Function at 0x1800b88b0
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x1b0], rbx
mov rax, qword [0x180208090]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov r15, r9
mov rdi, r8
mov rsi, rdx
mov rcx, r8
call fcn.180003800
mov rdx, qword [rdi + 8]
mov rcx, qword [rdi]
call fcn.1800b9cd0
mov rax, qword [rdi]
mov qword [rdi + 8], rax
mov byte [r15], 0
mov rcx, rsi
call fcn.180003a80
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r8d, r8d
mov edx, 0x80000000
call fcn.18009ba50
mov r14, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1800b8f9e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov ebx, r12d
mov rcx, rsi
call fcn.180005c00
test al, al
jne 0x1800b89c0
xor eax, eax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov dword [rbp - 0x40], eax
lea r8, [rbp - 0x60]
mov rcx, rsi
call fcn.18009bc30
test al, al
je 0x1800b89c0
mov ebx, dword [rbp - 0x44]
shl rbx, 0x20
mov eax, dword [rbp - 0x40]
add rbx, rax
mov al, 1
jmp 0x1800b89c2
xor al, al
mov rsi, r12
test al, al
cmovne rsi, rbx
lea rax, [rsi - 1]
cmp rax, 0x4ffffe
ja 0x1800b8a60
mov byte [rsp + 0x40], 0
lea rax, [rsp + 0x50]
mov qword [rbp - 0x60], rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x58], rax
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
lea r8, [rbp - 0x60]
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.18003b4a0
mov dword [rbp - 0x30], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x30]
mov r8d, esi
mov rdx, qword [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rbp - 0x30]
cmp rdx, rsi
jae 0x1800b8a60
mov byte [rsp + 0x40], 0
lea rax, [rsp + 0x50]
mov qword [rbp - 0x60], rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x58], rax
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
lea r8, [rbp - 0x60]
lea rcx, [rsp + 0x50]
call fcn.18003b4a0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
je 0x1800b8f6f
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
mov dword [rbp - 0x60], 0x2d2d4352
mov dword [rbp - 0x5c], 0x35343332
mov dword [rbp - 0x58], 0x61534350
mov dword [rbp - 0x54], 0x2d302e32
mov dword [rbp - 0x50], 0x2d736843
mov dword [rbp - 0x4c], 0x61435243
mov dword [rbp - 0x48], 0x38313031
mov dword [rbp - 0x44], 0x35313032
movdqa xmm2, xmmword [0x1801a4a70]
mov eax, r12d
mov ecx, 1
movd xmm3, ecx
lea rcx, [rbp - 0x60]
nop dword [rax]
movd xmm1, eax
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
movdqu xmm0, xmmword [rcx]
pslld xmm0, xmm3
paddd xmm1, xmm0
movdqu xmmword [rcx], xmm1
add eax, 4
lea rcx, [rcx + 0x10]
cmp eax, 8
jl 0x1800b8af0
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
sub rax, rdx
test rdx, rdx
je 0x1800b8f3c
lea r9, [rsp + 0x68]
mov r8d, eax
lea rcx, [rbp - 0x60]
call fcn.180047280
test al, al
je 0x1800b8f3c
mov rcx, qword [rsp + 0x70]
sub rcx, qword [rsp + 0x68]
movabs rax, 0x624dd2f1a9fbe77
mul rcx
mov rbx, rcx
sub rbx, rdx
shr rbx, 1
add rbx, rdx
shr rbx, 9
imul rax, rbx, 0x3e8
sub rcx, rax
jne 0x1800b8f3c
test rbx, rbx
jne 0x1800b8be9
lea rcx, [rsp + 0x68]
call fcn.180003800
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1800b8bb3
mov rdx, qword [rsp + 0x78]
sub rdx, rcx
call fcn.180005040
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r12
lea rcx, [rsp + 0x50]
call fcn.180003800
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1800b8be2
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
call fcn.180005040
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov al, 1
jmp 0x1800b8fa0
xor eax, eax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r12
lea r8, [rbp - 0x80]
mov rdx, rbx
lea rcx, [rbp - 0x80]
call fcn.1800b96f0
imul r8, rbx, 0x3e8
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rbp - 0x80]
call fcn.1800f73b0
mov r10, r12
mov rcx, qword [rbp - 0x78]
mov r9, qword [rbp - 0x80]
sub rcx, r9
movabs r13, 0x20c49ba5e353f7cf
mov rax, r13
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x1800b8cb7
mov r8, r12
nop dword [rax]
cmp dword [r8 + r9], 0x23ab45db
jne 0x1800b8e3c
mov word [r8 + r9 + 0x282], r12w
mov word [r8 + r9 + 0x382], r12w
mov word [r8 + r9 + 0x3ca], r12w
inc r10
add r8, 0x3e8
mov rcx, qword [rbp - 0x78]
mov r9, qword [rbp - 0x80]
sub rcx, r9
mov rax, r13
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r10, rdx
jb 0x1800b8c60
mov rax, qword [rdi + 0x10]
sub rax, qword [rdi]
sar rax, 7
cmp rbx, rax
jbe 0x1800b8cff
movabs rax, 0x1ffffffffffffff
mov qword [rbp - 0x30], rax
call fcn.1800037f0
mov qword [rbp - 0x60], rax
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x60]
call fcn.180004d90
cmp rbx, qword [rax]
ja 0x1800b8fc7
mov rdx, rbx
mov rcx, rdi
call fcn.1800b9600
lea rcx, [rbp - 0x20]
call fcn.180003c60
nop
lea rcx, [rbp]
call fcn.180003c60
nop
lea rcx, [rbp + 0x20]
call fcn.180003c60
nop
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r12
mov qword [rbp + 0x50], r12
mov dword [rbp + 0x58], r12d
mov byte [rbp + 0x5c], 0
mov r14, r12
mov rcx, qword [rbp - 0x78]
mov rbx, qword [rbp - 0x80]
sub rcx, rbx
mov rax, r13
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x1800b8ecc
mov rsi, r12
nop dword [rax]
lea rdx, [rbx + 4]
add rdx, rsi
lea rcx, [rbp - 0x20]
call fcn.180004070
lea rdx, [rbx + 0x284]
add rdx, rsi
lea rcx, [rbp]
call fcn.180004070
mov rax, qword [rsi + rbx + 0x3cc]
mov qword [rbp + 0x40], rax
mov rax, qword [rsi + rbx + 0x3d4]
mov qword [rbp + 0x48], rax
mov rax, qword [rsi + rbx + 0x3dc]
mov qword [rbp + 0x50], rax
lea rdx, [rbx + 0x384]
add rdx, rsi
lea rcx, [rbp + 0x20]
call fcn.180004070
mov eax, dword [rsi + rbx + 0x3e4]
mov dword [rbp + 0x58], eax
mov byte [rbp + 0x5c], 0
mov rdx, qword [rdi + 8]
cmp qword [rdi + 0x10], rdx
je 0x1800b8e8e
mov ecx, 0x80
call fcn.1800037e0
mov rbx, rax
mov qword [rbp - 0x60], rax
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.1800096b0
nop
lea rcx, [rbx + 0x20]
lea rdx, [rbp]
call fcn.1800096b0
nop
lea rcx, [rbx + 0x40]
lea rdx, [rbp + 0x20]
call fcn.1800096b0
nop
mov rax, qword [rbp + 0x40]
mov qword [rbx + 0x60], rax
mov rax, qword [rbp + 0x48]
mov qword [rbx + 0x68], rax
mov rax, qword [rbp + 0x50]
mov qword [rbx + 0x70], rax
mov eax, dword [rbp + 0x58]
mov dword [rbx + 0x78], eax
movzx eax, byte [rbp + 0x5c]
mov byte [rbx + 0x7c], al
sub qword [rdi + 8], 0xffffffffffffff80
jmp 0x1800b8e9a
mov byte [r15], 1
lea rcx, [rbp - 0x80]
call fcn.180003800
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1800b8f40
mov rdx, qword [rbp - 0x70]
sub rdx, rcx
mov rax, r13
imul rdx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x3e8
call fcn.180005040
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r12
jmp 0x1800b8f40
lea r8, [rbp - 0x20]
mov rcx, rdi
call fcn.1800b9b20
inc r14
add rsi, 0x3e8
mov rcx, qword [rbp - 0x78]
mov rbx, qword [rbp - 0x80]
sub rcx, rbx
mov rax, r13
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r14, rdx
jb 0x1800b8d60
mov byte [r15], 0
lea rcx, [rbp + 0x20]
call fcn.180003b80
nop
lea rcx, [rbp]
call fcn.180003b80
nop
lea rcx, [rbp - 0x20]
call fcn.180003b80
nop
lea rcx, [rbp - 0x80]
call fcn.180003800
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1800b8b84
mov rdx, qword [rbp - 0x70]
sub rdx, rcx
mov rax, r13
imul rdx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x3e8
call fcn.180005040
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r12
jmp 0x1800b8b84
mov byte [r15], 1
lea rcx, [rsp + 0x68]
call fcn.180003800
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1800b8f6f
mov rdx, qword [rsp + 0x78]
sub rdx, rcx
call fcn.180005040
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r12
lea rcx, [rsp + 0x50]
call fcn.180003800
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1800b8f9e
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
call fcn.180005040
xorps xmm0, xmm0
mov qword [rsp + 0x60], r12
movdqu xmmword [rsp + 0x50], xmm0
xor al, al
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.1800d8050
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180024ea0
nop
int3