Function at 0x1800181e0
Capabilities:
Check for peb beingdebugged flag
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x18021c8c0]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov rbx, r8
mov qword [rbp - 0x60], rbx
mov r13, rdx
mov qword [rsp + 0x50], rdx
mov qword [rbp - 0x28], rbx
mov rcx, r8
cmp qword [r8 + 0x18], 0x10
jb 0x180018230
mov rcx, qword [r8]
lea rdx, [0x1801af8e4]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rdi, rax
test rax, rax
jne 0x180018272
mov qword [r13], rax
mov qword [r13 + 8], rax
lea ecx, [rax + 0x30]
call fcn.1801720a0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [r13], rax
mov rcx, rbx
jmp 0x18001858d
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rbx, eax
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
mov qword [rsp + 0x50], rax
mov r9, rdi
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor edi, edi
mov qword [rsp + 0x58], rdi
mov qword [rbp], rdi
mov dword [rbp + 0x20], edi
mov dword [rbp + 0xa8], edi
mov qword [rbp + 0xc0], rsi
mov qword [rbp + 0xb0], rsi
lea rax, [rbx + rsi]
mov qword [rbp + 0xc8], rax
mov qword [rbp + 0xb8], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x10]
call fcn.180014350
mov r9, rax
mov qword [rsp + 0x60], rax
mov edx, dword [0x1802e1e34]
mov rcx, qword gs:[0x58]
mov r8, qword [rcx + rdx*8]
mov eax, reloc.WS2_32.dll_recv
cmp dword [rax + r8], edi
je 0x18001835a
mov eax, reloc.WS2_32.dll_sendto
mov ecx, dword [rax + r8]
jmp 0x180018360
mov ecx, dword [0x1802e1e9c]
movsxd r12, dword [rsp + 0x48]
mov r15d, dword [rsp + 0x44]
mov edx, dword [rsp + 0x40]
test ecx, ecx
je 0x1800183b7
mov r14d, dword [rbp - 0x30]
mov eax, r14d
imul eax, edx
imul eax, r15d
mov rbx, r9
test r12d, r12d
jle 0x1800183b7
movsxd r15, eax
mov esi, r12d
nop
mov r9d, r14d
mov r8d, dword [rsp + 0x44]
mov rcx, rbx
call fcn.1800054e0
add rbx, r15
sub rsi, 1
mov edx, dword [rsp + 0x40]
jne 0x180018390
mov rsi, qword [rsp + 0x50]
mov r15d, dword [rsp + 0x44]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], rdi
mov ecx, Ordinal_50
call fcn.1801720a0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp - 0x20], rax
mov r8d, dword [rsp + 0x40]
mov eax, r8d
mov ecx, dword [rbp - 0x30]
imul eax, ecx
movsxd rdx, eax
mov rbx, rdi
mov qword [rsp + 0x50], r12
test r12d, r12d
je 0x180018535
movsxd r12, r15d
imul r12, rdx
mov r14, qword [rsp + 0x60]
nop dword [rax]
mov rax, qword [rsp + 0x58]
mov esi, dword [rax + rbx*4]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov r9d, r15d
mov rcx, r14
call fcn.1800170e0
test rax, rax
jne 0x180018450
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
jmp 0x180018466
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x74], esi
movups xmm0, xmmword [rsp + 0x68]
mov dword [rbp - 0x80], ebx
movups xmmword [rbp - 0x7c], xmm0
mov rsi, qword [rbp - 0x20]
mov rax, qword [rsi + 8]
mov qword [rbp - 0x58], rax
mov dword [rbp - 0x50], edi
mov rcx, rsi
cmp byte [rax + 0x19], 0
jne 0x1800184aa
mov qword [rbp - 0x58], rax
cmp dword [rax + 0x1c], ebx
jge 0x180018497
mov dword [rbp - 0x50], edi
mov rax, qword [rax + 0x10]
jmp 0x1800184a4
mov dword [rbp - 0x50], 1
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x180018485
cmp byte [rcx + 0x19], 0
jne 0x1800184b5
cmp ebx, dword [rcx + 0x1c]
jge 0x18001851b
movabs rax, 0x555555555555555
cmp qword [rbp - 0x18], rax
je 0x1800185bf
lea rax, [rbp - 0x20]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdi
mov ecx, Ordinal_50
call fcn.1801720a0
nop
movups xmm0, xmmword [rbp - 0x80]
movups xmmword [rax + 0x1c], xmm0
mov ecx, dword [rbp - 0x70]
mov dword [rax + 0x2c], ecx
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov word [rax + 0x18], 0
mov qword [rbp - 0x38], rdi
movups xmm0, xmmword [rbp - 0x58]
movaps xmmword [rbp - 0x80], xmm0
mov r8, rax
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x20]
call fcn.180018ed0
inc rbx
add r14, r12
cmp rbx, qword [rsp + 0x50]
jae 0x180018535
mov ecx, dword [rbp - 0x30]
mov r8d, dword [rsp + 0x40]
jmp 0x180018420
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [r13], rdi
mov qword [r13 + 8], rdi
mov ecx, Ordinal_50
call fcn.1801720a0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov rcx, qword [rbp - 0x20]
mov qword [r13], rcx
mov qword [rbp - 0x20], rax
mov rcx, qword [r13 + 8]
mov rax, qword [rbp - 0x18]
mov qword [r13 + 8], rax
mov qword [rbp - 0x18], rcx
lea rcx, [rbp - 0x20]
call fcn.180018ac0
nop
mov rcx, qword [rbp - 0x60]
call fcn.180004430
mov rax, r13
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.180172080
mov rbx, qword [rsp + 0x220]
add rsp, 0x1e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180019170
nop
int3