Function at 0x180039be0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ecx, 0x59
mov dword [rbp - 0x30], 0x370059
mov dword [rbp - 0x2c], 0x3d002d
mov dword [rbp - 0x28], 0x350035
mov dword [rbp - 0x24], 0x3d0077
mov dword [rbp - 0x20], 0x350035
mov word [rbp - 0x1c], cx
movzx eax, word [0x1800bd1a4]
xor ax, cx
mov word [rbp - 0x1a], ax
movzx eax, word [0x1800bd1a6]
xor ax, cx
mov word [rbp - 0x18], ax
movzx eax, word [str.RtlDosPathNameToNtPathName_U]
xor ax, cx
mov word [rbp - 0x16], ax
movzx eax, word [0x1800bd1aa]
xor ax, cx
mov word [rbp - 0x14], ax
movzx eax, word [0x1800bd1ac]
xor ax, cx
mov word [rbp - 0x12], ax
movzx eax, word [0x1800bd1ae]
xor ax, cx
mov word [rbp - 0x10], ax
movzx eax, word [0x1800bd1b0]
xor ax, cx
mov word [rbp - 0xe], ax
movzx eax, word [0x1800bd1b2]
xor ax, cx
mov word [rbp - 0xc], ax
movzx eax, word [0x1800bd1b4]
xor ax, cx
mov word [rbp - 0xa], ax
xor eax, eax
mov word [rbp - 8], ax
xor esi, esi
nop dword [rax]
xor word [rbp + rax*2 - 0x2e], cx
inc rax
cmp rax, 0x13
jae 0x180039cc4
movzx ecx, word [rbp - 0x30]
jmp 0x180039cb0
mov word [rbp - 8], si
lea rcx, [rbp - 0x2e]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
call fcn.180026d20
mov rbx, rax
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0xc
lea rdx, str.NtLoadDriver
lea rcx, [rbp - 0x50]
call fcn.18002d6c0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.180038f70
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x180039d53
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180039d4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180039f63
call fcn.18003b2f0
call fcn.180026d20
mov rbx, rax
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0xe
lea rdx, str.NtUnloadDriver
lea rcx, [rbp - 0x50]
call fcn.18002d6c0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.180038f70
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x180039dd1
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180039dcc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180039f69
call fcn.18003b2f0
call fcn.180026d20
mov rbx, rax
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x1c
lea rdx, str.RtlDosPathNameToNtPathName_U
lea rcx, [rbp - 0x50]
call fcn.18002d6c0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.180038f70
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x180039e4f
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180039e4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180039f6f
call fcn.18003b2f0
call fcn.180026d20
mov rbx, rax
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x14
lea rdx, [0x1800bcad0]
lea rcx, [rbp - 0x50]
call fcn.18002d6c0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.180038f70
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x180039ecd
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180039ec8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180039f75
call fcn.18003b2f0
call fcn.180026d20
mov rbx, rax
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x14
lea rdx, str.RtlFreeUnicodeString
lea rcx, [rbp - 0x50]
call fcn.18002d6c0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.180038f70
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x180039f47
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180039f42
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180039f5d
call fcn.18003b2f0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.18004cc60
int3
call fcn.18004cc60
int3
call fcn.18004cc60
int3
call fcn.18004cc60
int3
call fcn.18004cc60
int3