Function at 0x180019760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov r14, rdx
mov r15, rcx
xor r12d, r12d
mov dword [rbp + 0x30], r12d
mov al, 0x3d
mov dword [rsp + 0x60], 0x61003d
mov dword [rsp + 0x64], 0x20002
mov dword [rsp + 0x68], 0x6f0061
mov dword [rsp + 0x6c], 0x720072
mov dword [rsp + 0x70], 0x1e0069
mov dword [rsp + 0x74], 0x64006e
mov dword [rsp + 0x78], 0x69006e
mov dword [rsp + 0x7c], 0x700078
mov dword [rbp - 0x80], 0x18001e
mov dword [rbp - 0x7c], 0x9000d
mov dword [rbp - 0x78], 0x1e0059
mov dword [rbp - 0x74], 0xc0046
mov dword [rbp - 0x70], 0x5f005c
mov dword [rbp - 0x6c], 0xd005e
mov dword [rbp - 0x68], 0x5e0008
mov dword [rbp - 0x64], 0x10000d
mov dword [rbp - 0x60], 0xe005e
mov dword [rbp - 0x5c], 0x5000a
mov dword [rbp - 0x58], 0x90010
mov dword [rbp - 0x54], 0x5f000c
mov dword [rbp - 0x50], 0x100004
mov dword [rbp - 0x4c], 0x5e0004
mov dword [rbp - 0x48], 0x5b0058
mov dword [rbp - 0x44], 0x590010
mov dword [rbp - 0x40], 0xc005b
mov dword [rbp - 0x3c], 0x5f005c
mov dword [rbp - 0x38], 0x5005c
mov dword [rbp - 0x34], 0x5f000f
mov dword [rbp - 0x30], 0xc000d
mov dword [rbp - 0x2c], 0x400008
mov word [rbp - 0x28], r12w
mov ecx, r12d
nop word [rax + rax]
movsx eax, al
xor word [rsp + rcx*2 + 0x62], ax
inc rcx
cmp rcx, 0x3b
jae 0x180019898
movzx eax, byte [rsp + 0x60]
jmp 0x180019880
mov word [rbp - 0x28], r12w
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x90], xmm1
lea rax, [rsp + 0x62]
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp word [rax + r8*2], r12w
jne 0x1800198c1
lea rdx, [rsp + 0x62]
lea rcx, [rbp + 0x80]
call fcn.180039db0
nop
mov al, pe_nt_image_headers64
mov dword [rsp + 0x60], 0x1c0040
mov dword [rsp + 0x64], 0x7f007f
mov dword [rsp + 0x68], 0x12001c
mov dword [rsp + 0x6c], 0xf000f
mov dword [rsp + 0x70], 0x630014
mov dword [rsp + 0x74], 0x190013
mov dword [rsp + 0x78], 0x140013
mov dword [rsp + 0x7c], 0xd0005
mov dword [rbp - 0x80], 0x650063
mov dword [rbp - 0x7c], 0x740070
mov dword [rbp - 0x78], 0x630024
mov dword [rbp - 0x74], 0x24003b
mov dword [rbp - 0x70], 0x220026
mov dword [rbp - 0x6c], 0x240025
mov dword [rbp - 0x68], 0x240023
mov dword [rbp - 0x64], 0x6d0022
mov dword [rbp - 0x60], 0x710072
mov dword [rbp - 0x5c], 0x780074
mov dword [rbp - 0x58], 0x74006d
mov dword [rbp - 0x54], 0x760071
mov dword [rbp - 0x50], 0x6d0024
mov dword [rbp - 0x4c], 0x250079
mov dword [rbp - 0x48], 0x240074
mov dword [rbp - 0x44], 0x23006d
mov dword [rbp - 0x40], 0x230025
mov dword [rbp - 0x3c], 0x720023
mov dword [rbp - 0x38], 0x720074
mov dword [rbp - 0x34], 0x710074
mov dword [rbp - 0x30], 0x780072
mov dword [rbp - 0x2c], 0x3d0023
mov word [rbp - 0x28], r12w
mov rcx, r12
mov r13d, 0x64
nop word [rax + rax]
movsx eax, al
xor word [rsp + rcx*2 + 0x62], ax
inc rcx
cmp rcx, 0x3b
jae 0x1800199e8
movzx eax, byte [rsp + 0x60]
jmp 0x1800199d0
mov word [rbp - 0x28], r12w
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xb0], xmm1
lea rax, [rsp + 0x62]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180019a10
lea rdx, [rsp + 0x62]
lea rcx, [rbp + 0xa0]
call fcn.180039db0
nop
mov al, 0x5a
mov dword [rsp + 0x60], 0x6005a
mov dword [rsp + 0x64], 0x650065
mov dword [rsp + 0x68], 0x80006
mov dword [rsp + 0x6c], 0x150015
mov dword [rsp + 0x70], 0x79000e
mov dword [rsp + 0x74], 0x30009
mov dword [rsp + 0x78], 0xe0009
mov dword [rsp + 0x7c], 0x17001f
mov dword [rbp - 0x80], 0x7f0079
mov dword [rbp - 0x7c], 0x6e006a
mov dword [rbp - 0x78], 0x79003e
mov dword [rbp - 0x74], 0x3e0021
mov dword [rbp - 0x70], 0x69003c
mov dword [rbp - 0x6c], 0x3c006b
mov dword [rbp - 0x68], 0x6a006b
mov dword [rbp - 0x64], 0x77006c
mov dword [rbp - 0x60], 0x62003e
mov dword [rbp - 0x5c], 0x6a006d
mov dword [rbp - 0x58], 0x6e0077
mov dword [rbp - 0x54], 0x69006f
mov dword [rbp - 0x50], 0x77003e
mov dword [rbp - 0x4c], 0x3c0062
mov dword [rbp - 0x48], 0x6b003b
mov dword [rbp - 0x44], 0x3f0077
mov dword [rbp - 0x40], 0x620039
mov dword [rbp - 0x3c], 0x38003b
mov dword [rbp - 0x38], 0x69006e
mov dword [rbp - 0x34], 0x3b003c
mov dword [rbp - 0x30], 0x3e006b
mov dword [rbp - 0x2c], 0x270068
mov word [rbp - 0x28], r12w
mov rcx, r12
movsx eax, al
xor word [rsp + rcx*2 + 0x62], ax
inc rcx
cmp rcx, 0x3b
jae 0x180019b29
movzx eax, byte [rsp + 0x60]
jmp 0x180019b11
mov word [rbp - 0x28], r12w
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xd0], xmm1
lea rax, [rsp + 0x62]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180019b50
lea rdx, [rsp + 0x62]
lea rcx, [rbp + 0xc0]
call fcn.180039db0
nop
mov al, 0x49
mov dword [rsp + 0x60], 0x150049
mov dword [rsp + 0x64], 0x760076
mov dword [rsp + 0x68], 0x1b0015
mov dword [rsp + 0x6c], 0x60006
mov dword [rsp + 0x70], 0x6a001d
mov dword [rsp + 0x74], 0x10001a
mov dword [rsp + 0x78], 0x1d001a
mov dword [rsp + 0x7c], 0x4000c
mov dword [rbp - 0x80], 0x6c006a
mov dword [rbp - 0x7c], 0x7d0079
mov dword [rbp - 0x78], 0x6a002d
mov dword [rbp - 0x74], 0x7c0032
mov dword [rbp - 0x70], 0x28002b
mov dword [rbp - 0x6c], 0x28002d
mov dword [rbp - 0x68], 0x700071
mov dword [rbp - 0x64], 0x640078
mov dword [rbp - 0x60], 0x7d0071
mov dword [rbp - 0x5c], 0x2b007b
mov dword [rbp - 0x58], 0x7d0064
mov dword [rbp - 0x54], 0x70007b
mov dword [rbp - 0x50], 0x64007f
mov dword [rbp - 0x4c], 0x7d0028
mov dword [rbp - 0x48], 0x7f0070
mov dword [rbp - 0x44], 0x7f0064
mov dword [rbp - 0x40], 0x280071
mov dword [rbp - 0x3c], 0x70002c
mov dword [rbp - 0x38], 0x78007a
mov dword [rbp - 0x34], 0x280028
mov dword [rbp - 0x30], 0x7f0078
mov dword [rbp - 0x2c], 0x34002a
mov word [rbp - 0x28], r12w
mov rcx, r12
movsx eax, al
xor word [rsp + rcx*2 + 0x62], ax
inc rcx
cmp rcx, 0x3b
jae 0x180019c69
movzx eax, byte [rsp + 0x60]
jmp 0x180019c51
mov word [rbp - 0x28], r12w
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xf0], xmm1
lea rax, [rsp + 0x62]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180019c90
lea rdx, [rsp + 0x62]
lea rcx, [rbp + 0xe0]
call fcn.180039db0
nop
lea rdi, [rbp + 0x80]
nop dword [rax]
nop dword [rax + rax]
mov ebx, 1
mov r8, rdi
cmp qword [rdi + 0x18], 7
jbe 0x180019cd2
mov r8, qword [rdi]
mov r9d, ebx
mov rdx, r13
lea rcx, [rsp + 0x60]
call fcn.1800069c0
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x38]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [rbp + 0x48], 0x30
mov qword [rbp + 0x50], r12
mov dword [rbp + 0x60], pe_nt_image_headers64
lea rax, [rbp + 0x38]
mov qword [rbp + 0x58], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x68], xmm0
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x100]
lea r8, [rbp + 0x48]
mov edx, 0x40100000
lea rcx, [rbp + 0x160]
call qword [sym.imp.ntdll.dll_NtCreateFile]
test eax, eax
jns 0x180019da2
inc ebx
cmp ebx, 9
jle 0x180019cc5
add rdi, 0x20
lea rax, [rbp + 0x100]
cmp rdi, rax
jne 0x180019cc0
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], r12
mov qword [r14 + 0x18], r12
xor r8d, r8d
lea rdx, [0x1801f19ec]
mov rcx, r14
call fcn.180039db0
jmp 0x180019dde
mov rax, qword [rbp + 0x160]
mov qword [r15 + 0xc0], rax
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], r12
mov qword [r14 + 0x18], r12
lea rax, [rsp + 0x60]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x180019dc4
mov r8, rsi
lea rdx, [rsp + 0x60]
mov rcx, r14
call fcn.180039db0
mov dword [rbp + 0x30], 1
lea r9, [fcn.1800086f0]
mov r8d, 4
mov edx, 0x20
lea rcx, [rbp + 0x80]
call fcn.1800c194c
mov rax, r14
mov rbx, qword [rsp + 0x250]
add rsp, 0x210
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret