Function at 0x180013e30
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
sub rsp, 0x210
mov rax, qword [0x180056150]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x40], rsp
xor r12d, r12d
mov byte [rsp + 0x48], r12b
xor eax, eax
mov word [rsp + 0x49], ax
mov byte [rsp + 0x4b], al
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
lea r8d, [r12 + 3]
mov dword [rsp + 0x20], r8d
xor r9d, r9d
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
mov qword [rsp + 0x58], rax
cmp rax, 0xffffffffffffffff
jne 0x180013eac
xor eax, eax
jmp 0x1800145c6
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x60]
mov r8d, 4
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x180013ee9
lea rdx, [0x180013ee2]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
xor eax, eax
jmp 0x1800145c6
mov ax, word [rsp + 0x48]
cmp ax, word [0x18004304c]
jne 0x1800145b1
mov word [rsp + 0x1a0], r12w
xor edx, edx
lea r8d, [rdx + 0x3e]
lea rcx, [rsp + 0x1a2]
call fcn.180022ca0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
or r13d, 0xffffffff
cmp eax, r13d
jne 0x180013f4b
lea rdx, [0x180013f44]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
xor eax, eax
jmp 0x1800145c6
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, 0x40
lea rdx, [rsp + 0x1a0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x180013f8b
lea rdx, [0x180013f84]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
xor eax, eax
jmp 0x1800145c6
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x1dc]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, r13d
jne 0x180013fc0
lea rdx, [0x180013fb9]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
xor eax, eax
jmp 0x1800145c6
mov dword [rsp + 0x70], r12d
xor edx, edx
mov r8d, 0xf4
lea rcx, [rsp + 0x74]
call fcn.180022ca0
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, 0xf8
lea rdx, [rsp + 0x70]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x180014014
lea rdx, [0x18001400d]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
xor eax, eax
jmp 0x1800145c6
movzx eax, word [rsp + 0x76]
lea edx, [rax + rax*4]
lea edx, [rdx*8 - 0x28]
mov r9d, 1
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, r13d
jne 0x180014054
lea rdx, [0x18001404d]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
xor eax, eax
jmp 0x1800145c6
mov byte [rsp + 0x170], r12b
xor eax, eax
mov dword [rsp + 0x171], eax
mov word [rsp + 0x175], ax
mov byte [rsp + 0x177], al
xor edx, edx
lea r8d, [rax + 0x20]
lea rcx, [rsp + 0x178]
call fcn.180022ca0
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, 0x28
lea rdx, [rsp + 0x170]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x1800140c7
lea rdx, [0x1800140c0]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
xor eax, eax
jmp 0x1800145c6
mov esi, dword [rsp + 0x180]
mov eax, dword [rsp + 0x184]
add esi, eax
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, r13d
jne 0x180014107
lea rdx, [0x180014100]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
xor eax, eax
jmp 0x1800145c6
mov byte [rsp + 0x4c], r12b
xor eax, eax
mov word [rsp + 0x4d], ax
mov byte [rsp + 0x4f], al
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
lea r8d, [rax + 4]
lea rdx, [rsp + 0x4c]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x180014152
lea rdx, [0x18001414b]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
xor eax, eax
jmp 0x1800145c6
mov eax, dword [rsp + 0x4c]
cmp eax, r12d
jne 0x1800142ce
mov byte [rsp + 0x1e0], 0xef
mov byte [rsp + 0x1e1], 0xbe
mov byte [rsp + 0x1e2], 0xad
mov byte [rsp + 0x1e3], 0xde
mov byte [rsp + 0x1e4], 0x4e
mov byte [rsp + 0x1e5], 0x75
mov byte [rsp + 0x1e6], 0x6c
mov byte [rsp + 0x1e7], 0x6c
mov byte [rsp + 0x1e8], 0x73
mov byte [rsp + 0x1e9], 0x6f
mov byte [rsp + 0x1ea], 0x66
mov byte [rsp + 0x1eb], 0x74
mov byte [rsp + 0x1ec], 0x49
mov byte [rsp + 0x1ed], 0x6e
mov byte [rsp + 0x1ee], 0x73
mov byte [rsp + 0x1ef], 0x74
mov byte [rsp + 0x1f0], r12b
xor eax, eax
mov qword [rsp + 0x1f1], rax
mov dword [rsp + 0x1f9], eax
mov word [rsp + 0x1fd], ax
mov byte [rsp + 0x1ff], al
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
lea r8d, [rax + 0x10]
lea rdx, [rsp + 0x1f0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x180014245
lea rdx, [0x18001423e]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
xor eax, eax
jmp 0x1800145c6
cmp dword [rsp + 0x50], 0x10
je 0x180014266
lea rdx, [0x18001425f]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
xor eax, eax
jmp 0x1800145c6
lea rax, [rsp + 0x1e0]
lea rcx, [rsp + 0x1f0]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x18001428d
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + 8]
jne 0x18001428d
mov eax, r12d
jmp 0x180014292
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r12d
jne 0x1800142b4
lea rdx, [0x1800142aa]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
mov eax, 0xc
jmp 0x1800145c6
lea rdx, [0x1800142c7]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
xor eax, eax
jmp 0x1800145c6
cmp eax, dword [0x180043050]
jne 0x1800142f3
lea rdx, [0x1800142e9]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
mov eax, 4
jmp 0x1800145c6
movzx edx, word [rsp + 0x4c]
cmp dx, word [0x180043058]
jne 0x18001431e
lea rdx, [0x180014314]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
mov eax, 8
jmp 0x1800145c6
cmp dx, word [0x18004305c]
jne 0x180014344
lea rdx, [0x18001433a]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
mov eax, 6
jmp 0x1800145c6
cmp eax, dword [0x180043060]
jne 0x180014369
lea rdx, [0x18001435f]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
mov eax, 0xc
jmp 0x1800145c6
mov ax, dx
cmp dx, word [0x180043068]
jne 0x180014392
lea rdx, [0x180014388]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
mov eax, 0xe
jmp 0x1800145c6
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, r13d
jne 0x1800143c2
lea rdx, [0x1800143bb]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
xor eax, eax
jmp 0x1800145c6
mov dword [rsp + 0x54], r12d
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, 4
lea rdx, [rsp + 0x54]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x180014404
lea rdx, [0x1800143fd]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
xor eax, eax
jmp 0x1800145c6
mov eax, dword [rsp + 0x54]
lea edx, [rax + rsi + 4]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, r13d
jne 0x18001443a
lea rdx, [0x180014433]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
xor eax, eax
jmp 0x1800145c6
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x64]
mov r8d, 4
lea rdx, [rsp + 0x4c]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x180014477
lea rdx, [0x180014470]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
xor eax, eax
jmp 0x1800145c6
lea rax, [rsp + 0x4c]
lea r8, [0x180000000]
mov dx, word [rax]
cmp dx, word [r8 + 0x4306c]
jne 0x1800144a1
mov dl, byte [rax + 2]
cmp dl, byte [r8 + 0x4306e]
jne 0x1800144a1
mov eax, r12d
jmp 0x1800144a6
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r12d
jne 0x1800144c8
lea rdx, [0x1800144be]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
mov eax, 2
jmp 0x1800145c6
lea rax, [rsp + 0x48]
mov dx, word [rax]
cmp dx, word [r8 + 0x43070]
jne 0x1800144eb
mov dl, byte [rax + 2]
cmp dl, byte [r8 + 0x43072]
jne 0x1800144eb
mov eax, r12d
jmp 0x1800144f0
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r12d
jne 0x180014512
lea rdx, [0x180014508]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
mov eax, 1
jmp 0x1800145c6
mov eax, dword [rsp + 0x48]
cmp eax, dword [str.Rar_]
jne 0x18001453b
lea rdx, [0x180014531]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
mov eax, 4
jmp 0x1800145c6
mov ax, word [rsp + 0x48]
cmp ax, word [0x18004307c]
jne 0x180014563
lea rdx, [0x18001455c]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
mov eax, 8
jmp 0x1800145c6
mov ax, word [rsp + 0x48]
cmp ax, word [0x180043080]
jne 0x18001458b
lea rdx, [0x180014584]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
mov eax, 6
jmp 0x1800145c6
mov eax, dword [rsp + 0x48]
cmp eax, dword [str.MSCF]
jne 0x1800145b1
lea rdx, [0x1800145aa]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
mov eax, 9
jmp 0x1800145c6
lea rdx, [0x1800145c4]
mov rcx, qword [rsp + 0x40]
call fcn.180025410
nop
nop
xor eax, eax
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.180022fd0
lea r11, [rsp + 0x210]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop r13
ret