Function at 0x180034860
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
cmp qword [rcx + 0x38], 0
mov r15, rdx
mov rdi, rcx
jne 0x180034c5f
xor ebx, ebx
mov dword [rsp + 0x20], 0x6a785b81
mov dword [rsp + 0x24], 0x524c454b
mov dword [rsp + 0x28], 0x4e514573
mov word [rsp + 0x2c], 0x66
mov qword [rbp + 0x1c8], rbx
mov rax, qword [rbp + 0x1c8]
nop word [rax + rax]
mov rcx, qword [rbp + 0x1c8]
mov rax, qword [rbp + 0x1c8]
add cl, 0x1c
xor cl, byte [rsp + rax + 0x21]
mov rax, qword [rbp + 0x1c8]
mov byte [rsp + rax + 0x21], cl
mov rax, qword [rbp + 0x1c8]
inc rax
mov qword [rbp + 0x1c8], rax
mov rax, qword [rbp + 0x1c8]
cmp rax, 0xc
jb 0x1800348c0
mov byte [rsp + 0x2d], bl
call fcn.1800015d0
mov rcx, qword gs:[0x58]
mov r14, rax
mov edx, dword [0x18039b468]
mov eax, 4
mov rsi, qword [rcx + rdx*8]
add rsi, rax
mov ecx, dword [rsi]
cmp dword [0x18039d510], ecx
jle 0x18003495e
lea rcx, [0x18039d510]
call fcn.180360f8c
cmp dword [0x18039d510], 0xffffffff
jne 0x18003495e
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x18039d510]
mov qword [0x1803a15b8], rax
call fcn.180360f2c
mov eax, dword [rsi]
cmp dword [0x1803a1558], eax
jle 0x180034997
lea rcx, [0x1803a1558]
call fcn.180360f8c
cmp dword [0x1803a1558], 0xffffffff
jne 0x180034997
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1803a1558]
mov qword [0x1803a1560], rax
call fcn.180360f2c
mov rcx, r14
call qword [0x1803a15b8]
mov rcx, rax
lea rdx, [rsp + 0x21]
call qword [0x1803a1560]
mov r12, rax
test rax, rax
je 0x180034c59
movdqa xmm0, xmmword [0x18038f6b0]
movdqu xmmword [rsp + 0x2e], xmm0
mov word [rsp + 0x3e], 0x1e
mov qword [rbp + 0x1c8], rbx
mov rcx, qword [rbp + 0x1c8]
nop dword [rax]
mov rcx, qword [rbp + 0x1c8]
mov rax, qword [rbp + 0x1c8]
add cl, 0x50
xor cl, byte [rsp + rax + 0x2f]
mov rax, qword [rbp + 0x1c8]
mov byte [rsp + rax + 0x2f], cl
mov rax, qword [rbp + 0x1c8]
inc rax
mov qword [rbp + 0x1c8], rax
mov rax, qword [rbp + 0x1c8]
cmp rax, 0x10
jb 0x1800349e0
mov byte [rsp + 0x3f], bl
call fcn.1800015d0
mov edx, dword [rsi]
mov r14, rax
cmp dword [0x18039d510], edx
jle 0x180034a63
lea rcx, [0x18039d510]
call fcn.180360f8c
cmp dword [0x18039d510], 0xffffffff
jne 0x180034a63
mov rdx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x18039d510]
mov qword [0x1803a15b8], rdx
call fcn.180360f2c
mov eax, dword [rsi]
cmp dword [0x1803a1558], eax
jle 0x180034a9c
lea rcx, [0x1803a1558]
call fcn.180360f8c
cmp dword [0x1803a1558], 0xffffffff
jne 0x180034a9c
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1803a1558]
mov qword [0x1803a1560], rax
call fcn.180360f2c
mov rcx, r14
call qword [0x1803a15b8]
mov rcx, rax
lea rdx, [rsp + 0x2f]
call qword [0x1803a1560]
mov rsi, rax
test rax, rax
je 0x180034c59
lea rax, [rbp + 0x60]
mov qword [rsp + 0x48], rax
mov qword [rbp + 0x1c8], 0x8e
mov qword [rsp + 0x40], 0x76
mov rdx, qword [rbp + 0x1c8]
mov rcx, qword [rsp + 0x40]
add rdx, rcx
mov qword [rbp + 0x1c8], rdx
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x1c8]
call r12
xor eax, eax
mov word [rbp + 0x1b0], 0x160e
mov byte [rbp + 0x1b2], al
mov qword [rbp + 0x1c8], rbx
mov rax, qword [rbp + 0x1c8]
nop
mov rcx, qword [rbp + 0x1c8]
mov rax, qword [rbp + 0x1c8]
add cl, 0x71
xor cl, byte [rbp + rax + 0x1b1]
mov rax, qword [rbp + 0x1c8]
mov byte [rbp + rax + 0x1b1], cl
mov rax, qword [rbp + 0x1c8]
inc rax
mov qword [rbp + 0x1c8], rax
mov rax, qword [rbp + 0x1c8]
cmp rax, 1
jb 0x180034b20
lea r9, [rsp + 0x50]
mov byte [rbp + 0x1b2], bl
xor r8d, r8d
lea rdx, [rbp + 0x1b1]
lea rcx, [rbp + 0x60]
call rsi
cmp byte [rdi + 0x58], 5
jne 0x180034c2e
mov dword [rbp + 0x1c0], 0x6f733bd2
mov word [rbp + 0x1c4], 0x7d
mov qword [rbp + 0x1c8], rbx
mov rax, qword [rbp + 0x1c8]
nop word [rax + rax]
mov rcx, qword [rbp + 0x1c8]
mov rax, qword [rbp + 0x1c8]
add cl, 0x15
xor cl, byte [rbp + rax + 0x1c1]
mov rax, qword [rbp + 0x1c8]
mov byte [rbp + rax + 0x1c1], cl
mov rax, qword [rbp + 0x1c8]
inc rax
mov qword [rbp + 0x1c8], rax
mov rax, qword [rbp + 0x1c8]
cmp rax, 4
jb 0x180034bb0
mov byte [rbp + 0x1c5], bl
cmp byte [rsp + 0x50], bl
je 0x180034c09
inc ebx
cmp byte [rsp + rbx + 0x50], 0
jne 0x180034c00
mov eax, ebx
lea rcx, [rsp + 0x50]
add rcx, rax
lea rdx, [rbp + 0x1c1]
sub rdx, rcx
nop dword [rax]
movzx eax, byte [rcx + rdx]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x180034c20
lea rbx, [rdi + 0x28]
mov r8, 0xffffffffffffffff
lea rax, [rsp + 0x50]
nop
inc r8
cmp byte [rax + r8], 0
jne 0x180034c40
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.180353890
jmp 0x180034c63
lea rdx, [rdi + 0x28]
jmp 0x180034c66
lea rbx, [rcx + 0x28]
mov rdx, rbx
mov rcx, r15
call fcn.1803520c0
mov rax, r15
add rsp, 0x270
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret