Function at 0x1800021c0
Capabilities:
Authenticate hmac
Check for software breakpoints
Contain obfuscated stackstrings
Encode data using base64
Encode data using xor
Get file size
Read file on windows
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x198
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x110], 0xfffffffffffffffe
mov rsi, rcx
mov qword [rbp + 0x10], 0
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov byte [rbp + 0x40], 0
lea rdi, [rbp + 0x41]
mov byte [rbp + 0x41], 0x4b
mov byte [rbp + 0x42], 0x4b
mov byte [rbp + 0x43], 0x6d
mov byte [rbp + 0x44], 0x24
mov byte [rbp + 0x45], 0x55
mov byte [rbp + 0x46], 0x55
mov byte [rbp + 0x47], 0x4b
mov byte [rbp + 0x48], 0x4f
mov byte [rbp + 0x49], 0x24
mov byte [rbp + 0x4a], 0x69
mov byte [rbp + 0x4b], 0x3b
mov byte [rbp + 0x4c], 0x53
mov byte [rbp + 0x4d], 0x17
mov byte [rbp + 0x4e], 0x36
mov byte [rbp + 0x4f], 0x66
mov byte [rbp + 0x50], 0x2f
mov byte [rbp + 0x51], 0x1b
mov byte [rbp + 0x52], 0x32
mov byte [rbp + 0x53], 0x35
mov byte [rbp + 0x54], 0x17
mov byte [rbp + 0x55], 0x4b
mov byte [rbp + 0x56], 0x1b
mov byte [rbp + 0x57], 0x66
mov byte [rbp + 0x58], 0x3b
mov byte [rbp + 0x59], 0x36
mov byte [rbp + 0x5a], 0x35
mov byte [rbp + 0x5b], 0x4f
mov byte [rbp + 0x5c], 0x55
mov byte [rbp + 0x5d], 0x52
mov byte [rbp + 0x5e], 0x32
mov byte [rbp + 0x5f], 0x52
mov byte [rbp + 0x60], 0x35
mov byte [rbp + 0x61], 0x4f
mov byte [rbp + 0x62], 0x53
mov byte [rbp + 0x63], 0x17
mov byte [rbp + 0x64], 0xa
mov byte [rbp + 0x65], 0x52
mov byte [rbp + 0x66], 0x32
mov byte [rbp + 0x67], 0x4f
mov byte [rbp + 0x68], 0x3b
mov byte [rbp + 0x69], 0x4c
mov byte [rbp + 0x6a], 0x4c
mov byte [rbp + 0x6b], 0xb
mov byte [rbp + 0x6c], 0x3f
mov byte [rbp + 0x6d], 0x17
mov byte [rbp + 0x6e], 0x4b
mov byte [rbp + 0x6f], 0x42
mov byte [rbp + 0x70], 0x39
mov byte [rbp + 0x71], 0xc
mov byte [rbp + 0x72], 0x4b
mov byte [rbp + 0x73], 0x4b
mov byte [rbp + 0x74], 0x4b
mov byte [rbp + 0x75], 0x4b
mov byte [rbp + 0x76], 0x4b
mov byte [rbp + 0x77], 0x4b
mov byte [rbp + 0x78], 0x6d
mov byte [rbp + 0x79], 0x24
mov byte [rbp + 0x7a], 0x55
mov byte [rbp + 0x7b], 0x55
mov byte [rbp + 0x7c], 0x4b
mov byte [rbp + 0x7d], 0x4f
mov byte [rbp + 0x7e], 0x24
mov byte [rbp + 0x7f], 0x69
mov byte [rbp + 0x80], 0x3b
mov byte [rbp + 0x81], 0x53
mov byte [rbp + 0x82], 0x17
mov byte [rbp + 0x83], 0x36
mov byte [rbp + 0x84], 0x66
mov byte [rbp + 0x85], 0x2f
mov byte [rbp + 0x86], 0x1b
mov byte [rbp + 0x87], 0x32
mov byte [rbp + 0x88], 0x17
mov byte [rbp + 0x89], 0x4b
mov byte [rbp + 0x8a], 0x1b
mov byte [rbp + 0x8b], 0x66
mov byte [rbp + 0x8c], 0x3b
mov byte [rbp + 0x8d], 0x36
mov byte [rbp + 0x8e], 0x35
mov byte [rbp + 0x8f], 0x4f
mov byte [rbp + 0x90], 0x55
mov byte [rbp + 0x91], 0x52
mov byte [rbp + 0x92], 0x32
mov byte [rbp + 0x93], 0x52
mov byte [rbp + 0x94], 0x35
mov byte [rbp + 0x95], 0x4f
mov byte [rbp + 0x96], 0x53
mov byte [rbp + 0x97], 0x17
mov byte [rbp + 0x98], 0xa
mov byte [rbp + 0x99], 0x52
mov byte [rbp + 0x9a], 0x32
mov byte [rbp + 0x9b], 0x4f
mov byte [rbp + 0x9c], 0x3b
mov byte [rbp + 0x9d], 0x4c
mov byte [rbp + 0x9e], 0x4c
mov byte [rbp + 0x9f], 0x59
mov byte [rbp + 0xa0], 0x73
mov byte [rbp + 0xa1], 0x17
mov byte [rbp + 0xa2], 0x4b
mov byte [rbp + 0xa3], 0x42
mov byte [rbp + 0xa4], 0x39
mov byte [rbp + 0xa5], 0xc
mov byte [rbp + 0xa6], 0x26
mov byte [rbp + 0xa7], 0x12
movzx eax, byte [rbp + 0x40]
not al
or al, 0xfe
cmp al, 0xff
je 0x1800024c9
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov rcx, rdi
call fcn.180008560
mov rbx, rax
cmp rax, 0xf
jbe 0x1800024ac
test rbx, rbx
js 0x1800034ca
mov rax, rbx
or rax, 0xf
cmp rax, 0x17
mov r15d, 0x16
cmovae r15, rax
cmp r15, 0xfff
jb 0x1800025ae
lea rcx, [r15 + 0x28]
call fcn.1800050e4
mov rcx, rax
add rcx, 0x27
mov r14, rcx
xor r14, 0x1f
and r14, rcx
mov qword [r14 - 8], rax
jmp 0x1800025ba
mov qword [rbp - 0x20], rbx
lea rcx, [rbp - 0x30]
mov rdx, rdi
mov r8, rbx
call fcn.180006b90
mov byte [rbp + rbx - 0x30], 0
jmp 0x1800025d9
xor eax, eax
nop dword [rax + rax]
movzx ecx, byte [rbp + rax + 0x41]
movzx ecx, cl
imul ecx, ecx, 0xffffffd4
mov edx, ecx
add edx, 0x318
movsx edx, dx
imul edx, edx, 0xffff8103
shr edx, 0x10
add edx, ecx
add edx, 0x318
movzx edx, dx
movsx r8d, dx
shr edx, 0xf
sar r8d, 6
add r8d, edx
mov edx, r8d
shl edx, 7
sub r8d, edx
add ecx, r8d
add ecx, 0x318
lea edx, [rcx + 0x7f]
cmp cx, 0xff81
movzx edx, dl
cmovb edx, ecx
mov byte [rbp + rax + 0x41], dl
mov rcx, rax
or rcx, 1
cmp rcx, 0x67
je 0x180002431
movzx edx, byte [rbp + rcx + 0x41]
movzx edx, dl
imul edx, edx, 0xffffffd4
mov r8d, edx
add r8d, 0x318
movsx r8d, r8w
imul r8d, r8d, 0xffff8103
shr r8d, 0x10
add r8d, edx
add r8d, 0x318
movzx r8d, r8w
movsx r9d, r8w
shr r8d, 0xf
sar r9d, 6
add r9d, r8d
mov r8d, r9d
shl r8d, 7
sub r9d, r8d
add edx, r9d
add edx, 0x318
lea r8d, [rdx + 0x7f]
cmp dx, 0xff81
movzx r8d, r8b
cmovb r8d, edx
mov byte [rbp + rcx + 0x41], r8b
add rax, 2
jmp 0x1800024d0
lea rcx, [r15 + 1]
call fcn.1800050e4
mov r14, rax
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], r15
mov rcx, r14
mov rdx, rdi
mov r8, rbx
call fcn.180006b90
mov byte [r14 + rbx], 0
mov qword [rbp - 0x30], r14
mov byte [rbp + 0x40], 0
lea rdi, [rbp + 0x41]
mov byte [rbp + 0x41], 0x1a
mov byte [rbp + 0x42], 0x1a
mov byte [rbp + 0x43], 0x4b
mov byte [rbp + 0x44], 0x6c
mov byte [rbp + 0x45], 0x12
mov byte [rbp + 0x46], 0x12
mov byte [rbp + 0x47], 0x1a
mov byte [rbp + 0x48], 0x63
mov byte [rbp + 0x49], 0x6c
mov byte [rbp + 0x4a], 2
mov byte [rbp + 0x4b], 0x73
mov byte [rbp + 0x4c], 0x2d
mov byte [rbp + 0x4d], 0x5d
mov byte [rbp + 0x4e], 0x77
mov byte [rbp + 0x4f], 0x6a
mov byte [rbp + 0x50], 0x17
mov byte [rbp + 0x51], 0x27
mov byte [rbp + 0x52], 0x2e
mov byte [rbp + 0x53], 0x45
mov byte [rbp + 0x54], 0x5d
mov byte [rbp + 0x55], 0x1a
mov byte [rbp + 0x56], 0x7a
mov byte [rbp + 0x57], 2
mov byte [rbp + 0x58], 0x6c
mov byte [rbp + 0x59], 0x37
mov byte [rbp + 0x5a], 0x73
mov byte [rbp + 0x5b], 0x2d
mov byte [rbp + 0x5c], 0x5d
mov byte [rbp + 0x5d], 0x77
mov byte [rbp + 0x5e], 8
mov byte [rbp + 0x5f], 4
mov byte [rbp + 0x60], 0x6e
mov byte [rbp + 0x61], 0x6a
mov byte [rbp + 0x62], 0x45
mov byte [rbp + 0x63], 0x37
mov byte [rbp + 0x64], 0x6a
mov byte [rbp + 0x65], 0x6c
mov byte [rbp + 0x66], 2
mov byte [rbp + 0x67], 0x59
mov byte [rbp + 0x68], 0x6c
mov byte [rbp + 0x69], 0x2e
mov byte [rbp + 0x6a], 0x6c
mov byte [rbp + 0x6b], 4
mov byte [rbp + 0x6c], 0x49
mov byte [rbp + 0x6d], 0x7a
mov byte [rbp + 0x6e], 0x30
mov byte [rbp + 0x6f], 0x6a
mov byte [rbp + 0x70], 0x45
mov byte [rbp + 0x71], 0x4c
mov byte [rbp + 0x72], 0x45
mov byte [rbp + 0x73], 0x55
mov byte [rbp + 0x74], 0x2e
mov byte [rbp + 0x75], 4
mov byte [rbp + 0x76], 0x77
mov byte [rbp + 0x77], 0x6a
mov byte [rbp + 0x78], 0x17
mov byte [rbp + 0x79], 0x27
mov byte [rbp + 0x7a], 0x2e
mov byte [rbp + 0x7b], 0x45
mov byte [rbp + 0x7c], 4
mov byte [rbp + 0x7d], 0x30
mov byte [rbp + 0x7e], 0x6a
mov byte [rbp + 0x7f], 0x17
mov byte [rbp + 0x80], 0x27
mov byte [rbp + 0x81], 0x2e
mov byte [rbp + 0x82], 0x45
mov byte [rbp + 0x83], 0x72
mov byte [rbp + 0x84], 0x12
mov byte [rbp + 0x85], 0x20
mov byte [rbp + 0x86], 0x20
mov byte [rbp + 0x87], 0x5d
mov byte [rbp + 0x88], 0x1a
mov byte [rbp + 0x89], 0x27
mov byte [rbp + 0x8a], 0x6a
mov byte [rbp + 0x8b], 0x73
mov byte [rbp + 0x8c], 0x77
mov byte [rbp + 0x8d], 0x45
mov byte [rbp + 0x8e], 0x63
mov byte [rbp + 0x8f], 0x12
mov byte [rbp + 0x90], 0x7a
mov byte [rbp + 0x91], 0x2e
mov byte [rbp + 0x92], 0x7a
mov byte [rbp + 0x93], 0x45
mov byte [rbp + 0x94], 0x63
mov byte [rbp + 0x95], 0x2d
mov byte [rbp + 0x96], 0x5d
mov byte [rbp + 0x97], 0x4e
mov byte [rbp + 0x98], 0x7a
mov byte [rbp + 0x99], 0x2e
mov byte [rbp + 0x9a], 0x63
mov byte [rbp + 0x9b], 0x73
mov byte [rbp + 0x9c], 0x4c
mov byte [rbp + 0x9d], 0x4c
mov byte [rbp + 0x9e], 1
mov byte [rbp + 0x9f], 0x3d
mov byte [rbp + 0xa0], 0x5d
mov byte [rbp + 0xa1], 0x1a
mov byte [rbp + 0xa2], 0x54
mov byte [rbp + 0xa3], 0xf
mov byte [rbp + 0xa4], 0x33
mov byte [rbp + 0xa5], 0x1a
mov byte [rbp + 0xa6], 0x1a
mov byte [rbp + 0xa7], 0x1a
mov byte [rbp + 0xa8], 0x1a
mov byte [rbp + 0xa9], 0x1a
mov byte [rbp + 0xaa], 0x1a
mov byte [rbp + 0xab], 0x4b
mov byte [rbp + 0xac], 0x6c
mov byte [rbp + 0xad], 0x12
mov byte [rbp + 0xae], 0x12
mov byte [rbp + 0xaf], 0x1a
mov byte [rbp + 0xb0], 0x63
mov byte [rbp + 0xb1], 0x6c
mov byte [rbp + 0xb2], 2
mov byte [rbp + 0xb3], 0x73
mov byte [rbp + 0xb4], 0x2d
mov byte [rbp + 0xb5], 0x5d
mov byte [rbp + 0xb6], 0x77
mov byte [rbp + 0xb7], 0x6a
mov byte [rbp + 0xb8], 0x17
mov byte [rbp + 0xb9], 0x27
mov byte [rbp + 0xba], 0x2e
mov byte [rbp + 0xbb], 0x5d
mov byte [rbp + 0xbc], 0x1a
mov byte [rbp + 0xbd], 0x7a
mov byte [rbp + 0xbe], 2
mov byte [rbp + 0xbf], 0x6c
mov byte [rbp + 0xc0], 0x37
mov byte [rbp + 0xc1], 0x73
mov byte [rbp + 0xc2], 0x2d
mov byte [rbp + 0xc3], 0x5d
mov byte [rbp + 0xc4], 0x77
mov byte [rbp + 0xc5], 8
mov byte [rbp + 0xc6], 4
mov byte [rbp + 0xc7], 0x6e
mov byte [rbp + 0xc8], 0x6a
mov byte [rbp + 0xc9], 0x45
mov byte [rbp + 0xca], 0x37
mov byte [rbp + 0xcb], 0x6a
mov byte [rbp + 0xcc], 0x6c
mov byte [rbp + 0xcd], 2
mov byte [rbp + 0xce], 0x59
mov byte [rbp + 0xcf], 0x6c
mov byte [rbp + 0xd0], 0x2e
mov byte [rbp + 0xd1], 0x6c
mov byte [rbp + 0xd2], 4
mov byte [rbp + 0xd3], 0x49
mov byte [rbp + 0xd4], 0x7a
mov byte [rbp + 0xd5], 0x30
mov byte [rbp + 0xd6], 0x6a
mov byte [rbp + 0xd7], 0x45
mov byte [rbp + 0xd8], 0x4c
mov byte [rbp + 0xd9], 0x45
mov byte [rbp + 0xda], 0x55
mov byte [rbp + 0xdb], 0x2e
mov byte [rbp + 0xdc], 4
mov byte [rbp + 0xdd], 0x77
mov byte [rbp + 0xde], 0x6a
mov byte [rbp + 0xdf], 0x17
mov byte [rbp + 0xe0], 0x27
mov byte [rbp + 0xe1], 0x2e
mov byte [rbp + 0xe2], 0x45
mov byte [rbp + 0xe3], 4
mov byte [rbp + 0xe4], 0x30
mov byte [rbp + 0xe5], 0x6a
mov byte [rbp + 0xe6], 0x17
mov byte [rbp + 0xe7], 0x27
mov byte [rbp + 0xe8], 0x2e
mov byte [rbp + 0xe9], 0x72
mov byte [rbp + 0xea], 0x12
mov byte [rbp + 0xeb], 0x20
mov byte [rbp + 0xec], 0x20
mov byte [rbp + 0xed], 0x5d
mov byte [rbp + 0xee], 0x1a
mov byte [rbp + 0xef], 0x27
mov byte [rbp + 0xf0], 0x6a
mov byte [rbp + 0xf1], 0x73
mov byte [rbp + 0xf2], 0x77
mov byte [rbp + 0xf3], 0x45
mov byte [rbp + 0xf4], 0x63
mov byte [rbp + 0xf5], 0x12
mov byte [rbp + 0xf6], 0x7a
mov byte [rbp + 0xf7], 0x2e
mov byte [rbp + 0xf8], 0x7a
mov byte [rbp + 0xf9], 0x45
mov byte [rbp + 0xfa], 0x63
mov byte [rbp + 0xfb], 0x2d
mov byte [rbp + 0xfc], 0x5d
mov byte [rbp + 0xfd], 0x4e
mov byte [rbp + 0xfe], 0x7a
mov byte [rbp + 0xff], 0x2e
mov byte [rbp + 0x100], 0x63
mov byte [rbp + 0x101], 0x73
mov byte [rbp + 0x102], 0x4c
mov byte [rbp + 0x103], 0x4c
mov byte [rbp + 0x104], 0x5b
mov byte [rbp + 0x105], 0x79
mov byte [rbp + 0x106], 0x5d
mov byte [rbp + 0x107], 0x1a
mov byte [rbp + 0x108], 0x54
mov byte [rbp + 0x109], 0xf
mov byte [rbp + 0x10a], 0x33
mov byte [rbp + 0x10b], 0x51
mov byte [rbp + 0x10c], 0x61
movzx eax, byte [rbp + 0x40]
mov ecx, eax
xor cl, 0xfe
test cl, al
jne 0x180002bf6
mov rax, 0xffffffffffffffff
xor ecx, ecx
movabs rdx, 0x8b731539f3861816
movabs r8, 0x748ceac60c79e7e9
movabs r9, 0x8b731539f3861817
movzx r10d, byte [rbp + rcx + 0x41]
movzx r10d, r10b
imul r10d, r10d, 0x37
mov r11d, r10d
add r11d, 0xffffeb29
movsx r11d, r11w
imul r11d, r11d, 0xffff8103
shr r11d, 0x10
add r11d, r10d
add r11d, 0xffffeb29
movzx r11d, r11w
movsx ebx, r11w
shr r11d, 0xf
sar ebx, 6
add ebx, r11d
mov r11d, ebx
shl r11d, 7
sub ebx, r11d
add r10d, ebx
add r10d, 0xffffeb29
lea r11d, [r10 + 0x7f]
cmp r10w, 0xff81
movzx r11d, r11b
cmovb r11d, r10d
mov byte [rbp + rcx + 0x41], r11b
mov r10d, eax
not r10d
mov r11, rax
and r11, rdx
mov rbx, rcx
and rbx, r8
or rbx, r11
xor rbx, r9
and r10d, 1
or r10, rbx
movzx r11d, byte [rbp + r10 + 0x41]
movzx r11d, r11b
imul r11d, r11d, 0x37
mov ebx, r11d
add ebx, 0xffffeb29
movsx ebx, bx
imul ebx, ebx, 0xffff8103
shr ebx, 0x10
add ebx, r11d
add ebx, 0xffffeb29
movzx ebx, bx
movsx r14d, bx
shr ebx, 0xf
sar r14d, 6
add r14d, ebx
mov ebx, r14d
shl ebx, 7
sub r14d, ebx
add r11d, r14d
add r11d, 0xffffeb29
lea ebx, [r11 + 0x7f]
cmp r11w, 0xff81
movzx ebx, bl
cmovb ebx, r11d
mov byte [rbp + r10 + 0x41], bl
add rcx, 2
add rax, 0xfffffffffffffffe
cmp rcx, 0xcc
jne 0x180002af0
mov qword [rbp - 0x10], 0
mov qword [rbp], 0
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
mov rcx, rdi
call fcn.180008560
mov rbx, rax
cmp rax, 0xf
jbe 0x180002c95
test rbx, rbx
js 0x1800034cf
mov rax, rbx
not rax
movabs rcx, 0xc9db1a3e8c26e658
and rcx, rax
movabs rax, 0x3624e5c173d919a7
and rax, rbx
or rax, rcx
movabs rcx, 0xc9db1a3e8c26e657
xor rcx, rax
mov eax, ebx
and eax, 0xf
or rax, rcx
cmp rax, 0x17
mov r15d, 0x16
cmovae r15, rax
cmp r15, 0xfff
jb 0x180002caf
lea rcx, [r15 + 0x28]
call fcn.1800050e4
mov r14, rax
add r14, 0x27
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x180002cbb
mov qword [rbp], rbx
lea rcx, [rbp - 0x10]
mov rdx, rdi
mov r8, rbx
call fcn.180006b90
mov byte [rbp + rbx - 0x10], 0
jmp 0x180002cda
lea rcx, [r15 + 1]
call fcn.1800050e4
mov r14, rax
mov qword [rbp], rbx
mov qword [rbp + 8], r15
mov rcx, r14
mov rdx, rdi
mov r8, rbx
call fcn.180006b90
mov byte [r14 + rbx], 0
mov qword [rbp - 0x10], r14
mov dword [rbp - 0x3c], 0
cmp qword [rsi + 0x18], 0x10
jb 0x180002ceb
mov rsi, qword [rsi]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov edx, 0xc0000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x180002fc9
mov rsi, rax
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
je 0x180002fc9
mov ebx, eax
lea ecx, [rbx + 1]
call fcn.180008540
test rax, rax
je 0x180002de5
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0x3c]
mov rcx, rsi
mov qword [rbp - 0x38], rax
mov rdx, rax
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180002fb7
mov eax, ebx
mov rdi, qword [rbp - 0x38]
mov byte [rdi + rax], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], 0xf
mov byte [rbp + 0x40], 0
mov rcx, rdi
call fcn.180008560
mov rbx, rax
cmp rax, 0xf
jbe 0x180002df3
test rbx, rbx
js 0x1800034d4
mov rax, rbx
or rax, 0xf
cmp rax, 0x17
mov edi, 0x16
cmovae rdi, rax
cmp rdi, 0xfff
jb 0x180002e0d
lea rcx, [rdi + 0x28]
call fcn.1800050e4
mov r14, rax
add r14, 0x27
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x180002e19
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180002fc9
mov qword [rbp + 0x50], rbx
lea rcx, [rbp + 0x40]
mov rdx, rdi
mov r8, rbx
call fcn.180006b90
mov byte [rbp + rbx + 0x40], 0
jmp 0x180002e39
lea rcx, [rdi + 1]
call fcn.1800050e4
mov r14, rax
mov qword [rbp + 0x50], rbx
mov qword [rbp + 0x58], rdi
mov rcx, r14
mov rdx, qword [rbp - 0x38]
mov r8, rbx
call fcn.180006b90
mov byte [r14 + rbx], 0
mov qword [rbp + 0x40], r14
mov rax, qword [rbp + 0x28]
cmp rax, 0x10
jb 0x180002e78
mov rcx, qword [rbp + 0x10]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180002e73
mov r8, qword [rcx - 8]
sub rcx, r8
add rcx, 0xfffffffffffffff8
cmp rcx, 0x20
jae 0x1800034c5
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005128
movups xmm0, xmmword [rbp + 0x40]
movups xmm1, xmmword [rbp + 0x50]
movaps xmmword [rbp + 0x20], xmm1
movaps xmmword [rbp + 0x10], xmm0
cmp qword [rbp + 8], 0x10
jb 0x180002e95
mov rbx, qword [rbp - 0x10]
jmp 0x180002e99
lea rbx, [rbp - 0x10]
mov r14, qword [rbp]
mov rax, qword [rbp + 0x20]
cmp qword [rbp + 0x28], 0x10
jb 0x180002eb3
mov r15, qword [rbp + 0x10]
sub rax, r14
jae 0x180002ebc
jmp 0x180002f2d
lea r15, [rbp + 0x10]
sub rax, r14
jb 0x180002f2d
test r14, r14
je 0x180002fb7
lea rdi, [rax + r15]
inc rdi
movsx r12d, byte [rbx]
mov r8, rdi
sub r8, r15
mov rcx, r15
mov edx, r12d
call fcn.180006a10
test rax, rax
je 0x180002f2d
mov r13, rax
nop dword [rax]
mov rcx, r13
mov rdx, rbx
mov r8, r14
call fcn.180006a90
test eax, eax
je 0x180002f20
inc r13
mov r8, rdi
sub r8, r13
mov rcx, r13
mov edx, r12d
call fcn.180006a10
mov r13, rax
test rax, rax
jne 0x180002ef0
jmp 0x180002f2d
sub r13, r15
cmp r13, 0xffffffffffffffff
jne 0x180002fb7
mov byte [rbp + 0x40], 0
mov byte [rbp + 0x41], 0x22
mov byte [rbp + 0x42], 0x17
mov byte [rbp + 0x43], 2
mov byte [rbp + 0x44], 0x10
mov byte [rbp + 0x45], 0x7e
mov byte [rbp + 0x46], 0x73
mov byte [rbp + 0x47], 0x24
mov byte [rbp + 0x48], 0x10
mov byte [rbp + 0x49], 0x6b
mov byte [rbp + 0x4a], 0x7e
mov byte [rbp + 0x4b], 0x13
mov byte [rbp + 0x4c], 0x5c
mov byte [rbp + 0x4d], 0x10
mov byte [rbp + 0x4e], 0x62
mov byte [rbp + 0x4f], 0x3d
mov byte [rbp + 0x50], 0x41
mov byte [rbp + 0x51], pe_nt_image_headers64
movzx eax, byte [rbp + 0x40]
mov ecx, eax
xor cl, 0xfe
test cl, al
je 0x180003107
lea rcx, [rbp + 0x41]
call fcn.180008560
mov r13, rax
mov rax, qword [rbp + 0x20]
mov r15, qword [rbp + 0x28]
cmp r15, 0x10
jb 0x180002fa6
mov rdi, qword [rbp + 0x10]
jmp 0x180002faa
lea rdi, [rbp + 0x10]
mov qword [rbp + 0x38], rax
sub rax, r13
jae 0x18000309b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x38]
call fcn.18000852c
mov rax, qword [rbp + 8]
cmp rax, 0x10
jb 0x180003008
mov rcx, qword [rbp - 0x10]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180003003
mov r8, qword [rcx - 8]
sub rcx, r8
add rcx, 0xfffffffffffffff8
cmp rcx, 0x20
jae 0x1800034c5
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005128
mov rax, qword [rbp - 0x18]
cmp rax, 0x10
jb 0x180003047
mov rcx, qword [rbp - 0x30]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180003042
mov r8, qword [rcx - 8]
sub rcx, r8
add rcx, 0xfffffffffffffff8
cmp rcx, 0x20
jae 0x1800034c5
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005128
mov rax, qword [rbp + 0x28]
cmp rax, 0x10
jb 0x180003086
mov rcx, qword [rbp + 0x10]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180003081
mov r8, qword [rcx - 8]
sub rcx, r8
add rcx, 0xfffffffffffffff8
cmp rcx, 0x20
jae 0x1800034c5
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180005128
nop
add rsp, 0x198
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
test r13, r13
je 0x1800031ee
mov rcx, rdi
lea r14, [rdi + rax]
inc r14
movsx ebx, byte [rbp + 0x41]
mov r8, r14
sub r8, rdi
mov edx, ebx
call fcn.180006a10
test rax, rax
je 0x180002fb7
mov r12, rax
nop dword [rax + rax]
mov rcx, r12
lea rdx, [rbp + 0x41]
mov r8, r13
call fcn.180006a90
test eax, eax
je 0x1800031fb
inc r12
mov r8, r14
sub r8, r12
mov rcx, r12
mov edx, ebx
call fcn.180006a10
mov r12, rax
test rax, rax
jne 0x1800030d0
jmp 0x180002fb7
xor eax, eax
nop dword [rax]
movzx ecx, byte [rbp + rax + 0x41]
movzx ecx, cl
imul ecx, ecx, 0xffffffd3
mov edx, ecx
add edx, 0x1518
movsx edx, dx
imul edx, edx, 0xffff8103
shr edx, 0x10
add edx, ecx
add edx, 0x1518
movzx edx, dx
movsx r8d, dx
shr edx, 0xf
sar r8d, 6
add r8d, edx
mov edx, r8d
shl edx, 7
sub r8d, edx
add ecx, r8d
add ecx, 0x1518
lea edx, [rcx + 0x7f]
cmp cx, 0xff81
movzx edx, dl
cmovb edx, ecx
mov byte [rbp + rax + 0x41], dl
mov rcx, rax
or rcx, 1
cmp rcx, 0x11
je 0x180002f86
movzx edx, byte [rbp + rcx + 0x41]
movzx edx, dl
imul edx, edx, 0xffffffd3
mov r8d, edx
add r8d, 0x1518
movsx r8d, r8w
imul r8d, r8d, 0xffff8103
shr r8d, 0x10
add r8d, edx
add r8d, 0x1518
movzx r8d, r8w
movsx r9d, r8w
shr r8d, 0xf
sar r9d, 6
add r9d, r8d
mov r8d, r9d
shl r8d, 7
sub r9d, r8d
add edx, r9d
add edx, 0x1518
lea r8d, [rdx + 0x7f]
cmp dx, 0xff81
movzx r8d, r8b
cmovb r8d, edx
mov byte [rbp + rcx + 0x41], r8b
add rax, 2
jmp 0x180003110
cmp qword [rbp + 8], 0x10
jb 0x180003215
mov r14, qword [rbp - 0x10]
jmp 0x180003219
sub r12, rdi
cmp r12, 0xffffffffffffffff
je 0x180002fb7
cmp qword [rbp + 8], 0x10
jb 0x180003226
mov r14, qword [rbp - 0x10]
jmp 0x18000322a
lea r14, [rbp - 0x10]
mov r8, qword [rbp + 0x38]
mov r13, qword [rbp]
xor r12d, r12d
jmp 0x18000323b
lea r14, [rbp - 0x10]
mov r8, qword [rbp + 0x38]
cmp r8, r12
jb 0x1800034d9
mov r13, qword [rbp]
sub r15, r8
cmp r15, r13
jae 0x18000325e
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
lea rcx, [rbp + 0x10]
mov rdx, r13
mov r9, r12
call fcn.180004ee0
jmp 0x1800032c5
lea rax, [r8 + r13]
mov qword [rbp + 0x20], rax
lea rax, [rdi + r12]
lea r15, [r14 + r13]
mov rbx, r13
cmp r15, rax
jbe 0x18000328b
add rdi, r8
mov rbx, r13
cmp rdi, r14
jb 0x18000328b
mov rbx, rax
sub rbx, r14
ja 0x18000328b
xor ebx, ebx
sub r8, r12
inc r8
mov rdi, rax
lea rcx, [rax + r13]
mov rdx, rax
call fcn.180006b90
mov rcx, rdi
mov rdx, r14
mov r8, rbx
call fcn.180006b90
sub r13, rbx
add r15, rbx
add rdi, rbx
mov rcx, rdi
mov rdx, r15
mov r8, r13
call fcn.180006b90
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov byte [rbp + 0x40], 0
mov byte [rbp + 0x41], 0x55
mov byte [rbp + 0x42], 0x3f
mov byte [rbp + 0x43], 0x50
mov byte [rbp + 0x44], 0xf
mov byte [rbp + 0x45], 0x37
mov byte [rbp + 0x46], 0x4a
mov byte [rbp + 0x47], 0x31
mov byte [rbp + 0x48], 0x56
mov byte [rbp + 0x49], 0xc
mov byte [rbp + 0x4a], 0x14
mov byte [rbp + 0x4b], 3
lea rcx, [rbp + 0x40]
call fcn.180004320
mov r12, rax
mov rcx, rax
call fcn.180008560
mov r13, rax
mov rax, qword [rbp + 0x20]
mov rcx, qword [rbp + 0x28]
mov qword [rbp - 0x48], rcx
cmp rcx, 0x10
jb 0x180003335
mov rdi, qword [rbp + 0x10]
jmp 0x180003339
lea rdi, [rbp + 0x10]
mov qword [rbp + 0x38], rax
sub rax, r13
jb 0x180002fb7
test r13, r13
je 0x1800033a7
mov rcx, rdi
lea rbx, [rdi + rax]
inc rbx
movsx r14d, byte [r12]
mov r8, rbx
sub r8, rdi
mov edx, r14d
call fcn.180006a10
test rax, rax
je 0x180002fb7
mov r15, rax
mov rcx, r15
mov rdx, r12
mov r8, r13
call fcn.180006a90
test eax, eax
je 0x1800033b4
inc r15
mov r8, rbx
sub r8, r15
mov rcx, r15
mov edx, r14d
call fcn.180006a10
mov r15, rax
test rax, rax
jne 0x180003374
jmp 0x180002fb7
cmp qword [rbp - 0x18], 0x10
jb 0x1800033ce
mov rbx, qword [rbp - 0x30]
jmp 0x1800033d2
sub r15, rdi
cmp r15, 0xffffffffffffffff
je 0x180002fb7
cmp qword [rbp - 0x18], 0x10
jb 0x1800033df
mov rbx, qword [rbp - 0x30]
jmp 0x1800033e3
lea rbx, [rbp - 0x30]
mov r8, qword [rbp + 0x38]
mov r13, qword [rbp - 0x20]
xor r15d, r15d
jmp 0x1800033f4
lea rbx, [rbp - 0x30]
mov r8, qword [rbp + 0x38]
cmp r8, r15
jb 0x1800034de
mov r13, qword [rbp - 0x20]
mov rax, qword [rbp - 0x48]
sub rax, r8
cmp rax, r13
jae 0x18000341b
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rbx
lea rcx, [rbp + 0x10]
mov rdx, r13
mov r9, r15
call fcn.180004ee0
jmp 0x180003485
lea rax, [r8 + r13]
mov qword [rbp + 0x20], rax
lea r12, [rdi + r15]
lea rax, [rbx + r13]
mov r14, r13
mov qword [rbp + 0x38], rax
cmp rax, r12
jbe 0x18000344d
add rdi, r8
mov r14, r13
cmp rdi, rbx
jb 0x18000344d
mov r14, r12
sub r14, rbx
ja 0x18000344d
xor r14d, r14d
sub r8, r15
inc r8
lea rcx, [r12 + r13]
mov rdx, r12
call fcn.180006b90
mov rcx, r12
mov rdx, rbx
mov r8, r14
call fcn.180006b90
sub r13, r14
mov rdx, qword [rbp + 0x38]
add rdx, r14
add r12, r14
mov rcx, r12
mov r8, r13
call fcn.180006b90
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rbp + 0x20]
cmp qword [rbp + 0x28], 0x10
jb 0x1800034a7
mov rdx, qword [rbp + 0x10]
jmp 0x1800034ab
lea rdx, [rbp + 0x10]
mov qword [rsp + 0x20], 0
mov rcx, rsi
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x180002fb7
call fcn.180008108
call fcn.180004840
call fcn.180004840
call fcn.180004840
call fcn.1800050d0
call fcn.1800050d0
int3