Function at 0x18007093d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov qword [rsp + 0xc0], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
movzx r15d, r9b
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r9b, r9b
jne 0x1800707ca
call fcn.18006fe30
test al, al
je 0x180070c82
call fcn.180068850
mov rbp, rax
xor edi, edi
cmp qword [rax + 0x10], rdi
jne 0x1800707fd
lea ecx, [rdi + 0x10]
call fcn.18007b56c
mov qword [rsp + 0x20], rax
test rax, rax
je 0x1800707f6
mov rcx, rax
call 0x18006cd70
jmp 0x1800707f9
mov rax, rdi
mov qword [rbp + 0x10], rax
mov r12d, 0x40
mov r8, r12
lea rdx, [rsp + 0x40]
mov rcx, qword [rbp + 0x10]
call 0x18006d760
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x20]
lea r8, [rsp + 0xd0]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.18006b4b0
mov r11, qword [rsp + 0x20]
mov byte [rsp + r11 + 0xd0], 0
mov dword [rsp + 0x94], edi
mov dword [rsp + 0x90], edi
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x98], 0x67452301
mov dword [rsp + 0x9c], 0xefcdab89
mov dword [rsp + 0xa0], 0x98badcfe
mov dword [rsp + 0xa4], 0x10325476
mov dword [rsp + 0xa8], 0xc3d2e1f0
mov byte [rsp + 0x40], 0
mov rax, qword [rsi + 0x10]
sub rax, 4
or ebp, 0xffffffff
cmp rax, 0x10
jb 0x1800708c9
lea r9d, [r12 - 0x3c]
lea r8, [rsp + reloc.mfc100.dll_Ordinal_408]
lea edx, [r12 - 0x30]
mov rcx, rsi
call fcn.18006b0d0
test al, al
je 0x1800708c9
mov r13d, dword [rsp + reloc.mfc100.dll_Ordinal_408]
jmp 0x1800708cc
mov r13d, ebp
mov rax, qword [rsi + 0x10]
sub rax, 4
cmp rax, 0xc
jb 0x1800708ff
mov r9d, 4
lea r8, [rsp + reloc.mfc100.dll_Ordinal_408]
lea edx, [r9 + 8]
mov rcx, rsi
call fcn.18006b0d0
test al, al
je 0x1800708ff
mov ebp, dword [rsp + reloc.mfc100.dll_Ordinal_408]
mov r9d, r13d
mov r8d, ebp
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.18006b7e0
mov qword [rsp + 0x20], r12
cmp byte [rsp + 0x40], 0
jne 0x1800709af
mov rax, qword [rsp + 0x48]
mov byte [rsp + rax + 0x50], pe_nt_image_headers64
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
cmp rax, 0x38
jbe 0x180070965
cmp rax, r12
jae 0x180070956
lea rcx, [rsp + rax + 0x50]
sub r12, rax
mov r8, r12
xor edx, edx
call fcn.180080140
lea rcx, [rsp + 0x40]
call fcn.18006b910
mov rax, qword [rsp + 0x48]
cmp rax, 0x38
jae 0x180070980
lea rcx, [rsp + rax + 0x50]
mov r8d, 0x38
sub r8, rax
xor edx, edx
call fcn.180080140
mov eax, dword [rsp + 0x90]
bswap eax
mov dword [rsp + 0x88], eax
mov eax, dword [rsp + 0x94]
bswap eax
mov dword [rsp + 0x8c], eax
lea rcx, [rsp + 0x40]
call fcn.18006b910
mov byte [rsp + 0x40], 1
mov rcx, rdi
nop word [rax + rax]
mov eax, dword [rsp + rcx*4 + 0x98]
bswap eax
mov dword [rsp + rcx*4 + 0xac], eax
inc rcx
cmp rcx, 5
jb 0x1800709c0
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x110]
mov edx, reloc.ca_core.dll_Ordinal_20
lea rcx, [rsp + 0xac]
call fcn.18006b4b0
mov r11, qword [rsp + 0x20]
mov byte [rsp + r11 + 0x110], 0
test r15b, r15b
je 0x180070ad3
mov byte [rsp + 0x28], 0x74
mov byte [rsp + 0x29], 0x79
mov byte [rsp + 0x2a], 0x70
mov byte [rsp + 0x2b], 0x65
mov byte [rsp + 0x2c], 0x3d
mov byte [rsp + 0x2d], 0x61
mov byte [rsp + 0x2e], 0x63
mov byte [rsp + 0x2f], 0x74
mov byte [rsp + 0x30], 0x69
mov byte [rsp + 0x31], 0x76
mov byte [rsp + 0x32], 0x61
mov byte [rsp + 0x33], 0x74
mov byte [rsp + 0x34], 0x69
mov byte [rsp + 0x35], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x36], WSAGetLastError
mov byte [rsp + 0x37], reloc.ca_core.dll_Ordinal_38
mov byte [rsp + 0x38], 0x63
mov byte [rsp + 0x39], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x3a], 0x64
mov byte [rsp + 0x3b], 0x65
mov byte [rsp + 0x3c], 0x3d
mov byte [rsp + 0x3d], 0
lea rdx, [rsp + 0x28]
mov rcx, rdi
cmp byte [rbx + 8], cl
je 0x180070aa0
nop word [rax + rax]
inc rcx
cmp byte [rcx + rbx + 8], 0
jne 0x180070a90
nop word [rax + rax]
cmp rcx, reloc.mfc100.dll_Ordinal_2048
jae 0x180070abb
movzx eax, byte [rdx]
mov byte [rcx + rbx + 8], al
inc rcx
inc rdx
cmp byte [rdx], 0
jne 0x180070aa0
mov byte [rcx + rbx + 8], 0
mov r8b, 1
mov rdx, r14
mov rcx, rbx
call fcn.180070590
jmp 0x180070b8e
mov byte [rsp + 0x28], 0x61
mov byte [rsp + 0x29], 0x63
mov byte [rsp + 0x2a], 0x74
mov byte [rsp + 0x2b], 0x69
mov byte [rsp + 0x2c], 0x76
mov byte [rsp + 0x2d], 0x61
mov byte [rsp + 0x2e], 0x74
mov byte [rsp + 0x2f], 0x69
mov byte [rsp + 0x30], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x31], WSAGetLastError
mov byte [rsp + 0x32], reloc.ca_core.dll_Ordinal_46
mov byte [rsp + 0x33], 0x70
mov byte [rsp + 0x34], 0x68
mov byte [rsp + 0x35], 0x70
mov byte [rsp + 0x36], 0x3f
mov byte [rsp + 0x37], 0x63
mov byte [rsp + 0x38], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x39], 0x64
mov byte [rsp + 0x3a], 0x65
mov byte [rsp + 0x3b], 0x3d
mov byte [rsp + 0x3c], 0
lea rdx, [rsp + 0x28]
mov rcx, rdi
cmp byte [rbx + 8], cl
je 0x180070b60
nop dword [rax]
inc rcx
cmp byte [rcx + rbx + 8], 0
jne 0x180070b50
nop word [rax + rax]
cmp rcx, reloc.mfc100.dll_Ordinal_2048
jae 0x180070b7b
movzx eax, byte [rdx]
mov byte [rcx + rbx + 8], al
inc rcx
inc rdx
cmp byte [rdx], 0
jne 0x180070b60
mov byte [rcx + rbx + 8], 0
mov r8b, 1
mov rdx, r14
mov rcx, rbx
call fcn.180070590
mov byte [rsp + 0x20], reloc.ca_core.dll_Ordinal_38
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x77
mov byte [rsp + 0x23], 0x69
mov byte [rsp + 0x24], 0x64
mov byte [rsp + 0x25], 0x3d
mov byte [rsp + 0x26], 0
lea rdx, [rsp + 0x20]
mov rcx, rdi
cmp byte [rbx + 8], cl
je 0x180070bd0
nop
inc rcx
cmp byte [rcx + rbx + 8], 0
jne 0x180070bc0
nop word [rax + rax]
cmp rcx, reloc.mfc100.dll_Ordinal_2048
jae 0x180070beb
movzx eax, byte [rdx]
mov byte [rcx + rbx + 8], al
inc rcx
inc rdx
cmp byte [rdx], 0
jne 0x180070bd0
mov byte [rcx + rbx + 8], 0
mov r8b, 1
lea rdx, [rsp + 0xd0]
mov rcx, rbx
call fcn.180070590
mov byte [rsp + 0x20], reloc.ca_core.dll_Ordinal_38
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x61
mov byte [rsp + 0x23], 0x73
mov byte [rsp + 0x24], 0x68
mov byte [rsp + 0x25], 0x3d
mov byte [rsp + 0x26], 0
lea rcx, [rsp + 0x20]
cmp byte [rbx + 8], 0
je 0x180070c40
inc rdi
cmp byte [rdi + rbx + 8], 0
jne 0x180070c31
nop dword [rax + rax]
cmp rdi, reloc.mfc100.dll_Ordinal_2048
jae 0x180070c5b
movzx eax, byte [rcx]
mov byte [rdi + rbx + 8], al
inc rdi
inc rcx
cmp byte [rcx], 0
jne 0x180070c40
mov byte [rdi + rbx + 8], 0
mov r8b, 1
lea rdx, [rsp + 0x110]
mov rcx, rbx
call fcn.180070590
test r15b, r15b
je 0x180070c80
mov rcx, rbx
call fcn.1800706c0
mov al, 1
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret