Function at 0x180161a90
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x4a8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x470], rax
mov rax, qword [rbp + 0x4a0]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x4a0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180161ae4
xor eax, eax
jmp 0x180162066
mov rax, qword [rbp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
cmp dword [rax], 0x4550
je 0x180161b0d
xor eax, eax
jmp 0x180162066
mov rax, qword [rbp + 0x48]
add rax, 0x18
mov qword [rbp + 0x68], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x68]
mov eax, dword [rcx + rax + 0x74]
mov qword [rbp + 0x88], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x68]
mov eax, dword [rcx + rax + 0x70]
mov qword [rbp + 0xa8], rax
cmp qword [rbp + 0x88], 0
je 0x180161b61
cmp qword [rbp + 0xa8], 0
jne 0x180161c64
mov byte [rbp + 0x368], 0x5b
mov byte [rbp + 0x369], 0x6d
mov byte [rbp + 0x36a], 0x65
mov byte [rbp + 0x36b], 0x6d
mov byte [rbp + 0x36c], 0x6f
mov byte [rbp + 0x36d], 0x72
mov byte [rbp + 0x36e], 0x79
mov byte [rbp + 0x36f], 0x2e
mov byte [rbp + 0x370], 0x63
mov byte [rbp + 0x371], 0x70
mov byte [rbp + 0x372], 0x70
mov byte [rbp + 0x373], 0x3a
mov byte [rbp + 0x374], 0x31
mov byte [rbp + 0x375], 0x38
mov byte [rbp + 0x376], 0x32
mov byte [rbp + 0x377], 0x5d
mov byte [rbp + 0x378], 0x20
mov byte [rbp + 0x379], 0
lea rcx, [rbp + 0x368]
call fcn.1800cefd0
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x428], rax
lea rdx, str.module_has_no_exports:__
mov rcx, qword [rbp + 0x428]
call fcn.18015e890
mov qword [rbp + 0x430], rax
mov rcx, qword [rbp + 0x4a0]
call fcn.180162080
mov qword [rbp + 0x438], rax
mov rdx, qword [rbp + 0x438]
mov rcx, qword [rbp + 0x430]
call fcn.18015e8e0
mov qword [rbp + 0x440], rax
lea rdx, [0x180257fb4]
mov rcx, qword [rbp + 0x440]
call fcn.18015e890
xor eax, eax
jmp 0x180162066
mov rax, qword [rbp + 0xa8]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xc8], rax
mov rax, qword [rbp + 0xc8]
mov eax, dword [rax + 0x20]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xc8]
mov eax, dword [rax + 0x24]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0xc8]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0xc8]
mov eax, dword [rax + 0x18]
mov qword [rbp + 0x148], rax
mov qword [rbp + 0x168], 0
mov rax, qword [rbp + 0x168]
cmp qword [rbp + 0x148], rax
je 0x180161f95
mov rax, qword [rbp + 0x168]
mov rcx, qword [rbp + 0x148]
sub rcx, rax
mov rax, rcx
shr rax, 1
mov rcx, qword [rbp + 0x168]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x188], rax
mov rax, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0x188]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov rdx, rax
mov rcx, qword [rbp + 0x4a8]
call fcn.18012c230
mov dword [rbp + 0x1a4], eax
cmp dword [rbp + 0x1a4], 0
jne 0x180161f66
mov rax, qword [rbp + 0x108]
mov rcx, qword [rbp + 0x188]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rbp + 0x128]
mov eax, dword [rcx + rax*4]
mov dword [rbp + 0x1c4], eax
mov byte [rbp + 0x398], 0x5b
mov byte [rbp + 0x399], 0x6d
mov byte [rbp + 0x39a], 0x65
mov byte [rbp + 0x39b], 0x6d
mov byte [rbp + 0x39c], 0x6f
mov byte [rbp + 0x39d], 0x72
mov byte [rbp + 0x39e], 0x79
mov byte [rbp + 0x39f], 0x2e
mov byte [rbp + 0x3a0], 0x63
mov byte [rbp + 0x3a1], 0x70
mov byte [rbp + 0x3a2], 0x70
mov byte [rbp + 0x3a3], 0x3a
mov byte [rbp + 0x3a4], 0x32
mov byte [rbp + 0x3a5], 0x30
mov byte [rbp + 0x3a6], 0x34
mov byte [rbp + 0x3a7], 0x5d
mov byte [rbp + 0x3a8], 0x20
mov byte [rbp + 0x3a9], 0
lea rcx, [rbp + 0x398]
call fcn.1800cefd0
mov r8, rax
mov dl, 1
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x428], rax
lea rdx, str.export_found:__
mov rcx, qword [rbp + 0x428]
call fcn.18015e890
mov qword [rbp + 0x430], rax
mov rax, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0x188]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x438], rax
mov rdx, qword [rbp + 0x438]
mov rcx, qword [rbp + 0x430]
call fcn.18015e890
mov qword [rbp + 0x440], rax
lea rdx, str.__in__
mov rcx, qword [rbp + 0x440]
call fcn.18015e890
mov qword [rbp + 0x448], rax
mov rcx, qword [rbp + 0x4a0]
call fcn.180162080
mov qword [rbp + 0x450], rax
mov rdx, qword [rbp + 0x450]
mov rcx, qword [rbp + 0x448]
call fcn.18015e8e0
mov qword [rbp + 0x458], rax
lea rdx, str.__at:
mov rcx, qword [rbp + 0x458]
call fcn.18015e890
mov qword [rbp + 0x460], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x3c4], ax
movzx eax, word [rbp + 0x3c4]
mov word [rbp + 0x3e4], ax
movzx edx, word [rbp + 0x3e4]
mov rcx, qword [rbp + 0x460]
call fcn.18015e9e0
mov qword [rbp + 0x468], rax
mov edx, dword [rbp + 0x1c4]
mov rcx, qword [rbp + 0x468]
call fcn.1800e80b0
mov eax, dword [rbp + 0x1c4]
cmp rax, qword [rbp + 0xa8]
jb 0x180161f51
mov eax, dword [rbp + 0x1c4]
sub rax, qword [rbp + 0xa8]
cmp rax, qword [rbp + 0x88]
jae 0x180161f51
jmp 0x180161f95
mov eax, dword [rbp + 0x1c4]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
jmp 0x180162066
cmp dword [rbp + 0x1a4], 0
jle 0x180161f82
mov rax, qword [rbp + 0x188]
inc rax
mov qword [rbp + 0x168], rax
jmp 0x180161f90
mov rax, qword [rbp + 0x188]
mov qword [rbp + 0x148], rax
jmp 0x180161ce9
mov byte [rbp + 0x408], 0x5b
mov byte [rbp + 0x409], 0x6d
mov byte [rbp + 0x40a], 0x65
mov byte [rbp + 0x40b], 0x6d
mov byte [rbp + 0x40c], 0x6f
mov byte [rbp + 0x40d], 0x72
mov byte [rbp + 0x40e], 0x79
mov byte [rbp + 0x40f], 0x2e
mov byte [rbp + 0x410], 0x63
mov byte [rbp + 0x411], 0x70
mov byte [rbp + 0x412], 0x70
mov byte [rbp + 0x413], 0x3a
mov byte [rbp + 0x414], 0x32
mov byte [rbp + 0x415], 0x32
mov byte [rbp + 0x416], 0x35
mov byte [rbp + 0x417], 0x5d
mov byte [rbp + 0x418], 0x20
mov byte [rbp + 0x419], 0
lea rcx, [rbp + 0x408]
call fcn.1800cefd0
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x428], rax
lea rdx, str.export_not_found:
mov rcx, qword [rbp + 0x428]
call fcn.18015e890
mov qword [rbp + 0x430], rax
mov rdx, qword [rbp + 0x4a8]
mov rcx, qword [rbp + 0x430]
call fcn.18015e890
xor eax, eax
mov rcx, qword [rbp + 0x470]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x488]
pop rdi
pop rbp
ret