Function at 0x1800d8ec4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov byte [rax + 0x18], r8b
mov byte [rax + 0x10], dl
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3f8]
sub rsp, 0x4b8
mov qword [rbp + 0xe8], 0xfffffffffffffffe
mov r14, rcx
mov r9d, dword [0x180195f94]
mov rax, qword gs:[0x58]
mov esi, 4
mov rbx, qword [rax + r9*8]
or r15, 0xffffffffffffffff
xor r12d, r12d
lea r13d, [r15 + 0x11]
mov eax, dword [rbx + rsi]
cmp dword [0x1801a0930], eax
jle 0x1800d913b
lea rcx, [0x1801a0930]
call fcn.180157af0
cmp dword [0x1801a0930], r15d
jne 0x1800d913b
lea rax, [rbp + 0x68]
mov qword [rbp - 0x48], rax
mov byte [rsp + 0x70], 0x48
mov byte [rsp + 0x71], 0x77
mov byte [rsp + 0x72], 0x6a
mov byte [rsp + 0x73], 0x66
mov byte [rsp + 0x74], 0x79
mov byte [rsp + 0x75], 0x6a
mov byte [rsp + 0x76], 0x59
mov byte [rsp + 0x77], 0x74
mov byte [rsp + 0x78], 0x74
mov byte [rsp + 0x79], 0x71
mov byte [rsp + 0x7a], 0x6d
mov byte [rsp + 0x7b], 0x6a
mov byte [rsp + 0x7c], 0x71
mov byte [rsp + 0x7d], 0x75
mov byte [rsp + 0x7e], 0x38
mov byte [rsp + 0x7f], 0x37
mov byte [rbp - 0x80], 0x58
mov byte [rbp - 0x7f], 0x73
mov byte [rbp - 0x7e], 0x66
mov byte [rbp - 0x7d], 0x75
mov byte [rbp - 0x7c], 0x78
mov byte [rbp - 0x7b], 0x6d
mov byte [rbp - 0x7a], 0x74
mov byte [rbp - 0x79], 0x79
mov byte [rbp - 0x78], r12b
mov al, byte [rsp + 0x70]
mov ecx, r12d
mov al, byte [rsp + rcx + 0x70]
sub al, 5
mov byte [rsp + rcx + 0x70], al
inc rcx
cmp rcx, 0x18
jb 0x1800d8fc9
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x78], r12
mov qword [rbp + 0x80], r12
lea rax, [rsp + 0x70]
mov r8, r15
inc r8
cmp byte [rax + r8], r12b
jne 0x1800d8ff6
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x68]
call fcn.18000c7ac
nop
mov byte [rsp + 0x44], 0x6d
mov byte [rsp + 0x45], 0x67
mov byte [rsp + 0x46], 0x74
mov byte [rsp + 0x47], 0x70
mov byte [rsp + 0x48], 0x67
mov byte [rsp + 0x49], 0x6e
mov byte [rsp + 0x4a], 0x35
mov byte [rsp + 0x4b], 0x34
mov byte [rsp + 0x4c], r12b
mov al, byte [rsp + 0x44]
mov rcx, r12
mov al, byte [rsp + rcx + 0x44]
sub al, 2
mov byte [rsp + rcx + 0x44], al
inc rcx
cmp rcx, 8
jb 0x1800d9042
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 8], xmm1
lea rax, [rsp + 0x44]
mov r8, r15
inc r8
cmp byte [rax + r8], r12b
jne 0x1800d906c
lea rdx, [rsp + 0x44]
lea rcx, [rbp - 0x18]
call fcn.18000c7ac
nop
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0xf0]
call fcn.1800ceb58
nop
mov qword [rsp + 0x20], r12
mov r9b, 1
lea r8, [rbp + 0x68]
mov rdx, rax
lea rcx, [0x18019e500]
call fcn.180013534
nop
mov rdx, qword [rbp]
cmp rdx, r13
jb 0x1800d90ee
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800d90e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800d90e9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180157a14
movdqa xmm0, xmmword [0x180165930]
movdqu xmmword [rbp - 8], xmm0
mov byte [rbp - 0x18], r12b
xor edx, edx
lea r8d, [rdx + 9]
lea rcx, [rsp + 0x44]
call qword [sym.imp.VCRUNTIME140.dll_memset]
nop
xor edx, edx
lea r8d, [rdx + 0x19]
lea rcx, [rsp + 0x70]
call qword [sym.imp.VCRUNTIME140.dll_memset]
lea rcx, [0x1801639f4]
call fcn.1801579fc
nop
lea rcx, [0x1801a0930]
call fcn.180157a84
mov dil, 0x65
mov eax, dword [rbx + rsi]
cmp dword [0x18019f520], eax
jle 0x1800d9391
lea rcx, [0x18019f520]
call fcn.180157af0
cmp dword [0x18019f520], r15d
jne 0x1800d9391
lea rax, [rbp + 0x88]
mov qword [rbp - 0x20], rax
mov byte [rsp + 0x60], 0x58
mov byte [rsp + 0x61], 0x7a
mov byte [rsp + 0x62], 0x77
mov byte [rsp + 0x63], 0x6b
mov byte [rsp + 0x64], 0x6d
mov byte [rsp + 0x65], 0x7b
mov byte [rsp + 0x66], 0x7b
mov byte [rsp + 0x67], 0x3b
mov byte [rsp + 0x68], 0x3a
mov byte [rsp + 0x69], 0x4e
mov byte [rsp + 0x6a], 0x71
mov byte [rsp + 0x6b], 0x7a
mov byte [rsp + 0x6c], 0x7b
mov byte [rsp + 0x6d], 0x7c
mov byte [rsp + 0x6e], 0x5f
mov byte [rsp + 0x6f], r12b
mov al, byte [rsp + 0x60]
mov rcx, r12
mov al, byte [rsp + rcx + 0x60]
sub al, 8
mov byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 0xf
jb 0x1800d91c8
xorps xmm0, xmm0
movups xmmword [rbp + 0x88], xmm0
mov qword [rbp + 0x98], r12
mov qword [rbp + 0xa0], r12
lea rax, [rsp + 0x60]
mov r8, r15
inc r8
cmp byte [rax + r8], r12b
jne 0x1800d91fb
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x88]
call fcn.18000c7ac
nop
mov dword [rsp + 0x50], 8
mov eax, dword [rsp + 0x50]
xor al, 0x6b
mov byte [rsp + 0x54], al
mov eax, dword [rsp + 0x50]
inc al
xor al, dil
mov byte [rsp + 0x55], al
mov eax, dword [rsp + 0x50]
add al, 2
xor al, 0x72
mov byte [rsp + 0x56], al
mov eax, dword [rsp + 0x50]
add al, 3
xor al, 0x6e
mov byte [rsp + 0x57], al
mov eax, dword [rsp + 0x50]
add al, 4
xor al, dil
mov byte [rsp + 0x58], al
mov eax, dword [rsp + 0x50]
add al, 5
xor al, 0x6c
mov byte [rsp + 0x59], al
mov eax, dword [rsp + 0x50]
add al, 6
xor al, 0x33
mov byte [rsp + 0x5a], al
mov eax, dword [rsp + 0x50]
add al, 7
xor al, 0x32
mov byte [rsp + 0x5b], al
xor eax, eax
mov byte [rsp + 0x5c], al
mov al, byte [rsp + 0x54]
mov rdx, r12
mov al, byte [rsp + rdx + 0x54]
mov ecx, dword [rsp + 0x50]
add cl, dl
xor cl, al
mov byte [rsp + rdx + 0x54], cl
inc rdx
cmp rdx, 8
jb 0x1800d928b
mov byte [rsp + 0x5c], r12b
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x18], xmm1
lea rax, [rsp + 0x54]
mov r8, r15
inc r8
cmp byte [rax + r8], r12b
jne 0x1800d92c0
lea rdx, [rsp + 0x54]
lea rcx, [rbp + 8]
call fcn.18000c7ac
nop
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x110]
call fcn.1800ceb58
nop
mov qword [rsp + 0x20], r12
mov r9b, 1
lea r8, [rbp + 0x88]
mov rdx, rax
lea rcx, [0x18019f870]
call fcn.1800122c8
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, r13
jb 0x1800d9345
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800d9340
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800d9340
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180157a14
movdqa xmm0, xmmword [0x180165930]
movdqu xmmword [rbp + 0x18], xmm0
mov byte [rbp + 8], r12b
xor edx, edx
lea r8d, [rdx + 9]
lea rcx, [rsp + 0x54]
call qword [sym.imp.VCRUNTIME140.dll_memset]
nop
mov r8, r13
xor edx, edx
lea rcx, [rsp + 0x60]
call qword [sym.imp.VCRUNTIME140.dll_memset]
lea rcx, [0x1801639e8]
call fcn.1801579fc
nop
lea rcx, [0x18019f520]
call fcn.180157a84
mov eax, dword [rbx + rsi]
cmp dword [0x18019ff88], eax
jle 0x1800d960c
lea rcx, [0x18019ff88]
call fcn.180157af0
cmp dword [0x18019ff88], r15d
jne 0x1800d960c
lea rax, [rbp + 0xa8]
mov qword [rbp - 0x20], rax
mov dword [rsp + 0x30], 0x29
mov eax, dword [rsp + 0x30]
xor al, 0x50
mov byte [rsp + 0x34], al
mov eax, dword [rsp + 0x30]
inc al
xor al, 0x72
mov byte [rsp + 0x35], al
mov eax, dword [rsp + 0x30]
add al, 2
xor al, 0x6f
mov byte [rsp + 0x36], al
mov eax, dword [rsp + 0x30]
add al, 3
xor al, 0x63
mov byte [rsp + 0x37], al
mov eax, dword [rsp + 0x30]
add al, 4
xor al, dil
mov byte [rsp + 0x38], al
mov eax, dword [rsp + 0x30]
add al, 5
xor al, 0x73
mov byte [rsp + 0x39], al
mov eax, dword [rsp + 0x30]
add al, 6
xor al, 0x73
mov byte [rsp + 0x3a], al
mov eax, dword [rsp + 0x30]
add al, 7
xor al, 0x33
mov byte [rsp + 0x3b], al
mov eax, dword [rsp + 0x30]
add al, 8
xor al, 0x32
mov byte [rsp + 0x3c], al
mov eax, dword [rsp + 0x30]
add al, 9
xor al, 0x4e
mov byte [rsp + 0x3d], al
mov eax, dword [rsp + 0x30]
add al, 0xa
xor al, dil
mov byte [rsp + 0x3e], al
mov eax, dword [rsp + 0x30]
add al, 0xb
xor al, 0x78
mov byte [rsp + 0x3f], al
mov eax, dword [rsp + 0x30]
add al, 0xc
xor al, 0x74
mov byte [rsp + 0x40], al
mov eax, dword [rsp + 0x30]
add al, 0xd
xor al, 0x57
mov byte [rsp + 0x41], al
xor eax, eax
mov byte [rsp + 0x42], al
mov al, byte [rsp + 0x34]
mov rdx, r12
mov al, byte [rsp + rdx + 0x34]
mov ecx, dword [rsp + 0x30]
add cl, dl
xor cl, al
mov byte [rsp + rdx + 0x34], cl
inc rdx
cmp rdx, 0xe
jb 0x1800d9481
mov byte [rsp + 0x42], r12b
xorps xmm0, xmm0
movups xmmword [rbp + 0xa8], xmm0
mov qword [rbp + 0xb8], r12
mov qword [rbp + 0xc0], r12
lea rax, [rsp + 0x34]
mov r8, r15
inc r8
cmp byte [rax + r8], r12b
jne 0x1800d94bf
lea rdx, [rsp + 0x34]
lea rcx, [rbp + 0xa8]
call fcn.18000c7ac
nop
mov dword [rbp - 0x74], 0x20
mov byte [rbp - 0x70], 0x4b
mov byte [rbp - 0x6f], 0x45
mov byte [rbp - 0x6e], 0x52
mov byte [rbp - 0x6d], 0x4e
mov byte [rbp - 0x6c], 0x45
mov byte [rbp - 0x6b], 0x4c
mov byte [rbp - 0x6a], 0x13
mov byte [rbp - 0x69], 0x12
xor eax, eax
mov byte [rbp - 0x68], al
mov al, byte [rbp - 0x70]
mov rdx, r12
mov al, byte [rbp + rdx - 0x70]
mov ecx, dword [rbp - 0x74]
xor cl, al
mov byte [rbp + rdx - 0x70], cl
inc rdx
cmp rdx, 8
jb 0x1800d950c
mov byte [rbp - 0x68], r12b
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x38], xmm1
lea rax, [rbp - 0x70]
mov r8, r15
inc r8
cmp byte [rax + r8], r12b
jne 0x1800d953c
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x28]
call fcn.18000c7ac
nop
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x130]
call fcn.1800ceb58
nop
mov qword [rsp + 0x20], r12
mov r9b, 1
lea r8, [rbp + 0xa8]
mov rdx, rax
lea rcx, [0x18019dcc0]
call fcn.1800122c8
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, r13
jb 0x1800d95c0
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800d95bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800d95bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180157a14
movdqa xmm0, xmmword [0x180165930]
movdqu xmmword [rbp + 0x38], xmm0
mov byte [rbp + 0x28], r12b
xor edx, edx
lea r8d, [rdx + 9]
lea rcx, [rbp - 0x70]
call qword [sym.imp.VCRUNTIME140.dll_memset]
nop
xor edx, edx
lea r8d, [rdx + 0xf]
lea rcx, [rsp + 0x34]
call qword [sym.imp.VCRUNTIME140.dll_memset]
lea rcx, [0x1801639dc]
call fcn.1801579fc
nop
lea rcx, [0x18019ff88]
call fcn.180157a84
xor r8d, r8d
lea edx, [r8 + 2]
lea rcx, [0x18019e500]
call fcn.1800103e0
mov rsi, rax
mov qword [rbp - 0x48], rax
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x174]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x170], 0x238
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x60], xmm0
mov rdi, r12
mov qword [rbp - 0x50], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea rcx, [rbp + 0xc8]
call fcn.1800d7fb8
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r12w
lea r8, [rbp + 0x170]
mov rdx, rsi
lea rcx, [0x18019f870]
call fcn.180010458
mov rbx, qword [rbp - 0x58]
test eax, eax
je 0x1800d98bb
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x60], r12
lea rax, [rbp + 0x19c]
mov r8, r15
inc r8
cmp word [rax + r8*2], r12w
jne 0x1800d96bb
lea rdx, [rbp + 0x19c]
lea rcx, [rbp + 0x48]
call fcn.18000c67c
mov r11, qword [r14 + 0x10]
mov r10, r14
cmp qword [r14 + 0x18], 8
jb 0x1800d96e6
mov r10, qword [r14]
lea rdx, [rbp + 0x48]
mov r15, qword [rbp + 0x60]
cmp r15, 8
setae r13b
mov r8, qword [rbp + 0x48]
cmovae rdx, r8
test r11, r11
jne 0x1800d9708
mov rsi, r12
jmp 0x1800d975e
cmp r11, qword [rbp + 0x58]
ja 0x1800d975a
mov rsi, rdx
movzx r12d, word [r10]
cmp word [rsi], r12w
jne 0x1800d9741
mov r14, r11
mov r9, r10
test r11, r11
je 0x1800d974c
mov rax, rsi
sub rax, r10
movzx ecx, word [rax + r9]
cmp cx, word [r9]
jne 0x1800d9741
add r9, 2
sub r14, 1
jmp 0x1800d9724
cmp rsi, rdx
je 0x1800d9757
sub rsi, 2
jmp 0x1800d9715
sub rsi, rdx
sar rsi, 1
xor r12d, r12d
jmp 0x1800d975e
xor r12d, r12d
or rsi, 0xffffffffffffffff
test r13b, r13b
je 0x1800d9798
lea rdx, [r15*2 + 2]
mov rax, r8
cmp rdx, 0x1000
jb 0x1800d9790
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800d98b4
mov rcx, r8
call fcn.180157a14
test rsi, rsi
jne 0x1800d9886
cmp byte [rbp + 0x408], r12b
je 0x1800d984b
mov edx, dword [rbp + 0x178]
lea rcx, [rbp + 0x150]
call fcn.1800d7fb8
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.180015424
lea rcx, [rbp + 0x150]
call fcn.18000bd8c
lea rcx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 8
cmovae rcx, qword [rbp + 0xc8]
lea r8, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae r8, qword [rbp - 0x40]
mov r9, qword [rbp - 0x30]
mov rdx, r9
mov r10, qword [rbp + 0xd8]
cmp r10, r9
cmovb rdx, r10
test rdx, rdx
je 0x1800d982e
sub r8, rcx
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x1800d9886
add rcx, 2
sub rdx, 1
jne 0x1800d981a
cmp r9, r10
jb 0x1800d9886
ja 0x1800d9886
cmp rbx, rdi
je 0x1800d9842
mov eax, dword [rbp + 0x178]
jmp 0x1800d985f
lea r8, [rbp + 0x178]
jmp 0x1800d9872
cmp byte [rbp + 0x410], r12b
je 0x1800d9835
cmp rbx, rdi
je 0x1800d986b
mov eax, dword [rbp + 0x190]
mov dword [rbx], eax
add rbx, 4
mov qword [rbp - 0x58], rbx
jmp 0x1800d9886
lea r8, [rbp + 0x190]
mov rdx, rbx
lea rcx, [rbp - 0x60]
call fcn.18001fba4
mov rdi, qword [rbp - 0x50]
mov rbx, qword [rbp - 0x58]
lea r8, [rbp + 0x170]
mov rsi, qword [rbp - 0x48]
mov rdx, rsi
lea rcx, [0x18019dcc0]
call fcn.180010458
test eax, eax
je 0x1800d98bb
mov r14, qword [rbp + 0x400]
or r15, 0xffffffffffffffff
jmp 0x1800d96a2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rbp - 0x60]
cmp rsi, rbx
jne 0x1800d98d2
or ebx, 0xffffffff
jmp 0x1800d9908
sub rbx, rsi
sar rbx, 2
sub ebx, 1
jne 0x1800d98e3
mov eax, r12d
jmp 0x1800d9903
mov dword [rbp + 0x418], r12d
mov dword [rbp + 0x41c], ebx
lea rdx, [0x180197590]
lea rcx, [rbp + 0x418]
call fcn.1800a7f70
cdqe
mov ebx, dword [rsi + rax*4]
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x1800d994b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800d9946
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800d9946
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180157a14
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r12w
lea rcx, [rbp + 0xc8]
call fcn.18000bd8c
nop
test rsi, rsi
je 0x1800d99a8
sub rdi, rsi
and rdi, 0xfffffffffffffffc
mov rax, rsi
cmp rdi, 0x1000
jb 0x1800d999d
add rdi, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800d999d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rdi
mov rcx, rsi
call fcn.180157a14
mov eax, ebx
add rsp, 0x4b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret