Function at 0x1c55150
Capabilities:
Contain obfuscated stackstrings
Read file on windows
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
push 0
push 0x80
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0x575c3a43
mov eax, dword [ebp - 0x2c]
movdqu xmmword [0xfe27bc], xmm0
mov dword [0xfe27bc], eax
push 3
mov dword [ebp - 0x28], 0x6f646e69
mov eax, dword [ebp - 0x28]
mov dword [0xfe27c0], eax
push 0
mov dword [ebp - 0x24], 0x6d5c7377
mov eax, dword [ebp - 0x24]
mov dword [0xfe27c4], eax
push 0
mov dword [ebp - 0x20], 0x706c6873
mov eax, dword [ebp - 0x20]
mov dword [0xfe27c8], eax
movq qword [0xfe27cc], xmm0
mov dword [ebp - 0x1c], 0x32336164
mov eax, dword [ebp - 0x1c]
push SysReAllocString
mov dword [0xfe27cc], eax
mov byte [0xfe27d4], 0
mov dword [ebp - 0x18], 0x6c6c642e
mov eax, dword [ebp - 0x18]
push 0xfe27bc
mov dword [ebp - 4], 0x61
mov dword [0xfe27d0], eax
mov byte [0xfe27d4], 0
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1c55237
push 0
lea eax, [ebp - 0x28]
push eax
push 1
push 0xd050f8
push esi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
movsx eax, byte [0xd050f8]
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, 1
mov dword [ebp - 8], 0
xor ecx, ecx
mov dword [ebp - 0x40], 0
push ebx
cpuid
xorps xmm0, xmm0
mov esi, ebx
movdqa xmmword [ebp - 0x50], xmm0
pop ebx
lea edi, [ebp - 0x50]
mov dword [edi], eax
mov eax, edi
mov edi, 0x1f
push ebx
mov dword [eax + 4], esi
mov dword [eax + 8], ecx
mov ecx, 1
mov dword [eax + 0xc], edx
mov eax, ecx
test dword [ebp - 0x40], 0x200
movdqa xmmword [ebp - 0x50], xmm0
cmove edi, ecx
mov dword [ebp - 0x40], 0
xor ecx, ecx
mov dword [ebp - 0x20], edi
cpuid
mov esi, ebx
pop ebx
lea edi, [ebp - 0x50]
mov dword [edi], eax
mov eax, edi
mov edi, 0x1f
mov dword [eax + 4], esi
mov esi, dword [ebp - 4]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, 1
test dword [ebp - 0x40], 0x200
cmove edi, eax
mov eax, dword [ebp - 0x20]
sub eax, edi
add esi, eax
mov dword [ebp - 4], esi
lea edi, [eax + 0x43200]
mov eax, 0x14141415
sub eax, dword [ebp - 0x20]
cmp edi, eax
je 0x1c552ff
mov edx, edi
test edi, edi
jle 0x1c552ff
mov ecx, section..text
mov al, byte [ebp - 8]
add al, dl
xor byte [ecx], al
test edx, edx
je 0x1c552ff
add dword [ebp - 8], esi
inc ecx
dec edx
lea eax, [ecx - 0x15151515]
cmp eax, edi
jl 0x1c552e5
mov eax, 1
mov dword [ebp - 0xc], 0
xor ecx, ecx
mov dword [ebp - 0x40], 0
push ebx
cpuid
xorps xmm0, xmm0
mov esi, ebx
movdqa xmmword [ebp - 0x50], xmm0
pop ebx
lea edi, [ebp - 0x50]
mov dword [edi], eax
mov eax, edi
mov edi, 0x1f
push ebx
mov dword [eax + 4], esi
mov dword [eax + 8], ecx
mov ecx, 1
mov dword [eax + 0xc], edx
mov eax, ecx
test dword [ebp - 0x40], 0x200
movdqa xmmword [ebp - 0x50], xmm0
cmove edi, ecx
mov dword [ebp - 0x40], 0
xor ecx, ecx
mov dword [ebp - 0x20], edi
cpuid
mov esi, ebx
pop ebx
lea edi, [ebp - 0x50]
mov dword [edi], eax
mov eax, edi
mov edi, 0x1f
mov dword [eax + 4], esi
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x20]
mov dword [eax + 0xc], edx
mov eax, 1
test dword [ebp - 0x40], 0x200
mov edx, ecx
cmove edi, eax
mov eax, ecx
sub eax, edi
sub edx, edi
add dword [ebp - 4], eax
add edx, 0x263a
mov eax, ecx
mov dword [ebp - 0x18], edx
sub eax, edi
add eax, 0x44b000
mov dword [ebp - 0x14], eax
mov eax, 0x17171718
sub eax, ecx
cmp edx, eax
je 0x1c55466
lea edi, [ebp - 0x48]
mov dword [ebp - 8], edx
mov dword [ebp - 0x48], 0x696c6176
lea ecx, [edi + 1]
mov dword [ebp - 0x44], 0x6f632064
mov byte [ebp - 0x40], 0
mov al, byte [edi]
inc edi
test al, al
jne 0x1c553d0
sub edi, ecx
or eax, 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x20], eax
xor edx, edx
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x18], ecx
jle 0x1c55457
mov eax, dword [ebp - 0x14]
sub eax, edi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov esi, dword [ebp - 0x14]
add al, byte [ebp - 0xc]
xor byte [edx + esi], al
mov esi, dword [ebp - 4]
test ecx, ecx
jne 0x1c55438
xor eax, eax
test edi, edi
je 0x1c55438
mov esi, dword [ebp - 0x28]
add esi, edx
movsx edx, byte [ebp + eax - 0x48]
movzx ecx, byte [esi]
cmp ecx, edx
jne 0x1c55430
inc eax
inc esi
mov ecx, 1
cmp eax, edi
jne 0x1c55411
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x20], edx
jmp 0x1c55435
mov edx, dword [ebp - 0x10]
xor ecx, ecx
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 8]
test eax, eax
je 0x1c5544f
add dword [ebp - 0xc], esi
inc edx
dec eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], eax
cmp edx, dword [ebp - 0x18]
jl 0x1c553f6
mov eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
jne 0x1c55461
mov dword [0x4517a0], 0
mov dword [0xd04f18], eax
cmp dword [0x4517a0], 0
jne 0x1c554fd
movdqa xmm0, xmmword [0x44dff0]
push 0
push 0x80
push 3
push 0
push 0
movdqu xmmword [0xd050f8], xmm0
push SysReAllocString
movdqa xmm0, xmmword [0x44e050]
push 0xd050f8
movdqu xmmword [0xd05108], xmm0
mov byte [0xd05118], 0
mov dword [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1c554e0
push 0
lea eax, [ebp - 0x28]
push eax
push 1
push 0xd050f8
push esi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, 1
xor ecx, ecx
push ebx
cpuid
pop ebx
call fcn.01c55000
call fcn.01c550b0
push 0xfffffffffffffffe
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov eax, 1
mov dword [ebp - 0x10], 0
xor ecx, ecx
mov dword [ebp - 0x40], 0
push ebx
cpuid
xorps xmm0, xmm0
mov esi, ebx
movdqa xmmword [ebp - 0x50], xmm0
pop ebx
lea edi, [ebp - 0x50]
mov dword [edi], eax
mov eax, edi
mov edi, 0x1f
push ebx
mov dword [eax + 4], esi
mov dword [eax + 8], ecx
mov ecx, 1
mov dword [eax + 0xc], edx
mov eax, ecx
test dword [ebp - 0x40], 0x200
movdqa xmmword [ebp - 0x50], xmm0
cmove edi, ecx
mov dword [ebp - 0x40], 0
xor ecx, ecx
mov dword [ebp - 0x28], edi
cpuid
mov esi, ebx
pop ebx
lea edi, [ebp - 0x50]
mov dword [edi], eax
mov eax, edi
mov edi, 0x1f
mov dword [eax + 4], esi
mov esi, dword [ebp - 4]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x28]
mov dword [eax + 0xc], edx
mov eax, 1
test dword [ebp - 0x40], 0x200
mov edx, ecx
cmove edi, eax
mov eax, ecx
sub eax, edi
sub edx, edi
add esi, eax
add edx, 0x2000
mov eax, 0x1919191a
sub eax, ecx
cmp edx, eax
je 0x1c555ca
mov edi, edx
test edi, edi
jle 0x1c555ca
mov ecx, section..data
lea ecx, [ecx]
mov al, dl
add al, byte [ebp - 0x10]
xor byte [ecx], al
test edx, edx
je 0x1c555ca
add dword [ebp - 0x10], esi
inc ecx
dec edx
lea eax, [ecx - 0x18181818]
cmp eax, edi
jl 0x1c555b0
call fcn.00426d23
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret