Function at 0x18000a750
Capabilities:
Contain obfuscated stackstrings
Create thread
Encode data using xor
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
xor edi, edi
lea r8, [0x18000a660]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xorps xmm0, xmm0
mov qword [rbp + 0x80], 0x50
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x90], xmm0
movdqa xmmword [rbp + 0xa0], xmm1
mov ebx, 0x782e
movdqa xmmword [rbp + 0xb0], xmm0
mov ecx, edi
mov qword [rbp + 0xc8], rdi
mov dword [rsp + 0x60], 0x7858785f
mov dword [rsp + 0x64], 0x78467855
mov dword [rsp + 0x68], 0x78437843
mov dword [rsp + 0x6c], 0x78457851
mov dword [rsp + 0x70], 0x78407847
mov dword [rsp + 0x74], 0x7849785d
mov dword [rsp + 0x78], 0x784c784b
mov dword [rsp + 0x7c], 0x7858784c
mov dword [rbp - 0x80], 0x784f784f
mov dword [rbp - 0x7c], 0x78247837
mov dword [rbp - 0x78], 0x78327832
mov dword [rbp - 0x74], 0x78207833
mov dword [rbp - 0x70], 0x78307836
mov dword [rbp - 0x6c], 0x78397839
mov dword [rbp - 0x68], 0x783c783b
mov dword [rbp - 0x64], 0x783d7829
mov dword [rbp - 0x60], 0x782a783f
mov dword [rbp - 0x5c], 0x78267820
mov dword [rbp - 0x58], 0x78227822
mov dword [rbp - 0x54], 0x78307823
mov dword [rbp - 0x50], 0x78327826
mov dword [rbp - 0x4c], 0x7828782f
mov dword [rbp - 0x48], 0x783e782a
mov dword [rbp - 0x44], 0x782c782b
mov dword [rbp - 0x40], 0x7828782e
mov dword [rbp - 0x3c], 0x78107805
mov dword [rbp - 0x38], 0x78147812
mov dword [rbp - 0x34], 0x78147801
mov dword [rbp - 0x30], 0x78107816
mov dword [rbp - 0x2c], 0x780c7819
mov dword [rbp - 0x28], 0x781b781a
mov dword [rbp - 0x24], 0x781a7809
mov dword [rbp - 0x20], 0x781f781f
mov dword [rbp - 0x1c], 0x78147807
mov dword [rbp - 0x18], 0x7803
mov byte [rbp - 0x14], 1
nop
lea eax, [rbx + rcx]
xor word [rsp + rcx*2 + 0x60], ax
inc rcx
cmp rcx, 0x45
jb 0x18000a8d0
lea rax, [rsp + 0x60]
mov qword [rbp + 0xc0], rax
lea rcx, [rbp + 0x80]
lea rax, [0x18000a500]
mov qword [rbp + 0x88], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov rcx, qword [0x1800dbeb0]
test rcx, rcx
je 0x18000ac50
lea rdx, [0x1800dbf48]
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [0x1800dbeb0]
lea rdx, [rbp + 0x100]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [rbp + 0x100]
mov rcx, rdi
mov edx, dword [0x1800dbf50]
mov r8d, dword [0x1800dbf54]
mov dword [0x1800dbf48], eax
mov eax, dword [rbp + 0x104]
mov dword [0x1800dbf4c], eax
mov dword [0x1800dbfc4], edx
mov dword [0x1800dbfc0], r8d
mov dword [rbp - 0x12], 0x7858785f
mov dword [rbp - 0xe], 0x78467855
mov dword [rbp - 0xa], 0x78437843
mov dword [rbp - 6], 0x78457851
mov dword [rbp - 2], 0x78407847
mov dword [rbp + 2], 0x7849785d
mov dword [rbp + 6], 0x784c784b
mov dword [rbp + 0xa], 0x7858784c
mov dword [rbp + 0xe], 0x784f784f
mov dword [rbp + 0x12], 0x78247837
mov dword [rbp + 0x16], 0x78327832
mov dword [rbp + 0x1a], 0x78207833
mov dword [rbp + 0x1e], 0x78307836
mov dword [rbp + 0x22], 0x78397839
mov dword [rbp + 0x26], 0x783c783b
mov dword [rbp + 0x2a], 0x783d7829
mov dword [rbp + 0x2e], 0x782a783f
mov dword [rbp + 0x32], 0x78267820
mov dword [rbp + 0x36], 0x78227822
mov dword [rbp + 0x3a], 0x78307823
mov dword [rbp + 0x3e], 0x78327826
mov dword [rbp + 0x42], 0x7828782f
mov dword [rbp + 0x46], 0x783e782a
mov dword [rbp + 0x4a], 0x782c782b
mov dword [rbp + 0x4e], 0x7828782e
mov dword [rbp + 0x52], 0x78107805
mov dword [rbp + 0x56], 0x78147812
mov dword [rbp + 0x5a], 0x78147801
mov dword [rbp + 0x5e], 0x78107816
mov dword [rbp + 0x62], 0x780c7819
mov dword [rbp + 0x66], 0x781b781a
mov dword [rbp + 0x6a], 0x781a7809
mov dword [rbp + 0x6e], 0x781f781f
mov dword [rbp + 0x72], 0x78147807
mov word [rbp + 0x76], di
mov byte [rbp + 0x78], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rbx + rcx]
xor word [rbp + rcx*2 - 0x12], ax
inc rcx
cmp rcx, 0x44
jb 0x18000aa70
mov byte [rbp + 0x78], dil
mov rax, rdi
mov dword [rsp + 0x60], 0x7858785f
mov dword [rsp + 0x64], 0x78467855
mov dword [rsp + 0x68], 0x78437843
mov dword [rsp + 0x6c], 0x78457851
mov dword [rsp + 0x70], 0x78407847
mov dword [rsp + 0x74], 0x7849785d
mov dword [rsp + 0x78], 0x784c784b
mov dword [rsp + 0x7c], 0x7858784c
mov dword [rbp - 0x80], 0x784f784f
mov dword [rbp - 0x7c], 0x78247837
mov dword [rbp - 0x78], 0x78327832
mov dword [rbp - 0x74], 0x78207833
mov dword [rbp - 0x70], 0x78307836
mov dword [rbp - 0x6c], 0x78397839
mov dword [rbp - 0x68], 0x783c783b
mov dword [rbp - 0x64], 0x783d7829
mov dword [rbp - 0x60], 0x782a783f
mov dword [rbp - 0x5c], 0x78267820
mov dword [rbp - 0x58], 0x78227822
mov dword [rbp - 0x54], 0x78307823
mov dword [rbp - 0x50], 0x78327826
mov dword [rbp - 0x4c], 0x7828782f
mov dword [rbp - 0x48], 0x783e782a
mov dword [rbp - 0x44], 0x782c782b
mov dword [rbp - 0x40], 0x7828782e
mov dword [rbp - 0x3c], 0x78107805
mov dword [rbp - 0x38], 0x78147812
mov dword [rbp - 0x34], 0x78147801
mov dword [rbp - 0x30], 0x78107816
mov dword [rbp - 0x2c], 0x780c7819
mov dword [rbp - 0x28], 0x781b781a
mov dword [rbp - 0x24], 0x781a7809
mov dword [rbp - 0x20], 0x781f781f
mov dword [rbp - 0x1c], 0x78147807
mov dword [rbp - 0x18], 0x7803
mov byte [rbp - 0x14], 1
nop dword [rax]
lea ecx, [rbx + rax]
xor word [rsp + rax*2 + 0x60], cx
inc rax
cmp rax, 0x45
jb 0x18000ab90
mov qword [rsp + 0x58], rdi
mov r9d, 0x90000000
mov qword [rsp + 0x50], rdi
xor ecx, ecx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], r8d
lea r8, [rbp - 0x12]
mov dword [rsp + 0x30], edx
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
mov byte [rbp - 0x14], dil
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, rax
mov qword [0x1800dc3f8], rax
lea rdx, [0x180044cb8]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x1800dc3f8]
mov edx, 0xffffffec
mov r8d, 0x800a0
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov rcx, qword [0x1800dc3f8]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1800dc3f8]
call qword [sym.imp.USER32.dll_UpdateWindow]
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3