Function at 0x18013da78
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov qword [rbp + 0x70], 0xfffffffffffffffe
mov dword [rbp + 0x58], 0x18
mov edi, 1
mov dword [rbp + 0x68], edi
xor ebx, ebx
mov qword [rbp + 0x60], rbx
mov ecx, dword [0x180195f94]
mov rax, qword gs:[0x58]
mov r13d, 4
mov r15, qword [rax + rcx*8]
or rsi, 0xffffffffffffffff
mov eax, dword [r15 + r13]
cmp dword [0x1801a2584], eax
jle 0x18013dd04
lea rcx, [0x1801a2584]
call fcn.180157af0
cmp dword [0x1801a2584], esi
jne 0x18013dd04
lea rax, [rbp - 8]
mov qword [rbp + 0x1b8], rax
mov dword [rsp + 0x30], 0xd
mov eax, dword [rsp + 0x30]
xor al, 0x43
mov byte [rsp + 0x34], al
mov eax, dword [rsp + 0x30]
add al, dil
xor al, 0x72
mov byte [rsp + 0x35], al
mov eax, dword [rsp + 0x30]
add al, 2
mov cl, 0x65
xor al, cl
mov byte [rsp + 0x36], al
mov eax, dword [rsp + 0x30]
add al, 3
xor al, 0x61
mov byte [rsp + 0x37], al
mov eax, dword [rsp + 0x30]
add al, 4
xor al, 0x74
mov byte [rsp + 0x38], al
mov eax, dword [rsp + 0x30]
add al, 5
xor al, cl
mov byte [rsp + 0x39], al
mov eax, dword [rsp + 0x30]
add al, 6
xor al, 0x50
mov byte [rsp + 0x3a], al
mov eax, dword [rsp + 0x30]
add al, 7
xor al, 0x69
mov byte [rsp + 0x3b], al
mov eax, dword [rsp + 0x30]
add al, 8
xor al, 0x70
mov byte [rsp + 0x3c], al
mov eax, dword [rsp + 0x30]
add al, 9
xor al, cl
mov byte [rsp + 0x3d], al
xor eax, eax
mov byte [rsp + 0x3e], al
mov al, byte [rsp + 0x34]
mov edx, ebx
mov al, byte [rsp + rdx + 0x34]
mov ecx, dword [rsp + 0x30]
add cl, dl
xor cl, al
mov byte [rsp + rdx + 0x34], cl
add rdx, rdi
cmp rdx, 0xa
jb 0x18013db8c
mov byte [rsp + 0x3e], bl
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], rbx
mov qword [rbp + 0x10], rbx
lea rax, [rsp + 0x34]
mov r8, rsi
inc r8
cmp byte [rax + r8], bl
jne 0x18013dbc0
lea rdx, [rsp + 0x34]
lea rcx, [rbp - 8]
call fcn.18000c7ac
nop
mov byte [rsp + 0x40], 0x72
mov byte [rsp + 0x41], 0x6c
mov byte [rsp + 0x42], 0x79
mov byte [rsp + 0x43], 0x75
mov byte [rsp + 0x44], 0x6c
mov byte [rsp + 0x45], 0x73
mov byte [rsp + 0x46], 0x3a
mov byte [rsp + 0x47], 0x39
mov byte [rsp + 0x48], bl
mov al, byte [rsp + 0x40]
mov rcx, rbx
mov al, byte [rsp + rcx + 0x40]
sub al, 7
mov byte [rsp + rcx + 0x40], al
add rcx, rdi
cmp rcx, 8
jb 0x18013dc0b
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x58], xmm1
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], bl
jne 0x18013dc35
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x68]
call fcn.18000c7ac
nop
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0xc0]
call fcn.1800ceb58
nop
mov qword [rsp + 0x20], rbx
mov r9b, dil
lea r8, [rbp - 8]
mov rdx, rax
lea rcx, [0x1801a0c90]
call fcn.180141ffc
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x18013dcb8
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18013dcb3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18013dcb3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180157a14
movdqa xmm0, xmmword [0x180165930]
movdqu xmmword [rbp - 0x58], xmm0
mov byte [rbp - 0x68], bl
xor edx, edx
lea r8d, [rdx + 9]
lea rcx, [rsp + 0x40]
call qword [sym.imp.VCRUNTIME140.dll_memset]
nop
xor edx, edx
lea r8d, [rdx + 0xb]
lea rcx, [rsp + 0x34]
call qword [sym.imp.VCRUNTIME140.dll_memset]
lea rcx, [0x180163f6c]
call fcn.1801579fc
nop
lea rcx, [0x1801a2584]
call fcn.180157a84
call fcn.18013cf58
test al, al
je 0x18013e37c
call fcn.18013cbf4
test al, al
je 0x18013e37c
lea r14, [0x1801a0ca0]
mov rcx, r14
cmp qword [0x1801a0cb8], 0x10
cmovae rcx, qword [0x1801a0ca0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18013dd6e
mov rcx, r14
cmp qword [0x1801a0cb8], 0x10
cmovae rcx, qword [0x1801a0ca0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1801a0c98], rax
mov r8, rax
mov rdx, r14
call fcn.1800150f8
xor r9d, r9d
lea r8, [rbp + 0x58]
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x1a8]
call qword [0x1801a0c90]
test eax, eax
je 0x18013e3a4
xor r8d, r8d
mov edx, edi
mov rcx, qword [rbp + 0x1a8]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x18013e3a4
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rax
lea rdx, [0x1801911f0]
lea rcx, [rbp + 0xa0]
call fcn.18000be28
nop
cmp qword [rbp + 0xb0], rbx
sete r14b
mov byte [0x180190187], r14b
mov r8, qword [rbp + 0x1b0]
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x140]
call fcn.18013b7a8
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movsd xmm1, qword [rax + 0x10]
movsd qword [rbp - 0x78], xmm1
mov rcx, qword [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp - 0x80]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x18013e368
cmp qword [0x180191200], rbx
je 0x18013de43
cmp byte [0x180190186], bl
je 0x18013de43
mov eax, dword [rbp - 0x78]
mov dword [0x180191230], eax
lea rdx, [0x1801911f0]
lea rcx, [rbp + 0xe0]
call fcn.1800d6468
nop
lea r8, [0x1801901c8]
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.18013a990
nop
lea rcx, [rbp + 0xe0]
call fcn.18000bd8c
mov eax, dword [r15 + r13]
cmp dword [0x1801a1dc0], eax
jle 0x18013e087
lea rcx, [0x1801a1dc0]
call fcn.180157af0
cmp dword [0x1801a1dc0], esi
jne 0x18013e087
lea rax, [rbp + 0x18]
mov qword [rbp + 0x1b8], rax
mov dword [rsp + 0x64], 2
mov byte [rsp + 0x68], 0x4c
mov byte [rsp + 0x69], 0x76
mov byte [rsp + 0x6a], 0x50
mov byte [rsp + 0x6b], 0x67
mov byte [rsp + 0x6c], 0x71
mov byte [rsp + 0x6d], 0x77
mov byte [rsp + 0x6e], 0x6f
mov byte [rsp + 0x6f], 0x67
mov byte [rsp + 0x70], 0x56
mov byte [rsp + 0x71], 0x6a
mov byte [rsp + 0x72], 0x70
mov byte [rsp + 0x73], 0x67
mov byte [rsp + 0x74], 0x63
mov byte [rsp + 0x75], 0x66
xor eax, eax
mov byte [rsp + 0x76], al
mov al, byte [rsp + 0x68]
mov rdx, rbx
mov al, byte [rsp + rdx + 0x68]
mov ecx, dword [rsp + 0x64]
xor cl, al
mov byte [rsp + rdx + 0x68], cl
add rdx, rdi
cmp rdx, 0xe
jb 0x18013df06
mov byte [rsp + 0x76], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x28], rbx
mov qword [rbp + 0x30], rbx
lea rax, [rsp + 0x68]
mov r8, rsi
inc r8
cmp byte [rax + r8], bl
jne 0x18013df38
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x18]
call fcn.18000c7ac
nop
mov byte [rbp + 0x1a0], 0x7b
mov byte [rbp + 0x1a1], 0x81
mov byte [rbp + 0x1a2], 0x71
mov byte [rbp + 0x1a3], 0x79
mov byte [rbp + 0x1a4], 0x79
mov byte [rbp + 0x1a5], bl
mov al, byte [rbp + 0x1a0]
mov rcx, rbx
mov al, byte [rbp + rcx + 0x1a0]
sub al, 0xd
mov byte [rbp + rcx + 0x1a0], al
add rcx, rdi
cmp rcx, 5
jb 0x18013df82
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
lea rax, [rbp + 0x1a0]
mov r8, rsi
inc r8
cmp byte [rax + r8], bl
jne 0x18013dfb4
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp - 0x48]
call fcn.18000c7ac
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x100]
call fcn.1800ceb58
nop
mov qword [rsp + 0x20], rbx
mov r9b, dil
lea r8, [rbp + 0x18]
mov rdx, rax
lea rcx, [0x1801a0eb0]
call fcn.180014104
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x18013e039
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18013e034
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18013e034
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180157a14
movdqa xmm0, xmmword [0x180165930]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], bl
xor edx, edx
lea r8d, [rdx + 6]
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.VCRUNTIME140.dll_memset]
nop
xor edx, edx
lea r8d, [rdx + 0xf]
lea rcx, [rsp + 0x68]
call qword [sym.imp.VCRUNTIME140.dll_memset]
lea rcx, [0x180163f60]
call fcn.1801579fc
nop
lea rcx, [0x1801a1dc0]
call fcn.180157a84
mov dl, dil
lea rcx, [rsp + 0x78]
call fcn.18013d818
mov rdx, qword [rbp - 0x80]
lea rcx, [0x1801a0eb0]
test al, al
jne 0x18013e335
call fcn.18000e52c
test r14b, r14b
je 0x18013e311
mov eax, dword [r15 + r13]
cmp dword [0x1801a1cb4], eax
jle 0x18013e2b1
lea rcx, [0x1801a1cb4]
call fcn.180157af0
cmp dword [0x1801a1cb4], esi
jne 0x18013e2b1
lea rax, [rbp + 0x38]
mov qword [rbp + 0x1b8], rax
mov byte [rsp + 0x52], 0x61
mov byte [rsp + 0x53], 0x72
mov byte [rsp + 0x54], 0x7f
mov byte [rsp + 0x55], 0x7a
mov byte [rsp + 0x56], 0x76
mov byte [rsp + 0x57], 0x7b
mov byte [rsp + 0x58], 0x6e
mov byte [rsp + 0x59], 0x81
mov byte [rsp + 0x5a], 0x72
mov byte [rsp + 0x5b], 0x5d
mov byte [rsp + 0x5c], 0x7f
mov byte [rsp + 0x5d], 0x7c
mov byte [rsp + 0x5e], 0x70
mov byte [rsp + 0x5f], 0x72
mov byte [rsp + 0x60], 0x80
mov byte [rsp + 0x61], 0x80
mov byte [rsp + 0x62], bl
mov al, byte [rsp + 0x52]
mov rcx, rbx
mov al, byte [rsp + rcx + 0x52]
sub al, 0xd
mov byte [rsp + rcx + 0x52], al
add rcx, rdi
cmp rcx, 0x10
jb 0x18013e143
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], rbx
mov qword [rbp + 0x50], rbx
lea rax, [rsp + 0x52]
mov r8, rsi
inc r8
cmp byte [rax + r8], bl
jne 0x18013e16d
lea rdx, [rsp + 0x52]
lea rcx, [rbp + 0x38]
call fcn.18000c7ac
nop
mov byte [rsp + 0x49], 0x6c
mov byte [rsp + 0x4a], 0x66
mov byte [rsp + 0x4b], 0x73
mov byte [rsp + 0x4c], 0x6f
mov byte [rsp + 0x4d], 0x66
mov byte [rsp + 0x4e], 0x6d
mov byte [rsp + 0x4f], 0x34
mov byte [rsp + 0x50], 0x33
mov byte [rsp + 0x51], bl
mov al, byte [rsp + 0x49]
mov rcx, rbx
mov al, byte [rsp + rcx + 0x49]
sub al, dil
mov byte [rsp + rcx + 0x49], al
add rcx, rdi
cmp rcx, 8
jb 0x18013e1b8
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
lea rax, [rsp + 0x49]
inc rsi
cmp byte [rax + rsi], bl
jne 0x18013e1e0
mov r8, rsi
lea rdx, [rsp + 0x49]
lea rcx, [rbp - 0x28]
call fcn.18000c7ac
nop
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x120]
call fcn.1800ceb58
nop
mov qword [rsp + 0x20], rbx
mov r9b, dil
lea r8, [rbp + 0x38]
mov rdx, rax
lea rcx, [0x1801a1150]
call fcn.18014132c
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x18013e265
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18013e260
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18013e260
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180157a14
movdqa xmm0, xmmword [0x180165930]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], bl
xor edx, edx
lea r8d, [rdx + 9]
lea rcx, [rsp + 0x49]
call qword [sym.imp.VCRUNTIME140.dll_memset]
nop
xor edx, edx
lea r8d, [rdx + 0x11]
lea rcx, [rsp + 0x52]
call qword [sym.imp.VCRUNTIME140.dll_memset]
lea rcx, [0x180163f54]
call fcn.1801579fc
nop
lea rcx, [0x1801a1cb4]
call fcn.180157a84
mov rsi, qword [rsp + 0x78]
lea r14, [0x1801a1160]
mov rcx, r14
cmp qword [0x1801a1178], 0x10
cmovae rcx, qword [0x1801a1160]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18013e306
mov rcx, r14
cmp qword [0x1801a1178], 0x10
cmovae rcx, qword [0x1801a1160]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1801a1158], rax
mov r8, rax
mov rdx, r14
call fcn.1800150f8
xor edx, edx
mov rcx, rsi
call qword [0x1801a1150]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18013e36b
call fcn.18000e52c
movups xmm0, xmmword [rsp + 0x78]
movaps xmmword [rbp + 0x80], xmm0
movsd xmm1, qword [rbp - 0x78]
movsd qword [rbp + 0x90], xmm1
mov rdx, qword [rbp + 0x1a8]
lea rcx, [rbp + 0x80]
call fcn.1800d64f8
jmp 0x18013e311
mov dil, bl
lea rcx, [rbp + 0xa0]
call fcn.18000bd8c
mov al, dil
jmp 0x18013e3a6
movabs rax, 0xe000000000000000
mov rcx, rbx
or rcx, rax
mov dl, dil
call fcn.180035dd0
add rbx, 0x3e8
cmp rbx, 0x493e0
jb 0x18013e37c
xor al, al
add rsp, 0x260
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret