Function at 0x180002390
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
xor edi, edi
movabs rax, 0x8a7b0d694c0bb7ad
mov rsi, rcx
mov qword [rbp + 0x6f], rax
mov dword [rbp - 0x21], 0x1c6ad4a
mov dword [rbp - 0x1d], 0xe814612e
xor eax, eax
lea r8d, [rdi + 8]
mov dword [rbp - 0x19], 0xe57dbcc
mov dword [rbp - 0x15], 0xb2493f5b
mov dword [rbp - 0x11], 0x6132f59c
mov dword [rbp - 0xd], 0xbb3a3c2c
mov dword [rbp - 9], 0x7a498380
mov dword [rbp - 5], 0xba3a2059
mov dword [rbp - 1], 0x7f26f39d
mov dword [rbp + 3], 0xbd3e392b
mov dword [rbp + 7], 0x7432f2ef
mov dword [rbp + 0xb], 0x8a433e50
mov edx, 2
nop word [rax + rax]
lea rcx, [rdx - 2]
lea rax, [rax + 6]
and ecx, 7
movzx ecx, byte [rbp + rcx + 0x6f]
xor cl, byte [rbp + rax - 0x27]
mov byte [rbp + rax + 9], cl
lea rcx, [rdx - 1]
and ecx, 7
movzx ecx, byte [rbp + rcx + 0x6f]
xor cl, byte [rbp + rax - 0x26]
mov byte [rbp + rax + 0xa], cl
mov rcx, rdx
and ecx, 7
movzx ecx, byte [rbp + rcx + 0x6f]
xor cl, byte [rbp + rax - 0x25]
mov byte [rbp + rax + 0xb], cl
lea rcx, [rdx + 1]
and ecx, 7
movzx ecx, byte [rbp + rcx + 0x6f]
xor cl, byte [rbp + rax - 0x24]
mov byte [rbp + rax + 0xc], cl
lea rcx, [rdx + 2]
and ecx, 7
movzx ecx, byte [rbp + rcx + 0x6f]
xor cl, byte [rbp + rax - 0x23]
mov byte [rbp + rax + 0xd], cl
lea rcx, [rdx + 3]
add rdx, 6
and ecx, 7
movzx ecx, byte [rbp + rcx + 0x6f]
xor cl, byte [rbp + rax - 0x22]
mov byte [rbp + rax + 0xe], cl
dec r8
jne 0x180001090
lea r8, [rbp + 0x13]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
test rax, rax
je 0x18000113b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x180001140
mov edi, 1
test rbx, rbx
je 0x18000114e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x1800012a0
xor ecx, ecx
call fcn.180003234
mov rcx, rax
call fcn.180003194
xor eax, eax
xor cl, cl
mov word [rbp + 0x70], ax
movzx eax, cl
mov ecx, 0x43
test rsi, rsi
mov word [rbp + 0x71], 0x5c
mov byte [rbp + 0x70], 0x3a
cmovne eax, ecx
lea rcx, [0x180013310]
mov byte [rbp + 0x6f], al
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.advapi32.dll
mov qword [0x1800178c0], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [0x1800178c0]
mov qword [0x1800178a8], rax
lea rax, [0x180001bb0]
lea rdx, [rbp - 0x39]
mov dword [rbp - 0x39], 0x56746547
mov dword [rbp - 0x35], 0x6d756c6f
mov dword [rbp - 0x31], 0x666e4965
mov qword [0x1800165c0], rax
mov dword [rbp - 0x2d], 0x616d726f
mov dword [rbp - 0x29], 0x6e6f6974
mov word [rbp - 0x25], 0x41
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x100
xor ecx, ecx
mov dword [rbp + 0x77], edi
mov qword [0x1800165c8], rax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
xor edx, edx
mov r8d, 0x100
mov rcx, rax
mov rbx, rax
call fcn.180004070
lea r8, [rbp + 0x77]
lea rcx, [rbp + 0x6f]
mov rdx, rbx
call qword [0x1800165c0]
mov edx, dword [rbp + 0x77]
mov rcx, rbx
call qword [0x1800165c0]
mov edx, dword [rbp + 0x77]
mov rcx, rbx
call qword [0x1800165c0]
mov rbx, rax
test rax, rax
je 0x1800012a0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea rcx, [rbx + 4]
mov qword [0x1800165d0], rax
call qword [0x1800165c0]
call qword [0x1800165c0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [0x1800165d0]
lea edx, [rdi + 0x64]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x1800165d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0xc0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
dec edx
je 0x18000239a
mov eax, 1
ret
jmp section..text