Function at 0x18000d4d0
Capabilities:
Contain obfuscated stackstrings
Get system information on windows
Parse pe header

Disassembly:
push rbp
push rbx
push rsi
push r12
push r14
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1800b80b8]
xor rax, rsp
mov qword [rbp], rax
xor r14d, r14d
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x50], rcx
mov r12, rdx
mov rsi, rcx
mov ebx, r14d
cmp rdx, 0x40
jae 0x18000d51e
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x18000dea7
mov eax, 0x5a4d
cmp word [rcx], ax
je 0x18000d538
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x18000dea7
movsxd rcx, dword [rcx + 0x3c]
lea rax, [rcx + 0x108]
cmp r12, rax
jb 0x18000d50e
cmp dword [rcx + rsi], 0x4550
mov qword [rsp + 0x158], r15
lea r15, [rcx + rsi]
jne 0x18000d572
mov eax, 0x8664
cmp word [r15 + 4], ax
jne 0x18000d572
mov ecx, dword [r15 + 0x38]
test cl, 1
je 0x18000d582
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x18000de9f
movzx eax, word [r15 + 6]
mov r9, rcx
movzx edx, word [r15 + 0x14]
mov qword [rsp + 0x148], rdi
test eax, eax
je 0x18000d5c8
lea rcx, [r15 + 0x24]
mov r8d, eax
add rcx, rdx
mov edx, dword [rcx + 4]
test edx, edx
jne 0x18000d5b3
mov eax, dword [rcx]
add rax, r9
jmp 0x18000d5b7
mov eax, dword [rcx]
add eax, edx
cmp rax, rbx
cmova rbx, rax
add rcx, 0x28
sub r8, 1
jne 0x18000d5a5
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edx, dword [rsp + 0x6c]
lea r8d, [rdx - 1]
lea edi, [rdx - 1]
not r8d
add edi, dword [r15 + 0x50]
lea rcx, [rdx - 1]
add rcx, rbx
and rdi, r8
and rcx, r8
cmp rdi, rcx
je 0x18000d607
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x18000de97
mov rbx, qword [r15 + 0x30]
mov qword [rsp + 0x150], r13
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x3000
mov r8, rdi
mov rcx, rax
mov rdx, rbx
call fcn.18000d3b0
mov qword [rsp + 0x40], rax
mov r13, rax
test rax, rax
jne 0x18000d660
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x3000
mov r8, rdi
mov rcx, rax
xor edx, edx
call fcn.18000d3b0
mov qword [rsp + 0x40], rax
mov r13, rax
test rax, rax
je 0x18000d691
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x50]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x18000d6a1
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [0x18008bbc0]
mov ecx, reloc.WLDAP32.dll_Ordinal_14
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x18000de8f
mov qword [rax + 8], r13
movzx eax, word [r15 + 0x16]
shr eax, 0xd
and eax, 1
mov qword [rbx + 0x40], r14
mov dword [rbx + 0x20], eax
lea rax, [0x18000d4a0]
mov qword [rbx + 0x28], rax
lea rax, [0x18000d4b0]
mov qword [rbx + 0x30], rax
lea rax, [0x18000d4c0]
mov qword [rbx + 0x38], rax
mov eax, dword [rsp + 0x6c]
mov dword [rbx + 0x50], eax
mov edi, dword [r15 + 0x54]
cmp r12, rdi
jae 0x18000d6f8
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x18000d85d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x1000
mov r8, rdi
mov rcx, rax
mov rdx, r13
call fcn.18000d3b0
mov r8d, dword [r15 + 0x54]
mov rdx, rsi
mov rcx, rax
mov rdi, rax
call fcn.180061610
movsxd rcx, dword [rsi + 0x3c]
add rcx, rdi
mov qword [rbx], rcx
mov qword [rcx + 0x30], r13
mov r13d, r14d
mov rcx, qword [rbx]
mov r12, qword [rbx + 8]
movzx eax, word [rcx + 0x14]
cmp r14w, word [rcx + 6]
jae 0x18000d81c
lea r14, [rcx + 0x28]
add r14, rax
mov edx, dword [r14]
test edx, edx
jne 0x18000d7a9
movsxd rax, dword [r15 + 0x38]
test eax, eax
jle 0x18000d802
mov edi, dword [r14 - 4]
mov rsi, rax
add rdi, r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x1000
mov r8, rsi
mov rcx, rax
mov rdx, rdi
call fcn.18000d3b0
test rax, rax
je 0x18000d85a
mov ecx, dword [r14 - 4]
mov r8, rsi
add rcx, r12
xor edx, edx
mov dword [r14 - 8], ecx
call fcn.180061460
jmp 0x18000d802
mov eax, dword [r14 + 4]
add eax, edx
cmp qword [rsp + 0x38], rax
jb 0x18000d84f
mov edi, dword [r14 - 4]
mov rsi, rdx
add rdi, r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x1000
mov r8, rsi
mov rcx, rax
mov rdx, rdi
call fcn.18000d3b0
test rax, rax
je 0x18000d85a
mov edi, dword [r14 - 4]
mov edx, dword [r14 + 4]
add rdi, r12
mov r8d, dword [r14]
mov rcx, rdi
add rdx, qword [rsp + 0x50]
call fcn.180061610
mov dword [r14 - 8], edi
mov rax, qword [rbx]
inc r13d
add r14, 0x28
movzx ecx, word [rax + 6]
cmp r13d, ecx
jl 0x18000d752
xor r14d, r14d
mov rax, qword [rbx]
mov r13d, 1
mov r11, qword [rax + 0x30]
sub r11, qword [r15 + 0x30]
je 0x18000d972
cmp dword [rax + 0xb4], 0
mov rdi, qword [rbx + 8]
jne 0x18000d8e8
mov eax, r14d
mov dword [rbx + 0x24], eax
jmp 0x18000d976
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor r14d, r14d
cmp dword [rbx + 0x1c], 0
je 0x18000d879
mov rax, qword [rbx]
xor r8d, r8d
mov rcx, qword [rbx + 8]
xor edx, edx
mov r9d, dword [rax + 0x28]
add r9, rcx
call r9
cmp qword [rbx + 0x10], 0
je 0x18000d8b8
cmp dword [rbx + 0x18], 0
mov edi, r14d
jle 0x18000d8af
mov rsi, r14
nop dword [rax]
mov rax, qword [rbx + 0x10]
mov rcx, qword [rsi + rax]
test rcx, rcx
je 0x18000d8a4
mov rdx, qword [rbx + 0x40]
call qword [rbx + gethostname]
inc edi
add rsi, 8
cmp edi, dword [rbx + 0x18]
jl 0x18000d890
mov rcx, qword [rbx + 0x10]
call fcn.180062e08
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18000d8cf
xor edx, edx
mov r8d, 0x8000
call qword [0x18008bbc0]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18000de8f
mov r9d, dword [rax + 0xb0]
add r9, rdi
mov eax, dword [r9]
test eax, eax
je 0x18000d96a
nop dword [rax]
mov r10d, eax
lea rdx, [r9 + 8]
mov eax, dword [r9 + 4]
add r10, rdi
sub rax, 8
mov r8d, r14d
test rax, 0xfffffffffffffffe
jbe 0x18000d95c
nop dword [rax]
movzx eax, word [rdx]
mov ecx, eax
shr eax, 0xc
and ecx, 0xfff
cmp eax, 3
je 0x18000d93e
cmp eax, 0xa
jne 0x18000d942
add qword [rcx + r10], r11
jmp 0x18000d942
add dword [rcx + r10], r11d
mov ecx, dword [r9 + 4]
inc r8d
sub rcx, 8
mov eax, r8d
shr rcx, 1
add rdx, 2
cmp rax, rcx
jb 0x18000d920
mov eax, dword [r9 + 4]
add r9, rax
mov eax, dword [r9]
test eax, eax
jne 0x18000d900
mov eax, r13d
mov dword [rbx + 0x24], eax
jmp 0x18000d976
mov dword [rbx + 0x24], r13d
mov rax, qword [rbx]
mov r12, qword [rbx + 8]
cmp dword [rax + 0x94], 0
je 0x18000da6f
mov r15d, dword [rax + 0x90]
mov edx, reloc.WS2_32.dll_sendto
add r15, r12
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x18000da6f
nop word [rax + rax]
mov eax, dword [r15 + 0xc]
test eax, eax
je 0x18000da6f
mov rdx, qword [rbx + 0x40]
lea rcx, [r12 + rax]
call qword [rbx + Ordinal_41]
mov r14, rax
test rax, rax
je 0x18000dae7
mov eax, dword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
inc eax
movsxd rdx, eax
shl rdx, 3
call fcn.180067db4
mov rcx, rax
test rax, rax
je 0x18000dad3
mov qword [rbx + 0x10], rax
movsxd rax, dword [rbx + 0x18]
mov qword [rcx + rax*8], r14
inc dword [rbx + 0x18]
mov ecx, dword [r15]
test ecx, ecx
jne 0x18000da0e
mov ecx, dword [r15 + 0x10]
mov edi, dword [r15 + 0x10]
mov esi, ecx
add rdi, r12
add rsi, r12
cmp qword [rsi], 0
je 0x18000da55
mov rax, qword [rsi]
mov rcx, r14
mov r8, qword [rbx + 0x40]
test rax, rax
jns 0x18000da34
movzx edx, ax
jmp 0x18000da3c
lea rdx, [r12 + 2]
add rdx, rax
call qword [rbx + 0x30]
mov qword [rdi], rax
test rax, rax
je 0x18000dabf
add rsi, 8
add rdi, 8
cmp qword [rsi], 0
jne 0x18000da20
add r15, 0x14
mov edx, reloc.WS2_32.dll_sendto
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x18000d9b0
mov rcx, qword [rbx]
movabs rax, 0xffffffff00000000
mov r11d, dword [rbx + 0x50]
dec r11d
not r11d
movzx r10d, word [rcx + 0x14]
mov r14, qword [rcx + 0x30]
add r10, rcx
and r14, rax
mov qword [rsp + 0x48], r14
mov r9d, dword [r10 + 0x20]
mov r8d, dword [r10 + 0x28]
or r9, r14
and r11, r9
mov qword [rbp - 0x20], r9
test r8d, r8d
jne 0x18000daf9
mov eax, dword [r10 + 0x3c]
test al, 0x40
je 0x18000daf1
mov r8d, dword [rcx + 0x20]
jmp 0x18000daf9
mov rdx, qword [rbx + 0x40]
mov rcx, r14
call qword [rbx + gethostname]
mov ecx, reloc.WLDAP32.dll_Ordinal_127
jmp 0x18000d854
mov rdx, qword [rbx + 0x40]
mov rcx, r14
call qword [rbx + gethostname]
mov ecx, reloc.WLDAP32.dll_Ordinal_14
jmp 0x18000d854
mov ecx, Ordinal_127
jmp 0x18000d854
test al, al
jns 0x18000daf9
mov r8d, dword [rcx + 0x24]
lea rsi, [0x1800a6748]
mov edx, dword [r10 + 0x3c]
mov edi, r13d
mov dword [rsp + 0x30], r13d
cmp r13w, word [rcx + 6]
jae 0x18000dcf7
lea rsi, [r10 + 0x64]
nop dword [rax + rax]
mov ecx, dword [rbx + 0x50]
mov r10d, dword [rsi - 0x1c]
mov r12d, dword [rsi - 0x14]
or r10, r14
mov qword [rsp + 0x38], r10
lea r15d, [rcx - 1]
not r15d
and r15, r10
test r12d, r12d
jne 0x18000db5c
mov eax, dword [rsi]
test al, 0x40
je 0x18000db51
mov rax, qword [rbx]
mov r12d, dword [rax + 0x20]
jmp 0x18000db5c
test al, al
jns 0x18000db5c
mov rax, qword [rbx]
mov r12d, dword [rax + 0x24]
cmp r11, r15
je 0x18000dcb5
mov r10d, r8d
lea rax, [r10 + r9]
cmp rax, r15
ja 0x18000dcb0
test r8d, r8d
je 0x18000dc9d
bt edx, 0x19
jae 0x18000dbbb
cmp r9, r11
jne 0x18000dc9d
mov rax, qword [rbx]
cmp dword [rax + 0x38], ecx
je 0x18000dba4
xor edx, edx
mov eax, r8d
div ecx
test edx, edx
jne 0x18000dc9d
mov r8d, 0x4000
mov rdx, r10
mov rcx, r9
call qword [0x18008bbc0]
jmp 0x18000dc9d
mov ecx, edx
mov eax, edx
shr rax, 0x1e
and eax, 1
shr rcx, 0x1d
and ecx, 1
lea rcx, [rax + rcx*2]
mov eax, edx
shr rax, 0x1f
lea rcx, [rax + rcx*2]
lea rax, [0x1800a6748]
mov edi, dword [rax + rcx*4]
bt edx, 0x1a
jae 0x18000dbef
bts edi, 9
mov qword [rsp + 0x58], r10
mov qword [rsp + 0x60], r9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
movdqa xmm0, xmmword [0x1800a8670]
xor r14d, r14d
mov r13, rax
mov dword [rbp - 0x68], 0x54004e
mov rax, qword [0x180119cf0]
mov dword [rbp - 0x64], 0x4c0044
mov dword [rbp - 0x60], 0x2e004c
mov dword [rbp - 0x5c], 0x4c0044
mov dword [rbp - 0x58], Ordinal_79
mov dword [rbp - 0x28], 0x6f6d654d
mov word [rbp - 0x24], 0x7972
mov byte [rbp - 0x22], r14b
movdqu xmmword [rbp - 0x38], xmm0
test rax, rax
jne 0x18000dc70
lea rcx, [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180119cf0], rax
lea rcx, [rsp + 0x50]
mov r9d, edi
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x58]
mov rcx, r13
lea rdx, [rsp + 0x60]
call rax
test eax, eax
jne 0x18000d85d
mov edi, dword [rsp + 0x30]
mov r14, qword [rsp + 0x48]
mov r9, qword [rsp + 0x38]
mov r11, r15
mov edx, dword [rsi]
mov r8d, r12d
mov qword [rbp - 0x20], r9
jmp 0x18000dcd1
mov r10, qword [rsp + 0x38]
mov ecx, dword [rsi]
mov eax, ecx
and eax, edx
or edx, ecx
bt eax, 0x19
jb 0x18000dcc7
btr edx, 0x19
mov r8d, r12d
sub r8d, dword [rbp - 0x20]
add r8d, r10d
mov rax, qword [rbx]
inc edi
add rsi, 0x28
mov dword [rsp + 0x30], edi
movzx ecx, word [rax + 6]
cmp edi, ecx
jl 0x18000db20
mov r13d, 1
lea rsi, [0x1800a6748]
test r8d, r8d
je 0x18000dd1d
bt edx, 0x19
jae 0x18000dd9d
cmp r9, r11
jne 0x18000dd1d
mov edx, r8d
mov rcx, r9
mov r8d, 0x4000
call qword [0x18008bbc0]
xor r14d, r14d
mov rax, qword [rbx]
mov rsi, qword [rbx + 8]
mov ecx, dword [rax + 0xd0]
test ecx, ecx
je 0x18000dd5b
mov rdi, qword [rcx + rsi + 0x18]
test rdi, rdi
je 0x18000dd5b
mov rax, qword [rdi]
test rax, rax
je 0x18000dd5b
xor r8d, r8d
mov edx, r13d
mov rcx, rsi
call rax
mov rax, qword [rdi + 8]
lea rdi, [rdi + 8]
test rax, rax
jne 0x18000dd43
mov rax, qword [rbx]
mov ecx, dword [rax + 0x28]
test ecx, ecx
je 0x18000de88
cmp dword [rbx + 0x20], 0
mov eax, ecx
je 0x18000de7d
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
add rax, rcx
mov edx, r13d
call rax
test eax, eax
jne 0x18000de77
mov ecx, 0x45a
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x18000d85d
mov ecx, edx
mov eax, edx
shr rax, 0x1e
shr rcx, 0x1d
and eax, 1
and ecx, 1
lea rcx, [rax + rcx*2]
mov eax, edx
shr rax, 0x1f
lea rcx, [rax + rcx*2]
mov edi, dword [rsi + rcx*4]
bt edx, 0x1a
jae 0x18000ddca
bts edi, 9
mov eax, r8d
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], r9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
movdqa xmm0, xmmword [0x1800a8670]
xor r14d, r14d
mov rsi, rax
mov dword [rbp - 0x50], 0x54004e
mov rax, qword [0x180119cf0]
mov dword [rbp - 0x4c], 0x4c0044
mov dword [rbp - 0x48], 0x2e004c
mov dword [rbp - 0x44], 0x4c0044
mov dword [rbp - 0x40], Ordinal_79
mov dword [rbp - 0x10], 0x6f6d654d
mov word [rbp - 0xc], 0x7972
mov byte [rbp - 0xa], r14b
movdqu xmmword [rbp - 0x20], xmm0
test rax, rax
jne 0x18000de4e
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180119cf0], rax
lea rcx, [rsp + 0x30]
mov r9d, edi
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x48]
mov rcx, rsi
lea rdx, [rsp + 0x38]
call rax
test eax, eax
jne 0x18000d85d
jmp 0x18000dd20
mov dword [rbx + 0x1c], r13d
jmp 0x18000de8c
add rax, qword [rsp + 0x40]
mov qword [rbx + 0x48], rax
jmp 0x18000de8c
mov qword [rbx + 0x48], r14
mov r14, rbx
mov r13, qword [rsp + 0x150]
mov rdi, qword [rsp + 0x148]
mov r15, qword [rsp + 0x158]
mov rax, r14
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.18005c430
add rsp, 0x110
pop r14
pop r12
pop rsi
pop rbx
pop rbp
ret