Function at 0x180008510
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r15
lea rbp, [rsp - 0xb8]
sub rsp, 0x1b8
movdqa xmm0, xmmword [0x18038fc40]
xor r15d, r15d
mov qword [rbp + 0x108], r15
mov r13, rcx
mov qword [rbp + 8], r15
mov qword [rbp + 0x10], r15
mov dword [rbp + 0xf8], r15d
movdqu xmmword [rbp - 0x2f], xmm0
mov word [rbp + 0xfc], 0x100
mov dword [rbp - 0x1f], 0xefe9e5ea
mov dword [rbp - 0x1b], 0xe3daedfd
mov word [rbp - 0x17], 0xef
mov qword [rbp + 0x100], r15
mov rax, qword [rbp + 0x100]
nop dword [rax]
mov rcx, qword [rbp + 0x100]
mov rax, qword [rbp + 0x100]
add cl, 0x74
xor cl, byte [rbp + rax - 0x2e]
mov rax, qword [rbp + 0x100]
mov byte [rbp + rax - 0x2e], cl
mov rax, qword [rbp + 0x100]
inc rax
mov qword [rbp + 0x100], rax
mov rax, qword [rbp + 0x100]
cmp rax, 0x18
jb 0x180008580
mov byte [rbp - 0x16], r15b
call fcn.180001690
mov rcx, qword gs:[0x58]
mov rdi, rax
mov edx, dword [0x18039b468]
mov eax, 4
mov rbx, qword [rcx + rdx*8]
add rbx, rax
mov ecx, dword [rbx]
cmp dword [0x18039d510], ecx
jle 0x18000861e
lea rcx, [0x18039d510]
call fcn.180360f8c
cmp dword [0x18039d510], 0xffffffff
jne 0x18000861e
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x18039d510]
mov qword [0x1803a15b8], rax
call fcn.180360f2c
mov eax, dword [rbx]
cmp dword [0x1803a1558], eax
jle 0x180008657
lea rcx, [0x1803a1558]
call fcn.180360f8c
cmp dword [0x1803a1558], 0xffffffff
jne 0x180008657
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1803a1558]
mov qword [0x1803a1560], rax
call fcn.180360f2c
mov qword [rsp + 0x1f0], r12
mov rcx, rdi
mov qword [rsp + 0x1b0], r14
call qword [0x1803a15b8]
mov rcx, rax
lea rdx, [rbp - 0x2e]
call qword [0x1803a1560]
mov rsi, rax
test rax, rax
je 0x1800090ea
xor eax, eax
mov dword [rsp + 0x60], 0x8793a6ed
mov byte [rsp + 0x68], al
mov dword [rsp + 0x64], 0x828cb786
mov qword [rbp + 0x100], r15
mov rax, qword [rbp + 0x100]
nop dword [rax]
mov rcx, qword [rbp + 0x100]
mov rax, qword [rbp + 0x100]
sub cl, 0x20
xor cl, byte [rsp + rax + 0x61]
mov rax, qword [rbp + 0x100]
mov byte [rsp + rax + 0x61], cl
mov rax, qword [rbp + 0x100]
inc rax
mov qword [rbp + 0x100], rax
mov rax, qword [rbp + 0x100]
cmp rax, 7
jb 0x1800086b0
mov byte [rsp + 0x68], r15b
call fcn.180001690
mov ecx, dword [rbx]
mov rdi, rax
cmp dword [0x18039d510], ecx
jle 0x180008734
lea rcx, [0x18039d510]
call fcn.180360f8c
cmp dword [0x18039d510], 0xffffffff
jne 0x180008734
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1803a15b8], rcx
lea rcx, [0x18039d510]
call fcn.180360f2c
mov eax, dword [rbx]
cmp dword [0x1803a1558], eax
jle 0x18000876d
lea rcx, [0x1803a1558]
call fcn.180360f8c
cmp dword [0x1803a1558], 0xffffffff
jne 0x18000876d
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1803a1558]
mov qword [0x1803a1560], rax
call fcn.180360f2c
mov rcx, rdi
call qword [0x1803a15b8]
mov rcx, rax
lea rdx, [rsp + 0x61]
call qword [0x1803a1560]
mov r12, rax
test rax, rax
je 0x1800090ea
mov dword [rsp + 0x74], 0x8d82a07d
mov dword [rsp + 0x78], 0x9eb09c8e
mov dword [rsp + 0x7c], 0x969b9f
mov qword [rbp + 0x100], r15
mov rax, qword [rbp + 0x100]
nop word [rax + rax]
mov rcx, qword [rbp + 0x100]
mov rax, qword [rbp + 0x100]
sub cl, 0x14
xor cl, byte [rsp + rax + 0x75]
mov rax, qword [rbp + 0x100]
mov byte [rsp + rax + 0x75], cl
mov rax, qword [rbp + 0x100]
inc rax
mov qword [rbp + 0x100], rax
mov rax, qword [rbp + 0x100]
cmp rax, 0xa
jb 0x1800087c0
mov byte [rsp + 0x7f], r15b
call fcn.1800015d0
mov ecx, dword [rbx]
mov rdi, rax
cmp dword [0x18039d510], ecx
jle 0x180008844
lea rcx, [0x18039d510]
call fcn.180360f8c
cmp dword [0x18039d510], 0xffffffff
jne 0x180008844
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1803a15b8], rcx
lea rcx, [0x18039d510]
call fcn.180360f2c
mov eax, dword [rbx]
cmp dword [0x1803a1558], eax
jle 0x18000887d
lea rcx, [0x1803a1558]
call fcn.180360f8c
cmp dword [0x1803a1558], 0xffffffff
jne 0x18000887d
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1803a1558]
mov qword [0x1803a1560], rax
call fcn.180360f2c
mov rcx, rdi
call qword [0x1803a15b8]
mov rcx, rax
lea rdx, [rsp + 0x75]
call qword [0x1803a1560]
mov r14, rax
test rax, rax
je 0x1800090ea
xor eax, eax
mov dword [rsp + 0x69], 0x6a674bd8
mov byte [rsp + 0x73], al
mov dword [rsp + 0x6d], 0x7f4a676b
mov word [rsp + 0x71], 0x6a6b
mov qword [rbp + 0x100], r15
mov rax, qword [rbp + 0x100]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x100]
mov rax, qword [rbp + 0x100]
add cl, 7
xor cl, byte [rsp + rax + 0x6a]
mov rax, qword [rbp + 0x100]
mov byte [rsp + rax + 0x6a], cl
mov rax, qword [rbp + 0x100]
inc rax
mov qword [rbp + 0x100], rax
mov rax, qword [rbp + 0x100]
cmp rax, 9
jb 0x1800088d0
mov byte [rsp + 0x73], r15b
call fcn.1800015d0
mov ecx, dword [rbx]
mov rdi, rax
cmp dword [0x18039d510], ecx
jle 0x180008954
lea rcx, [0x18039d510]
call fcn.180360f8c
cmp dword [0x18039d510], 0xffffffff
jne 0x180008954
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1803a15b8], rcx
lea rcx, [0x18039d510]
call fcn.180360f2c
mov eax, dword [rbx]
cmp dword [0x1803a1558], eax
jle 0x18000898d
lea rcx, [0x1803a1558]
call fcn.180360f8c
cmp dword [0x1803a1558], 0xffffffff
jne 0x18000898d
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1803a1558]
mov qword [0x1803a1560], rax
call fcn.180360f2c
mov rcx, rdi
call qword [0x1803a15b8]
mov rcx, rax
lea rdx, [rsp + 0x6a]
call qword [0x1803a1560]
mov r15, rax
test rax, rax
je 0x1800090ea
lea rax, [rbp + 0x108]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0xf8]
xor eax, eax
xor r8d, r8d
mov dword [rsp + 0x48], eax
mov dl, 1
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call rsi
movdqa xmm0, xmmword [0x18038f880]
xor esi, esi
movdqu xmmword [rbp - 0x15], xmm0
mov dword [rbp - 5], 0x73704a79
mov dword [rbp - 1], 0x624648
mov qword [rbp + 0x100], rsi
mov rax, qword [rbp + 0x100]
mov rcx, qword [rbp + 0x100]
mov rax, qword [rbp + 0x100]
add cl, 0xe
xor cl, byte [rbp + rax - 0x14]
mov rax, qword [rbp + 0x100]
mov byte [rbp + rax - 0x14], cl
mov rax, qword [rbp + 0x100]
inc rax
mov qword [rbp + 0x100], rax
mov rax, qword [rbp + 0x100]
cmp rax, 0x16
jb 0x180008a12
mov byte [rbp + 2], sil
call fcn.180001690
mov ecx, dword [rbx]
mov rdi, rax
cmp dword [0x18039d510], ecx
jle 0x180008a95
lea rcx, [0x18039d510]
call fcn.180360f8c
cmp dword [0x18039d510], 0xffffffff
jne 0x180008a95
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1803a15b8], rcx
lea rcx, [0x18039d510]
call fcn.180360f2c
mov eax, dword [rbx]
cmp dword [0x1803a1558], eax
jle 0x180008ace
lea rcx, [0x1803a1558]
call fcn.180360f8c
cmp dword [0x1803a1558], 0xffffffff
jne 0x180008ace
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1803a1558]
mov qword [0x1803a1560], rax
call fcn.180360f2c
mov rcx, rdi
call qword [0x1803a15b8]
mov rcx, rax
lea rdx, [rbp - 0x14]
call qword [0x1803a1560]
mov rdi, rax
test rax, rax
je 0x180008b5c
mov dword [rbp - 0x80], 0x31c6346
mov dword [rbp - 0x7c], 0x1b00051e
mov dword [rbp - 0x78], 0x81505
mov qword [rbp + 0x100], rsi
mov rax, qword [rbp + 0x100]
nop
mov rcx, qword [rbp + 0x100]
mov rax, qword [rbp + 0x100]
add cl, 0x30
xor cl, byte [rbp + rax - 0x7f]
mov rax, qword [rbp + 0x100]
mov byte [rbp + rax - 0x7f], cl
mov rax, qword [rbp + 0x100]
inc rax
mov qword [rbp + 0x100], rax
mov rax, qword [rbp + 0x100]
cmp rax, 0xa
jb 0x180008b10
lea rdx, [rbp + 8]
mov byte [rbp - 0x75], sil
lea rcx, [rbp - 0x7f]
call rdi
movdqa xmm0, xmmword [0x18038f530]
lea rdi, [rbp + 0x50]
mov qword [rbp - 0x70], 0x12
mov qword [rbp + 0x100], 0x4e
mov rcx, qword [rbp + 0x100]
mov rax, qword [rbp - 0x70]
add rcx, rax
mov eax, 1
mov qword [rbp + 0x100], rcx
mov rcx, qword [rbp + 0x100]
rep stosb byte [rdi], al
mov qword [rbp + 0x54], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x78], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xa8], rax
mov dword [rbp + 0x50], 0xffffffff
mov dword [rbp + 0x6c], esi
mov dword [rbp + 0x70], 5
mov dword [rbp + 0x80], 0xffffffff
mov qword [rbp + 0x84], 1
mov dword [rbp + 0x9c], esi
mov dword [rbp + 0xa0], 2
movdqu xmmword [rbp + 0x18], xmm0
mov word [rbp + 0x28], 0x2a
mov qword [rbp + 0x100], rsi
mov rax, qword [rbp + 0x100]
nop word [rax + rax]
mov rcx, qword [rbp + 0x100]
mov rax, qword [rbp + 0x100]
add cl, 0x5c
xor cl, byte [rbp + rax + 0x19]
mov rax, qword [rbp + 0x100]
mov byte [rbp + rax + 0x19], cl
mov rax, qword [rbp + 0x100]
inc rax
mov qword [rbp + 0x100], rax
mov rax, qword [rbp + 0x100]
cmp rax, 0x10
jb 0x180008c10
mov byte [rbp + 0x29], sil
call fcn.180001690
mov ecx, dword [rbx]
mov rdi, rax
cmp dword [0x18039d510], ecx
jle 0x180008c93
lea rcx, [0x18039d510]
call fcn.180360f8c
cmp dword [0x18039d510], 0xffffffff
jne 0x180008c93
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1803a15b8], rcx
lea rcx, [0x18039d510]
call fcn.180360f2c
mov eax, dword [rbx]
cmp dword [0x1803a1558], eax
jle 0x180008ccc
lea rcx, [0x1803a1558]
call fcn.180360f8c
cmp dword [0x1803a1558], 0xffffffff
jne 0x180008ccc
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1803a1558]
mov qword [0x1803a1560], rax
call fcn.180360f2c
mov rcx, rdi
call qword [0x1803a15b8]
mov rcx, rax
lea rdx, [rbp + 0x19]
call qword [0x1803a1560]
mov rdi, rax
test rax, rax
je 0x180008d57
mov qword [rbp + 0x100], 0xe
lea r9, [rbp + 0x10]
mov qword [rbp - 0x70], 0x22
xor r8d, r8d
mov rdx, qword [rbp + 0x100]
mov rcx, qword [rbp - 0x70]
add rdx, rcx
mov qword [rbp + 0x40], rdx
mov qword [rbp - 0x70], 0x48
mov qword [rbp + 0x100], 0x18
mov rdx, qword [rbp + 0x100]
mov rcx, qword [rbp - 0x70]
add rdx, rcx
mov qword [rbp + 0x100], rdx
xor edx, edx
mov rax, qword [rbp + 0x100]
mov rcx, qword [rbp + 0x40]
div rcx
lea rdx, [rbp + 0x50]
mov rcx, rax
call rdi
mov edx, 0x28
lea ecx, [rdx + 0x18]
call r14
movdqa xmm0, xmmword [0x18038f740]
mov rdi, rax
movdqu xmmword [rbp - 0x68], xmm0
mov dword [rbp - 0x58], 0x6b575945
mov dword [rbp - 0x54], 0x41514255
mov dword [rbp - 0x50], 0x5842455d
mov word [rbp - 0x4c], 0x4a
mov qword [rbp + 0x100], rsi
mov rax, qword [rbp + 0x100]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x100]
mov rax, qword [rbp + 0x100]
add cl, 0x1d
xor cl, byte [rbp + rax - 0x67]
mov rax, qword [rbp + 0x100]
mov byte [rbp + rax - 0x67], cl
mov rax, qword [rbp + 0x100]
inc rax
mov qword [rbp + 0x100], rax
mov rax, qword [rbp + 0x100]
cmp rax, 0x1c
jb 0x180008da0
mov byte [rbp - 0x4b], sil
call fcn.180001690
mov ecx, dword [rbx]
mov rsi, rax
cmp dword [0x18039d510], ecx
jle 0x180008e23
lea rcx, [0x18039d510]
call fcn.180360f8c
cmp dword [0x18039d510], 0xffffffff
jne 0x180008e23
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1803a15b8], rcx
lea rcx, [0x18039d510]
call fcn.180360f2c
mov eax, dword [rbx]
cmp dword [0x1803a1558], eax
jle 0x180008e5c
lea rcx, [0x1803a1558]
call fcn.180360f8c
cmp dword [0x1803a1558], 0xffffffff
jne 0x180008e5c
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1803a1558]
mov qword [0x1803a1560], rax
call fcn.180360f2c
mov rcx, rsi
call qword [0x1803a15b8]
mov rcx, rax
lea rdx, [rbp - 0x67]
call qword [0x1803a1560]
test rax, rax
je 0x180008e81
mov edx, 1
mov rcx, rdi
call rax
movdqa xmm0, xmmword [0x18038f850]
xor eax, eax
mov byte [rbp - 0x30], al
xor r14d, r14d
movdqu xmmword [rbp - 0x4a], xmm0
mov dword [rbp - 0x3a], 0x6f6a706a
mov dword [rbp - 0x36], 0x7e5a6f73
mov word [rbp - 0x32], 0x4d43
mov qword [rbp + 0x100], r14
mov rax, qword [rbp + 0x100]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x100]
mov rax, qword [rbp + 0x100]
add cl, 9
xor cl, byte [rbp + rax - 0x49]
mov rax, qword [rbp + 0x100]
mov byte [rbp + rax - 0x49], cl
mov rax, qword [rbp + 0x100]
inc rax
mov qword [rbp + 0x100], rax
mov rax, qword [rbp + 0x100]
cmp rax, 0x19
jb 0x180008ec0
mov byte [rbp - 0x30], r14b
call fcn.180001690
mov ecx, dword [rbx]
mov rsi, rax
cmp dword [0x18039d510], ecx
jle 0x180008f43
lea rcx, [0x18039d510]
call fcn.180360f8c
cmp dword [0x18039d510], 0xffffffff
jne 0x180008f43
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1803a15b8], rcx
lea rcx, [0x18039d510]
call fcn.180360f2c
mov eax, dword [rbx]
cmp dword [0x1803a1558], eax
jle 0x180008f7c
lea rcx, [0x1803a1558]
call fcn.180360f8c
cmp dword [0x1803a1558], 0xffffffff
jne 0x180008f7c
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1803a1558]
mov qword [0x1803a1560], rax
call fcn.180360f2c
mov rcx, rsi
call qword [0x1803a15b8]
mov rcx, rax
lea rdx, [rbp - 0x49]
call qword [0x1803a1560]
test rax, rax
je 0x180008fa7
mov r8, qword [rbp + 0x10]
xor r9d, r9d
mov rcx, rdi
lea edx, [r9 + 1]
call rax
movdqa xmm0, xmmword [0x18038fbe0]
movdqu xmmword [rbp + 0x2a], xmm0
mov word [rbp + 0x3a], 0xd6
mov qword [rbp + 0x100], r14
mov rax, qword [rbp + 0x100]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x100]
mov rax, qword [rbp + 0x100]
sub cl, 0x78
xor cl, byte [rbp + rax + 0x2b]
mov rax, qword [rbp + 0x100]
mov byte [rbp + rax + 0x2b], cl
mov rax, qword [rbp + 0x100]
inc rax
mov qword [rbp + 0x100], rax
mov rax, qword [rbp + 0x100]
cmp rax, 0x10
jb 0x180008fd0
mov byte [rbp + 0x3b], r14b
call fcn.180001690
mov edx, dword [rbx]
mov rsi, rax
cmp dword [0x18039d510], edx
jle 0x180009053
lea rcx, [0x18039d510]
call fcn.180360f8c
cmp dword [0x18039d510], 0xffffffff
jne 0x180009053
mov rdx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x18039d510]
mov qword [0x1803a15b8], rdx
call fcn.180360f2c
mov eax, dword [rbx]
cmp dword [0x1803a1558], eax
jle 0x18000908c
lea rcx, [0x1803a1558]
call fcn.180360f8c
cmp dword [0x1803a1558], 0xffffffff
jne 0x18000908c
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1803a1558]
mov qword [0x1803a1560], rax
call fcn.180360f2c
mov rcx, rsi
call qword [0x1803a15b8]
mov rcx, rax
lea rdx, [rbp + 0x2b]
call qword [0x1803a1560]
test rax, rax
je 0x1800090b4
mov r8, rdi
mov edx, 4
mov rcx, r13
call rax
mov rcx, qword [rbp + 0x108]
test rcx, rcx
je 0x1800090c3
call r12
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x1800090cf
call r12
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x1800090db
call r15
test rdi, rdi
je 0x1800090e6
mov rcx, rdi
call r15
mov al, 1
jmp 0x1800090ec
xor al, al
mov r14, qword [rsp + 0x1b0]
mov r12, qword [rsp + 0x1f0]
add rsp, 0x1b8
pop r15
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret