Function at 0x180036440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x180189e48]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], r8
cmp qword [rcx + 0x7a18], 0
jne 0x18003656a
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x70]
call fcn.1800f4bb0
mov word [rsp + 0x55], 0x5f64
mov dword [rsp + 0x63], 0x64255f
mov dword [rsp + 0x58], 0x4a5f4c4c
mov word [rsp + 0x60], 0x6354
mov dword [rsp + 0x50], 0x65726854
mov word [rsp + 0x5d], 0x6e6f
mov byte [rsp + 0x5f], 0x5f
mov byte [rsp + 0x5c], 0x73
mov byte [rsp + 0x57], 0x44
mov byte [rsp + 0x54], 0x61
mov byte [rsp + 0x62], 0x70
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call sym.dll.dll_sprintf
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1000018
xor r9d, r9d
xor edx, edx
lea rcx, [rdx - 1]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rdi + 0x7a18], rax
test rax, rax
je 0x180036664
mov qword [rsp + 0x20], 0x1000018
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 0x7a20], rax
test rax, rax
je 0x180036664
xor edx, edx
mov r8d, 0x1000018
mov rcx, rax
call fcn.1800f4bb0
xor edx, edx
mov r8d, 0x1000018
mov rcx, qword [rdi + 0x7a20]
call fcn.1800f4bb0
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x18003658b
mov rdx, qword [rbx]
mov rcx, qword [rdi + 0x7a20]
add rcx, 0xc
nop word [rax + rax]
movzx eax, byte [rdx]
mov byte [rcx], al
lea rdx, [rdx + 1]
lea rcx, [rcx + 1]
test al, al
jne 0x1800365a0
mov rax, qword [rdi + 0x7a20]
mov dword [rax], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rdi + 0x7a20]
mov dword [rcx + 8], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rcx, qword [rdi + 0x1814]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1800365ee
mov rcx, qword [rdi + 0x1814]
jmp 0x1800365f0
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x180036610
mov rcx, rbx
call fcn.180007560
nop
mov rcx, rsi
call fcn.180007560
jmp 0x1800366fa
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r14d, eax
mov rcx, qword [rdi + 0x1814]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x180036633
mov rcx, qword [rdi + 0x1814]
jmp 0x180036635
xor ecx, ecx
movsxd r9, dword [rbp + 0xe0]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2710
mov dword [rsp + 0x20], 1
mov r8, r14
mov edx, 0x1023
call qword [sym.imp.USER32.dll_SendMessageTimeoutA]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x18003669e
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x180036699
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180036717
mov rcx, r8
call fcn.1800f2580
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x1800366e7
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x1800366e2
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18003671d
mov rcx, r8
call fcn.1800f2580
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1800f21e0
add rsp, 0x190
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1800f9714
nop
call fcn.1800f9714
int3