Function at 0x18000130c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r13
push r14
lea rbp, [rax - 0x248]
sub rsp, 0x330
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x220], rax
xor r14d, r14d
lea rcx, [rbp + 0x12]
xor edx, edx
mov r8d, 0x206
mov qword [0x18000bf30], r14
mov qword [0x18000bf28], r14
mov qword [0x18000bf20], r14
mov word [rbp + 0x10], r14w
call fcn.180005840
lea edx, [r14 + 0x64]
mov r8d, 0x104
xor ecx, ecx
lea eax, [rdx - 0x31]
mov word [rbp - 0x10], dx
mov dword [rsp + 0x48], 0x750072
mov word [rsp + 0x54], ax
xor eax, eax
mov dword [rsp + 0x4c], 0x64006e
mov qword [rsp + 0x62], rax
mov dword [rsp + 0x6a], eax
mov word [rsp + 0x6e], ax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rsp + 0x3a], rax
mov dword [rsp + 0x42], eax
mov word [rsp + 0x46], ax
mov qword [rbp], rax
mov qword [rbp + 8], rax
lea eax, [rdx - 1]
lea rdx, [rbp + 0x10]
mov word [rbp - 0x3c], ax
xor eax, eax
mov dword [rsp + 0x50], 0x6c006c
mov dword [rsp + 0x56], 0x2e0032
mov dword [rsp + 0x5a], 0x780065
mov dword [rsp + 0x5e], 0x65
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x76], rax
mov dword [rbp - 0x6e], eax
mov word [rbp - 0x6a], ax
mov dword [rbp - 0x68], 0x790073
mov dword [rbp - 0x64], 0x700073
mov dword [rbp - 0x60], 0x650072
mov dword [rbp - 0x5c], 0x2e0070
mov dword [rbp - 0x58], 0x780065
mov dword [rbp - 0x54], 0x65
mov dword [rsp + 0x20], 0x780065
mov dword [rsp + 0x24], 0x6c0070
mov dword [rsp + 0x28], 0x72006f
mov dword [rsp + 0x2c], 0x720065
mov dword [rsp + 0x30], 0x65002e
mov dword [rsp + 0x34], 0x650078
mov word [rsp + 0x38], r14w
mov dword [rbp - 0x18], 0x650072
mov dword [rbp - 0x14], 0x650067
mov dword [rbp - 0xe], 0x740069
mov dword [rbp - 0xa], 0x65002e
mov dword [rbp - 6], 0x650078
mov word [rbp - 2], r14w
mov dword [rbp - 0x40], 0x760073
mov dword [rbp - 0x3a], 0x6f0068
mov dword [rbp - 0x36], 0x740073
mov dword [rbp - 0x32], 0x65002e
mov dword [rbp - 0x2e], 0x650078
mov word [rbp - 0x2a], r14w
mov dword [rsp + 0x70], 0x690077
mov dword [rsp + 0x74], 0x6c006e
mov dword [rsp + 0x78], 0x67006f
mov dword [rsp + 0x7c], 0x6e006f
mov dword [rbp - 0x80], 0x65002e
mov dword [rbp - 0x7c], 0x650078
mov word [rbp - 0x78], r14w
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rbx, [rbp + rcx*2 + 0x10]
jmp 0x180001508
sub rbx, 2
cmp word [rbx], 0x5c
jne 0x180001504
add rbx, 2
lea rdx, [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18000157b
lea rdx, [rbp - 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18000157b
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18000157b
lea rdx, [rbp - 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18000157b
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18000157b
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x180001585
mov dword [0x18000bf20], 1
lea rax, [0x18000bf20]
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.180001c10
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rbp
ret