Function at 0x180031bd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0x98
mov rax, qword [0x180071748]
xor rax, rsp
mov qword [rbp - 9], rax
mov ebx, dword [rbp + 0x7f]
mov r12, r8
mov rax, qword [rbp + 0x77]
mov r11, r9
mov qword [rbp - 0x39], rdx
mov rdx, rcx
mov qword [rbp - 0x49], r9
lea r8d, [rbx - 0x12]
mov qword [rbp - 0x51], rcx
mov qword [rbp - 0x41], rax
mov dword [rbp - 0x55], ebx
mov dword [rbp - 0x65], r8d
cmp ebx, r8d
jbe case.0x180031c96.0
movzx r14d, byte [rbp - 0x68]
lea r8d, [rbx - 0xfb]
movsxd rsi, dword [rbp - 0x55]
lea rcx, [0x180000000]
mov rdi, qword [rbp - 0x39]
mov r13, rsi
mov r15, qword [rbp - 0x39]
mov eax, dword [rbp - 0x65]
mov byte [rbp - 0x68], r14b
movzx r9d, byte [rbp - 0x68]
mov dword [rbp - 0x59], r8d
movzx r8d, byte [rbp - 0x68]
mov r10d, dword [rbp - 0x59]
mov byte [rbp - 0x67], r9b
mov byte [rbp - 0x69], r8b
nop
cmp r10d, 0x25
ja case.default.0x180031c96
mov eax, r10d
movzx eax, byte [rcx + rax + 0x321e4]
mov ecx, dword [rcx + rax*4 + 0x3219c]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
test r14b, r14b
je 0x180031caa
cmp esi, dword [0x180072730]
jne 0x180031caa
mov r14b, 1
jmp 0x180031cad
xor r14b, r14b
mov byte [rbp - 0x68], r14b
cmp r9b, r8b
je case.0x180031c96.17
test r9b, r9b
mov eax, 0x28
mov ecx, 0x26
cmovne eax, ecx
mov dword [rbp - 0x61], eax
jmp case.0x180031c96.0
mov qword [rdi], r11
jmp case.0x180031c96.17
movdqa xmm0, xmmword [str.http:__www.w3.org_XML_1998_names]
movdqa xmm1, xmmword [0x18006c7f0]
mov dword [rbp - 0x11], 0x65636170
mov eax, dword [rbp - 0x11]
movups xmmword [0x1800726e0], xmm0
mov dword [0x180072700], eax
movups xmmword [0x1800726f0], xmm1
mov byte [0x180072704], 0
mov dword [0x180072708], 0x24
jmp case.0x180031c96.17
cmp byte [rdx], 0
jne 0x180031d39
cmp qword [r11], 0
je case.0x180031c96.17
mov dword [rbp - 0x61], 0x1c
jmp case.0x180031c96.0
mov rax, qword [r11]
test rax, rax
je case.0x180031c96.17
cmp byte [rax], 0x78
jne case.0x180031c96.17
cmp byte [rax + 1], 0x6d
jne case.0x180031c96.17
cmp byte [rax + 2], 0x6c
jne case.0x180031c96.17
movzx ecx, byte [rax + 3]
cmp cl, 0x6e
jne 0x180031d8b
cmp byte [rax + 4], 0x73
jne case.0x180031c96.17
cmp byte [rax + 5], 0
jne case.0x180031c96.17
mov dword [rbp - 0x61], 0x27
jmp case.0x180031c96.0
mov eax, dword [rbp - 0x65]
test cl, cl
lea rcx, [0x180000000]
jne case.default.0x180031c96
mov r9b, 1
mov byte [rbp - 0x67], r9b
jmp case.default.0x180031c96
mov rcx, qword [rdi + 0x20]
movsxd r8, esi
mov dword [rdi + 0x28], esi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [r12]
mov rdx, qword [rbp - 0x51]
movzx r8d, byte [rbp - 0x69]
movzx r9d, byte [rbp - 0x67]
movzx ecx, byte [rax + 0x374]
mov r10d, dword [rbp - 0x59]
mov r11, qword [rbp - 0x49]
test cl, cl
je case.0x180031c96.17
mov rax, qword [rdi + 0x20]
mov byte [rax + r13 - 1], cl
jmp case.0x180031c96.17
cmp byte [rdx], 0
jne 0x180031e0f
mov rax, qword [r12]
mov rcx, qword [rax + 0x2a8]
add rcx, 0x130
cmp r11, rcx
jne 0x180031e0f
xor eax, eax
jmp 0x180031e12
mov rax, rdi
mov rcx, qword [rbp - 0x39]
mov qword [r11 + 8], rax
mov rax, qword [rcx]
mov qword [rdi + 8], rax
mov qword [rcx], rdi
jmp case.0x180031c96.17
mov rax, qword [rbp - 0x41]
mov qword [rdi + 0x18], rax
jmp case.0x180031c96.17
xor esi, esi
xor r13d, r13d
cmp byte [rdx], sil
jne 0x180031e67
lea rcx, [0x180000000]
test r8b, r8b
je 0x180031ec3
cmp esi, dword [0x180072708]
jne 0x180031ec3
mov r8b, 1
mov byte [rbp - 0x69], r8b
jmp 0x18003214e
lea rax, [0x180000000]
test r8b, r8b
je 0x180031e86
cmp esi, dword [0x180072708]
jg 0x180031e83
movzx eax, byte [rax + r13 + 0x726e0]
cmp byte [rdx + r13], al
je 0x180031e86
xor r8b, r8b
lea rcx, [0x180000000]
test r9b, r9b
jne 0x180031eb1
test r14b, r14b
je 0x180031eb1
cmp esi, dword [0x180072730]
jg 0x180031eae
movzx eax, byte [rcx + r13 + 0x72710]
cmp byte [rdx + r13], al
je 0x180031eb1
xor r14b, r14b
inc r13
inc esi
cmp byte [rdx + r13], 0
jne 0x180031e60
mov byte [rbp - 0x68], r14b
jmp 0x180031e47
xor r8b, r8b
mov byte [rbp - 0x69], r8b
jmp 0x18003214e
mov rcx, qword [rbp - 0x41]
mov rax, qword [r12]
mov rdx, qword [rcx]
mov rcx, r11
call qword [rax + 0x20]
mov rdx, qword [rbp - 0x51]
movzx r8d, byte [rbp - 0x69]
movzx r9d, byte [rbp - 0x67]
mov r10d, dword [rbp - 0x59]
mov r11, qword [rbp - 0x49]
mov qword [rbp - 0x61], rax
jmp case.0x180031c96.17
mov rax, qword [r11 + 8]
mov qword [rdi + 0x10], rax
jmp case.0x180031c96.17
test r14b, r14b
jne 0x180032167
mov rdx, qword [r12]
lea rax, [r13 + 1]
movzx ecx, byte [rdx + 0x374]
test cl, cl
cmove rax, r13
mov r13, rax
lea eax, [rsi + 1]
cmove eax, esi
cmp qword [rdx + 0x2d0], 0
mov esi, eax
je 0x180031fe8
mov r14d, 0xa1
nop dword [rax]
mov eax, r14d
sub eax, 0xa1
je 0x180031fc5
cmp eax, 0x5a
jne 0x180031fd0
cmp esi, dword [rdi + 0x2c]
jle 0x180031fb4
mov ebx, 0x101
nop dword [rax]
cmp ebx, 0x101
je 0x180031f8c
cmp ebx, 0x3c3c
jne 0x180031fa6
lea eax, [rsi + 0x18]
mov qword [rdi + 0x20], r15
mov dword [rdi + 0x2c], eax
jmp 0x180031fa6
mov r8, qword [r12]
lea eax, [rsi + 0x18]
mov rcx, qword [rdi + 0x20]
movsxd rdx, eax
call qword [r8 + 0x20]
mov r15, rax
test rax, rax
je 0x180032021
add ebx, 0x3b3b
cmp ebx, 0x7676
jbe 0x180031f70
mov rcx, qword [r12]
mov rax, qword [rdi + 8]
mov qword [rcx + 0x2d0], rax
jmp 0x180031fd0
mov rax, qword [r12]
mov rdi, qword [rax + 0x2d0]
add r14d, 0x5a
cmp r14d, 0x155
jb 0x180031f50
movzx r14d, byte [rbp - 0x68]
jmp 0x18003205e
mov ebx, 0xcf
nop dword [rax]
mov eax, ebx
sub eax, 0xcf
je 0x180032045
sub eax, 1
je 0x18003202d
sub eax, 1
je 0x180032010
cmp eax, 1
jne 0x180032054
lea eax, [rsi + 0x18]
mov dword [rdi + 0x2c], eax
jmp 0x180032054
cmp qword [rdi + 0x20], 0
jne 0x180032054
mov rax, qword [r12]
mov rcx, rdi
call qword [rax + 0x28]
mov dword [rbp - 0x61], 1
jmp case.0x180031c96.0
test rdi, rdi
je 0x180032021
mov rdx, qword [r12]
lea eax, [rsi + 0x18]
movsxd rcx, eax
call qword [rdx + 0x18]
mov qword [rdi + 0x20], rax
jmp 0x180032054
mov rax, qword [r12]
mov ecx, 0x30
call qword [rax + 0x18]
mov rdi, rax
inc ebx
cmp ebx, 0xd3
jb 0x180031ff0
mov rdx, qword [rbp - 0x51]
movzx r8d, byte [rbp - 0x69]
movzx r9d, byte [rbp - 0x67]
mov ebx, dword [rbp - 0x55]
mov r10d, dword [rbp - 0x59]
mov r11, qword [rbp - 0x49]
jmp case.0x180031c96.17
mov r8b, 1
mov byte [rbp - 0x69], r8b
movzx r14d, r8b
mov byte [rbp - 0x68], r8b
jmp case.0x180031c96.17
cmp qword [rbp - 0x41], 0
je case.0x180031c96.17
mov rcx, qword [r12]
mov rax, qword [rcx + 0xc8]
test rax, rax
je case.0x180031c96.17
mov rcx, qword [rcx + 8]
xor r8d, r8d
cmp qword [r11 + 8], r8
cmovne r8, rdx
mov rdx, qword [r11]
call rax
mov rdx, qword [rbp - 0x51]
movzx r8d, byte [rbp - 0x69]
movzx r9d, byte [rbp - 0x67]
mov r10d, dword [rbp - 0x59]
mov r11, qword [rbp - 0x49]
jmp case.0x180031c96.17
xor eax, eax
cmp byte [r12 + 1], 0x3a
sete al
mov dword [rbp - 0x61], eax
jmp case.0x180031c96.17
movdqa xmm0, xmmword [str.http:__www.w3.org_XML_1998_names]
xor r9b, r9b
mov dword [rbp - 0x19], 0x736e6c6d
mov eax, dword [rbp - 0x19]
movups xmmword [0x180072710], xmm0
mov dword [0x180072728], eax
mov dword [rbp - 0x21], 0x30322f67
mov dword [rbp - 0x1d], 0x782f3030
movsd xmm0, qword [rbp - 0x21]
mov word [rbp - 0x15], 0x2f
movzx eax, word [rbp - 0x15]
movsd qword [0x180072720], xmm0
mov word [0x18007272c], ax
mov dword [0x180072730], 0x1d
mov byte [rbp - 0x67], r9b
lea rcx, [0x180000000]
mov eax, dword [rbp - 0x65]
dec ebx
dec r10d
mov dword [rbp - 0x55], ebx
mov dword [rbp - 0x59], r10d
cmp ebx, eax
ja 0x180031c70
jmp case.0x180031c96.0
mov eax, 0x28
mov dword [rbp - 0x61], eax
jmp case.0x180031c96.0
mov dword [rbp - 0x61], 0
mov rax, qword [rbp - 0x61]
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.180064e10
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret