Function at 0x18001fb70
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x1b0], rbx
mov rax, qword [0x18008d0c0]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov r15, r9
mov qword [rsp + 0x50], r9
mov r14, r8
mov qword [rsp + 0x48], r8
mov rsi, rdx
mov rdi, qword [r8 + 8]
mov rbx, qword [r8]
cmp rbx, rdi
je 0x18001fbda
mov rcx, rbx
call fcn.180013bc0
sub rbx, 0xffffffffffffff80
cmp rbx, rdi
jne 0x18001fbc6
mov rbx, qword [r14]
mov qword [r14 + 8], rbx
mov byte [r15], 0
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x18001fbef
mov rcx, qword [rsi]
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r8d, r8d
mov edx, 0x80000000
call fcn.180012a80
mov r14, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x180020756
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
xor r12d, r12d
mov qword [rsp + 0x70], r12
mov ebx, r12d
cmp qword [rsi + 0x10], rbx
je 0x18001fc8d
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov dword [rbp - 0x50], eax
lea r8, [rbp - 0x70]
mov rcx, rsi
call fcn.180012db0
test al, al
je 0x18001fc8d
mov ebx, dword [rbp - 0x54]
shl rbx, 0x20
mov eax, dword [rbp - 0x50]
add rbx, rax
mov al, 1
jmp 0x18001fc8f
xor al, al
mov rdi, r12
test al, al
cmovne rdi, rbx
lea rax, [rdi - 1]
cmp rax, 0x4ffffe
ja 0x18001fd2d
mov byte [rsp + 0x40], 0
lea rax, [rsp + 0x60]
mov qword [rbp - 0x40], rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x38], rax
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm0
lea r8, [rbp - 0x40]
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.18000ea50
mov dword [rbp - 0x48], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x48]
mov r8d, edi
mov rdx, qword [rsp + 0x60]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rbp - 0x48]
cmp rdx, rdi
jae 0x18001fd2d
mov byte [rsp + 0x40], 0
lea rax, [rsp + 0x60]
mov qword [rbp - 0x40], rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x38], rax
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm0
lea r8, [rbp - 0x40]
lea rcx, [rsp + 0x60]
call fcn.18000ea50
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x68]
cmp qword [rsp + 0x60], rax
jne 0x18001fd86
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x180020756
mov rdx, qword [rsp + 0x70]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180020743
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180020785
jmp 0x180020743
xor eax, eax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov rcx, r12
mov qword [rbp - 0x70], rcx
mov qword [rbp - 0x68], r12
mov r9, r12
mov qword [rbp - 0x60], r12
mov dword [rbp - 0x40], 0x2d2d4352
mov dword [rbp - 0x3c], 0x35343332
mov dword [rbp - 0x38], 0x61534350
mov dword [rbp - 0x34], 0x2d302e32
mov dword [rbp - 0x30], 0x2d736843
mov dword [rbp - 0x2c], 0x61435243
mov dword [rbp - 0x28], 0x38313031
mov dword [rbp - 0x24], 0x35313032
movdqa xmm2, xmmword [0x1800798a0]
mov eax, r12d
mov edx, 1
movd xmm3, edx
lea rdx, [rbp - 0x40]
nop word [rax + rax]
movd xmm1, eax
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
movdqu xmm0, xmmword [rdx]
pslld xmm0, xmm3
paddd xmm1, xmm0
movdqu xmmword [rdx], xmm1
add eax, 4
lea rdx, [rdx + 0x10]
cmp eax, 8
jl 0x18001fe00
mov rax, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
sub rax, rdx
test rdx, rdx
je 0x1800206cb
lea r9, [rbp - 0x70]
mov r8d, eax
lea rcx, [rbp - 0x40]
call fcn.180025c50
test al, al
je 0x1800206c3
mov rcx, qword [rbp - 0x68]
mov rsi, qword [rbp - 0x70]
sub rcx, rsi
movabs rax, 0x624dd2f1a9fbe77
mul rcx
mov rbx, rcx
sub rbx, rdx
shr rbx, 1
add rbx, rdx
shr rbx, 9
imul rax, rbx, 0x3e8
sub rcx, rax
je 0x18001ff1c
mov byte [r15], 1
test rsi, rsi
je 0x18001fed8
mov rdx, qword [rbp - 0x60]
sub rdx, rsi
mov rax, rsi
cmp rdx, 0x1000
jb 0x18001fec4
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002079d
mov rcx, rsi
call fcn.180037624
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r12
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x180020756
mov rdx, qword [rsp + 0x70]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180020743
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002078b
jmp 0x180020743
test rbx, rbx
jne 0x18001ffbb
test rsi, rsi
je 0x18001ff6a
mov rdx, qword [rbp - 0x60]
sub rdx, rsi
mov rax, rsi
cmp rdx, 0x1000
jb 0x18001ff56
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800207a3
mov rcx, rsi
call fcn.180037624
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r12
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x18001ffb4
mov rdx, qword [rsp + 0x70]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001ffa1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800207a9
call fcn.180037624
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
mov al, 1
jmp 0x180020758
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r12
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.180021630
imul r8, rbx, 0x3e8
mov rdx, rsi
mov rcx, qword [rsp + 0x78]
call fcn.180039130
mov r10, r12
mov rcx, qword [rbp - 0x80]
mov r9, qword [rsp + 0x78]
sub rcx, r9
movabs r14, 0x20c49ba5e353f7cf
mov rax, r14
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x180020088
mov r8, r12
nop word [rax + rax]
cmp dword [r8 + r9], 0x23ab45db
jne 0x1800201a2
mov word [r8 + r9 + 0x282], r12w
mov word [r8 + r9 + 0x382], r12w
mov word [r8 + r9 + 0x3ca], r12w
inc r10
add r8, 0x3e8
mov rcx, qword [rbp - 0x80]
mov r9, qword [rsp + 0x78]
sub rcx, r9
mov rax, r14
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r10, rdx
jb 0x180020030
mov rdi, qword [rsp + 0x48]
mov rax, qword [rdi + 0x10]
sub rax, qword [rdi]
sar rax, 7
cmp rbx, rax
jbe 0x1800200bb
movabs rax, 0x1ffffffffffffff
cmp rbx, rax
ja 0x1800207af
mov rdx, rbx
mov rcx, rdi
call fcn.1800212e0
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], r12
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r12w
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 7
mov word [rbp], r12w
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [0x180079880]
movdqu xmmword [rbp + 0x30], xmm1
mov word [rbp + 0x20], r12w
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r12
mov qword [rbp + 0x50], r12
mov dword [rbp + 0x58], r12d
mov byte [rbp + 0x5c], 0
mov qword [rbp - 0x48], r12
mov rcx, qword [rbp - 0x80]
mov r8, qword [rsp + 0x78]
sub rcx, r8
mov rax, r14
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x1800205c6
mov r9, r12
mov qword [rbp - 0x40], r12
movabs rdi, 0x7ffffffffffffffe
lea r13, [r9 + r8]
lea rcx, [r13 + 4]
call fcn.1800429cc
mov r15, rax
mov r14, qword [rbp - 8]
cmp rax, r14
ja 0x180020295
lea rdi, [rbp - 0x20]
cmp r14, 8
cmovae rdi, qword [rbp - 0x20]
mov qword [rbp - 0x10], rax
lea rbx, [rax + rax]
mov r8, rbx
lea rdx, [r13 + 4]
mov rcx, rdi
call fcn.180039130
xor eax, eax
mov word [rbx + rdi], ax
jmp 0x18002039f
mov byte [r15], 1
mov r8, qword [rsp + 0x78]
test r8, r8
je 0x18002020c
mov rcx, qword [rbp - 0x78]
sub rcx, r8
mov rax, r14
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x3e8
mov rax, r8
cmp rdx, 0x1000
jb 0x1800201f7
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800207b5
mov rcx, r8
call fcn.180037624
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r12
test rsi, rsi
je 0x180020251
mov rdx, qword [rbp - 0x60]
sub rdx, rsi
mov rax, rsi
cmp rdx, 0x1000
jb 0x18002023d
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800207bb
mov rcx, rsi
call fcn.180037624
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r12
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x180020756
mov rdx, qword [rsp + 0x70]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180020743
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180020791
jmp 0x180020743
cmp r15, rdi
ja 0x1800207e5
mov rbx, r15
or rbx, 7
cmp rbx, rdi
jbe 0x1800202af
mov rbx, rdi
jmp 0x1800202d0
mov rcx, r14
shr rcx, 1
mov rax, rdi
sub rax, rcx
cmp r14, rax
jbe 0x1800202c5
mov rbx, rdi
jmp 0x1800202d0
lea rax, [rcx + r14]
cmp rbx, rax
cmovb rbx, rax
lea rax, [rbx + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x1800202f3
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x180020303
cmp rdx, 0x1000
jb 0x18002032a
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.18003762c
test rax, rax
je 0x1800207c7
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18002033e
test rdx, rdx
je 0x180020339
mov rcx, rdx
call fcn.18003762c
jmp 0x18002033b
xor eax, eax
mov rdi, rax
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], rbx
lea rbx, [r15 + r15]
mov r8, rbx
lea rdx, [r13 + 4]
mov rcx, rdi
call fcn.180039130
xor eax, eax
mov word [rbx + rdi], ax
cmp r14, 8
jb 0x18002039b
lea rdx, [r14*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180020396
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800207cd
call fcn.180037624
mov qword [rbp - 0x20], rdi
lea rcx, [r13 + 0x284]
call fcn.1800429cc
mov r15, rax
mov r14, qword [rbp + 0x18]
cmp rax, r14
ja 0x1800203eb
lea rdi, [rbp]
cmp r14, 8
cmovae rdi, qword [rbp]
mov qword [rbp + 0x10], rax
lea rbx, [rax + rax]
mov r8, rbx
lea rdx, [r13 + 0x284]
mov rcx, rdi
call fcn.180039130
xor r12d, r12d
mov word [rbx + rdi], r12w
jmp 0x180020504
movabs rdx, 0x7ffffffffffffffe
cmp r15, rdx
ja 0x1800207df
mov rbx, r15
or rbx, 7
cmp rbx, rdx
jbe 0x18002040f
mov rbx, rdx
jmp 0x180020430
mov rcx, r14
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp r14, rax
jbe 0x180020425
mov rbx, rdx
jmp 0x180020430
lea rax, [r14 + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rax, [rbx + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x180020453
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x180020463
cmp rdx, 0x1000
jb 0x18002048a
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.18003762c
test rax, rax
je 0x1800207d3
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18002049e
test rdx, rdx
je 0x180020499
mov rcx, rdx
call fcn.18003762c
jmp 0x18002049b
xor eax, eax
mov rdi, rax
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], rbx
lea rbx, [r15 + r15]
mov r8, rbx
lea rdx, [r13 + 0x284]
mov rcx, rdi
call fcn.180039130
xor r12d, r12d
mov word [rbx + rdi], r12w
cmp r14, 8
jb 0x180020500
lea rdx, [r14*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800204fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800207d9
call fcn.180037624
mov qword [rbp], rdi
mov rax, qword [r13 + 0x3cc]
mov qword [rbp + 0x40], rax
mov rax, qword [r13 + 0x3d4]
mov qword [rbp + 0x48], rax
mov rax, qword [r13 + 0x3dc]
mov qword [rbp + 0x50], rax
lea rdx, [r13 + 0x384]
lea rcx, [rbp + 0x20]
call fcn.180001d94
mov eax, dword [r13 + 0x3e4]
mov dword [rbp + 0x58], eax
mov byte [rbp + 0x5c], 0
mov rdi, qword [rsp + 0x48]
mov rax, qword [rdi + 8]
cmp qword [rdi + 0x10], rax
je 0x180020565
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.18001dc30
sub qword [rdi + 8], 0xffffffffffffff80
jmp 0x180020574
lea r8, [rbp - 0x20]
mov rdx, rax
mov rcx, rdi
call fcn.180021ab0
mov rbx, qword [rbp - 0x48]
inc rbx
mov qword [rbp - 0x48], rbx
mov r9, qword [rbp - 0x40]
add r9, 0x3e8
mov qword [rbp - 0x40], r9
mov rcx, qword [rbp - 0x80]
mov r8, qword [rsp + 0x78]
sub rcx, r8
movabs r14, 0x20c49ba5e353f7cf
mov rax, r14
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rbx, rdx
jb 0x18002014c
mov r15, qword [rsp + 0x50]
mov byte [r15], 0
lea rcx, [rbp - 0x20]
call fcn.180013bc0
nop
mov r8, qword [rsp + 0x78]
test r8, r8
je 0x18002063a
mov rcx, qword [rbp - 0x78]
sub rcx, r8
mov rax, r14
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x3e8
mov rax, r8
cmp rdx, 0x1000
jb 0x180020625
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800207c1
mov rcx, r8
call fcn.180037624
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r12
test rsi, rsi
je 0x18002067f
mov rdx, qword [rbp - 0x60]
sub rdx, rsi
mov rax, rsi
cmp rdx, 0x1000
jb 0x18002066b
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800207eb
mov rcx, rsi
call fcn.180037624
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r12
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x18001ffb4
mov rdx, qword [rsp + 0x70]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001ffa1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180020797
jmp 0x18001ffa1
mov r9, qword [rbp - 0x60]
mov rcx, qword [rbp - 0x70]
mov byte [r15], 1
test rcx, rcx
je 0x180020710
sub r9, rcx
mov rax, rcx
cmp r9, 0x1000
jb 0x1800206fc
add r9, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800207f1
mov rdx, r9
call fcn.180037624
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r12
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x180020756
mov rdx, qword [rsp + 0x70]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180020743
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002077f
call fcn.180037624
xorps xmm0, xmm0
mov qword [rsp + 0x70], r12
movdqu xmmword [rsp + 0x60], xmm0
xor al, al
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.180037600
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180042954
int3
call fcn.180042954
int3
call fcn.180042954
int3
call fcn.180042954
int3
call fcn.180042954
nop
call fcn.180042954
nop
call fcn.180042954
nop
call fcn.180042954
nop
call fcn.18000e3c0
nop
call fcn.180042954
nop
call fcn.180042954
nop
call fcn.180042954
nop
call fcn.180042954
int3
call fcn.180042954
int3
call fcn.180042954
int3
call fcn.180042954
int3
call fcn.180001eb0
int3
call fcn.180001eb0
nop
call fcn.180042954
int3
call fcn.180042954
int3