Function at 0x180018754
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
sub rsp, 0x210
mov rax, qword [0x1800a7120]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x40], rsp
xor r12d, r12d
mov byte [rsp + 0x48], r12b
xor eax, eax
mov word [rsp + 0x49], ax
mov byte [rsp + 0x4b], al
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
lea r8d, [r12 + 3]
mov dword [rsp + 0x20], r8d
xor r9d, r9d
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
mov qword [rsp + 0x58], rax
cmp rax, 0xffffffffffffffff
jne 0x1800187d0
xor eax, eax
jmp 0x180018eea
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x60]
mov r8d, 4
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x18001880d
lea rdx, [0x180018806]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
xor eax, eax
jmp 0x180018eea
mov ax, word [rsp + 0x48]
cmp ax, word [0x18008754c]
jne 0x180018ed5
mov word [rsp + 0x1a0], r12w
xor edx, edx
lea r8d, [rdx + 0x3e]
lea rcx, [rsp + 0x1a2]
call fcn.18005c190
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
or r13d, 0xffffffff
cmp eax, r13d
jne 0x18001886f
lea rdx, [0x180018868]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
xor eax, eax
jmp 0x180018eea
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, 0x40
lea rdx, [rsp + 0x1a0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x1800188af
lea rdx, [0x1800188a8]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
xor eax, eax
jmp 0x180018eea
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x1dc]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, r13d
jne 0x1800188e4
lea rdx, [0x1800188dd]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
xor eax, eax
jmp 0x180018eea
mov dword [rsp + 0x70], r12d
xor edx, edx
mov r8d, 0xf4
lea rcx, [rsp + 0x74]
call fcn.18005c190
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, 0xf8
lea rdx, [rsp + 0x70]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x180018938
lea rdx, [0x180018931]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
xor eax, eax
jmp 0x180018eea
movzx eax, word [rsp + 0x76]
lea edx, [rax + rax*4]
lea edx, [rdx*8 - 0x28]
mov r9d, 1
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, r13d
jne 0x180018978
lea rdx, [0x180018971]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
xor eax, eax
jmp 0x180018eea
mov byte [rsp + 0x170], r12b
xor eax, eax
mov dword [rsp + 0x171], eax
mov word [rsp + 0x175], ax
mov byte [rsp + 0x177], al
xor edx, edx
lea r8d, [rax + 0x20]
lea rcx, [rsp + 0x178]
call fcn.18005c190
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, Ordinal_41
lea rdx, [rsp + 0x170]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x1800189eb
lea rdx, [0x1800189e4]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
xor eax, eax
jmp 0x180018eea
mov esi, dword [rsp + 0x180]
mov eax, dword [rsp + 0x184]
add esi, eax
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, r13d
jne 0x180018a2b
lea rdx, [0x180018a24]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
xor eax, eax
jmp 0x180018eea
mov byte [rsp + 0x4c], r12b
xor eax, eax
mov word [rsp + 0x4d], ax
mov byte [rsp + 0x4f], al
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
lea r8d, [rax + 4]
lea rdx, [rsp + 0x4c]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x180018a76
lea rdx, [0x180018a6f]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
xor eax, eax
jmp 0x180018eea
mov eax, dword [rsp + 0x4c]
cmp eax, r12d
jne 0x180018bf2
mov byte [rsp + 0x1e0], 0xef
mov byte [rsp + 0x1e1], 0xbe
mov byte [rsp + 0x1e2], 0xad
mov byte [rsp + 0x1e3], 0xde
mov byte [rsp + 0x1e4], Ordinal_79
mov byte [rsp + 0x1e5], 0x75
mov byte [rsp + 0x1e6], WSAGetLastError
mov byte [rsp + 0x1e7], WSAGetLastError
mov byte [rsp + 0x1e8], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x1e9], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x1ea], 0x66
mov byte [rsp + 0x1eb], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x1ec], Ordinal_79
mov byte [rsp + 0x1ed], WSAGetLastError
mov byte [rsp + 0x1ee], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x1ef], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x1f0], r12b
xor eax, eax
mov qword [rsp + 0x1f1], rax
mov dword [rsp + 0x1f9], eax
mov word [rsp + 0x1fd], ax
mov byte [rsp + 0x1ff], al
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
lea r8d, [rax + 0x10]
lea rdx, [rsp + 0x1f0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x180018b69
lea rdx, [0x180018b62]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
xor eax, eax
jmp 0x180018eea
cmp dword [rsp + 0x50], 0x10
je 0x180018b8a
lea rdx, [0x180018b83]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
xor eax, eax
jmp 0x180018eea
lea rax, [rsp + 0x1e0]
lea rcx, [rsp + 0x1f0]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x180018bb1
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + 8]
jne 0x180018bb1
mov eax, r12d
jmp 0x180018bb6
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r12d
jne 0x180018bd8
lea rdx, [0x180018bce]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
mov eax, ntohs
jmp 0x180018eea
lea rdx, [0x180018beb]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
xor eax, eax
jmp 0x180018eea
cmp eax, dword [0x180087550]
jne 0x180018c17
lea rdx, [0x180018c0d]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
mov eax, 4
jmp 0x180018eea
movzx edx, word [rsp + 0x4c]
cmp dx, word [0x180087558]
jne 0x180018c42
lea rdx, [0x180018c38]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
mov eax, 8
jmp 0x180018eea
cmp dx, word [0x18008755c]
jne 0x180018c68
lea rdx, [0x180018c5e]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
mov eax, 6
jmp 0x180018eea
cmp eax, dword [0x180087560]
jne 0x180018c8d
lea rdx, [0x180018c83]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
mov eax, ntohs
jmp 0x180018eea
mov ax, dx
cmp dx, word [0x180087568]
jne 0x180018cb6
lea rdx, [0x180018cac]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
mov eax, ntohs
jmp 0x180018eea
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, r13d
jne 0x180018ce6
lea rdx, [0x180018cdf]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
xor eax, eax
jmp 0x180018eea
mov dword [rsp + 0x54], r12d
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, 4
lea rdx, [rsp + 0x54]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x180018d28
lea rdx, [0x180018d21]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
xor eax, eax
jmp 0x180018eea
mov eax, dword [rsp + 0x54]
lea edx, [rax + rsi + 4]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, r13d
jne 0x180018d5e
lea rdx, [0x180018d57]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
xor eax, eax
jmp 0x180018eea
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x64]
mov r8d, 4
lea rdx, [rsp + 0x4c]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x180018d9b
lea rdx, [0x180018d94]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
xor eax, eax
jmp 0x180018eea
lea rax, [rsp + 0x4c]
lea r8, [0x180000000]
mov dx, word [rax]
cmp dx, word [r8 + 0x8756c]
jne 0x180018dc5
mov dl, byte [rax + 2]
cmp dl, byte [r8 + 0x8756e]
jne 0x180018dc5
mov eax, r12d
jmp 0x180018dca
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r12d
jne 0x180018dec
lea rdx, [0x180018de2]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
mov eax, 2
jmp 0x180018eea
lea rax, [rsp + 0x48]
mov dx, word [rax]
cmp dx, word [r8 + 0x87570]
jne 0x180018e0f
mov dl, byte [rax + 2]
cmp dl, byte [r8 + 0x87572]
jne 0x180018e0f
mov eax, r12d
jmp 0x180018e14
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r12d
jne 0x180018e36
lea rdx, [0x180018e2c]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
mov eax, 1
jmp 0x180018eea
mov eax, dword [rsp + 0x48]
cmp eax, dword [str.Rar_]
jne 0x180018e5f
lea rdx, [0x180018e55]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
mov eax, 4
jmp 0x180018eea
mov ax, word [rsp + 0x48]
cmp ax, word [0x18008757c]
jne 0x180018e87
lea rdx, [0x180018e80]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
mov eax, 8
jmp 0x180018eea
mov ax, word [rsp + 0x48]
cmp ax, word [0x180087580]
jne 0x180018eaf
lea rdx, [0x180018ea8]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
mov eax, 6
jmp 0x180018eea
mov eax, dword [rsp + 0x48]
cmp eax, dword [str.MSCF]
jne 0x180018ed5
lea rdx, [0x180018ece]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
mov eax, 9
jmp 0x180018eea
lea rdx, [0x180018ee8]
mov rcx, qword [rsp + 0x40]
call fcn.18005eb30
nop
nop
xor eax, eax
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.18005c4c0
lea r11, [rsp + 0x210]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop r13
ret