rar_]
jne 0x18000f75b
lea rdx, [0x18000f751]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
mov eax, 4
jmp 0x18000f7e6
mov ax, word [rsp + 0x48]
cmp ax, word [0x18004609c]
jne 0x18000f783
lea rdx, [0x18000f77c]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
mov eax, 8
jmp 0x18000f7e6
mov ax, word [rsp + 0x48]
cmp ax, word [0x1800460a0]
jne 0x18000f7ab
lea rdx, [0x18000f7a4]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
mov eax, 6
jmp 0x18000f7e6
mov eax, dword [rsp + 0x48]
cmp eax, dword [str.MSCF]
jne 0x18000f7d1
lea rdx, [0x18000f7ca]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
mov eax, 9
jmp 0x18000f7e6
lea rdx, [0x18000f7e4]
mov rcx, qword [rsp + 0x40]
call fcn.180028980
nop
nop
xor eax, eax
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.180026540
lea r11, [rsp + 0x210]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop r13
ret