Function at 0x1800564b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Read .ini file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x38]
sub rsp, 0x138
mov rax, qword [0x180111618]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov r14, r9
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x78], rcx
mov qword [rbp - 0x80], rdx
mov qword [rbp - 0x78], rbx
mov r8, rcx
cmp qword [rcx + 0x18], 0x10
jb 0x1800564f9
mov r8, qword [rcx]
mov dword [rsp + 0x30], 0xa9a8b6ac
mov word [rsp + 0x34], pe_nt_image_headers64
xor r15d, r15d
mov ecx, r15d
nop
lea eax, [rcx - 0x1e]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x180056510
mov byte [rsp + 0x35], r15b
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x180056532
mov rdx, qword [rbx]
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18005653f
mov rcx, qword [rdi]
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], 0x64
lea r9, [rbp - 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [rsp + 0x30], 0xa9a8b6ac
mov word [rsp + 0x34], pe_nt_image_headers64
mov rcx, r15
nop dword [rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x180056570
mov byte [rsp + 0x35], r15b
lea rax, [rbp - 0x50]
lea r8, [rsp + 0x30]
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1800565a4
inc rax
test ecx, ecx
jne 0x180056591
test edx, edx
je 0x180056727
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], al
lea rax, [rbp - 0x50]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800565e0
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x48]
call fcn.180004420
nop
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x70]
call fcn.18005bc70
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x180056645
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180056640
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180056822
call fcn.18006e3e0
mov rax, qword [rbp - 0x68]
mov r9, qword [rbp - 0x70]
sub rax, r9
sar rax, 2
movsxd rdx, dword [rbp + 0x90]
cmp rax, rdx
jne 0x18005682e
mov r11, r15
cmp rdx, 4
jl 0x1800566bf
lea rcx, [r14 + 4]
mov r8, r9
sub r8, r14
lea r10, [rdx - 4]
shr r10, 2
inc r10
lea r11, [r10*4]
nop word [rax + rax]
mov eax, dword [r8 + rcx - 4]
mov dword [rcx - 4], eax
mov eax, dword [r8 + rcx]
mov dword [rcx], eax
mov eax, dword [r8 + rcx + 4]
mov dword [rcx + 4], eax
mov eax, dword [r8 + rcx + 8]
mov dword [rcx + 8], eax
lea rcx, [rcx + 0x10]
sub r10, 1
jne 0x180056690
cmp r11, rdx
jl 0x1800566c4
jmp 0x1800566e1
test rdx, rdx
jle 0x1800566e1
lea rcx, [r14 + r11*4]
mov r8, r9
sub r8, r14
sub rdx, r11
mov eax, dword [rcx + r8]
mov dword [rcx], eax
lea rcx, [rcx + 4]
sub rdx, 1
jne 0x1800566d1
test r9, r9
je 0x180056727
mov rax, qword [rbp - 0x60]
sub rax, r9
sar rax, 2
lea rdx, [rax*4]
mov rax, r9
cmp rdx, 0x1000
jb 0x18005671e
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180056828
mov rcx, r9
call fcn.18006e3e0
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x180056761
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x18005675c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180056900
mov rcx, r8
call fcn.18006e3e0
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x1800567a6
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x1800567a1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180056816
mov rcx, r8
call fcn.18006e3e0
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800567eb
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1800567e6
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18005681c
mov rcx, r8
call fcn.18006e3e0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.18006e500
add rsp, 0x138
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.180075cf4
nop
call fcn.180075cf4
nop
call fcn.180075cf4
nop
call fcn.180075cf4
nop
mov dword [rsp + 0x30], 0x978f81
mov byte [rsp + 0x34], 1
lea rcx, [rsp + 0x30]
call fcn.1800677e0
mov rcx, rax
call fcn.180086168
mov dword [rsp + 0x30], 0x100b8c2
lea rcx, [rsp + 0x30]
call fcn.1800677b0
mov rdx, rax
lea rcx, [0x180113050]
call fcn.180001480
mov rbx, rax
mov dword [rsp + 0x38], 0xc5b6b1a7
mov dword [rsp + 0x3c], 0xdcd9c7cb
mov word [rsp + 0x40], pe_nt_image_headers64
lea rcx, [rsp + 0x38]
call fcn.180067810
mov rdx, rax
mov rcx, rbx
call fcn.180001480
mov rbx, rax
movdqa xmm0, xmmword [0x1800abc00]
movdqu xmmword [rsp + 0x48], xmm0
movdqa xmm1, xmmword [0x1800abbe0]
movdqu xmmword [rsp + 0x58], xmm1
mov dword [rsp + 0x68], 0x6b6b736f
mov dword [rsp + 0x6c], 0x7a7c6963
mov word [rsp + 0x70], 0x24
mov byte [rsp + 0x72], 1
lea rcx, [rsp + 0x48]
call fcn.180067870
mov rdx, rax
mov rcx, rbx
call fcn.180001480
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.1800860ac
nop
call fcn.180075cf4
int3