Function at 0x180006680
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x180028010]
xor rax, rsp
mov qword [rbp + 8], rax
mov qword [rbp - 0x48], r8
mov rdi, rdx
mov r13, rcx
mov qword [rbp - 0x40], rdx
cmp qword [rcx + 0x30], 0
je 0x180006944
movdqa xmm0, xmmword [0x180024620]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x180024380]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm0, xmmword [0x180024650]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x180024410]
movdqa xmmword [rsp + 0x70], xmm1
mov dword [rbp - 0x80], 0x4a7c4f7c
mov dword [rbp - 0x7c], 0x457c447c
mov byte [rbp - 0x78], 0x7c
xor eax, eax
mov word [rbp - 0x77], ax
xor ebx, ebx
mov ecx, ebx
nop word [rax + rax]
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x41], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x42], al
add rcx, 2
cmp rcx, 0x48
jb 0x180006720
mov word [rbp - 0x77], bx
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x68]
call fcn.180002930
mov rcx, rax
call fcn.1800028c0
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x180006763
mov rcx, qword [rdi]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rsi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x180006944
movdqa xmm0, xmmword [0x180024200]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x1800247d0]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm0, xmmword [0x180024350]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x180024740]
movdqa xmmword [rsp + 0x70], xmm1
mov dword [rbp - 0x80], 0x2d1b281b
mov dword [rbp - 0x7c], 0x221b231b
mov byte [rbp - 0x78], 0x1b
xor eax, eax
mov word [rbp - 0x77], ax
mov rcx, rbx
nop
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x41], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x42], al
add rcx, 2
cmp rcx, 0x48
jb 0x1800067f0
mov word [rbp - 0x77], bx
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x68]
call fcn.180002930
mov rcx, rax
call fcn.1800028c0
mov dword [rbp - 0x38], ebx
lea rdx, [rbp - 0x38]
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_GetFileSize]
mov r14d, eax
test eax, eax
je 0x18000693a
mov eax, dword [r13 + 0x40]
cmp r14d, eax
jbe 0x18000693a
sub r14d, eax
mov r12d, r14d
mov ecx, r14d
call fcn.18000e72c
mov r15, rax
mov r8d, r14d
xor edx, edx
mov rcx, rax
call fcn.18000ff50
mov byte [r15], bl
mov eax, dword [r13 + 0x40]
test eax, eax
je 0x180006888
mov edx, eax
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
movdqa xmm0, xmmword [0x180024620]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x180024380]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm0, xmmword [0x180024650]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x180024410]
movdqa xmmword [rsp + 0x70], xmm1
mov dword [rbp - 0x80], 0x4a7c4f7c
mov dword [rbp - 0x7c], 0x457c447c
mov byte [rbp - 0x78], 0x7c
xor eax, eax
mov word [rbp - 0x77], ax
mov rcx, rbx
nop dword [rax + rax]
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x41], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x42], al
add rcx, 2
cmp rcx, 0x48
jb 0x1800068e0
mov word [rbp - 0x77], bx
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x68]
call fcn.180002930
mov rcx, rax
call fcn.1800028c0
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x38]
mov r8d, r14d
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x180006975
mov rcx, r15
call fcn.18000e0dc
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
nop
mov rcx, rdi
call fcn.1800028c0
xor al, al
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.18000e080
mov rbx, qword [rsp + 0x168]
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movdqa xmm0, xmmword [0x180024270]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x180024780]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm0, xmmword [0x180024320]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x180024710]
movdqa xmmword [rsp + 0x70], xmm1
mov dword [rbp - 0x80], 0x2e182b18
mov dword [rbp - 0x7c], 0x21182018
mov byte [rbp - 0x78], 0x18
xor eax, eax
mov word [rbp - 0x77], ax
mov rcx, rbx
nop dword [rax + rax]
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x41], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x42], al
add rcx, 2
cmp rcx, 0x48
jb 0x1800069d0
mov word [rbp - 0x77], bx
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x68]
call fcn.180002930
mov rcx, rax
call fcn.1800028c0
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
lea rdx, [r13 + 0x20]
cmp qword [rdx + 0x18], 8
jb 0x180006a24
mov rdx, qword [rdx]
lea rcx, [rbp - 0x28]
call fcn.1800034a0
nop
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x68]
call fcn.18000a800
mov r8d, 0x10
lea rdx, [rbp - 8]
mov rcx, rax
call fcn.180003590
mov rcx, r12
call fcn.18000e72c
mov rsi, rax
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.18000ff50
mov byte [rsi], 0
movdqa xmm0, xmmword [0x180024b00]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x180023f40]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm0, xmmword [0x180024870]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x180023ec0]
movdqa xmmword [rsp + 0x70], xmm1
mov dword [rbp - 0x80], 0x7e487b48
mov dword [rbp - 0x7c], 0x71487048
mov byte [rbp - 0x78], 0x48
xor eax, eax
mov word [rbp - 0x77], ax
mov rcx, rbx
nop dword [rax + rax]
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x41], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x42], al
add rcx, 2
cmp rcx, 0x48
jb 0x180006ac0
mov word [rbp - 0x77], 0
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x68]
call fcn.180002930
mov rcx, rax
call fcn.1800028c0
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov r9d, 0x10
lea r8, [rbp - 8]
mov edx, r14d
mov rcx, r15
call fcn.18000dbd0
movdqa xmm0, xmmword [0x180023f10]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x180024b10]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm0, xmmword [str.8_n8_t8]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x180024aa0]
movdqa xmmword [rsp + 0x70], xmm1
mov dword [rbp - 0x80], 0xe380b38
mov dword [rbp - 0x7c], 0x1380038
mov byte [rbp - 0x78], 0x38
xor eax, eax
mov word [rbp - 0x77], ax
mov rcx, rbx
nop
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x41], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x42], al
add rcx, 2
cmp rcx, 0x48
jb 0x180006b70
mov word [rbp - 0x77], 0
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x68]
call fcn.180002930
mov rcx, rax
call fcn.1800028c0
movdqa xmm0, xmmword [0x180023f10]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x180024b10]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm0, xmmword [str.8_n8_t8]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x180024aa0]
movdqa xmmword [rsp + 0x70], xmm1
mov dword [rbp - 0x80], 0xe380b38
mov dword [rbp - 0x7c], 0x1380038
mov byte [rbp - 0x78], 0x38
xor eax, eax
mov word [rbp - 0x77], ax
mov rcx, rbx
nop dword [rax + rax]
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x41], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x42], al
add rcx, 2
cmp rcx, 0x48
jb 0x180006c00
mov word [rbp - 0x77], 0
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x68]
call fcn.180002930
mov rcx, rax
call fcn.1800028c0
cmp dword [rbp - 0x30], r14d
jne 0x180006d05
cmp dword [rsi], 0xdd7ab5da
jne 0x180006d05
movdqa xmm0, xmmword [0x1800242b0]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x180024720]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm0, xmmword [0x1800242e0]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x180024790]
movdqa xmmword [rsp + 0x70], xmm1
mov dword [rbp - 0x80], 0x2b1d2e1d
mov dword [rbp - 0x7c], 0x241d251d
mov byte [rbp - 0x78], 0x1d
xor eax, eax
mov word [rbp - 0x77], ax
nop
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rbx + 0x41], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rbx + 0x42], al
add rbx, 2
cmp rbx, 0x48
jb 0x180006ca0
mov word [rbp - 0x77], 0
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x68]
call fcn.180002930
mov rcx, rax
call fcn.1800028c0
mov rax, qword [rbp - 0x48]
mov qword [rax], rsi
mov dword [rax + 8], r14d
mov rcx, r15
call fcn.18000e0dc
nop
lea rcx, [rbp - 0x28]
call fcn.180002970
nop
mov rcx, rdi
call fcn.1800028c0
mov al, 1
jmp 0x18000694e
movdqa xmm0, xmmword [0x180024910]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x180024120]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm0, xmmword [0x180024a80]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x1800240b0]
movdqa xmmword [rsp + 0x70], xmm1
mov dword [rbp - 0x80], 0x6c5a695a
mov dword [rbp - 0x7c], 0x635a625a
mov byte [rbp - 0x78], 0x5a
xor eax, eax
mov word [rbp - 0x77], ax
nop word [rax + rax]
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rbx + 0x41], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rbx + 0x42], al
add rbx, 2
cmp rbx, 0x48
jb 0x180006d60
mov word [rbp - 0x77], 0
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x68]
call fcn.180002930
mov rcx, rax
call fcn.1800028c0
mov rcx, r15
call fcn.18000e0dc
mov rcx, rsi
call fcn.18000e0dc
nop
lea rcx, [rbp - 0x28]
call fcn.180002970
jmp 0x180006944