Function at 0x18000b1c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x180078040]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov rsi, rdx
mov r15, rcx
mov qword [rsp + 0x50], rcx
mov qword [rbp + 0x70], rdx
xor edi, edi
movdqa xmm0, xmmword [0x18006d950]
movdqu xmmword [rsp + 0x78], xmm0
movdqa xmm1, xmmword [0x18006d9c0]
movdqu xmmword [rbp - 0x78], xmm1
mov dword [rbp - 0x68], 0x636c2562
mov dword [rbp - 0x64], 0x256f66
mov ecx, edi
nop dword [rax]
movzx eax, byte [rsp + 0x78]
xor byte [rsp + rcx + 0x79], al
movzx eax, byte [rsp + 0x78]
xor byte [rsp + rcx + 0x7a], al
add rcx, 2
cmp rcx, 0x26
jb 0x18000b230
mov byte [rbp - 0x61], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
lea rax, [rsp + 0x79]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x18000b270
lea rdx, [rsp + 0x79]
lea rcx, [rsp + 0x58]
call fcn.180004c10
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], rax
lea rcx, [rbp + 0xc0]
call fcn.18000e840
nop
lea r8, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x68]
add r9, r8
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0xc0]
call fcn.18000ec70
nop
lea rcx, [rbp + 0xc0]
call fcn.18000e750
nop
mov rdx, qword [rsi]
lea rcx, [rbp - 0x60]
call fcn.180004510
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x98], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa8], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x18000b37b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b376
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bafe
call fcn.180037fe0
movdqa xmm0, xmmword [0x18006d740]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], di
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x18000b3c9
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b3c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bb04
call fcn.180037fe0
movdqa xmm0, xmmword [0x18006d750]
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], 0
cmp byte [0x18007b424], 0
je 0x18000b412
mov eax, dword [0x18007b420]
test eax, eax
je 0x18000b412
imul eax, eax, 0x69
mov dword [0x18007b420], eax
test eax, eax
je 0x18000b412
sub eax, 0x70
mov dword [0x18007b420], eax
test eax, eax
je 0x18000b412
add eax, 0x5c
mov dword [0x18007b420], eax
lea rax, [rbp + 8]
mov qword [rbp + 0x20], rax
lea rax, [rsp + 0x78]
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x50], 0x45
mov al, 2
xor cl, cl
mov dl, 0x11
xor r8d, r8d
xor al, 0x45
mov byte [rsp + 0x51], al
xor cl, 0x45
mov byte [rsp + 0x52], cl
xor dl, 0x45
mov byte [rsp + 0x53], dl
mov byte [rsp + 0x54], r8b
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
lea rax, [rsp + 0x51]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18000b470
lea rdx, [rsp + 0x51]
lea rcx, [rbp - 0x20]
call fcn.180004c10
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
lea rdx, [0x18007b430]
mov r8, r14
inc r8
cmp byte [rdx + r8], 0
jne 0x18000b4a2
lea rcx, [rbp - 0x40]
call fcn.180004c10
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], rdi
lea rdx, [rbp + 0x98]
lea rcx, [rsp + 0x78]
call fcn.18000be50
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], rax
lea rcx, [rbp + 0xc0]
call fcn.18000e840
nop
lea r8, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova r8, qword [rbp - 0x20]
mov r9, qword [rbp - 0x10]
add r9, r8
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0xc0]
call fcn.18000ec70
nop
lea rcx, [rbp + 0xc0]
call fcn.18000e750
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm0
movups xmmword [rbp + 0x190], xmm0
movups xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], rax
lea rcx, [rbp + 0x140]
call fcn.18000e840
nop
lea r8, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova r8, qword [rbp - 0x40]
mov r9, qword [rbp - 0x30]
add r9, r8
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x140]
call fcn.18000ec70
nop
lea rcx, [rbp + 0x140]
call fcn.18000e750
nop
mov dword [rsp + 0x30], 1
lea rax, [rbp + 8]
mov qword [rsp + 0x28], rax
mov word [rsp + 0x20], 0x1bb
mov r9, rbx
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x78]
call fcn.180005dd0
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x18000b638
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b633
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bb0a
call fcn.180037fe0
movdqa xmm0, xmmword [0x18006d750]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x18000b684
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b67f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bb10
call fcn.180037fe0
movdqa xmm0, xmmword [0x18006d750]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
mov cl, 3
mov dword [rsp + 0x40], 0x66714003
mov dword [rsp + 0x44], 0x45667762
mov dword [rsp + 0x48], 0x54666f6a
xor eax, eax
mov byte [rsp + 0x4c], al
mov rax, rdi
nop dword [rax + rax]
xor byte [rsp + rax + 0x41], cl
inc rax
cmp rax, 0xb
jae 0x18000b6d4
movzx ecx, byte [rsp + 0x40]
jmp 0x18000b6c0
mov byte [rsp + 0x4c], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rdi
lea rax, [rsp + 0x41]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x18000b6f0
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x60]
call fcn.180004c10
mov rbx, qword [rsi]
add rbx, 0x20
cmp qword [rbx + 0x18], 7
jbe 0x18000b719
mov rbx, qword [rbx]
lea rcx, [rbp - 0x60]
call fcn.1800016d0
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rbx
call rax
mov r13, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x18000ba43
mov byte [rsp + 0x40], 0x3c
mov cl, 0x6b
mov dl, 0x4e
mov r8b, 0x55
mov r9b, 0x48
mov r10b, 0x59
mov al, 0x7a
movzx r11d, r8b
mov bl, 0x50
movzx edi, r10b
xor r12d, r12d
xor cl, 0x3c
mov byte [rsp + 0x41], cl
xor dl, 0x3c
mov byte [rsp + 0x42], dl
xor r8b, 0x3c
mov byte [rsp + 0x43], r8b
xor r9b, 0x3c
mov byte [rsp + 0x44], r9b
xor r10b, 0x3c
mov byte [rsp + 0x45], r10b
xor al, 0x3c
mov byte [rsp + 0x46], al
xor r11b, 0x3c
mov byte [rsp + 0x47], r11b
xor bl, 0x3c
mov byte [rsp + 0x48], bl
xor dil, 0x3c
mov byte [rsp + 0x49], dil
mov byte [rsp + 0x4a], r12b
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xor edi, edi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
lea rax, [rsp + 0x41]
mov r8, r14
inc r8
cmp byte [rax + r8], dil
jne 0x18000b7e1
lea rdx, [rsp + 0x41]
lea rcx, [rsp + 0x58]
call fcn.180004c10
mov rbx, qword [rbp + 0x88]
sub rbx, qword [rbp + 0x80]
lea rcx, [rsp + 0x58]
call fcn.1800016d0
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0xb8]
mov r8d, ebx
mov rdx, qword [rbp + 0x80]
mov rcx, r13
call rax
cmp byte [0x18007b424], dil
je 0x18000b862
mov ecx, dword [0x18007b420]
test ecx, ecx
je 0x18000b862
imul ecx, ecx, 0x69
mov dword [0x18007b420], ecx
test ecx, ecx
je 0x18000b862
sub ecx, 0x70
mov dword [0x18007b420], ecx
test ecx, ecx
je 0x18000b862
add ecx, 0x5c
mov dword [0x18007b420], ecx
test eax, eax
jne 0x18000b995
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, r15
call fcn.18000d600
nop
mov rcx, qword [rbp + 0x80]
test rcx, rcx
je 0x18000b8cd
mov rdx, qword [rbp + 0x90]
sub rdx, rcx
cmp rdx, 0x1000
mov rax, rcx
jb 0x18000b8b6
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000baec
call fcn.180037fe0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], rdi
mov rdx, qword [rbp + 0xb0]
cmp rdx, 7
jbe 0x18000b914
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x98]
cmp rdx, 0x1000
mov rax, rcx
jb 0x18000b90e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000baf2
call fcn.180037fe0
nop
mov rcx, qword [rsi]
test rcx, rcx
je 0x18000b968
mov rdx, qword [rsi + 8]
call fcn.180004e10
mov rcx, qword [rsi]
mov rdx, qword [rsi + 0x10]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
cmp rdx, 0x1000
jb 0x18000b958
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000baf8
mov rcx, r8
call fcn.180037fe0
mov qword [rsi], rdi
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rdi
mov rax, r15
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.180037fc0
mov rbx, qword [rsp + 0x320]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov cl, 0x39
mov dword [rsp + 0x40], 0x56557a39
mov dword [rsp + 0x44], 0x58715c4a
mov dword [rsp + 0x48], 0x5c555d57
xor eax, eax
mov byte [rsp + 0x4c], al
nop word [rax + rax]
xor byte [rsp + rax + 0x41], cl
inc rax
cmp rax, 0xb
jae 0x18000b9d4
movzx ecx, byte [rsp + 0x40]
jmp 0x18000b9c0
mov byte [rsp + 0x4c], dil
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
lea rax, [rsp + 0x41]
inc r14
cmp byte [rax + r14], dil
jne 0x18000b9f0
mov r8, r14
lea rdx, [rsp + 0x41]
lea rcx, [rsp + 0x58]
call fcn.180004c10
lea rcx, [rsp + 0x58]
call fcn.1800016d0
mov rcx, r13
call rax
xorps xmm0, xmm0
movups xmmword [r15], xmm0
mov qword [r15 + 0x10], rdi
mov qword [r15 + 0x18], rdi
mov r8d, 2
lea rdx, [0x18006d66c]
mov rcx, r15
call fcn.180004ae0
jmp 0x18000b87b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, r15
call fcn.18000d600
nop
mov rcx, qword [rbp + 0x80]
test rcx, rcx
je 0x18000baa2
mov rdx, qword [rbp + 0x90]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ba8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000baec
call fcn.180037fe0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], rdi
mov rdx, qword [rbp + 0xb0]
cmp rdx, 7
jbe 0x18000b914
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b90e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000baf2
jmp 0x18000b90e
call fcn.18003ef50
nop
call fcn.18003ef50
nop
call fcn.18003ef50
nop
call fcn.18003ef50
nop
call fcn.18003ef50
nop
call fcn.18003ef50
nop
call fcn.18003ef50
int3