Function at 0x180012870
Capabilities:
Contain obfuscated stackstrings
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rbx, rdx
mov r15, rcx
xor r13d, r13d
mov qword [rbp - 0x21], r13
mov qword [rbp - 0x11], r13
mov qword [rbp - 9], 0xf
mov byte [rbp - 0x21], r13b
mov dword [rbp - 0x59], 0xbab7ab9b
mov dword [rbp - 0x55], 0x8ea88898
mov dword [rbp - 0x51], 0xe3bd8c94
xor eax, eax
mov qword [rbp - 0x4d], rax
mov dword [rbp - 0x45], eax
mov r9d, r13d
movabs r11, 0x335373829896a6dc
mov r10, r11
lea rax, [rbp - 0x59]
sub r10, rax
nop word [rax + rax]
lea r8, [rbp - 0x59]
add r8, r9
movzx edx, byte [r8]
lea rax, [r8 + r10]
and rax, rdx
imul rcx, rax, 0xfffffffffffffffe
add rcx, rdx
add rcx, r11
add rcx, r9
sub cl, 4
mov byte [r8], cl
inc r9
cmp r9, 0x18
jb 0x1800128f0
mov dword [rbp - 0x69], 0x717a6e73
mov dword [rbp - 0x65], 0x313d7569
mov dword [rbp - 0x61], 0x7f78613c
mov byte [rbp - 0x5d], 0xca
xor eax, eax
mov word [rbp - 0x5c], ax
mov byte [rbp - 0x5a], al
mov r9, r13
movabs r11, 0x80e2615833b9a421
mov r10, r11
lea rax, [rbp - 0x69]
sub r10, rax
nop word [rax + rax]
lea r8, [rbp - 0x69]
add r8, r9
movzx edx, byte [r8]
lea rax, [r8 + r10]
and rax, rdx
imul rcx, rax, 0xfffffffffffffffe
add rcx, rdx
add rcx, r11
add rcx, r9
add cl, 0x19
mov byte [r8], cl
inc r9
cmp r9, 0x10
jb 0x180012960
lea rcx, [rbp - 0x69]
call fcn.180009bb0
lea rdx, [rbp - 0x59]
mov rcx, rax
call fcn.1800096f0
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, qword [rbx]
call rax
mov r14, rax
mov qword [rbp + 0x1f], rax
mov rcx, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x27], rcx
mov byte [rbp + 0x2f], 1
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x180012c06
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r12d, eax
test eax, eax
je 0x180012c06
mov rcx, qword [rbp - 0x11]
cmp r12, rcx
ja 0x180012a25
lea rcx, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
cmovae rcx, qword [rbp - 0x21]
mov qword [rbp - 0x11], r12
mov byte [rcx + r12], 0
jmp 0x180012a7a
mov rdi, r12
sub rdi, rcx
mov rdx, qword [rbp - 9]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x180012a61
mov qword [rbp - 0x11], r12
lea rbx, [rbp - 0x21]
cmp rdx, 0x10
cmovae rbx, qword [rbp - 0x21]
add rbx, rcx
mov r8, rdi
xor edx, edx
mov rcx, rbx
call fcn.180019ff0
mov byte [rdi + rbx], 0
jmp 0x180012a7a
mov byte [rsp + 0x20], 0
mov r9, rdi
movzx r8d, byte [rbp + 0x6f]
mov rdx, rdi
lea rcx, [rbp - 0x21]
call fcn.180014250
lea rbx, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
jb 0x180012a92
mov rbx, qword [rbp - 0x21]
test rbx, rbx
je 0x180012c06
mov r8, r12
xor edx, edx
mov rcx, rbx
call fcn.180019ff0
mov dword [rbp + 0x6f], r13d
mov dword [rbp - 1], 0x878b8092
mov dword [rbp + 3], 0xba8280e2
mov byte [rbp + 7], 0x14
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 8], xmm0
mov word [rbp + 0x18], ax
mov r9, r13
movabs r11, 0x3b2f17357fe8225a
mov r10, r11
lea rax, [rbp - 1]
sub r10, rax
nop dword [rax]
lea r8, [rbp - 1]
add r8, r9
movzx edx, byte [r8]
lea rax, [r8 + r10]
and rax, rdx
imul rcx, rax, 0xfffffffffffffffe
add rcx, rdx
add rcx, r11
add rcx, r9
sub cl, 0x76
mov byte [r8], cl
inc r9
cmp r9, 0x1b
jb 0x180012ae0
mov dword [rbp - 0x41], 0x213a2e23
mov dword [rbp - 0x3d], 0x617d2529
mov dword [rbp - 0x39], 0x3f38317c
mov byte [rbp - 0x35], 0xaa
xor eax, eax
mov qword [rbp - 0x34], rax
mov dword [rbp - 0x2c], eax
mov word [rbp - 0x28], ax
mov r9, r13
movabs r11, 0x11e0db006d6a0c69
mov r10, r11
lea rax, [rbp - 0x41]
sub r10, rax
nop dword [rax + rax]
lea r8, [rbp - 0x41]
add r8, r9
movzx edx, byte [r8]
lea rax, [r8 + r10]
and rax, rdx
imul rcx, rax, 0xfffffffffffffffe
add rcx, rdx
add rcx, r11
add rcx, r9
add cl, 0x21
mov byte [r8], cl
inc r9
cmp r9, 0x1b
jb 0x180012b50
lea rcx, [rbp - 0x41]
call fcn.180009bb0
lea rdx, [rbp - 1]
mov rcx, rax
call fcn.1800096f0
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x6f]
mov r8d, r12d
mov rdx, rbx
mov rcx, r14
call rax
mov byte [r15], 1
lea rcx, [r15 + 8]
lea rdx, [rbp - 0x21]
call fcn.18000fa90
nop
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp - 9]
cmp rdx, 0x10
jb 0x180012caa
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180012ca5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180012cd4
jmp 0x180012ca5
mov qword [rbp - 1], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 0x17], 0xf
mov byte [rbp - 1], 0
mov byte [r15], 0
lea rcx, [r15 + 8]
lea rdx, [rbp - 1]
call fcn.18000fa90
nop
mov rdx, qword [rbp + 0x17]
cmp rdx, 0x10
jb 0x180012c64
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180012c5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180012cda
call fcn.1800159cc
nop
test r14, r14
je 0x180012c73
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp - 9]
cmp rdx, 0x10
jb 0x180012caa
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180012ca5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180012cce
call fcn.1800159cc
mov rax, r15
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180022ca4
int3
call fcn.180022ca4
nop
call fcn.180022ca4
nop