Function at 0x18008b930
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x1b0], rbx
mov rax, qword [0x180122010]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov r13, r9
mov rsi, r8
mov rdi, rdx
mov rcx, r8
call fcn.18008cc20
mov byte [r13], 0
mov rcx, rdi
call fcn.180005be8
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r8d, r8d
mov edx, 0x80000000
call fcn.18006bf40
mov r14, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x18008c2ec
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov ebx, r12d
mov rcx, rdi
call fcn.180005ea0
test al, al
jne 0x18008ba2e
xor eax, eax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov dword [rbp - 0x60], eax
lea r8, [rbp - 0x80]
mov rcx, rdi
call fcn.18006c060
test al, al
je 0x18008ba2e
mov ebx, dword [rbp - 0x64]
shl rbx, 0x20
mov eax, dword [rbp - 0x60]
add rbx, rax
mov al, 1
jmp 0x18008ba30
xor al, al
mov rdi, r12
test al, al
cmovne rdi, rbx
lea rax, [rdi - 1]
cmp rax, 0x4ffffe
ja 0x18008bace
mov byte [rsp + 0x40], 0
lea rax, [rsp + 0x50]
mov qword [rbp - 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x48], rax
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x50], xmm0
lea r8, [rbp - 0x50]
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.180015700
mov dword [rbp - 0x30], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x30]
mov r8d, edi
mov rdx, qword [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rbp - 0x30]
cmp rdx, rdi
jae 0x18008bace
mov byte [rsp + 0x40], 0
lea rax, [rsp + 0x50]
mov qword [rbp - 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x48], rax
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x50], xmm0
lea r8, [rbp - 0x50]
lea rcx, [rsp + 0x50]
call fcn.180015700
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jne 0x18008bb27
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18008c2ec
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008c2d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008c31b
jmp 0x18008c2d9
xor eax, eax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov r9, r12
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r12
mov rdx, r12
mov qword [rbp - 0x70], rdx
mov dword [rbp - 0x50], 0x2d2d4352
mov dword [rbp - 0x4c], 0x35343332
mov dword [rbp - 0x48], 0x61534350
mov dword [rbp - 0x44], 0x2d302e32
mov dword [rbp - 0x40], 0x2d736843
mov dword [rbp - 0x3c], 0x61435243
mov dword [rbp - 0x38], 0x38313031
mov dword [rbp - 0x34], 0x35313032
movdqa xmm2, xmmword [0x1800f13c0]
mov eax, r12d
mov ecx, 1
movd xmm3, ecx
lea rcx, [rbp - 0x50]
nop word [rax + rax]
movd xmm1, eax
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
movdqu xmm0, xmmword [rcx]
pslld xmm0, xmm3
paddd xmm1, xmm0
movdqu xmmword [rcx], xmm1
add eax, 4
lea rcx, [rcx + 0x10]
cmp eax, 8
jl 0x18008bba0
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
sub rcx, rax
test rax, rax
je 0x18008c260
lea r9, [rbp - 0x80]
mov r8d, ecx
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.180027d70
test al, al
je 0x18008c258
mov rcx, qword [rbp - 0x78]
mov rdi, qword [rbp - 0x80]
sub rcx, rdi
movabs rax, 0x624dd2f1a9fbe77
mul rcx
mov rbx, rcx
sub rbx, rdx
shr rbx, 1
add rbx, rdx
shr rbx, 9
imul rax, rbx, 0x3e8
sub rcx, rax
je 0x18008bcc0
mov byte [r13], 1
test rdi, rdi
je 0x18008bc7c
mov rdx, qword [rbp - 0x70]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x18008bc68
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008c333
mov rcx, rdi
call fcn.18009c654
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r12
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18008c2ec
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008c2d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008c321
jmp 0x18008c2d9
test rbx, rbx
jne 0x18008bd5f
test rdi, rdi
je 0x18008bd0e
mov rdx, qword [rbp - 0x70]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x18008bcfa
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008c339
mov rcx, rdi
call fcn.18009c654
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r12
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18008bd58
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008bd45
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008c33f
call fcn.18009c654
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov al, 1
jmp 0x18008c2ee
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r12
lea r8, [rsp + 0x68]
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.18008d0c0
imul r8, rbx, 0x3e8
mov rdx, rdi
mov rcx, qword [rsp + 0x68]
call fcn.18009fcb0
mov r10, r12
mov rcx, qword [rsp + 0x70]
mov r8, qword [rsp + 0x68]
sub rcx, r8
movabs r11, 0x20c49ba5e353f7cf
mov rax, r11
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x18008be39
mov r9, r12
nop word [rax + rax]
cmp dword [r9 + r8], 0x23ab45db
jne 0x18008bffd
mov word [r9 + r8 + 0x282], r12w
mov word [r9 + r8 + 0x382], r12w
mov word [r9 + r8 + 0x3ca], r12w
inc r10
add r9, 0x3e8
mov rcx, qword [rsp + 0x70]
mov r8, qword [rsp + 0x68]
sub rcx, r8
mov rax, r11
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r10, rdx
jb 0x18008bde0
mov rax, qword [rsi + 0x10]
sub rax, qword [rsi]
sar rax, 7
cmp rbx, rax
jbe 0x18008be81
movabs rax, 0x1ffffffffffffff
mov qword [rbp - 0x30], rax
call fcn.180005d10
mov qword [rbp - 0x50], rax
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.1800063e8
cmp rbx, qword [rax]
ja 0x18008c345
mov rdx, rbx
mov rcx, rsi
call fcn.18008ce80
lea rcx, [rbp - 0x20]
call fcn.180005c00
nop
lea rcx, [rbp]
call fcn.180005c00
nop
lea rcx, [rbp + 0x20]
call fcn.180005c00
nop
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r12
mov qword [rbp + 0x50], r12
mov dword [rbp + 0x58], r12d
mov byte [rbp + 0x5c], 0
mov r14, r12
mov rcx, qword [rsp + 0x70]
mov r15, qword [rsp + 0x68]
sub rcx, r15
movabs rbx, 0x20c49ba5e353f7cf
mov rax, rbx
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x18008c144
mov rdi, rbx
nop word [rax + rax]
lea rbx, [r12 + r15]
lea rcx, [rbx + 4]
call fcn.1800063e0
mov r8, rax
lea rdx, [rbx + 4]
lea rcx, [rbp - 0x20]
call fcn.180006148
lea rbx, [r12 + r15]
lea rcx, [rbx + 0x284]
call fcn.1800063e0
mov r8, rax
lea rdx, [rbx + 0x284]
lea rcx, [rbp]
call fcn.180006148
mov rax, qword [r12 + r15 + 0x3cc]
mov qword [rbp + 0x40], rax
mov rax, qword [r12 + r15 + 0x3d4]
mov qword [rbp + 0x48], rax
mov rax, qword [r12 + r15 + 0x3dc]
mov qword [rbp + 0x50], rax
lea rbx, [r12 + r15]
lea rcx, [rbx + 0x384]
call fcn.1800063e0
mov r8, rax
lea rdx, [rbx + 0x384]
lea rcx, [rbp + 0x20]
call fcn.180006148
mov eax, dword [r12 + r15 + 0x3e4]
mov dword [rbp + 0x58], eax
mov byte [rbp + 0x5c], 0
mov rdx, qword [rsi + 8]
cmp qword [rsi + 0x10], rdx
je 0x18008c0f3
mov ecx, 0x80
call fcn.180005d08
mov rbx, rax
mov qword [rbp - 0x50], rax
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.180006e50
nop
lea rcx, [rbx + 0x20]
lea rdx, [rbp]
call fcn.180006e50
nop
lea rcx, [rbx + 0x40]
lea rdx, [rbp + 0x20]
call fcn.180006e50
nop
mov rax, qword [rbp + 0x40]
mov qword [rbx + 0x60], rax
mov rax, qword [rbp + 0x48]
mov qword [rbx + 0x68], rax
mov rax, qword [rbp + 0x50]
mov qword [rbx + 0x70], rax
mov eax, dword [rbp + 0x58]
mov dword [rbx + 0x78], eax
movzx eax, byte [rbp + 0x5c]
mov byte [rbx + 0x7c], al
sub qword [rsi + 8], 0xffffffffffffff80
jmp 0x18008c0ff
mov byte [r13], 1
mov r8, qword [rsp + 0x68]
test r8, r8
je 0x18008c06a
mov rcx, qword [rsp + 0x78]
sub rcx, r8
mov rax, r11
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x3e8
mov rax, r8
cmp rdx, 0x1000
jb 0x18008c054
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008c34b
mov rcx, r8
call fcn.18009c654
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r12
test rdi, rdi
je 0x18008c0af
mov rdx, qword [rbp - 0x70]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x18008c09b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008c351
mov rcx, rdi
call fcn.18009c654
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r12
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18008c2ec
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008c2d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008c327
jmp 0x18008c2d9
lea r8, [rbp - 0x20]
mov rcx, rsi
call fcn.18008d530
inc r14
add r12, 0x3e8
mov rcx, qword [rsp + 0x70]
mov r15, qword [rsp + 0x68]
sub rcx, r15
mov rax, rdi
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r14, rdx
jb 0x18008bef0
mov rdi, qword [rbp - 0x80]
xor r12d, r12d
movabs rbx, 0x20c49ba5e353f7cf
mov byte [r13], 0
lea rcx, [rbp + 0x20]
call fcn.180005bf8
nop
lea rcx, [rbp]
call fcn.180005bf8
nop
lea rcx, [rbp - 0x20]
call fcn.180005bf8
nop
mov r8, qword [rsp + 0x68]
test r8, r8
je 0x18008c1cf
mov rcx, qword [rsp + 0x78]
sub rcx, r8
mov rax, rbx
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x3e8
mov rax, r8
cmp rdx, 0x1000
jb 0x18008c1b9
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008c357
mov rcx, r8
call fcn.18009c654
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r12
test rdi, rdi
je 0x18008c214
mov rdx, qword [rbp - 0x70]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x18008c200
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008c35d
mov rcx, rdi
call fcn.18009c654
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r12
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18008bd58
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008bd45
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008c32d
jmp 0x18008bd45
mov rdx, qword [rbp - 0x70]
mov r9, qword [rbp - 0x80]
mov byte [r13], 1
test r9, r9
je 0x18008c2a6
sub rdx, r9
mov rax, r9
cmp rdx, 0x1000
jb 0x18008c292
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008c363
mov rcx, r9
call fcn.18009c654
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r12
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18008c2ec
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008c2d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008c315
call fcn.18009c654
xorps xmm0, xmm0
mov qword [rsp + 0x60], r12
movdqu xmmword [rsp + 0x50], xmm0
xor al, al
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.18009c630
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800a308c
int3
call fcn.1800a308c
int3
call fcn.1800a308c
int3
call fcn.1800a308c
int3
call fcn.1800a308c
nop
call fcn.1800a308c
nop
call fcn.1800a308c
nop
call fcn.1800a308c
nop
call fcn.180006c20
nop
call fcn.1800a308c
nop
call fcn.1800a308c
nop
call fcn.1800a308c
nop
call fcn.1800a308c
int3
call fcn.1800a308c
int3