Function at 0x18001fdd0
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x1b0], rbx
mov rax, qword [0x18008d0c0]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov r15, r9
mov qword [rsp + 0x50], r9
mov r14, r8
mov qword [rsp + 0x48], r8
mov rsi, rdx
mov rdi, qword [r8 + 8]
mov rbx, qword [r8]
cmp rbx, rdi
je 0x18001fe3a
mov rcx, rbx
call fcn.180013bd0
sub rbx, 0xffffffffffffff80
cmp rbx, rdi
jne 0x18001fe26
mov rbx, qword [r14]
mov qword [r14 + 8], rbx
mov byte [r15], 0
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x18001fe4f
mov rcx, qword [rsi]
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r8d, r8d
mov edx, 0x80000000
call fcn.180012a90
mov r14, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1800209b6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
xor r12d, r12d
mov qword [rsp + 0x70], r12
mov ebx, r12d
cmp qword [rsi + 0x10], rbx
je 0x18001feed
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov dword [rbp - 0x50], eax
lea r8, [rbp - 0x70]
mov rcx, rsi
call fcn.180012dc0
test al, al
je 0x18001feed
mov ebx, dword [rbp - 0x54]
shl rbx, 0x20
mov eax, dword [rbp - 0x50]
add rbx, rax
mov al, 1
jmp 0x18001feef
xor al, al
mov rdi, r12
test al, al
cmovne rdi, rbx
lea rax, [rdi - 1]
cmp rax, 0x4ffffe
ja 0x18001ff8d
mov byte [rsp + 0x40], 0
lea rax, [rsp + 0x60]
mov qword [rbp - 0x40], rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x38], rax
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm0
lea r8, [rbp - 0x40]
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.18000ea70
mov dword [rbp - 0x48], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x48]
mov r8d, edi
mov rdx, qword [rsp + 0x60]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rbp - 0x48]
cmp rdx, rdi
jae 0x18001ff8d
mov byte [rsp + 0x40], 0
lea rax, [rsp + 0x60]
mov qword [rbp - 0x40], rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x38], rax
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm0
lea r8, [rbp - 0x40]
lea rcx, [rsp + 0x60]
call fcn.18000ea70
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x68]
cmp qword [rsp + 0x60], rax
jne 0x18001ffe6
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1800209b6
mov rdx, qword [rsp + 0x70]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800209a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800209e5
jmp 0x1800209a3
xor eax, eax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov rcx, r12
mov qword [rbp - 0x70], rcx
mov qword [rbp - 0x68], r12
mov r9, r12
mov qword [rbp - 0x60], r12
mov dword [rbp - 0x40], 0x2d2d4352
mov dword [rbp - 0x3c], 0x35343332
mov dword [rbp - 0x38], 0x61534350
mov dword [rbp - 0x34], 0x2d302e32
mov dword [rbp - 0x30], 0x2d736843
mov dword [rbp - 0x2c], 0x61435243
mov dword [rbp - 0x28], 0x38313031
mov dword [rbp - 0x24], 0x35313032
movdqa xmm2, xmmword [0x1800798d0]
mov eax, r12d
mov edx, 1
movd xmm3, edx
lea rdx, [rbp - 0x40]
nop word [rax + rax]
movd xmm1, eax
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
movdqu xmm0, xmmword [rdx]
pslld xmm0, xmm3
paddd xmm1, xmm0
movdqu xmmword [rdx], xmm1
add eax, 4
lea rdx, [rdx + 0x10]
cmp eax, 8
jl 0x180020060
mov rax, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
sub rax, rdx
test rdx, rdx
je 0x18002092b
lea r9, [rbp - 0x70]
mov r8d, eax
lea rcx, [rbp - 0x40]
call fcn.180025c60
test al, al
je 0x180020923
mov rcx, qword [rbp - 0x68]
mov rsi, qword [rbp - 0x70]
sub rcx, rsi
movabs rax, 0x624dd2f1a9fbe77
mul rcx
mov rbx, rcx
sub rbx, rdx
shr rbx, 1
add rbx, rdx
shr rbx, 9
imul rax, rbx, 0x3e8
sub rcx, rax
je 0x18002017c
mov byte [r15], 1
test rsi, rsi
je 0x180020138
mov rdx, qword [rbp - 0x60]
sub rdx, rsi
mov rax, rsi
cmp rdx, 0x1000
jb 0x180020124
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800209fd
mov rcx, rsi
call fcn.180037644
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r12
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1800209b6
mov rdx, qword [rsp + 0x70]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800209a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800209eb
jmp 0x1800209a3
test rbx, rbx
jne 0x18002021b
test rsi, rsi
je 0x1800201ca
mov rdx, qword [rbp - 0x60]
sub rdx, rsi
mov rax, rsi
cmp rdx, 0x1000
jb 0x1800201b6
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180020a03
mov rcx, rsi
call fcn.180037644
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r12
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x180020214
mov rdx, qword [rsp + 0x70]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180020201
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180020a09
call fcn.180037644
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
mov al, 1
jmp 0x1800209b8
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r12
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.180021720
imul r8, rbx, 0x3e8
mov rdx, rsi
mov rcx, qword [rsp + 0x78]
call fcn.180039150
mov r10, r12
mov rcx, qword [rbp - 0x80]
mov r9, qword [rsp + 0x78]
sub rcx, r9
movabs r14, 0x20c49ba5e353f7cf
mov rax, r14
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x1800202e8
mov r8, r12
nop word [rax + rax]
cmp dword [r8 + r9], 0x23ab45db
jne 0x180020402
mov word [r8 + r9 + 0x282], r12w
mov word [r8 + r9 + 0x382], r12w
mov word [r8 + r9 + 0x3ca], r12w
inc r10
add r8, 0x3e8
mov rcx, qword [rbp - 0x80]
mov r9, qword [rsp + 0x78]
sub rcx, r9
mov rax, r14
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r10, rdx
jb 0x180020290
mov rdi, qword [rsp + 0x48]
mov rax, qword [rdi + 0x10]
sub rax, qword [rdi]
sar rax, 7
cmp rbx, rax
jbe 0x18002031b
movabs rax, 0x1ffffffffffffff
cmp rbx, rax
ja 0x180020a0f
mov rdx, rbx
mov rcx, rdi
call fcn.180021430
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], r12
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r12w
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 7
mov word [rbp], r12w
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [0x1800798b0]
movdqu xmmword [rbp + 0x30], xmm1
mov word [rbp + 0x20], r12w
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r12
mov qword [rbp + 0x50], r12
mov dword [rbp + 0x58], r12d
mov byte [rbp + 0x5c], 0
mov qword [rbp - 0x48], r12
mov rcx, qword [rbp - 0x80]
mov r8, qword [rsp + 0x78]
sub rcx, r8
mov rax, r14
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x180020826
mov r9, r12
mov qword [rbp - 0x40], r12
movabs rdi, 0x7ffffffffffffffe
lea r13, [r9 + r8]
lea rcx, [r13 + 4]
call fcn.1800429ec
mov r15, rax
mov r14, qword [rbp - 8]
cmp rax, r14
ja 0x1800204f5
lea rdi, [rbp - 0x20]
cmp r14, 8
cmovae rdi, qword [rbp - 0x20]
mov qword [rbp - 0x10], rax
lea rbx, [rax + rax]
mov r8, rbx
lea rdx, [r13 + 4]
mov rcx, rdi
call fcn.180039150
xor eax, eax
mov word [rbx + rdi], ax
jmp 0x1800205ff
mov byte [r15], 1
mov r8, qword [rsp + 0x78]
test r8, r8
je 0x18002046c
mov rcx, qword [rbp - 0x78]
sub rcx, r8
mov rax, r14
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x3e8
mov rax, r8
cmp rdx, 0x1000
jb 0x180020457
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180020a15
mov rcx, r8
call fcn.180037644
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r12
test rsi, rsi
je 0x1800204b1
mov rdx, qword [rbp - 0x60]
sub rdx, rsi
mov rax, rsi
cmp rdx, 0x1000
jb 0x18002049d
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180020a1b
mov rcx, rsi
call fcn.180037644
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r12
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1800209b6
mov rdx, qword [rsp + 0x70]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800209a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800209f1
jmp 0x1800209a3
cmp r15, rdi
ja 0x180020a45
mov rbx, r15
or rbx, 7
cmp rbx, rdi
jbe 0x18002050f
mov rbx, rdi
jmp 0x180020530
mov rcx, r14
shr rcx, 1
mov rax, rdi
sub rax, rcx
cmp r14, rax
jbe 0x180020525
mov rbx, rdi
jmp 0x180020530
lea rax, [rcx + r14]
cmp rbx, rax
cmovb rbx, rax
lea rax, [rbx + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x180020553
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x180020563
cmp rdx, 0x1000
jb 0x18002058a
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.18003764c
test rax, rax
je 0x180020a27
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18002059e
test rdx, rdx
je 0x180020599
mov rcx, rdx
call fcn.18003764c
jmp 0x18002059b
xor eax, eax
mov rdi, rax
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], rbx
lea rbx, [r15 + r15]
mov r8, rbx
lea rdx, [r13 + 4]
mov rcx, rdi
call fcn.180039150
xor eax, eax
mov word [rbx + rdi], ax
cmp r14, 8
jb 0x1800205fb
lea rdx, [r14*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800205f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180020a2d
call fcn.180037644
mov qword [rbp - 0x20], rdi
lea rcx, [r13 + 0x284]
call fcn.1800429ec
mov r15, rax
mov r14, qword [rbp + 0x18]
cmp rax, r14
ja 0x18002064b
lea rdi, [rbp]
cmp r14, 8
cmovae rdi, qword [rbp]
mov qword [rbp + 0x10], rax
lea rbx, [rax + rax]
mov r8, rbx
lea rdx, [r13 + 0x284]
mov rcx, rdi
call fcn.180039150
xor r12d, r12d
mov word [rbx + rdi], r12w
jmp 0x180020764
movabs rdx, 0x7ffffffffffffffe
cmp r15, rdx
ja 0x180020a3f
mov rbx, r15
or rbx, 7
cmp rbx, rdx
jbe 0x18002066f
mov rbx, rdx
jmp 0x180020690
mov rcx, r14
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp r14, rax
jbe 0x180020685
mov rbx, rdx
jmp 0x180020690
lea rax, [r14 + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rax, [rbx + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x1800206b3
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x1800206c3
cmp rdx, 0x1000
jb 0x1800206ea
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.18003764c
test rax, rax
je 0x180020a33
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1800206fe
test rdx, rdx
je 0x1800206f9
mov rcx, rdx
call fcn.18003764c
jmp 0x1800206fb
xor eax, eax
mov rdi, rax
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], rbx
lea rbx, [r15 + r15]
mov r8, rbx
lea rdx, [r13 + 0x284]
mov rcx, rdi
call fcn.180039150
xor r12d, r12d
mov word [rbx + rdi], r12w
cmp r14, 8
jb 0x180020760
lea rdx, [r14*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002075b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180020a39
call fcn.180037644
mov qword [rbp], rdi
mov rax, qword [r13 + 0x3cc]
mov qword [rbp + 0x40], rax
mov rax, qword [r13 + 0x3d4]
mov qword [rbp + 0x48], rax
mov rax, qword [r13 + 0x3dc]
mov qword [rbp + 0x50], rax
lea rdx, [r13 + 0x384]
lea rcx, [rbp + 0x20]
call fcn.180001d94
mov eax, dword [r13 + 0x3e4]
mov dword [rbp + 0x58], eax
mov byte [rbp + 0x5c], 0
mov rdi, qword [rsp + 0x48]
mov rax, qword [rdi + 8]
cmp qword [rdi + 0x10], rax
je 0x1800207c5
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.18001de90
sub qword [rdi + 8], 0xffffffffffffff80
jmp 0x1800207d4
lea r8, [rbp - 0x20]
mov rdx, rax
mov rcx, rdi
call fcn.180021ba0
mov rbx, qword [rbp - 0x48]
inc rbx
mov qword [rbp - 0x48], rbx
mov r9, qword [rbp - 0x40]
add r9, 0x3e8
mov qword [rbp - 0x40], r9
mov rcx, qword [rbp - 0x80]
mov r8, qword [rsp + 0x78]
sub rcx, r8
movabs r14, 0x20c49ba5e353f7cf
mov rax, r14
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rbx, rdx
jb 0x1800203ac
mov r15, qword [rsp + 0x50]
mov byte [r15], 0
lea rcx, [rbp - 0x20]
call fcn.180013bd0
nop
mov r8, qword [rsp + 0x78]
test r8, r8
je 0x18002089a
mov rcx, qword [rbp - 0x78]
sub rcx, r8
mov rax, r14
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x3e8
mov rax, r8
cmp rdx, 0x1000
jb 0x180020885
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180020a21
mov rcx, r8
call fcn.180037644
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r12
test rsi, rsi
je 0x1800208df
mov rdx, qword [rbp - 0x60]
sub rdx, rsi
mov rax, rsi
cmp rdx, 0x1000
jb 0x1800208cb
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180020a4b
mov rcx, rsi
call fcn.180037644
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r12
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x180020214
mov rdx, qword [rsp + 0x70]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180020201
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800209f7
jmp 0x180020201
mov r9, qword [rbp - 0x60]
mov rcx, qword [rbp - 0x70]
mov byte [r15], 1
test rcx, rcx
je 0x180020970
sub r9, rcx
mov rax, rcx
cmp r9, 0x1000
jb 0x18002095c
add r9, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180020a51
mov rdx, r9
call fcn.180037644
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r12
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1800209b6
mov rdx, qword [rsp + 0x70]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800209a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800209df
call fcn.180037644
xorps xmm0, xmm0
mov qword [rsp + 0x70], r12
movdqu xmmword [rsp + 0x60], xmm0
xor al, al
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.180037620
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180042974
int3
call fcn.180042974
int3
call fcn.180042974
int3
call fcn.180042974
int3
call fcn.180042974
nop
call fcn.180042974
nop
call fcn.180042974
nop
call fcn.180042974
nop
call fcn.18000e3d0
nop
call fcn.180042974
nop
call fcn.180042974
nop
call fcn.180042974
nop
call fcn.180042974
int3
call fcn.180042974
int3
call fcn.180042974
int3
call fcn.180042974
int3
call fcn.180001eb0
int3
call fcn.180001eb0
nop
call fcn.180042974
int3
call fcn.180042974
int3