Function at 0x18000bb70
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov rax, qword [0x180052d38]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov bl, byte [0x180052140]
mov eax, 0xdd8dde0e
mov qword [rbp - 0x19], rax
mov esi, 0x97
mov al, byte [0x180052144]
xor ecx, ecx
mov byte [rbp - 0x58], al
mov r14d, 0x2ad5ca9c
movzx eax, byte [0x180052067]
mov dword [rbp - 0x41], eax
lea r12d, [rsi - 0x61]
mov rax, qword [0x180052158]
mov word [rbp - 0x55], ax
movabs rax, 0x8916fcd3bcfa8
mov qword [rbp - 0x51], rax
mov rax, qword [0x180052118]
movsx r15d, byte [reloc.mozglue.dll_export_full.dll_Ordinal_128]
mov byte [rbp - 0x59], al
movabs rax, 0x9f80bc702d2d9
mov qword [rbp - 0x39], rax
mov rax, qword [0x180052148]
mov qword [rbp - 9], rax
movsx eax, word [0x180052064]
mov dword [rbp - 0x45], eax
mov eax, dword [0x1800520f4]
mov qword [rbp - 0x31], 0x4029
mov dword [rbp - 0x25], eax
mov rax, qword [0x180052118]
mov qword [rbp - 0x11], rax
mov rax, qword [0x180052128]
mov qword [rbp - 0x39], rax
movzx eax, byte [0x18005203f]
mov word [rbp - 0x51], ax
mov al, byte [0x18005203f]
mov rax, qword [0x180052108]
mov byte [rbp - 0x51], al
mov dword [rbp - 0x49], 0x86140323
mov qword [rbp - 0x39], 0x2e88
mov dword [rbp - 0x49], 0x824
mov byte [rbp - 0x51], Ordinal_127
mov qword [rbp - 0x39], 0x52fd
mov rax, qword [0x180052160]
mov eax, 0xdadda9dc
mov dword [rbp - 0x21], r8d
mov qword [rbp - 0x39], rax
xor r8d, r8d
lea eax, [rsi + 0x1c]
mov qword [rbp - 1], rdx
mov word [rbp - 0x51], ax
xor edx, edx
mov al, byte [str.__x_iscii_as]
mov eax, dword [0x180052150]
mov dword [rbp - 0x49], eax
movsx eax, byte [0x18005204b]
mov word [rbp - 0x51], ax
call fcn.18000d01c
movzx eax, al
xor r10d, r10d
mov qword [rbp - 0x39], rax
mov ecx, r10d
mov rax, qword [rbp - 0x19]
movzx eax, word [0x180053720]
mov word [0x180052130], ax
movzx eax, word [0x180052130]
test ax, ax
movzx eax, word [rbp - 0x55]
movzx r8d, word [rbp - 0x55]
sete cl
add r8w, si
sub cx, ax
not r8w
sub r8w, word [0x180052144]
mov eax, 0xf67
movzx edx, cx
movzx ecx, byte [0x18005203f]
imul edx, eax
mov eax, dword [0x180053720]
add r8w, dx
add cx, r8w
not cx
mov word [0x180052140], cx
movdqa xmm0, xmmword [str._ooooo_____eeeee]
lea ecx, [rsi + 0x11]
mov dword [rbp - 0x51], eax
mov eax, dword [0x18005213c]
sub cl, al
mov al, byte [0x18005203f]
add cl, al
mov byte [0x18005203f], cl
mov eax, dword [rbp - 0x51]
add eax, 0x4b3
mov dword [rbp - 0x49], eax
mov eax, dword [rbp - 0x51]
add eax, 0x3c6
mov byte [0x180052063], 0xc4
mov dword [rbp - 0x29], eax
mov eax, dword [rbp - 0x51]
add eax, 0x5ff
mov dword [rbp - 0x51], eax
mov al, byte [rbp - 0x58]
movdqu xmmword [rbp + 7], xmm0
mov dword [rbp + 0x17], 0x67676765
lea eax, [r12 - 0x32]
mov word [0x180052134], ax
mov rcx, qword [rbp - 0x31]
mov eax, dword [0x1800520f4]
sub rcx, rax
mov dword [rbp + 0x1b], 0x5f5f5f5f
mov rax, qword [rbp - 0x31]
sub rcx, rax
mov byte [rbp + 0x1f], r10b
mov qword [rbp - 0x31], rcx
mov eax, dword [0x1800520e4]
add eax, 0xb6
add qword [0x180052110], rax
mov rdx, qword gs:[0x30]
movsx eax, byte [rbp - 0x59]
imul eax, eax, 0x3a
mov byte [0x180052066], al
movabs rax, 0x1ff45c8579692
movsxd rcx, dword [rbp - 0x45]
xor rcx, rax
mov rax, qword [rdx + 0x60]
mov qword [rbp - 0x51], rcx
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x20]
mov r13, qword [rax]
lea rdi, [r13 - 0x10]
test bl, bl
je 0x18000be4c
mov ecx, dword [rbp - 0x45]
movsx eax, byte [reloc.mozglue.dll_export_full.dll_Ordinal_128]
movsx r8d, cx
imul r8d, eax
mov al, byte [rbp - 0x59]
neg al
sbb cx, cx
add cx, 0x7a22
not r8w
add cx, r8w
not cx
mov word [0x180052138], cx
jmp 0x18000be64
mov eax, dword [0x18005208c]
mov r14d, r15d
sub eax, 0x25356bb9
mov qword [0x180052148], rax
neg r14d
mov eax, 0x71ce
mov qword [0x180052118], 2
mov word [0x180052130], ax
mov rax, qword [0x180052118]
test rax, rax
je 0x18000bec3
sub rax, 1
je 0x18000beb8
cmp rax, 1
jne 0x18000bec9
movsx edx, word [0x180052130]
mov ecx, 0x7a21
movzx eax, word [0x180052130]
movsx ecx, cx
imul edx, ecx
sub ax, dx
mov word [0x180052130], ax
jmp 0x18000bec9
mov eax, dword [0x180053720]
mov dword [rbp - 0x41], eax
jmp 0x18000bec9
mov esi, r14d
xor esi, 6
mov al, byte [0x180052066]
test al, al
je 0x18000beed
movzx ecx, word [0x18005216c]
mov rax, qword [0x180052158]
xor rax, rcx
mov qword [0x180052158], rax
jmp 0x18000bf18
movzx eax, word [0x18005216c]
cmp ax, 0x31
je 0x18000bf18
mov rax, qword [0x180052118]
mov cl, byte [reloc.mozglue.dll_export_full.dll_Ordinal_128]
add al, cl
and cl, al
mov byte [reloc.mozglue.dll_export_full.dll_Ordinal_128], cl
mov dword [rbp - 0x45], 0x23
mov eax, dword [rbp - 0x29]
mov ebx, 1
mov eax, dword [rbp - 0x49]
mov eax, dword [rbp - 0x25]
add eax, 0x7a21
movsxd rcx, eax
mov qword [rbp - 0x51], rcx
mov byte [0x180052066], 0x50
jmp 0x18000c0c6
mov dl, byte [0x180052168]
xor r8d, r8d
xor ecx, ecx
call fcn.18000d01c
movzx eax, al
xor edx, edx
mov word [0x180052144], ax
test ax, ax
jne 0x18000bfb8
mov al, byte [0x180052067]
test al, al
je 0x18000bf83
movzx eax, word [0x180052178]
mov r12d, dword [0x180052150]
sub rax, 0x8b
mov qword [rbp - 0x51], rax
jmp 0x18000bfd0
movzx eax, byte [0x18005203f]
cmp dword [rbp - 0x11], eax
jae 0x18000bfd0
mov eax, dword [0x18005208c]
add eax, ebx
mov dword [0x18005208c], eax
mov rcx, qword [0x180052108]
mov rax, qword [rbp - 0x39]
cmp rcx, rax
mov eax, edx
sete al
mov dword [0x18005208c], eax
jmp 0x18000bfd0
cmp qword [0x180052110], rdx
je 0x18000bfd0
mov al, byte [0x18005204b]
lea eax, [rsi + 0x71]
mov byte [str.6RCertAddCertificate], al
mov rcx, qword [rdi + 0x60]
call fcn.18000b29c
cmp eax, 0x18cf5f14
je 0x18000c0fd
mov eax, dword [rbp - 0x41]
mov edx, 0x69
mov dword [rsp + 0x28], eax
xor ecx, ecx
mov dword [rsp + 0x20], 0xab
lea r9d, [rdx + 0x5c]
lea r8d, [rdx + 0x3a]
call fcn.18000cd5c
movsxd rcx, dword [0x180052154]
xor r10d, r10d
mov rax, qword [rbp - 0x19]
mov r9d, r10d
mov edx, dword [0x1800520e4]
cmp rcx, rax
movsx r8d, word [0x18005217c]
mov ecx, r10d
movzx eax, byte [rbp - 0x58]
setg r9b
cmp r8d, edx
cmove r9d, ebx
cmp rax, qword [0x180052148]
seta cl
cmp ecx, r9d
jb 0x18000c0c3
mov al, byte [str.__x_iscii_as]
mov ecx, r10d
test al, al
mov eax, r10d
sete cl
cmp rcx, r12
setne al
cmp rax, qword [0x180052120]
jne 0x18000c077
mov eax, dword [0x180052174]
add al, 0x2a
mov byte [rbp - 0x58], al
jmp 0x18000c0c3
test r14d, r14d
mov eax, r10d
sete al
cmp r15d, eax
jae 0x18000c098
mov eax, dword [0x18005204c]
add eax, 0xcea5
mov dword [0x180052174], eax
jmp 0x18000c0c3
cmp dword [0x18005204c], r10d
je 0x18000c0c3
movzx eax, word [0x18005216c]
mov rdx, qword [rbp - 0x51]
imul rdx, rax
mov rax, qword [rbp - 0x51]
movzx r12d, word [0x180052144]
add rax, rdx
mov qword [rbp - 0x51], rax
mov rdi, qword [rdi]
cmp qword [rdi], r13
jne 0x18000bf3e
cmp esi, r15d
mov ecx, r10d
mov eax, r10d
sete cl
cmp esi, 0x63
sete al
cmp ecx, eax
je 0x18000c263
mov dl, bl
mov cl, 0x15
call fcn.18000ced4
mov al, byte [0x18005203f]
jmp 0x18000c2b9
mov rax, qword [rbp - 0x51]
mov r8, qword [rbp - 9]
sub rax, r8
mov qword [0x180052128], 4
mov qword [rbp - 0x51], rax
mov rax, qword [0x180052128]
test rax, rax
je 0x18000c1d4
sub rax, rbx
je 0x18000c187
sub rax, rbx
je 0x18000c173
sub rax, rbx
je 0x18000c14b
cmp rax, rbx
jne 0x18000c1f1
mov byte [0x180052063], 0x70
jmp 0x18000c1f1
movzx eax, word [0x180053720]
movzx ecx, byte [str.__x_iscii_as]
mov word [0x18005217c], ax
mov eax, dword [0x180052150]
lea edx, [rax + rax]
add ecx, edx
mov dword [0x180052150], ecx
jmp 0x18000c1f1
mov al, byte [0x18005204b]
sub al, byte [0x180052148]
mov byte [0x18005204b], al
jmp 0x18000c1f1
mov rax, qword [rbp - 0x31]
movzx edx, word [0x18005216c]
movsx rcx, byte [0x18005203b]
mov word [0x1801de9ea], ax
movsx eax, word [0x18005217c]
add eax, 0x52
cdqe
add rax, r8
add rdx, rax
movzx eax, word [0x180052168]
imul rcx, rax
not rdx
imul rcx, rcx, 0xffffffffc9804770
mov ecx, ecx
imul rcx, rdx
mov qword [rbp - 0x39], rcx
jmp 0x18000c1f1
mov edx, dword [0x18005208c]
mov rax, qword [0x180052158]
sub edx, 0x1260
sub rax, rdx
mov qword [0x180052158], rax
mov r9d, dword [rbp - 0x21]
mov r8, qword [rbp - 1]
mov edx, dword [rdi + 0x40]
mov rcx, qword [rdi + 0x30]
call fcn.18000a140
movsxd rdx, dword [0x180052154]
xor r8d, r8d
mov rcx, qword [rbp - 0x19]
mov r9, rax
cmp rdx, rcx
mov ecx, dword [0x180052154]
setne r8b
xor edx, edx
cmp ecx, 0x24
setne dl
cmp r8d, edx
jne 0x18000c25e
mov al, byte [0x18005203b]
test al, al
je 0x18000c258
movsx ecx, byte [0x180052066]
movzx eax, word [rbp - 0x55]
add cx, ax
lea eax, [r15 - 0x20]
mov word [rbp - 0x55], cx
mov dword [0x18005213c], eax
jmp 0x18000c25e
mov al, byte [0x180052066]
mov rax, r9
jmp 0x18000c2bb
mov al, byte [rbp - 0x59]
test al, al
je 0x18000c276
movzx eax, word [0x18005216c]
test ax, ax
je 0x18000c279
mov ebx, r10d
movzx eax, byte [rbp - 0x59]
cmp eax, ebx
jne 0x18000c299
movzx ecx, byte [0x18005203f]
mov eax, 0xcc
add cx, ax
mov word [0x180052138], cx
jmp 0x18000c2b9
mov eax, dword [rbp - 0x41]
not eax
add eax, 0x72
jns 0x18000c2b2
mov eax, dword [0x1801996d0]
mov qword [0x180052128], rax
jmp 0x18000c2b9
mov rax, qword [0x180052108]
xor eax, eax
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.18002ca80
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret