Function at 0x180001000
Capabilities:
Allocate or change rwx memory
Compress data via winapi
Get file size
Read file on windows

Disassembly:
push rbp
push rbx
push rdi
push r12
lea rbp, [rsp - 0x1a8]
sub rsp, 0x2a8
mov rax, qword [0x180018008]
xor rax, rsp
mov qword [rbp + 0x190], rax
xor edx, edx
lea rcx, [rbp - 0x70]
mov r8d, 0x1f4
call fcn.180002600
mov r8d, 0xfa
lea rdx, [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rbp - 0x70]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x180001054
mov ecx, edx
test edx, edx
je 0x18000107f
lea rax, [rbp - 0x70]
lea rax, [rax + rcx*2]
nop dword [rax]
cmp word [rax], 0x5c
je 0x18000107f
sub rax, 2
add ecx, 0xffffffff
jne 0x180001070
inc ecx
lea rdi, [rbp - 0x70]
mov eax, ecx
lea r8, [rbp - 0x70]
sub rdx, rax
xor eax, eax
lea rdi, [rdi + rcx*2]
mov rcx, rdx
rep stosb byte [rdi], al
lea rcx, [rbp - 0x70]
lea rdx, str._wslog.bin
call qword [sym.imp.USER32.dll_wsprintfW]
xor r12d, r12d
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], r12d
mov edx, 0x80000000
mov ebx, 0xc0000242
mov dword [rsp + 0x20], 3
lea r8d, [r12 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x18000147c
mov qword [rsp + 0x2d0], rsi
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x2e0], r14
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, eax
lea ecx, [r12 + 0x40]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
test rax, rax
je 0x180001498
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], r12
mov r8d, esi
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180001498
mov rcx, rdi
mov qword [rsp + 0x2a0], r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [rsi + rsi*4]
add edi, edi
nop dword [rax + rax]
mov edx, edi
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r15, rax
test rax, rax
je 0x1800011b0
lea rax, [rsp + 0x5c]
mov ecx, 3
mov qword [rsp + 0x28], rax
mov r9, r14
mov r8d, edi
mov dword [rsp + 0x20], esi
mov rdx, r15
call qword [sym.imp.ntdll.dll_RtlDecompressBuffer]
mov ebx, eax
test eax, eax
jns 0x1800011a6
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
add edi, edi
cmp ebx, 0xc0000242
je 0x180001160
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
cmovs r15, r12
js 0x180001464
mov r9d, 0x10
mov qword [rsp + 0x2d8], r13
lea r8, [0x180014648]
xor ecx, ecx
lea rdx, [0x180014650]
call qword [sym.imp.USER32.dll_MessageBoxA]
movsxd r13, dword [r15 + 0x3c]
mov ecx, 0x40
add r13, r15
mov edi, dword [r13 + 0x50]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x18000145c
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x68], rdi
mov r9d, 0x40
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
js 0x18000145c
movzx ebx, word [r13 + 0x14]
mov edi, r12d
add rbx, r13
cmp r12w, word [r13 + 6]
jae 0x180001289
nop dword [rax + rax]
mov eax, edi
lea rcx, [rax + rax*4]
mov edx, dword [rbx + rcx*8 + 0x2c]
mov r8d, dword [rbx + rcx*8 + 0x28]
add rdx, r15
mov ecx, dword [rbx + rcx*8 + 0x24]
add rcx, rsi
call fcn.180002a60
movzx eax, word [r13 + 6]
inc edi
cmp edi, eax
jb 0x180001260
mov eax, dword [r13 + 0x90]
test eax, eax
je 0x180001381
lea r14, [rsi + rax]
mov qword [rsp + 0x48], r12
mov eax, dword [r14 + 0xc]
mov qword [rsp + 0x40], r12
test eax, eax
je 0x180001381
nop dword [rax]
nop word [rax + rax]
mov edx, eax
lea rcx, [rsp + 0x70]
add rdx, rsi
call qword [sym.imp.ntdll.dll_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x80]
call qword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
test eax, eax
js 0x180001371
lea r9, [rsp + 0x48]
xor edx, edx
lea r8, [rbp - 0x80]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_LdrLoadDll]
test eax, eax
js 0x180001367
mov ebx, dword [r14]
mov edi, dword [r14 + 0x10]
add rbx, rsi
add rdi, rsi
mov rax, qword [rbx]
test rax, rax
je 0x180001367
jns 0x180001320
movzx r8d, ax
xor edx, edx
jmp 0x18000133a
lea rdx, [rsi + 2]
add rdx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntdll.dll_RtlInitAnsiString]
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
test eax, eax
js 0x180001356
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
mov rax, qword [rbx + 8]
add rbx, 8
add rdi, 8
test rax, rax
jne 0x180001316
lea rcx, [rbp - 0x80]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov eax, dword [r14 + 0x20]
add r14, 0x14
test eax, eax
jne 0x1800012c0
mov eax, dword [r13 + 0xb0]
test eax, eax
je 0x18000142f
mov r10, rsi
lea rdx, [rsi + rax]
sub r10, qword [r13 + 0x30]
cmp dword [rdx], r12d
je 0x18000142f
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [rdx + 4]
lea r9, [rdx + 8]
add rax, rdx
cmp r9, rax
je 0x180001427
nop
movzx r8d, word [r9]
mov eax, r8d
movzx edi, r8w
shr eax, 0xc
sub eax, 1
je 0x180001418
sub eax, 1
je 0x180001407
sub eax, 1
je 0x1800013f5
cmp eax, 7
jne 0x180001418
mov ecx, dword [rdx]
and r8d, 0xfff
lea rax, [rsi + r8]
add qword [rcx + rax], r10
jmp 0x180001418
mov ecx, dword [rdx]
and edi, 0xfff
lea rax, [rsi + rdi]
add dword [rcx + rax], r10d
jmp 0x180001418
mov ecx, dword [rdx]
and edi, 0xfff
lea rax, [rsi + rdi]
add word [rcx + rax], r10w
mov eax, dword [rdx + 4]
add r9, 2
add rax, rdx
cmp r9, rax
jne 0x1800013c0
mov rdx, r9
cmp dword [r9], r12d
jne 0x1800013b0
mov edi, dword [r13 + 0x28]
mov rcx, r15
add rdi, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_EtwpCreateEtwThread]
mov edx, 0xffffffff
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r13, qword [rsp + 0x2d8]
mov r15, qword [rsp + 0x2a0]
mov rsi, qword [rsp + 0x2d0]
mov r14, qword [rsp + 0x2e0]
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1800014d0
add rsp, 0x2a8
pop r12
pop rdi
pop rbx
pop rbp
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000146c