Function at 0x180041880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xe40
mov rax, qword [0x1800c2008]
xor rax, rsp
mov qword [rsp + 0xe30], rax
lea rcx, [0x1800a1cf0]
nop
nop
nop
nop
nop
nop
mov dword [rsp + 0x50], 0
mov qword [rsp + 0xc8], 0
mov dword [rsp + 0x118], 0
mov dword [rsp + 0x114], 0
mov dword [rsp + 0x110], 0
mov dword [rsp + 0xc0], 0
mov byte [rsp + 0x9e0], 0x6b
mov byte [rsp + 0x9e1], 0x65
mov byte [rsp + 0x9e2], 0x72
mov byte [rsp + 0x9e3], 0x6e
mov byte [rsp + 0x9e4], 0x65
mov byte [rsp + 0x9e5], 0x6c
mov byte [rsp + 0x9e6], 0x62
mov byte [rsp + 0x9e7], 0x61
mov byte [rsp + 0x9e8], 0x73
mov byte [rsp + 0x9e9], 0x65
mov byte [rsp + 0x9ea], 0x2e
mov byte [rsp + 0x9eb], 0x64
mov byte [rsp + 0x9ec], 0x6c
mov byte [rsp + 0x9ed], 0x6c
mov byte [rsp + 0x9ee], 0
mov byte [rsp + 0x9b0], 0x6e
mov byte [rsp + 0x9b1], 0x74
mov byte [rsp + 0x9b2], 0x64
mov byte [rsp + 0x9b3], 0x6c
mov byte [rsp + 0x9b4], 0x6c
mov byte [rsp + 0x9b5], 0x2e
mov byte [rsp + 0x9b6], 0x64
mov byte [rsp + 0x9b7], 0x6c
mov byte [rsp + 0x9b8], 0x6c
mov byte [rsp + 0x9b9], 0
mov byte [rsp + 0x9c0], 0x61
mov byte [rsp + 0x9c1], 0x70
mov byte [rsp + 0x9c2], 0x70
mov byte [rsp + 0x9c3], 0x68
mov byte [rsp + 0x9c4], 0x65
mov byte [rsp + 0x9c5], 0x6c
mov byte [rsp + 0x9c6], 0x70
mov byte [rsp + 0x9c7], 0x2e
mov byte [rsp + 0x9c8], 0x64
mov byte [rsp + 0x9c9], 0x6c
mov byte [rsp + 0x9ca], 0x6c
mov byte [rsp + 0x9cb], 0
mov byte [rsp + 0x9d0], 0x41
mov byte [rsp + 0x9d1], 0x63
mov byte [rsp + 0x9d2], 0x6c
mov byte [rsp + 0x9d3], 0x61
mov byte [rsp + 0x9d4], 0x79
mov byte [rsp + 0x9d5], 0x65
mov byte [rsp + 0x9d6], 0x72
mov byte [rsp + 0x9d7], 0x73
mov byte [rsp + 0x9d8], 0x2e
mov byte [rsp + 0x9d9], 0x64
mov byte [rsp + 0x9da], 0x6c
mov byte [rsp + 0x9db], 0x6c
mov byte [rsp + 0x9dc], 0
lea rax, [rsp + 0x120]
mov rdi, rax
xor eax, eax
mov ecx, 0x888
rep stosb byte [rdi], al
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xd0], 0
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x114]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x118]
lea r8, [rsp + 0xc8]
mov rdx, qword [rsp + 0xe60]
mov rcx, qword [rsp + 0xe50]
call fcn.180042220
movzx eax, al
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0
jne 0x180041b4c
mov rax, qword [rsp + 0xe50]
mov eax, dword [rax + 0x4458]
or eax, 8
mov rcx, qword [rsp + 0xe50]
mov dword [rcx + 0x4458], eax
xor al, al
jmp 0x180042206
cmp qword [rsp + 0xd8], 0
jne 0x180041b92
mov rax, qword [rsp + 0xe50]
mov eax, dword [rax + 0x4458]
or eax, 8
mov rcx, qword [rsp + 0xe50]
mov dword [rcx + 0x4458], eax
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xe50]
call fcn.180042690
xor al, al
jmp 0x180042206
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
cmp dword [rax + 0xc], 0
je 0x1800420eb
mov r8, qword [rsp + 0xd0]
mov edx, dword [rsp + 0xc0]
mov rax, qword [rsp + 0x58]
mov ecx, dword [rax + 0xc]
call fcn.180028470
mov eax, eax
mov rcx, qword [rsp + 0xc8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], 0
mov rax, qword [rsp + 0x58]
cmp dword [rax], 0
jne 0x180041c28
mov r8, qword [rsp + 0xd0]
mov edx, dword [rsp + 0xc0]
mov rax, qword [rsp + 0x58]
mov ecx, dword [rax + 0x10]
call fcn.180028470
mov eax, eax
mov rcx, qword [rsp + 0xc8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x180041c58
mov r8, qword [rsp + 0xd0]
mov edx, dword [rsp + 0xc0]
mov rax, qword [rsp + 0x58]
mov ecx, dword [rax]
call fcn.180028470
mov eax, eax
mov rcx, qword [rsp + 0xc8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0
mov rcx, qword [rsp + 0xa0]
call qword [0x18008c2f8]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
jne 0x180041c94
mov rax, qword [rsp + 0x58]
add rax, 0x14
mov qword [rsp + 0x58], rax
jmp 0x180041b9f
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x1800420c2
mov byte [rsp + 0xb00], 0
lea rax, [rsp + 0xb01]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov qword [rsp + 0x70], 0
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0x10]
mov rcx, qword [rsp + 0xe58]
add rcx, rax
mov rax, rcx
movsxd rcx, dword [rsp + 0x68]
mov rax, qword [rax + rcx]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x60]
mov ecx, 0x80000000
mov rax, qword [rax]
and rax, rcx
test rax, rax
je 0x180041d4b
mov rax, qword [rsp + 0x60]
mov rax, qword [rax]
and rax, 0x7fffffff
mov dword [rsp + 0x6c], eax
mov r8d, dword [rsp + 0x6c]
lea rdx, [0x1800a1d10]
lea rcx, [rsp + 0xb00]
call fcn.180012800
movzx eax, word [rsp + 0x6c]
mov edx, eax
mov rcx, qword [rsp + 0x80]
call qword [0x18008c188]
mov qword [rsp + 0x70], rax
jmp 0x180041dc8
mov r8, qword [rsp + 0xd0]
mov edx, dword [rsp + 0xc0]
mov rax, qword [rsp + 0x60]
mov ecx, dword [rax]
call fcn.180028470
mov eax, eax
mov rcx, qword [rsp + 0xc8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
add rax, 2
mov qword [rsp + 0x90], rax
mov r8d, 0x103
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0xb00]
call fcn.180042740
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
call qword [0x18008c188]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x88], rax
je 0x1800420a2
mov rax, qword [rsp + 0xe50]
mov eax, dword [rax + 0x4450]
cmp dword [rsp + 0x50], eax
jl 0x180041df4
jmp 0x1800420c2
lea rax, [rsp + 0xe0]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov byte [rsp + 0xc10], 0
lea rax, [rsp + 0xc11]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov r8d, 0x30
lea rdx, [rsp + 0xe0]
mov rcx, qword [rsp + 0x88]
call qword [0x18008c310]
mov qword [rsp + 0xb8], rax
cmp qword [rsp + 0xb8], 0x30
jne 0x180041e6f
mov r8d, 0x104
lea rdx, [rsp + 0xc10]
mov rcx, qword [rsp + 0xe8]
call qword [0x18008c3b0]
mov byte [rsp + 0x9f0], 0
lea rax, [rsp + 0x9f1]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov edx, 0x5c
lea rcx, [rsp + 0xc10]
call fcn.180041490
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0x98], 0
je 0x180041ecb
mov rax, qword [rsp + 0x98]
inc rax
mov rdx, rax
lea rcx, [rsp + 0x9f0]
call fcn.18001e310
lea rdx, [rsp + 0x9e0]
lea rcx, [rsp + 0x9f0]
call fcn.1800633f0
test eax, eax
je 0x1800420a2
lea rdx, [rsp + 0x9b0]
lea rcx, [rsp + 0x9f0]
call fcn.1800633f0
test eax, eax
je 0x1800420a2
lea rdx, [rsp + 0x9c0]
lea rcx, [rsp + 0x9f0]
call fcn.1800633f0
test eax, eax
je 0x1800420a2
lea rdx, [rsp + 0x9d0]
lea rcx, [rsp + 0x9f0]
call fcn.1800633f0
test eax, eax
je 0x1800420a2
movsxd rax, dword [rsp + 0x50]
imul rax, rax, 0x108
lea rax, [rsp + rax + 0x230]
mov rdi, rax
xor eax, eax
mov ecx, 0x40
rep stosb byte [rdi], al
movsxd rax, dword [rsp + 0x50]
imul rax, rax, 0x108
lea rax, [rsp + rax + 0x230]
mov r8d, 0x40
lea rdx, [rsp + 0x9f0]
mov rcx, rax
call fcn.180042750
movsxd rax, dword [rsp + 0x50]
imul rax, rax, 0x108
lea rax, [rsp + rax + 0x168]
mov ecx, 1
imul rcx, rcx, 0x40
mov byte [rax + rcx + 0xc8], 0
mov rax, qword [rsp + 0xe58]
mov rcx, qword [rsp + 0x70]
sub rcx, rax
mov rax, rcx
movsxd rcx, dword [rsp + 0x50]
imul rcx, rcx, 0x108
mov dword [rsp + rcx + 0x168], eax
mov rax, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x88]
sub rcx, rax
mov rax, rcx
movsxd rcx, dword [rsp + 0x50]
imul rcx, rcx, 0x108
mov dword [rsp + rcx + 0x16c], eax
movsxd rax, dword [rsp + 0x50]
imul rax, rax, 0x108
lea rax, [rsp + rax + 0x170]
mov r8d, 0x40
mov rdx, qword [rsp + 0xa0]
mov rcx, rax
call fcn.180042750
movsxd rax, dword [rsp + 0x50]
imul rax, rax, 0x108
lea rax, [rsp + rax + 0x168]
mov ecx, 1
imul rcx, rcx, 0x40
mov byte [rax + rcx + 8], 0
movsxd rax, dword [rsp + 0x50]
imul rax, rax, 0x108
lea rax, [rsp + rax + 0x1b0]
mov r8d, pe_nt_image_headers64
lea rdx, [rsp + 0xb00]
mov rcx, rax
call fcn.180042760
movsxd rax, dword [rsp + 0x50]
imul rax, rax, 0x108
lea rax, [rsp + rax + 0x168]
mov ecx, 1
imul rcx, rcx, 0x80
mov byte [rax + rcx + 0x48], 0
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x60], rax
movsxd rax, dword [rsp + 0x68]
add rax, 8
mov dword [rsp + 0x68], eax
jmp 0x180041c94
mov rax, qword [rsp + 0xe50]
mov eax, dword [rax + 0x4450]
cmp dword [rsp + 0x50], eax
jle 0x1800420d8
jmp 0x1800420eb
mov rax, qword [rsp + 0x58]
add rax, 0x14
mov qword [rsp + 0x58], rax
jmp 0x180041b9f
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xe50]
call fcn.180042690
cmp dword [rsp + 0x50], 0
jle 0x1800421fc
mov byte [rsp + 0xd20], 0
lea rax, [rsp + 0xd21]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0xd20]
mov rcx, qword [rsp + 0xe58]
call qword [0x18008c3b0]
mov edx, 0x5c
lea rcx, [rsp + 0xd20]
call fcn.180041490
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0
je 0x18004219a
mov rax, qword [rsp + 0xa8]
inc rax
mov r8d, 0x40
mov rdx, rax
lea rcx, [rsp + 0x120]
call fcn.180042770
mov eax, 1
imul rax, rax, 0x40
mov byte [rsp + rax + 0x120], 0
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x164], eax
mov rax, qword [rsp + 0xe50]
movsxd rax, dword [rax + 0x4448]
imul rax, rax, 0x888
mov rcx, qword [rsp + 0xe50]
lea rax, [rcx + rax + 8]
mov r8d, 0x888
lea rdx, [rsp + 0x120]
mov rcx, rax
call fcn.180028540
mov rax, qword [rsp + 0xe50]
mov eax, dword [rax + 0x4448]
inc eax
mov rcx, qword [rsp + 0xe50]
mov dword [rcx + 0x4448], eax
mov al, 1
jmp 0x180042206
mov rcx, qword [rsp + 0xe30]
xor rcx, rsp
call fcn.18005ef70
add rsp, 0xe40
pop rdi
ret