Function at 0x1800139c0
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections

Disassembly:
push rbp
push rdi
lea rbp, [rsp - 0x68]
sub rsp, 0x168
mov rax, qword [0x180030010]
xor rax, rsp
mov qword [rbp + 0x40], rax
mov qword [rbp - 0x58], rcx
mov rdi, rdx
mov rcx, rdx
call fcn.180014f20
test eax, eax
jne 0x180013f1c
mov qword [rsp + 0x180], rbx
lea ecx, [rax + 1]
mov qword [rsp + 0x190], rsi
mov qword [rsp + 0x198], r12
mov qword [rsp + 0x160], r13
mov qword [rsp + 0x158], r14
mov qword [rsp + 0x150], r15
call fcn.180010c50
mov rcx, rax
call fcn.180010e70
movdqa xmm0, xmmword [str.NtCreateSection]
lea rcx, [rsp + 0x50]
mov rbx, rax
mov qword [rsp + 0x70], rax
xor eax, eax
xor edx, edx
mov r15d, eax
movdqu xmmword [rsp + 0x50], xmm0
call fcn.180010df0
movdqa xmm0, xmmword [0x180021160]
lea rcx, [rsp + 0x50]
xor edx, edx
mov word [rsp + 0x60], 0x6e6f
movdqu xmmword [rsp + 0x50], xmm0
mov r14, rax
mov byte [rsp + 0x62], r15b
call fcn.180010df0
movdqa xmm0, xmmword [0x1800210e0]
lea rcx, [rsp + 0x50]
xor edx, edx
mov dword [rsp + 0x60], 0x6e6f6974
movdqu xmmword [rsp + 0x50], xmm0
mov r13, rax
mov byte [rsp + 0x64], r15b
call fcn.180010df0
movdqa xmm0, xmmword [0x1800211c0]
lea rcx, [rsp + 0x50]
xor edx, edx
mov qword [rbp - 0x50], rax
movdqu xmmword [rsp + 0x50], xmm0
mov rsi, rax
mov dword [rsp + 0x60], 0x79726f
call fcn.180010df0
movdqa xmm0, xmmword [0x180021150]
lea rcx, [rsp + 0x50]
xor edx, edx
mov qword [rbp - 0x48], rax
movdqu xmmword [rsp + 0x50], xmm0
mov r12, rax
mov dword [rsp + 0x60], 0x72506e6f
mov dword [rsp + 0x64], 0x7365636f
mov word [rsp + 0x68], 0x73
call fcn.180010df0
movdqa xmm0, xmmword [0x180021190]
lea rcx, [rsp + 0x50]
xor edx, edx
mov qword [rbp - 0x78], rax
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x656765
call fcn.180010df0
movdqa xmm0, xmmword [0x1800211f0]
lea rcx, [rsp + 0x50]
xor edx, edx
mov qword [rbp - 0x68], rax
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x636f7250
mov dword [rsp + 0x64], 0x737365
call fcn.180010df0
movdqa xmm0, xmmword [0x1800211a0]
lea rcx, [rsp + 0x50]
xor edx, edx
mov qword [rbp - 0x70], rax
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x656765
call fcn.180010df0
mov rcx, rbx
mov qword [rbp - 0x60], rax
call fcn.180014f20
test eax, eax
jne 0x180013bf5
mov rcx, rbx
call fcn.180014060
mov rcx, rax
mov r15, rax
sub rcx, rbx
add r14, rcx
mov rcx, rax
sub rcx, rbx
add r13, rcx
mov rcx, rax
sub rcx, rbx
add rsi, rcx
mov rcx, rax
sub rcx, rbx
mov qword [rbp - 0x50], rsi
add r12, rcx
mov rcx, rax
sub rax, rbx
mov qword [rbp - 0x48], r12
add qword [rbp - 0x68], rax
sub rcx, rbx
add qword [rbp - 0x78], rcx
mov rax, r15
sub rax, rbx
add qword [rbp - 0x70], rax
mov rax, r15
sub rax, rbx
add qword [rbp - 0x60], rax
mov rcx, rdi
call fcn.180013f40
mov qword [rsp + 0x50], rax
lea r9, [rbp + 0x30]
xor r8d, r8d
mov edx, 0xf001f
movsxd rsi, dword [rax + 0x3c]
add rsi, rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0x40
movzx ecx, word [rsi + 0x14]
lea r12, [rsi + 0x18]
add r12, rcx
mov qword [rbp + 0x28], rax
mov ecx, dword [rsi + 0x50]
mov qword [rbp + 0x30], rcx
lea rcx, [rbp + 0x28]
call r14
xor ecx, ecx
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x40], ecx
lea rax, [rbp + 0x38]
mov dword [rsp + 0x38], 2
lea r8, [rbp + 0x20]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov qword [rsp + 0x28], rcx
lea rdx, [rcx - 1]
mov qword [rsp + 0x20], rcx
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x38], rcx
mov rcx, qword [rbp + 0x28]
call r13
cmp qword [rbp - 0x58], rdi
jne 0x180013c97
mov r14, rdi
jmp 0x180013ca2
mov rcx, rdi
call fcn.180014060
mov r14, rax
mov rcx, qword [rbp + 0x20]
mov r8d, 1
mov rdx, r14
call fcn.180011380
xor eax, eax
mov r10d, eax
cmp ax, word [rsi + 6]
jae 0x180013d0a
xor ebx, ebx
mov ecx, r10d
mov eax, ebx
lea rdx, [rcx + rcx*4]
cmp dword [r12 + rdx*8 + 8], ebx
lea r9, [r12 + rdx*8]
jbe 0x180013cf9
cmp dword [r9 + 0x24], ebx
jge 0x180013cf0
mov r8d, dword [r9 + 0xc]
mov ecx, eax
add r8, rcx
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rdi + r8]
mov qword [r8 + rcx], rdx
add eax, 8
cmp eax, dword [r9 + 8]
jb 0x180013cd5
movzx eax, word [rsi + 6]
inc r10d
cmp r10d, eax
jb 0x180013cc1
mov rbx, qword [rsp + 0x70]
cmp qword [rbp - 0x58], rdi
je 0x180013d18
mov rcx, r14
call fcn.180011050
cmp rdi, rbx
jne 0x180013d86
movdqa xmm0, xmmword [0x1800210c0]
lea rcx, [rsp + 0x70]
xor edx, edx
mov word [rbp - 0x80], 0x7472
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rbp - 0x7e], 0
call fcn.180010df0
mov rdx, qword [rbp + 0x20]
mov r8, rax
sub r8, rbx
mov dword [rsp + 0x70], 0x25ff
lea rax, [0x1800106c0]
mov word [rsp + 0x74], 0
mov qword [rsp + 0x76], rax
mov eax, dword [rsp + 0x78]
movsd xmm0, qword [rsp + 0x70]
movsd qword [r8 + rdx], xmm0
mov dword [r8 + rdx + 8], eax
movzx eax, word [rsp + 0x7c]
mov word [r8 + rdx + 0xc], ax
mov rdx, qword [rbp + 0x20]
mov rcx, 0xffffffffffffffff
mov rbx, qword [rbp - 0x50]
call rbx
mov rdx, rdi
mov rcx, 0xffffffffffffffff
call rbx
mov r8d, dword [rsi + 0x54]
xor edx, edx
mov ecx, dword [rsi + 0x38]
mov rax, qword [rbp - 0x48]
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x78]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x70]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x68]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x60]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, r8d
div rcx
mov qword [rbp - 0x40], r13
xor r13d, r13d
test rdx, rdx
mov qword [rbp - 0x10], rdi
mov qword [rbp], rsi
cmove ecx, r13d
mov qword [rbp + 8], r13
sub rcx, rdx
mov dword [rbp + 0x18], 0x40000000
add rcx, r8
mov qword [rbp + 0x10], rcx
lea rcx, [rbp - 0x40]
call fcn.1800144e0
mov r8, qword [rbp + 0x10]
test r8, r8
je 0x180013e30
mov r9d, dword [rbp + 0x18]
lea rcx, [rbp - 0x40]
mov rdx, qword [rbp + 8]
call fcn.1800146f0
mov ecx, dword [rsi + 0x54]
xor edx, edx
mov r9d, dword [rsi + 0x38]
mov eax, ecx
div r9
mov r8d, 2
test rdx, rdx
cmove r9, r13
sub r9, rdx
lea rdx, [rcx + r9]
mov rcx, rdi
call fcn.180011110
mov r14d, r13d
cmp r13w, word [rsi + 6]
jae 0x180013ec1
nop dword [rax]
nop dword [rax + rax]
mov r11d, dword [rsi + 0x38]
xor edx, edx
mov eax, r14d
lea rcx, [rax + rax*4]
mov r10d, dword [r12 + rcx*8 + 8]
lea rbx, [r12 + rcx*8]
mov ecx, dword [r12 + rcx*8 + 0x24]
mov eax, r10d
div r11
mov r9, rdx
call fcn.1800147f0
mov ecx, dword [rbx + 0xc]
test r9, r9
mov r8d, eax
cmove r11, r13
add rcx, rdi
sub r11, r9
lea rdx, [r10 + r11]
call fcn.180011110
movzx eax, word [rsi + 6]
inc r14d
cmp r14d, eax
jb 0x180013e70
mov rdx, qword [rbp + 0x28]
mov rcx, rdi
call fcn.180014450
mov rcx, qword [rsp + 0x50]
call fcn.180011050
mov r14, qword [rsp + 0x158]
mov r13, qword [rsp + 0x160]
mov r12, qword [rsp + 0x198]
mov rsi, qword [rsp + 0x190]
mov rbx, qword [rsp + 0x180]
test r15, r15
je 0x180013f0c
mov rcx, r15
call fcn.180011050
mov rcx, rdi
call fcn.180010da0
mov r15, qword [rsp + 0x150]
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.1800156d0
add rsp, 0x168
pop rdi
pop rbp
ret