Function at 0x18004e6f0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x1800c8010]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov r15, rcx
mov qword [rsp + 0x50], rcx
xor ebx, ebx
mov qword [rbp + 0x70], rbx
mov dword [rbp + 0xd8], 0x528
mov dword [rbp + 0xdc], 3
lea rsi, [rcx + 0x58]
xor edx, edx
mov r8d, 0x528
mov rcx, rsi
call fcn.180059570
movdqa xmm0, xmmword [0x1800bb0d0]
movdqu xmmword [rbp + 0xe0], xmm0
movdqa xmm1, xmmword [str.Q_____Z___]
movdqu xmmword [rbp + 0xf0], xmm1
mov dword [rbp + 0x100], 0x151162
mov ecx, ebx
nop word [rax + rax]
movzx eax, cl
add al, byte [rbp + 0xe0]
xor byte [rbp + rcx + 0xe1], al
inc rcx
cmp rcx, 0x22
jb 0x18004e790
mov byte [rbp + 0x103], bl
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], bl
lea rax, [rbp + 0xe1]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x18004e7d2
lea rdx, [rbp + 0xe1]
lea rcx, [rsp + 0x30]
call fcn.18000b0f0
lea rdx, [rsp + 0x30]
call fcn.18000a540
mov r14, rax
movdqa xmm0, xmmword [str.Qgde]
movdqu xmmword [rbp + 0xa0], xmm0
movdqa xmm1, xmmword [0x1800bb1d0]
movdqu xmmword [rbp + 0xb0], xmm1
movdqa xmm0, xmmword [0x1800bb6a0]
movdqu xmmword [rbp + 0xc0], xmm0
mov dword [rbp + 0xd0], 0xc1bab9c1
mov word [rbp + 0xd4], VariantTimeToSystemTime
mov rcx, rbx
nop
movzx eax, byte [rbp + 0xa0]
add al, cl
xor byte [rbp + rcx + 0xa1], al
inc rcx
cmp rcx, 0x34
jb 0x18004e840
mov byte [rbp + 0xd5], bl
mov qword [rbp + 0xf0], rbx
mov qword [rbp + 0xf8], 0xf
mov byte [rbp + 0xe0], bl
lea rax, [rbp + 0xa1]
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x18004e881
lea rdx, [rbp + 0xa1]
lea rcx, [rbp + 0xe0]
call fcn.18000b0f0
nop
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0xa0]
call fcn.180009fe0
nop
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rdx, qword [rbp + 0xa0]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x60]
call fcn.18000aa90
nop
mov qword [rbp + 0x88], rbx
mov qword [rbp + 0x90], 7
mov word [rbp + 0x78], bx
mov rdx, qword [rsp + 0x60]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x18004e900
lea rcx, [rbp + 0x78]
call fcn.18000af70
nop
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
cmp rcx, rax
je 0x18004e92a
call fcn.180061acc
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x18004e96b
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004e966
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004f205
call fcn.180055890
mov qword [rbp + 0xb0], rbx
mov qword [rbp + 0xb8], 0xf
mov byte [rbp + 0xa0], 0
lea rdx, [rbp + 0x78]
cmp qword [rbp + 0x90], 8
cmovae rdx, qword [rbp + 0x78]
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
call r14
test eax, eax
setne r14b
mov rdx, qword [rbp + 0x90]
cmp rdx, 8
jb 0x18004e9fa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004e9f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004f20b
call fcn.180055890
mov qword [rbp + 0x88], rbx
mov qword [rbp + 0x90], 7
mov word [rbp + 0x78], bx
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x18004ea51
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004ea4c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004f211
call fcn.180055890
test r14b, r14b
jne 0x18004eec3
movdqa xmm0, xmmword [0x1800bc450]
movdqu xmmword [rbp + 0xe0], xmm0
movdqa xmm1, xmmword [0x1800bc3a0]
movdqu xmmword [rbp + 0xf0], xmm1
mov dword [rbp + 0x100], 0x77730574
mov dword [rbp + 0x104], 0x77010000
mov word [rbp + 0x108], 6
mov rcx, rbx
nop word [rax + rax]
movzx eax, byte [rbp + 0xe0]
xor byte [rbp + rcx + 0xe1], al
movzx eax, byte [rbp + 0xe0]
xor byte [rbp + rcx + 0xe2], al
add rcx, 2
cmp rcx, 0x28
jb 0x18004eaa0
mov byte [rbp + 0x109], 0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
lea rax, [rbp + 0xe1]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18004eaf0
lea rdx, [rbp + 0xe1]
lea rcx, [rsp + 0x30]
call fcn.18000b0f0
lea rdx, [rsp + 0x30]
call fcn.18000a540
mov r14, rax
movdqa xmm0, xmmword [0x1800bb020]
movdqu xmmword [rbp + 0x78], xmm0
mov dword [rbp + 0x88], 0x56552552
mov dword [rbp + 0x8c], 0x2d2f5221
mov dword [rbp + 0x90], 0x282a5b
mov rcx, rbx
nop word [rax + rax]
movzx eax, cl
add al, byte [rbp + 0x78]
xor byte [rbp + rcx + 0x79], al
inc rcx
cmp rcx, 0x1a
jb 0x18004eb50
mov byte [rbp + 0x93], 0
mov qword [rbp + 0xf0], rbx
mov qword [rbp + 0xf8], 0xf
mov byte [rbp + 0xe0], 0
lea rax, [rbp + 0x79]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18004eb90
lea rdx, [rbp + 0x79]
lea rcx, [rbp + 0xe0]
call fcn.18000b0f0
nop
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x78]
call fcn.180009fe0
nop
lea rdx, [rbp + 0x78]
cmp qword [rbp + 0x90], 0x10
cmovae rdx, qword [rbp + 0x78]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x60]
call fcn.18000aa90
nop
mov qword [rbp + 0xb0], rbx
mov qword [rbp + 0xb8], 7
mov word [rbp + 0xa0], bx
mov rdx, qword [rsp + 0x60]
mov r8, rdi
inc r8
cmp word [rdx + r8*2], 0
jne 0x18004ec03
lea rcx, [rbp + 0xa0]
call fcn.18000af70
nop
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
cmp rcx, rax
je 0x18004ec30
call fcn.180061acc
nop
mov rdx, qword [rbp + 0x90]
cmp rdx, 0x10
jb 0x18004ec6e
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004ec69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004f217
call fcn.180055890
mov qword [rbp + 0x88], rbx
mov qword [rbp + 0x90], 0xf
mov byte [rbp + 0x78], 0
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 8
cmovae rdx, qword [rbp + 0xa0]
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0xdc]
xor r8d, r8d
mov rcx, qword [rbp + 0x70]
call r14
test eax, eax
setne r14b
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x18004ed09
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004ed04
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004f21d
call fcn.180055890
mov qword [rbp + 0xb0], rbx
mov qword [rbp + 0xb8], 7
mov word [rbp + 0xa0], bx
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x18004ed63
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004ed5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004f223
call fcn.180055890
test r14b, r14b
jne 0x18004eec3
cmp dword [rbp + 0xd8], 0x528
jne 0x18004eeb3
mov dword [rbp + 0x98], 0xcc9933dd
test rsi, rsi
je 0x18004eeb3
movsd xmm1, qword [0x1800ba7c8]
movq rdx, xmm1
lea rcx, [0x1800a7d98]
call fcn.18000ba10
lea r10, [rsi + 2]
mov r14, rsi
not r14
mov r12d, 1
sub r12, rsi
mov r13d, 2
sub r13, rsi
mov eax, 3
sub rax, rsi
mov qword [rsp + 0x58], rax
mov r11, 0xfffffffffffffffe
sub r11, rsi
xor r15b, r15b
mov rdi, rax
movzx edx, byte [r10 - 2]
lea rax, [r11 + r10]
and eax, 3
movzx ecx, byte [rbp + rax + 0x98]
xor cl, dl
xor cl, r15b
mov byte [r10 - 2], cl
movzx r8d, byte [r10 - 1]
lea rax, [r10 + r14]
and eax, 3
movzx ecx, byte [rbp + rax + 0x98]
xor cl, dl
xor cl, r8b
mov byte [r10 - 1], cl
movzx r9d, byte [r10]
mov rax, r10
sub rax, rsi
and eax, 3
movzx ecx, byte [rbp + rax + 0x98]
xor cl, r8b
xor cl, r9b
mov byte [r10], cl
movzx edx, byte [r10 + 1]
lea rax, [r12 + r10]
and eax, 3
movzx ecx, byte [rbp + rax + 0x98]
xor cl, dl
xor cl, r9b
mov byte [r10 + 1], cl
movzx r8d, byte [r10 + 2]
lea rax, [r10 + r13]
and eax, 3
movzx ecx, byte [rbp + rax + 0x98]
xor cl, r8b
xor cl, dl
mov byte [r10 + 2], cl
movzx r15d, byte [r10 + 3]
lea rax, [rdi + r10]
and eax, 3
movzx ecx, byte [rbp + rax + 0x98]
xor cl, r15b
xor cl, r8b
mov byte [r10 + 3], cl
add r10, 6
lea rax, [r11 + r10]
cmp rax, 0x528
jb 0x18004ede1
mov rdi, 0xffffffffffffffff
mov r15, qword [rsp + 0x50]
jmp 0x18004eec3
xor edx, edx
mov r8d, 0x528
mov rcx, rsi
call fcn.180059570
cmp qword [rbp + 0x70], 0
je 0x18004ef7c
movdqa xmm0, xmmword [0x1800bb810]
mov dword [rbp + 0x88], 0x3e3a403c
mov dword [rbp + 0x8c], 0x3f393b4b
mov dword [rbp + 0x90], 0x424a3a41
mov word [rbp + 0x94], 0x3d39
mov byte [rbp + 0x96], 0
psubb xmm0, xmmword [0x1800bacd0]
movdqu xmmword [rbp + 0x78], xmm0
mov eax, 0x10
nop word [rax + rax]
add byte [rbp + rax + 0x78], 0xf7
inc rax
cmp rax, 0x1e
jb 0x18004ef20
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
lea rax, [rbp + 0x78]
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18004ef50
lea rdx, [rbp + 0x78]
lea rcx, [rsp + 0x30]
call fcn.18000b0f0
lea rdx, [rsp + 0x30]
call fcn.18000a540
mov rcx, qword [rbp + 0x70]
call rax
mov qword [rbp + 0x70], rbx
cmp qword [rsi], 0
jne 0x18004f178
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov r8d, 0x12
lea rdx, str..PhysicalDrive0
lea rcx, [rsp + 0x30]
call fcn.18000b0f0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x78]
call fcn.180029e20
nop
movsd xmm1, qword [0x1800ba7c8]
movq rdx, xmm1
lea rcx, [0x1800a7d98]
call fcn.18000ba10
cmp qword [rbp + 0x88], 0
jne 0x18004f030
call fcn.180030350
mov rbx, rax
mov rdx, qword [rbp + 0x90]
cmp rdx, 0x10
jb 0x18004f171
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004f16c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004f1ff
jmp 0x18004f16c
lea rdx, [rbp + 0x78]
cmp qword [rbp + 0x90], 0x10
cmovae rdx, qword [rbp + 0x78]
mov qword [rbp + 0xb0], rbx
mov qword [rbp + 0xb8], 0xf
mov byte [rbp + 0xa0], 0
nop word [rax + rax]
inc rdi
cmp byte [rdx + rdi], 0
jne 0x18004f060
mov r8, rdi
lea rcx, [rbp + 0xa0]
call fcn.18000b0f0
mov r14, qword [rbp + 0xb0]
lea rdi, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rdi, qword [rbp + 0xa0]
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
test rdi, rdi
je 0x18004f126
test r14, r14
je 0x18004f126
movsd xmm1, qword [0x1800ba7c8]
movq rdx, xmm1
lea rcx, [0x1800a7d98]
call fcn.18000ba10
mov r8d, r14d
mov rdx, rdi
lea rcx, [rbp + 0xe0]
call fcn.180030140
test eax, eax
je 0x18004f126
mov rbx, qword [rbp + 0x118]
xor rbx, qword [rbp + 0x110]
xor rbx, qword [rbp + 0x108]
xor rbx, qword [rbp + 0x100]
xor rbx, qword [rbp + 0xf8]
xor rbx, qword [rbp + 0xf0]
xor rbx, qword [rbp + 0xe8]
xor rbx, qword [rbp + 0xe0]
lea rcx, [rbp + 0xa0]
call fcn.18000b090
nop
mov rdx, qword [rbp + 0x90]
cmp rdx, 0x10
jb 0x18004f171
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004f16c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004f1f9
call fcn.180055890
mov qword [r15 + 0x60], rbx
mov qword [rsi], rbx
cmp qword [r15 + 0x28], 0
je 0x18004f19e
lea r8, [r15 + 0x18]
cmp qword [r8 + 0x18], 0x10
jb 0x18004f18d
mov r8, qword [r8]
lea rcx, [r15 + 0x378]
mov edx, 0x104
call fcn.18006805c
cmp qword [r15 + 0x48], 0
je 0x18004f1c4
lea r8, [r15 + 0x38]
cmp qword [r8 + 0x18], 0x10
jb 0x18004f1b3
mov r8, qword [r8]
lea rcx, [r15 + 0x47c]
mov edx, 0x104
call fcn.18006805c
mov eax, 1
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.1800555d0
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180067178
int3
call fcn.180067178
nop
call fcn.180067178
nop
call fcn.180067178
nop
call fcn.180067178
nop
call fcn.180067178
int3
call fcn.180067178
nop
call fcn.180067178
int3