Function at 0x180039670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov ecx, 1
xor eax, eax
lock cmpxchg dword [0x1800cae0c], ecx
jne 0x180039aa5
mov ecx, 0x30
mov dword [rsp + 0x20], 0x630030
mov dword [rsp + 0x24], 0x740055
mov dword [rsp + 0x28], 0x520055
mov dword [rsp + 0x2c], 0x570045
mov dword [rsp + 0x30], 0x420060
mov dword [rsp + 0x34], 0x460059
mov dword [rsp + 0x38], 0x5c0059
mov dword [rsp + 0x3c], 0x570055
mov dword [rsp + 0x40], 0x300055
movzx eax, word [0x1800bd15a]
xor ax, cx
mov word [rsp + 0x44], ax
movzx eax, word [0x1800bd15c]
xor ax, cx
mov word [rsp + 0x46], ax
movzx eax, word [0x1800bd15e]
xor ax, cx
mov word [rsp + 0x48], ax
movzx eax, word [str.SeLoadDriverPrivilege]
xor ax, cx
mov word [rsp + 0x4a], ax
movzx eax, word [0x1800bd162]
xor ax, cx
mov word [rsp + 0x4c], ax
movzx eax, word [0x1800bd164]
xor ax, cx
mov word [rsp + 0x4e], ax
movzx eax, word [0x1800bd166]
xor ax, cx
mov word [rsp + 0x50], ax
movzx eax, word [0x1800bd168]
xor ax, cx
mov word [rsp + 0x52], ax
movzx eax, word [0x1800bd16a]
xor ax, cx
mov word [rsp + 0x54], ax
movzx eax, word [0x1800bd16c]
xor ax, cx
mov word [rsp + 0x56], ax
movzx eax, word [0x1800bd16e]
xor ax, cx
mov word [rsp + 0x58], ax
movzx eax, word [0x1800bd170]
xor ax, cx
mov word [rsp + 0x5a], ax
movzx eax, word [0x1800bd172]
xor ax, cx
mov word [rsp + 0x5c], ax
movzx eax, word [0x1800bd174]
xor ax, cx
mov word [rsp + 0x5e], ax
movzx eax, word [0x1800bd176]
xor ax, cx
mov word [rsp + 0x60], ax
movzx eax, word [0x1800bd178]
xor ax, cx
mov word [rsp + 0x62], ax
xor eax, eax
mov word [rsp + 0x64], ax
xor edi, edi
xor word [rsp + rax*2 + 0x22], cx
inc rax
cmp rax, 0x21
jae 0x1800397f7
movzx ecx, word [rsp + 0x20]
jmp 0x1800397e2
mov word [rsp + 0x64], di
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], 7
lea rax, [rsp + 0x22]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180039820
lea rdx, [rsp + 0x22]
lea rcx, [rbp - 0x30]
call fcn.18002d540
lea rcx, [rbp - 0x30]
call fcn.180039ad0
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x180039882
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003987d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180039ac2
call fcn.18003b2f0
mov ecx, 0x67
mov dword [rsp + 0x70], 0x340067
mov dword [rsp + 0x74], 0x2b0002
mov dword [rsp + 0x78], 0x60008
mov dword [rsp + 0x7c], 0x230003
mov dword [rbp - 0x80], 0xe0015
mov dword [rbp - 0x7c], 0x20011
mov dword [rbp - 0x78], 0x370015
mov dword [rbp - 0x74], 0xe0015
mov dword [rbp - 0x70], 0xe0011
mov dword [rbp - 0x6c], 0x2000b
mov dword [rbp - 0x68], 0x20000
mov word [rbp - 0x64], cx
movzx eax, word [0x1800bd18c]
xor ax, cx
mov word [rbp - 0x62], ax
movzx eax, word [0x1800bd18e]
xor ax, cx
mov word [rbp - 0x60], ax
movzx eax, word [str.ntdll.dll]
xor ax, cx
mov word [rbp - 0x5e], ax
movzx eax, word [0x1800bd192]
xor ax, cx
mov word [rbp - 0x5c], ax
movzx eax, word [0x1800bd194]
xor ax, cx
mov word [rbp - 0x5a], ax
movzx eax, word [0x1800bd196]
xor ax, cx
mov word [rbp - 0x58], ax
movzx eax, word [0x1800bd198]
xor ax, cx
mov word [rbp - 0x56], ax
movzx eax, word [0x1800bd19a]
xor ax, cx
mov word [rbp - 0x54], ax
movzx eax, word [0x1800bd19c]
xor ax, cx
mov word [rbp - 0x52], ax
movzx eax, word [0x1800bd19e]
xor ax, cx
mov word [rbp - 0x50], ax
movzx eax, word [0x1800bd1a0]
xor ax, cx
mov word [rbp - 0x4e], ax
movzx eax, word [0x1800bd1a2]
xor ax, cx
mov word [rbp - 0x4c], ax
movzx eax, word [0x1800bd1a4]
xor ax, cx
mov word [rbp - 0x4a], ax
movzx eax, word [0x1800bd1a6]
xor ax, cx
mov word [rbp - 0x48], ax
movzx eax, word [str.RtlDosPathNameToNtPathName_U]
xor ax, cx
mov word [rbp - 0x46], ax
movzx eax, word [0x1800bd1aa]
xor ax, cx
mov word [rbp - 0x44], ax
movzx eax, word [0x1800bd1ac]
xor ax, cx
mov word [rbp - 0x42], ax
movzx eax, word [0x1800bd1ae]
xor ax, cx
mov word [rbp - 0x40], ax
movzx eax, word [0x1800bd1b0]
xor ax, cx
mov word [rbp - 0x3e], ax
movzx eax, word [0x1800bd1b2]
xor ax, cx
mov word [rbp - 0x3c], ax
movzx eax, word [0x1800bd1b4]
xor ax, cx
mov word [rbp - 0x3a], ax
xor eax, eax
mov word [rbp - 0x38], ax
mov rax, rdi
nop dword [rax + rax]
xor word [rsp + rax*2 + 0x72], cx
inc rax
cmp rax, 0x2b
jae 0x180039a25
movzx ecx, word [rsp + 0x70]
jmp 0x180039a10
mov word [rbp - 0x38], di
mov qword [rbp - 0x10], rdi
mov qword [rbp], rdi
mov qword [rbp + 8], 7
lea rax, [rsp + 0x72]
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x180039a40
mov r8, rbx
lea rdx, [rsp + 0x72]
lea rcx, [rbp - 0x10]
call fcn.18002d540
lea rcx, [rbp - 0x10]
call fcn.180039ad0
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x180039aa0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180039a9b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180039abc
call fcn.18003b2f0
call fcn.180039be0
mov al, 1
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.18004cc60
int3
call fcn.18004cc60
int3