Function at 0x1800065a0
Capabilities:
Check for time delay via gettickcount
Move file
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x488]
sub rsp, 0x560
mov qword [rbp + 0xe0], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov r15d, r9d
mov r14, r8
mov rdi, rdx
mov rsi, rcx
xor r12d, r12d
mov qword [rbp + 0xe8], r12
mov eax, dword [rcx + 0x1c]
cmp eax, 3
jne 0x180006da8
mov qword [rbp + 0x120], 0xffffffffffffffff
mov qword [rbp + 0x138], r12
mov qword [rbp + 0x140], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x128], r12b
xor r8d, r8d
lea rdx, [0x18008323b]
lea rcx, [rbp + 0x128]
call fcn.180001520
nop
mov qword [rbp + 0x148], r12
mov qword [rbp + 0x150], r12
call fcn.18000b400
mov qword [rbp + 0x148], rax
lea edx, [r12 + 2]
lea rcx, [rbp + 0x158]
call fcn.180028848
nop
mov qword [rbp + 0x1a8], r12
mov qword [rbp + 0x1b0], r12
mov qword [rbp + 0x1b8], r12
mov qword [rbp + 0x1c0], r12
mov qword [rbp + 0x1c8], r12
lea ecx, [r12 + 0x10]
call fcn.18002aeb4
mov qword [rbp + 0x1a8], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x230], xmm0
movups xmmword [rax], xmm0
lea rcx, [rbp + 0x1a8]
mov rax, qword [rbp + 0x1a8]
mov qword [rax], rcx
lea edx, [r12 + 2]
lea rcx, [rbp + 0x1d0]
call fcn.180028848
mov byte [rbp + 0x220], r12b
lea rcx, [rbp + 0x120]
call fcn.180003a40
test al, al
jne 0x1800066e1
lea rcx, [rbp + 0x120]
call fcn.1800037e0
jmp 0x180007030
cmp qword [rbp + 0x120], 0xffffffffffffffff
je 0x1800066d0
lea rax, [0x180003e50]
mov qword [rbp + 0x80], rax
lea rax, [rbp + 0x120]
mov qword [rbp + 0x88], rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp]
call fcn.18000b490
nop
cmp dword [rbp + 8], 0
jne 0x180006728
mov ecx, 1
call fcn.180028d1c
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0xf0], xmm0
lea rcx, [rbp + 0xf0]
call fcn.180028ec4
test eax, eax
je 0x18000674b
mov ecx, eax
call fcn.180028ce0
mov qword [rbp], r12
mov dword [rbp + 8], r12d
lea rax, [0x1800060f0]
mov qword [rbp + 0x90], rax
lea rax, [rbp + 0x120]
mov qword [rbp + 0x98], rax
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x10]
call fcn.18000b490
nop
cmp dword [rbp + 0x18], 0
jne 0x180006790
mov ecx, 1
call fcn.180028d1c
movaps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x100], xmm0
lea rcx, [rbp + 0x100]
call fcn.180028ec4
test eax, eax
je 0x1800067b3
mov ecx, eax
call fcn.180028ce0
mov qword [rbp + 0x10], r12
mov dword [rbp + 0x18], r12d
cmp dword [rbp + 8], 0
jne 0x180007065
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r12
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.1800250a0
mov r8, r15
mov rdx, r14
mov rcx, qword [rbp - 0x80]
call fcn.18004b110
lea r9, [rbp + 0xc5]
mov r8d, r15d
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x180006800
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x28], dl
lea rax, [rbp + 0xc5]
cmp r9, rax
je 0x18000685c
lea r8, [rbp + 0xc5]
sub r8, r9
mov rdx, r9
lea rcx, [rbp - 0x28]
call fcn.180001520
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, eax
lea r10, [rbp + 0xdd]
nop dword [rax]
dec r10
mov eax, 0xcccccccd
mul r9d
shr edx, 3
movzx ecx, dl
shl cl, 2
lea r8d, [rcx + rdx]
add r8b, r8b
sub r9b, r8b
add r9b, 0x30
mov byte [r10], r9b
mov r9d, edx
test edx, edx
jne 0x180006870
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x40], dl
lea rax, [rbp + 0xdd]
cmp r10, rax
je 0x1800068ce
lea r8, [rbp + 0xdd]
sub r8, r10
mov rdx, r10
lea rcx, [rbp + 0x40]
call fcn.180001520
nop
mov r9d, 2
lea r8, [0x180082fe8]
lea rcx, [rbp + 0x40]
call fcn.180024650
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r8d, 1
lea rdx, [0x1800824cc]
lea rcx, [rbp + 0x20]
call fcn.180026f90
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp - 0x30]
mov rax, rdx
mov r9, qword [rbp - 0x38]
sub rax, r9
mov rcx, qword [rbp - 0x10]
mov r8, qword [rbp - 0x18]
cmp r8, rax
jbe 0x180006984
mov rax, rcx
sub rax, r8
cmp rax, r9
jb 0x180006984
lea r8, [rbp - 0x48]
cmp rdx, 0x10
cmovae r8, qword [rbp - 0x48]
lea rcx, [rbp - 0x28]
call fcn.180024650
jmp 0x18000699a
lea rdx, [rbp - 0x28]
cmp rcx, 0x10
cmovae rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x48]
call fcn.180026f90
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r8d, 4
lea rdx, str..dat
lea rcx, [rbp - 0x68]
call fcn.180026f90
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x180006a3b
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006a36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000706b
call fcn.18002aef0
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x68], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x180006a86
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006a81
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007071
call fcn.18002aef0
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x180006ad1
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006acc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007077
call fcn.18002aef0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x180006b1c
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006b17
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000707d
call fcn.18002aef0
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x180006b67
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006b62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007083
call fcn.18002aef0
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x28], 0
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rax, qword [rsp + 0x40]
mov qword [rbp + 0xa0], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xa8], rax
movaps xmm0, xmmword [rbp + 0xa0]
movdqa xmmword [rbp + 0x110], xmm0
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x120]
call fcn.180003c40
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x60], 0
mov r8d, recv
lea rdx, str.127.0.0.1_
lea rcx, [rsp + 0x60]
call fcn.180001520
nop
lea rdx, [rbp + 0x128]
lea rcx, [rbp + 0x60]
call fcn.1800279f0
nop
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae rdx, qword [rbp + 0x60]
mov r8, qword [rbp + 0x70]
lea rcx, [rsp + 0x60]
call fcn.180026f90
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x180006c55
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006c50
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007089
call fcn.18002aef0
mov r8d, 1
lea rdx, [0x180083000]
lea rcx, [rsp + 0x60]
call fcn.180026f90
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.180026f90
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x180006de3
mov dword [rsi + 0x1c], 2
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x180006cf0
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006ceb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000708f
call fcn.18002aef0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x60], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x180006d40
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006d3b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007095
call fcn.18002aef0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x180006d99
mov rdx, qword [rbp - 0x70]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006d88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000709b
call fcn.18002aef0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r12
lea rcx, [rbp + 0x120]
call fcn.1800037e0
mov eax, dword [rsi + 0x1c]
cmp eax, 2
jne 0x180006fe2
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x240]
call fcn.18004b570
call fcn.180025c90
mov rbx, rax
cmp byte [rax + 0x218], 0
je 0x180006ee1
lea r8, [rax + 0x10]
jmp 0x180006eed
mov byte [rdi], 1
mov qword [rdi + 8], rax
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x180006e27
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006e22
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800070a1
call fcn.18002aef0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x60], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x180006e77
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006e72
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800070a7
call fcn.18002aef0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x180006ed0
mov rdx, qword [rbp - 0x70]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006ebf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000705f
call fcn.18002aef0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r12
lea rcx, [rbp + 0x120]
call fcn.1800037e0
jmp 0x180007037
mov rcx, rbx
call fcn.180025d50
lea r8, [rbx + 0x10]
lea rdx, [0x180083490]
lea rcx, [rbp + 0x240]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rbx + 0x219]
call fcn.180026590
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, eax
lea r8, [rbp + 0x240]
lea rdx, str._skbg_x.dat
lea rcx, [rbp + 0x240]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 1]
lea rcx, [rbp + 0x240]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x180006f9b
mov dword [rbp + 0x490], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x490]
mov r8d, r15d
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x180006faa
test rbx, rbx
je 0x180006faa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x240]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
xor edx, edx
lea r8d, [rdx + 4]
lea rcx, [rbp + 0x240]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test rbx, rbx
jne 0x180007056
mov dword [rsi + 0x1c], 1
mov eax, 1
cmp eax, 1
jne 0x180007030
lea ecx, [rax + 0x27]
call fcn.18002aeb4
mov rbx, rax
mov qword [rbp + 0x490], rax
mov qword [rax], r12
mov qword [rax + 8], r12
mov qword [rax + 0x10], 0x1000
mov qword [rax + 0x18], r12
mov dword [rax + 0x20], r12d
lea rcx, [rsi - 0x18]
mov r8, r14
mov rdx, rax
call fcn.180006510
test al, al
jne 0x180007056
mov edx, 0x28
mov rcx, rbx
call fcn.18002aef0
mov byte [rdi], 0
mov qword [rdi + 8], r12
mov rax, rdi
lea r11, [rsp + 0x560]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov byte [rdi], 1
mov qword [rdi + 8], rbx
jmp 0x180007037
call fcn.18004df84
nop
call fcn.1800509cc
nop
call fcn.18004df84
nop
call fcn.18004df84
nop
call fcn.18004df84
nop
call fcn.18004df84
nop
call fcn.18004df84
nop
call fcn.18004df84
nop
call fcn.18004df84
nop
call fcn.18004df84
nop
call fcn.18004df84
nop
call fcn.18004df84
nop
call fcn.18004df84
int3