Function at 0x18001a370
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x210
mov rax, qword [0x1800ac2b8]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x40], rsp
mov byte [rsp + 0x4c], 0
xor eax, eax
mov word [rsp + 0x4d], ax
mov byte [rsp + 0x4f], al
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rax + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
mov qword [rsp + 0x58], rax
cmp rax, 0xffffffffffffffff
jne 0x180019c07
xor eax, eax
jmp 0x18001a344
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x60]
mov r8d, 4
lea rdx, [rsp + 0x4c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180019c43
lea rdx, [0x180019c3c]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
xor eax, eax
jmp 0x18001a344
mov ax, word [rsp + 0x4c]
cmp ax, word [0x18008b57c]
jne 0x18001a32f
mov word [rsp + 0x1a0], bx
xor eax, eax
mov qword [rsp + 0x1a2], rax
mov qword [rsp + 0x1aa], rax
mov qword [rsp + 0x1b2], rax
mov qword [rsp + 0x1ba], rax
mov qword [rsp + 0x1c2], rax
mov qword [rsp + 0x1ca], rax
mov qword [rsp + 0x1d2], rax
mov dword [rsp + 0x1da], eax
mov word [rsp + 0x1de], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x180019cd6
lea rdx, [0x180019ccf]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
xor eax, eax
jmp 0x18001a344
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
mov r8d, 0x40
lea rdx, [rsp + 0x1a0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180019d15
lea rdx, [0x180019d0e]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
xor eax, eax
jmp 0x18001a344
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x1dc]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x180019d4a
lea rdx, [0x180019d43]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
xor eax, eax
jmp 0x18001a344
mov dword [rsp + 0x70], ebx
xor edx, edx
mov r8d, 0xf4
lea rcx, [rsp + 0x74]
call fcn.18005f790
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
mov r8d, 0xf8
lea rdx, [rsp + 0x70]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180019d9c
lea rdx, [0x180019d95]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
xor eax, eax
jmp 0x18001a344
movzx eax, word [rsp + 0x76]
lea edx, [rax + rax*4]
lea edx, [rdx*8 - 0x28]
mov r9d, 1
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x180019ddc
lea rdx, [0x180019dd5]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
xor eax, eax
jmp 0x18001a344
mov byte [rsp + 0x170], 0
xor eax, eax
mov dword [rsp + 0x171], eax
mov word [rsp + 0x175], ax
mov byte [rsp + 0x177], al
mov qword [rsp + 0x178], rax
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x188], rax
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
lea r8d, [rax + 0x28]
lea rdx, [rsp + 0x170]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180019e59
lea rdx, [0x180019e52]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
xor eax, eax
jmp 0x18001a344
mov ecx, dword [rsp + 0x184]
mov esi, dword [rsp + 0x180]
add esi, ecx
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x180019e99
lea rdx, [0x180019e92]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
xor eax, eax
jmp 0x18001a344
mov byte [rsp + 0x48], 0
xor eax, eax
mov word [rsp + 0x49], ax
mov byte [rsp + 0x4b], al
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
lea r8d, [rax + 4]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180019ee3
lea rdx, [0x180019edc]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
xor eax, eax
jmp 0x18001a344
mov eax, dword [rsp + 0x48]
test eax, eax
jne 0x18001a05b
mov byte [rsp + 0x1e0], 0xef
mov byte [rsp + 0x1e1], 0xbe
mov byte [rsp + 0x1e2], 0xad
mov byte [rsp + 0x1e3], 0xde
mov byte [rsp + 0x1e4], Ordinal_79
mov byte [rsp + 0x1e5], 0x75
mov byte [rsp + 0x1e6], WSAGetLastError
mov byte [rsp + 0x1e7], WSAGetLastError
mov byte [rsp + 0x1e8], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x1e9], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x1ea], 0x66
mov byte [rsp + 0x1eb], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x1ec], Ordinal_79
mov byte [rsp + 0x1ed], WSAGetLastError
mov byte [rsp + 0x1ee], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x1ef], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x1f0], al
xor eax, eax
mov qword [rsp + 0x1f1], rax
mov dword [rsp + 0x1f9], eax
mov word [rsp + 0x1fd], ax
mov byte [rsp + 0x1ff], al
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
lea r8d, [rax + 0x10]
lea rdx, [rsp + 0x1f0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180019fd3
lea rdx, [0x180019fcc]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
xor eax, eax
jmp 0x18001a344
cmp dword [rsp + 0x50], 0x10
je 0x180019ff4
lea rdx, [0x180019fed]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
xor eax, eax
jmp 0x18001a344
lea rax, [rsp + 0x1e0]
lea rcx, [rsp + 0x1f0]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x18001a019
add rax, 8
mov rdx, qword [rax]
cmp rdx, qword [rcx + 8]
je 0x18001a020
sbb eax, eax
sbb eax, 0xffffffff
mov ebx, eax
test ebx, ebx
jne 0x18001a041
lea rdx, [0x18001a037]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
mov eax, ntohs
jmp 0x18001a344
lea rdx, [0x18001a054]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
xor eax, eax
jmp 0x18001a344
cmp eax, dword [0x18008b580]
jne 0x18001a080
lea rdx, [0x18001a076]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
mov eax, 4
jmp 0x18001a344
movzx edx, word [rsp + 0x48]
cmp dx, word [0x18008b588]
jne 0x18001a0ab
lea rdx, [0x18001a0a1]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
mov eax, 8
jmp 0x18001a344
cmp dx, word [0x18008b58c]
jne 0x18001a0d1
lea rdx, [0x18001a0c7]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
mov eax, 6
jmp 0x18001a344
cmp eax, dword [0x18008b590]
jne 0x18001a0f6
lea rdx, [0x18001a0ec]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
mov eax, ntohs
jmp 0x18001a344
mov ax, dx
cmp dx, word [0x18008b598]
jne 0x18001a11f
lea rdx, [0x18001a115]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
mov eax, ntohs
jmp 0x18001a344
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x18001a14f
lea rdx, [0x18001a148]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
xor eax, eax
jmp 0x18001a344
mov dword [rsp + 0x54], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
mov r8d, 4
lea rdx, [rsp + 0x54]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18001a18f
lea rdx, [0x18001a188]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
xor eax, eax
jmp 0x18001a344
mov eax, dword [rsp + 0x54]
lea edx, [rax + rsi + 4]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x18001a1c5
lea rdx, [0x18001a1be]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
xor eax, eax
jmp 0x18001a344
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x64]
mov r8d, 4
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18001a201
lea rdx, [0x18001a1fa]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
xor eax, eax
jmp 0x18001a344
lea rax, [rsp + 0x48]
lea r8, [0x180000000]
mov dx, word [rax]
cmp dx, word [r8 + 0x8b59c]
jne 0x18001a22a
mov dl, byte [rax + 2]
cmp dl, byte [r8 + 0x8b59e]
jne 0x18001a22a
mov eax, ebx
jmp 0x18001a22f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x18001a250
lea rdx, [0x18001a246]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
mov eax, 2
jmp 0x18001a344
lea rax, [rsp + 0x4c]
mov dx, word [rax]
cmp dx, word [r8 + 0x8b5a0]
jne 0x18001a271
add rax, 2
mov dl, byte [rax]
cmp dl, byte [r8 + 0x8b5a2]
je 0x18001a278
sbb eax, eax
sbb eax, 0xffffffff
mov ebx, eax
test ebx, ebx
jne 0x18001a299
lea rdx, [0x18001a28f]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
mov eax, 1
jmp 0x18001a344
mov eax, dword [rsp + 0x4c]
cmp eax, dword [str.Rar_]
jne 0x18001a2c2
lea rdx, [0x18001a2b8]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
mov eax, 4
jmp 0x18001a344
movzx edx, word [rsp + 0x4c]
cmp dx, word [0x18008b5ac]
jne 0x18001a2ea
lea rdx, [0x18001a2e3]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
mov eax, 8
jmp 0x18001a344
cmp dx, word [0x18008b5b0]
jne 0x18001a30d
lea rdx, [0x18001a306]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
mov eax, 6
jmp 0x18001a344
cmp eax, dword [str.MSCF]
jne 0x18001a32f
lea rdx, [0x18001a328]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
mov eax, 9
jmp 0x18001a344
lea rdx, [0x18001a342]
mov rcx, qword [rsp + 0x40]
call fcn.180061c20
nop
nop
xor eax, eax
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.18005f4d0
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
jne 0x18001a386
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
lea rdx, [0x18008b5c0]
mov rcx, rax
mov rbx, rax
call fcn.180061d98
test eax, eax
jne 0x18001a3b9
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180019b90
lea rdx, [0x18008b5d0]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a4a5
lea rdx, [0x18008b5e0]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a3f6
lea rdx, [0x18008b5f0]
mov rcx, rbx
call fcn.180061d98
test eax, eax
jne 0x18001a406
mov eax, 7
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rdx, [0x18008b600]
mov rcx, rbx
call fcn.180061d98
test eax, eax
jne 0x18001a429
mov eax, 5
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rdx, [0x18008b608]
mov rcx, rbx
call fcn.180061d98
test eax, eax
jne 0x18001a44c
mov eax, 3
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rdx, [0x18008b618]
mov rcx, rbx
call fcn.180061d98
test eax, eax
jne 0x18001a46f
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rdx, [0x18008b628]
mov rcx, rbx
call fcn.180061d98
test eax, eax
jne 0x18001a492
mov eax, reloc.WS2_32.dll_listen
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rdx, [0x18008b630]
mov rcx, rbx
call fcn.180061d98
test eax, eax
jne 0x18001a4b5
mov eax, reloc.WS2_32.dll_ntohs
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rdx, [0x18008b640]
mov rcx, rbx
call fcn.180061d98
test eax, eax
jne 0x18001a4d8
mov eax, 0xa
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rdx, [0x18008b650]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a940
lea rdx, [0x18008b660]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a940
lea rdx, [0x18008b670]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a940
lea rdx, [0x18008b680]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a940
lea rdx, [0x18008b690]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a940
lea rdx, [0x18008b6a0]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a940
lea rdx, [0x18008b6b0]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a940
lea rdx, str..vcd
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a940
lea rdx, [0x18008b6d0]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a940
lea rdx, str..wmt
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a940
lea rdx, str..vhd
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a940
lea rdx, str..vmdk
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a940
lea rdx, str..vdi
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a940
lea rdx, [0x18008b720]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b730]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b740]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b750]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b760]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b770]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b780]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b790]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b79c]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b7a8]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b7b8]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b7c8]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b7d8]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b7e8]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b7f8]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b808]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b818]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b828]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b838]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b848]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b850]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b860]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b870]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b880]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b890]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b8a0]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b8b0]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b8c0]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b8d0]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b8e0]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b8f0]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b900]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b910]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, str..ace
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, [0x18008b930]
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
lea rdx, str..uue
mov rcx, rbx
call fcn.180061d98
test eax, eax
je 0x18001a930
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, ntohs
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, reloc.WS2_32.dll_recv
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret