Function at 0x18002b790
Capabilities:
Acquire debug privileges
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x1800c8010]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1800bafa0]
xor esi, esi
movdqa xmm1, xmmword [0x1800bb1a0]
mov ecx, esi
mov qword [rbp + 0x17], rsi
movdqu xmmword [rbp - 0x49], xmm0
mov dword [rbp - 0x29], 0x424b3545
movdqu xmmword [rbp - 0x39], xmm1
mov dword [rbp - 0x25], 0x45403336
mov word [rbp - 0x21], 0x4c
movzx eax, cl
add al, byte [rbp - 0x49]
xor byte [rbp + rcx - 0x48], al
inc rcx
cmp rcx, 0x28
jb 0x18002b7f0
mov rbx, 0xffffffffffffffff
mov byte [rbp - 0x20], sil
mov r8, rbx
mov qword [rbp + 0x37], rsi
mov qword [rbp + 0x3f], 0xf
lea rax, [rbp - 0x48]
mov byte [rbp + 0x27], sil
inc r8
cmp byte [rax + r8], sil
jne 0x18002b825
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x27]
call fcn.18000b0f0
lea rdx, [rbp + 0x27]
call fcn.18000a540
movdqa xmm1, xmmword [0x1800bbbc0]
mov rdi, rax
movdqa xmm0, xmmword [0x1800bb580]
mov rax, rsi
movdqu xmmword [rbp - 0x39], xmm1
mov dword [rbp - 0x29], 0x403b3e3d
movdqa xmm1, xmmword [0x1800baca0]
movdqu xmmword [rbp - 0x49], xmm0
mov dword [rbp - 0x25], 0x3e394c39
mov word [rbp - 0x21], 0x373c
mov byte [rbp - 0x1f], sil
nop dword [rax]
nop dword [rax + rax]
movdqu xmm0, xmmword [rbp + rax - 0x49]
psubb xmm0, xmm1
movdqu xmmword [rbp + rax - 0x49], xmm0
add rax, 0x10
cmp rax, 0x20
jb 0x18002b890
cmp rax, 0x2a
jae 0x18002b8be
add byte [rbp + rax - 0x49], 0xf9
inc rax
cmp rax, 0x2a
jb 0x18002b8b0
mov qword [rbp - 1], rsi
lea rax, [rbp - 0x49]
mov qword [rbp + 7], 0xf
mov r8, rbx
mov byte [rbp - 0x11], sil
inc r8
cmp byte [rax + r8], sil
jne 0x18002b8d5
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x11]
call fcn.18000b0f0
lea rdx, [rbp - 0x11]
call fcn.18000a540
call rax
lea r8, [rbp + 0x17]
mov edx, 0x28
mov rcx, rax
call rdi
test eax, eax
je 0x18002bb42
movdqa xmm0, xmmword [0x1800bc4b0]
mov rcx, rsi
movdqa xmm1, xmmword [0x1800bc5c0]
movdqu xmmword [rbp - 0x49], xmm0
mov dword [rbp - 0x19], 0x136313
movdqa xmm0, xmmword [str.vsr]
movdqu xmmword [rbp - 0x29], xmm0
movdqu xmmword [rbp - 0x39], xmm1
nop dword [rax]
movzx eax, cl
add al, byte [rbp - 0x49]
xor byte [rbp + rcx - 0x48], al
inc rcx
cmp rcx, 0x32
jb 0x18002b940
mov byte [rbp - 0x16], sil
lea rax, [rbp - 0x48]
mov qword [rbp - 1], rsi
mov r8, rbx
mov qword [rbp + 7], 0xf
mov byte [rbp - 0x11], sil
nop
inc r8
cmp byte [rax + r8], sil
jne 0x18002b970
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x11]
call fcn.18000b0f0
lea rdx, [rbp - 0x11]
call fcn.18000a540
lea r8, [rbp + 0x1f]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call rax
test eax, eax
je 0x18002bb42
movsd xmm1, qword [0x1800ba7d0]
lea rcx, [0x1800a7d98]
mov rax, qword [rbp + 0x1f]
movq rdx, xmm1
mov dword [rbp + 0x27], 1
mov qword [rbp + 0x2b], rax
mov dword [rbp + 0x33], 2
call fcn.18000ba10
movdqa xmm0, xmmword [0x1800bb970]
mov rax, rsi
movdqa xmm1, xmmword [0x1800bb7c0]
movdqu xmmword [rbp - 0x49], xmm0
mov word [rbp - 0x19], 0x413f
movdqa xmm0, xmmword [0x1800bbc70]
movdqu xmmword [rbp - 0x39], xmm1
mov byte [rbp - 0x17], sil
movdqa xmm1, xmmword [0x1800bacf0]
movdqu xmmword [rbp - 0x29], xmm0
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rbp + rax - 0x49]
psubb xmm0, xmm1
movdqu xmmword [rbp + rax - 0x49], xmm0
add rax, 0x10
cmp rax, 0x30
jb 0x18002ba20
cmp rax, 0x32
jae 0x18002ba4e
add byte [rbp + rax - 0x49], 0xf6
inc rax
cmp rax, 0x32
jb 0x18002ba40
mov qword [rbp - 1], rsi
lea rax, [rbp - 0x49]
mov qword [rbp + 7], 0xf
mov r8, rbx
mov byte [rbp - 0x11], sil
inc r8
cmp byte [rax + r8], sil
jne 0x18002ba65
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x11]
call fcn.18000b0f0
lea rdx, [rbp - 0x11]
call fcn.18000a540
mov rcx, qword [rbp + 0x17]
lea r8, [rbp + 0x27]
mov r9d, 0x10
mov qword [rsp + 0x28], rsi
xor edx, edx
mov qword [rsp + 0x20], rsi
call rax
test eax, eax
je 0x18002bb42
movdqa xmm1, xmmword [0x1800bb510]
mov rax, rsi
movdqa xmm0, xmmword [0x1800bb5f0]
movdqu xmmword [rbp - 0x39], xmm1
mov byte [rbp - 0x29], sil
movdqa xmm1, xmmword [0x1800babe0]
movdqu xmmword [rbp - 0x49], xmm0
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rbp + rax - 0x49]
psubb xmm0, xmm1
movdqu xmmword [rbp + rax - 0x49], xmm0
add rax, 0x10
cmp rax, 0x20
jb 0x18002bae0
mov qword [rbp - 1], rsi
lea rax, [rbp - 0x49]
mov qword [rbp + 7], 0xf
mov byte [rbp - 0x11], sil
nop
inc rbx
cmp byte [rax + rbx], sil
jne 0x18002bb10
mov r8, rbx
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x11]
call fcn.18000b0f0
lea rdx, [rbp - 0x11]
call fcn.18000a540
call rax
cmp eax, 0x514
je 0x18002bb48
mov eax, 1
jmp 0x18002bb4a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, esi
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1800555d0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret