Function at 0x18000c740
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x460]
sub rsp, 0x560
mov rax, qword [0x18005a098]
xor rax, rsp
mov qword [rbp + 0x450], rax
mov dword [rbp - 0x30], 0x6f0043
mov eax, 0x75
mov word [rbp - 0x2c], ax
mov dword [rbp - 0x2a], 0x64006c
mov dword [rbp - 0x26], 0x6e0020
mov dword [rbp - 0x22], 0x74006f
lea r8d, [rax - 1]
mov dword [rbp - 0x1e], 0x730020
mov dword [rbp - 0x1a], 0x740065
mov dword [rbp - 0x16], 0x250020
mov dword [rbp - 0x12], 0x200073
mov dword [rbp - 0xe], 0x70006f
mov word [rbp - 0xa], r8w
mov dword [rbp - 8], 0x6f0069
mov dword [rbp - 4], 0x73006e
xor r15d, r15d
mov word [rbp], r15w
mov bl, 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1800573a0]
lea ecx, [rax - 0x48]
call fcn.18000ccd0
movzx esi, bl
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], r15b
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9d, 0x9f
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180036490
test al, al
jne 0x18000c91b
mov word [rbp - 0x50], 0x5f
lea r8d, [r15 + 4]
lea rdx, [0x18004ae99]
lea rcx, [rbp - 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
movzx eax, word [0x18004aec2]
mov word [rbp - 0x4b], ax
movzx eax, byte [0x18004aec4]
mov byte [rbp - 0x49], al
mov byte [rbp - 0x48], r15b
lea r8d, [r15 + 3]
lea rdx, [0x18004aedb]
lea rcx, [rbp - 0x48]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
movzx eax, word [0x18004aefc]
mov word [rbp - 0x45], ax
movzx eax, byte [0x18004aefe]
mov byte [rbp - 0x43], al
mov eax, dword [0x18004af26]
mov dword [rbp - 0x42], eax
movzx eax, byte [0x18004af2a]
mov byte [rbp - 0x3e], al
mov eax, 0x5f36
mov word [rbp - 0x3d], ax
mov eax, dword [0x18004af50]
mov dword [rbp - 0x3b], eax
movzx eax, byte [0x18004af54]
mov byte [rbp - 0x37], al
mov word [rbp - 0x36], 0x7575
mov byte [rbp - 0x34], r15b
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
lea rcx, [rbp - 0x50]
call qword [sym.imp.GDI32.dll_GetEnhMetaFileA]
mov rbx, rax
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
test rbx, rbx
jne 0x18000c8fb
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetRegionData]
jmp 0x18000cbc2
mov edx, 1
lea rcx, [rdx - 2]
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_EraseTape]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteEnhMetaFile]
jmp 0x18000cbc2
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
movsd xmm0, qword [0x180057448]
mulsd xmm0, qword [0x180050b38]
addsd xmm0, qword [0x180050ab8]
cvttsd2si rax, xmm0
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x30], r15
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x48]
mov edx, 0xce
lea rcx, [0x1800573c8]
call fcn.18000d880
mov edx, 0x64
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov r14, rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
xor r9d, r9d
xor edx, edx
lea rcx, [rdx - 1]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rdi, rax
mov r8d, 0x122
lea rdx, [rsp + 0x50]
xor ecx, ecx
call fcn.18000b8d0
test al, al
jne 0x18000cac3
mov ecx, 0x4f
mov word [rbp - 0x50], cx
mov edx, 0x49
mov word [rbp - 0x4f], dx
mov dword [rbp - 0x4e], 0x445f44
mov word [rbp - 0x4b], cx
mov dword [rbp - 0x4a], 0x313154
mov eax, 0x5f
mov word [rbp - 0x47], ax
mov word [rbp - 0x46], cx
mov eax, 0x46
mov word [rbp - 0x45], ax
mov dword [rbp - 0x44], 0x414f4c46
mov dword [rbp - 0x40], 0x435f44
mov eax, 0x41
mov word [rbp - 0x3d], ax
mov eax, 0x50
mov word [rbp - 0x3c], ax
mov dword [rbp - 0x3b], 0x4c494241
mov word [rbp - 0x37], dx
mov eax, 0x5954
mov word [rbp - 0x36], ax
mov byte [rbp - 0x34], 0
mov dword [rsp + 0x48], r15d
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetEnhMetaFileDescriptionW]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
xor r9d, r9d
xor edx, edx
lea rcx, [rdx - 1]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbx, rax
test rax, rax
je 0x18000cb6f
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
mov r8d, 0x3d
lea rdx, [rbp + 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000cb6f
movzx eax, bl
test rdi, rdi
cmove eax, r15d
test r14, r14
cmove esi, r15d
test al, al
je 0x18000cb4e
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
mov r8d, 0x400
lea rdx, [rbp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18000caff
cmp dword [rsp + 0x40], eax
jbe 0x18000cb45
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
mov dword [rsp + 0x20], r15d
mov r9d, dword [rsp + 0x40]
xor r8d, r8d
mov edx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x20], r15d
mov r9d, dword [rsp + 0x40]
xor r8d, r8d
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test sil, sil
je 0x18000cb5c
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteObject]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xbb
call fcn.180040380
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x18000cbaf
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000cbaa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000cbaa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800431e4
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x18000cc01
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000cbfc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000cbfc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800431e4
mov rcx, qword [rbp + 0x450]
xor rcx, rsp
call fcn.1800436f0
lea r11, [rsp + 0x560]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret