Function at 0x180018de8
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
sub rsp, 0x210
mov rax, qword [0x1800a8120]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x40], rsp
xor r12d, r12d
mov byte [rsp + 0x48], r12b
xor eax, eax
mov word [rsp + 0x49], ax
mov byte [rsp + 0x4b], al
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
lea r8d, [r12 + 3]
mov dword [rsp + 0x20], r8d
xor r9d, r9d
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
mov qword [rsp + 0x58], rax
cmp rax, 0xffffffffffffffff
jne 0x180018e64
xor eax, eax
jmp 0x18001957e
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x60]
mov r8d, 4
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x180018ea1
lea rdx, [0x180018e9a]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
xor eax, eax
jmp 0x18001957e
mov ax, word [rsp + 0x48]
cmp ax, word [0x18008864c]
jne 0x180019569
mov word [rsp + 0x1a0], r12w
xor edx, edx
lea r8d, [rdx + 0x3e]
lea rcx, [rsp + 0x1a2]
call fcn.18005c800
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
or r13d, 0xffffffff
cmp eax, r13d
jne 0x180018f03
lea rdx, [0x180018efc]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
xor eax, eax
jmp 0x18001957e
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, 0x40
lea rdx, [rsp + 0x1a0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x180018f43
lea rdx, [0x180018f3c]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
xor eax, eax
jmp 0x18001957e
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x1dc]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, r13d
jne 0x180018f78
lea rdx, [0x180018f71]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
xor eax, eax
jmp 0x18001957e
mov dword [rsp + 0x70], r12d
xor edx, edx
mov r8d, 0xf4
lea rcx, [rsp + 0x74]
call fcn.18005c800
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, 0xf8
lea rdx, [rsp + 0x70]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x180018fcc
lea rdx, [0x180018fc5]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
xor eax, eax
jmp 0x18001957e
movzx eax, word [rsp + 0x76]
lea edx, [rax + rax*4]
lea edx, [rdx*8 - 0x28]
mov r9d, 1
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, r13d
jne 0x18001900c
lea rdx, [0x180019005]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
xor eax, eax
jmp 0x18001957e
mov byte [rsp + 0x170], r12b
xor eax, eax
mov dword [rsp + 0x171], eax
mov word [rsp + 0x175], ax
mov byte [rsp + 0x177], al
xor edx, edx
lea r8d, [rax + 0x20]
lea rcx, [rsp + 0x178]
call fcn.18005c800
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, Ordinal_41
lea rdx, [rsp + 0x170]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x18001907f
lea rdx, [0x180019078]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
xor eax, eax
jmp 0x18001957e
mov esi, dword [rsp + 0x180]
mov eax, dword [rsp + 0x184]
add esi, eax
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, r13d
jne 0x1800190bf
lea rdx, [0x1800190b8]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
xor eax, eax
jmp 0x18001957e
mov byte [rsp + 0x4c], r12b
xor eax, eax
mov word [rsp + 0x4d], ax
mov byte [rsp + 0x4f], al
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
lea r8d, [rax + 4]
lea rdx, [rsp + 0x4c]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x18001910a
lea rdx, [0x180019103]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
xor eax, eax
jmp 0x18001957e
mov eax, dword [rsp + 0x4c]
cmp eax, r12d
jne 0x180019286
mov byte [rsp + 0x1e0], 0xef
mov byte [rsp + 0x1e1], 0xbe
mov byte [rsp + 0x1e2], 0xad
mov byte [rsp + 0x1e3], 0xde
mov byte [rsp + 0x1e4], Ordinal_79
mov byte [rsp + 0x1e5], 0x75
mov byte [rsp + 0x1e6], WSAGetLastError
mov byte [rsp + 0x1e7], WSAGetLastError
mov byte [rsp + 0x1e8], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x1e9], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x1ea], 0x66
mov byte [rsp + 0x1eb], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x1ec], Ordinal_79
mov byte [rsp + 0x1ed], WSAGetLastError
mov byte [rsp + 0x1ee], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x1ef], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x1f0], r12b
xor eax, eax
mov qword [rsp + 0x1f1], rax
mov dword [rsp + 0x1f9], eax
mov word [rsp + 0x1fd], ax
mov byte [rsp + 0x1ff], al
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
lea r8d, [rax + 0x10]
lea rdx, [rsp + 0x1f0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x1800191fd
lea rdx, [0x1800191f6]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
xor eax, eax
jmp 0x18001957e
cmp dword [rsp + 0x50], 0x10
je 0x18001921e
lea rdx, [0x180019217]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
xor eax, eax
jmp 0x18001957e
lea rax, [rsp + 0x1e0]
lea rcx, [rsp + 0x1f0]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x180019245
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + 8]
jne 0x180019245
mov eax, r12d
jmp 0x18001924a
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r12d
jne 0x18001926c
lea rdx, [0x180019262]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
mov eax, ntohs
jmp 0x18001957e
lea rdx, [0x18001927f]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
xor eax, eax
jmp 0x18001957e
cmp eax, dword [0x180088650]
jne 0x1800192ab
lea rdx, [0x1800192a1]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
mov eax, 4
jmp 0x18001957e
movzx edx, word [rsp + 0x4c]
cmp dx, word [0x180088658]
jne 0x1800192d6
lea rdx, [0x1800192cc]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
mov eax, 8
jmp 0x18001957e
cmp dx, word [0x18008865c]
jne 0x1800192fc
lea rdx, [0x1800192f2]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
mov eax, 6
jmp 0x18001957e
cmp eax, dword [0x180088660]
jne 0x180019321
lea rdx, [0x180019317]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
mov eax, ntohs
jmp 0x18001957e
mov ax, dx
cmp dx, word [0x180088668]
jne 0x18001934a
lea rdx, [0x180019340]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
mov eax, ntohs
jmp 0x18001957e
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, r13d
jne 0x18001937a
lea rdx, [0x180019373]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
xor eax, eax
jmp 0x18001957e
mov dword [rsp + 0x54], r12d
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, 4
lea rdx, [rsp + 0x54]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x1800193bc
lea rdx, [0x1800193b5]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
xor eax, eax
jmp 0x18001957e
mov eax, dword [rsp + 0x54]
lea edx, [rax + rsi + 4]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, r13d
jne 0x1800193f2
lea rdx, [0x1800193eb]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
xor eax, eax
jmp 0x18001957e
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x64]
mov r8d, 4
lea rdx, [rsp + 0x4c]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r12d
jne 0x18001942f
lea rdx, [0x180019428]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
xor eax, eax
jmp 0x18001957e
lea rax, [rsp + 0x4c]
lea r8, [0x180000000]
mov dx, word [rax]
cmp dx, word [r8 + 0x8866c]
jne 0x180019459
mov dl, byte [rax + 2]
cmp dl, byte [r8 + 0x8866e]
jne 0x180019459
mov eax, r12d
jmp 0x18001945e
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r12d
jne 0x180019480
lea rdx, [0x180019476]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
mov eax, 2
jmp 0x18001957e
lea rax, [rsp + 0x48]
mov dx, word [rax]
cmp dx, word [r8 + 0x88670]
jne 0x1800194a3
mov dl, byte [rax + 2]
cmp dl, byte [r8 + 0x88672]
jne 0x1800194a3
mov eax, r12d
jmp 0x1800194a8
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r12d
jne 0x1800194ca
lea rdx, [0x1800194c0]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
mov eax, 1
jmp 0x18001957e
mov eax, dword [rsp + 0x48]
cmp eax, dword [str.Rar_]
jne 0x1800194f3
lea rdx, [0x1800194e9]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
mov eax, 4
jmp 0x18001957e
mov ax, word [rsp + 0x48]
cmp ax, word [0x18008867c]
jne 0x18001951b
lea rdx, [0x180019514]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
mov eax, 8
jmp 0x18001957e
mov ax, word [rsp + 0x48]
cmp ax, word [0x180088680]
jne 0x180019543
lea rdx, [0x18001953c]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
mov eax, 6
jmp 0x18001957e
mov eax, dword [rsp + 0x48]
cmp eax, dword [str.MSCF]
jne 0x180019569
lea rdx, [0x180019562]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
mov eax, 9
jmp 0x18001957e
lea rdx, [0x18001957c]
mov rcx, qword [rsp + 0x40]
call fcn.18005f190
nop
nop
xor eax, eax
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.18005cb30
lea r11, [rsp + 0x210]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop r13
ret