Function at 0x180005d90
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2f0]
sub rsp, 0x3f0
mov rax, qword [0x180028010]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
mov r15, r8
mov r12, rdx
mov qword [rbp + 0x40], rdx
xor esi, esi
mov edi, esi
mov dword [rsp + 0x78], esi
lea r8, [rsp + 0x70]
movzx edx, byte [rsp + 0x70]
lea rcx, [rbp + 0x68]
call fcn.180003ea0
nop
mov rdx, r12
lea rcx, [rbp + 0x68]
call fcn.180003970
nop
lea r8d, [rsi + 4]
lea rdx, [0x180023cc8]
lea rcx, [rbp + 0x68]
call fcn.18000a9f0
lea rcx, [rbp + 0x68]
call fcn.180002ba0
lea rdx, [rbp + 0x90]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov r14, rax
movdqa xmm0, xmmword [0x180024540]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1800242f0]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmmword [0x180024730]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x180024330]
movdqa xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x60], 0x42744774
mov dword [rsp + 0x64], 0x4d744c74
mov byte [rsp + 0x68], 0x74
xor eax, eax
mov word [rsp + 0x69], ax
mov ecx, esi
nop dword [rax]
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x21], al
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x22], al
add rcx, 2
cmp rcx, 0x48
jb 0x180005e80
mov word [rsp + 0x69], 0
lea rdx, [rsp + 0x21]
lea rcx, [rbp + 0x48]
call fcn.180002930
mov rcx, rax
call fcn.1800028c0
cmp r14, 0xffffffffffffffff
jne 0x180005f80
movdqa xmm0, xmmword [0x180024ad0]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x180023f50]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmmword [0x180024850]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x180023e90]
movdqa xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x60], 0x7f497a49
mov dword [rsp + 0x64], 0x70497149
mov byte [rsp + 0x68], 0x49
xor eax, eax
mov word [rsp + 0x69], ax
nop word [rax + rax]
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rsi + 0x21], al
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rsi + 0x22], al
add rsi, 2
cmp rsi, 0x48
jb 0x180005f20
mov word [rsp + 0x69], 0
lea rdx, [rsp + 0x21]
lea rcx, [rbp + 0x48]
call fcn.180002930
mov rcx, rax
call fcn.1800028c0
nop
lea rcx, [rbp + 0x68]
call fcn.1800028c0
nop
mov rcx, r12
call fcn.1800028c0
xor al, al
jmp 0x180006647
movdqa xmm0, xmmword [0x180024340]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x180024470]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmmword [0x1800241f0]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x1800244d0]
movdqa xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x60], 0x33053605
mov dword [rsp + 0x64], 0x3c053d05
mov byte [rsp + 0x68], 5
xor eax, eax
mov word [rsp + 0x69], ax
mov rcx, rsi
nop word [rax + rax]
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x21], al
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x22], al
add rcx, 2
cmp rcx, 0x48
jb 0x180005fe0
mov word [rsp + 0x69], 0
lea rdx, [rsp + 0x21]
lea rcx, [rbp - 0x40]
call fcn.180002930
mov rcx, rax
call fcn.1800028c0
lea rdx, [rbp + 0xbc]
lea rcx, [rbp + 0x48]
call fcn.180002930
nop
lea rdx, [0x180023cd4]
lea rcx, [rbp + 0x48]
call fcn.18000ae90
test al, al
jne 0x1800064ea
lea rdx, [0x180023cd8]
lea rcx, [rbp + 0x48]
call fcn.18000ae90
test al, al
jne 0x1800064ea
xor eax, eax
mov rcx, rsi
mov word [rsp + 0x69], ax
test byte [rbp + 0x90], 0x10
je 0x180006175
movdqa xmm0, xmmword [0x180023e80]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x180024b70]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmmword [str.__t__n_]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x180024ac0]
movdqa xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x60], 0xd3b083b
mov dword [rsp + 0x64], 0x23b033b
mov byte [rsp + 0x68], 0x3b
nop
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x21], al
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x22], al
add rcx, 2
cmp rcx, 0x48
jb 0x1800060c0
mov word [rsp + 0x69], 0
lea rdx, [rsp + 0x21]
lea rcx, [rbp - 0x40]
call fcn.180002930
mov rcx, rax
call fcn.1800028c0
movdqa xmm0, xmmword [0x180024a10]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x180023e10]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmmword [0x180024980]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x180023dd0]
movdqa xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x60], 0x76407340
mov dword [rsp + 0x64], 0x79407840
mov byte [rsp + 0x68], 0x40
xor eax, eax
mov word [rsp + 0x69], ax
mov rcx, rsi
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x21], al
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x22], al
add rcx, 2
cmp rcx, 0x48
jb 0x180006150
lea rcx, [rbp - 0x40]
jmp 0x180006561
movdqa xmm0, xmmword [str.LLyL]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x180023ea0]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmmword [0x180024800]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x180023f60]
movdqa xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x60], 0x7a4c7f4c
mov dword [rsp + 0x64], 0x754c744c
mov byte [rsp + 0x68], 0x4c
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x21], al
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x22], al
add rcx, 2
cmp rcx, 0x48
jb 0x1800061c2
mov word [rsp + 0x69], 0
lea rdx, [rsp + 0x21]
lea rcx, [rbp - 0x40]
call fcn.180002930
mov rcx, rax
call fcn.1800028c0
mov byte [rbp - 0x80], 0x3d
mov al, 0x13
mov cl, 0x3d
mov dl, 0x54
movzx r8d, cl
mov r9b, 0x53
movzx r10d, cl
movzx r11d, dl
movzx ebx, cl
xor r13d, r13d
xor al, cl
mov byte [rbp - 0x7f], al
xor cl, cl
mov byte [rbp - 0x7e], cl
xor dl, bl
mov byte [rbp - 0x7d], dl
xor r8b, bl
mov byte [rbp - 0x7c], r8b
xor r9b, bl
mov byte [rbp - 0x7b], r9b
xor r10b, bl
mov byte [rbp - 0x7a], r10b
xor r11b, bl
mov byte [rbp - 0x79], r11b
xor bl, bl
mov byte [rbp - 0x78], bl
mov word [rbp - 0x77], r13w
lea rdx, [rbp - 0x7f]
lea rcx, [rbp - 0x20]
call fcn.180002930
nop
or edi, 1
mov dword [rsp + 0x78], edi
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.180003830
cmp rax, 0xffffffffffffffff
jne 0x1800063eb
mov byte [rbp - 0x70], 0x7b
mov al, 0x55
mov cl, 0x7b
mov dl, 0xf
movzx r8d, cl
mov r9b, 3
movzx r10d, cl
movzx r11d, dl
movzx ebx, cl
xor al, cl
mov byte [rbp - 0x6f], al
xor cl, cl
mov byte [rbp - 0x6e], cl
xor dl, bl
mov byte [rbp - 0x6d], dl
xor r8b, bl
mov byte [rbp - 0x6c], r8b
xor r9b, bl
mov byte [rbp - 0x6b], r9b
xor r10b, bl
mov byte [rbp - 0x6a], r10b
xor r11b, bl
mov byte [rbp - 0x69], r11b
xor bl, bl
mov byte [rbp - 0x68], bl
mov word [rbp - 0x67], r13w
lea rdx, [rbp - 0x6f]
lea rcx, [rbp + 0x20]
call fcn.180002930
nop
or edi, 2
mov dword [rsp + 0x78], edi
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.180003830
cmp rax, 0xffffffffffffffff
jne 0x1800063eb
mov byte [rbp - 0x60], 0x62
mov al, 0x4c
mov cl, 0x62
mov dl, 0x12
movzx r8d, cl
mov r9b, 6
movzx r10d, cl
mov r11b, 4
movzx ebx, cl
xor al, cl
mov byte [rbp - 0x5f], al
xor cl, cl
mov byte [rbp - 0x5e], cl
xor dl, bl
mov byte [rbp - 0x5d], dl
xor r8b, bl
mov byte [rbp - 0x5c], r8b
xor r9b, bl
mov byte [rbp - 0x5b], r9b
xor r10b, bl
mov byte [rbp - 0x5a], r10b
xor r11b, bl
mov byte [rbp - 0x59], r11b
xor bl, bl
mov byte [rbp - 0x58], bl
mov word [rbp - 0x57], r13w
lea rdx, [rbp - 0x5f]
lea rcx, [rbp]
call fcn.180002930
nop
or edi, 4
mov dword [rsp + 0x78], edi
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.180003830
cmp rax, 0xffffffffffffffff
jne 0x1800063eb
mov byte [rbp - 0x50], 0x3d
mov al, 0x13
mov cl, 0x3d
mov dl, 0x57
movzx r8d, cl
mov r9b, 0x4d
movzx r10d, cl
mov r11b, 0x5a
movzx ebx, cl
xor al, cl
mov byte [rbp - 0x4f], al
xor cl, cl
mov byte [rbp - 0x4e], cl
xor dl, bl
mov byte [rbp - 0x4d], dl
xor r8b, bl
mov byte [rbp - 0x4c], r8b
xor r9b, bl
mov byte [rbp - 0x4b], r9b
xor r10b, bl
mov byte [rbp - 0x4a], r10b
xor r11b, bl
mov byte [rbp - 0x49], r11b
xor bl, bl
mov byte [rbp - 0x48], bl
mov word [rbp - 0x47], r13w
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x40]
call fcn.180002930
or edi, 8
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.180003830
cmp rax, 0xffffffffffffffff
je 0x1800063ed
mov bl, 1
test dil, 8
je 0x180006400
and edi, 0xfffffff7
lea rcx, [rbp - 0x40]
call fcn.1800028c0
nop
test dil, 4
je 0x180006413
and edi, 0xfffffffb
lea rcx, [rbp]
call fcn.1800028c0
nop
test dil, 2
je 0x180006426
and edi, 0xfffffffd
lea rcx, [rbp + 0x20]
call fcn.1800028c0
nop
test dil, 1
je 0x180006438
and edi, 0xfffffffe
lea rcx, [rbp - 0x20]
call fcn.1800028c0
test bl, bl
je 0x18000657b
movdqa xmm0, xmmword [0x1800245e0]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1800243b0]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmmword [0x180024680]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x180024450]
movdqa xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x60], 0x487e4d7e
mov dword [rsp + 0x64], 0x477e467e
mov byte [rsp + 0x68], 0x7e
xor eax, eax
mov word [rsp + 0x69], ax
mov rcx, rsi
nop word [rax + rax]
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x21], al
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x22], al
add rcx, 2
cmp rcx, 0x48
jb 0x1800064a0
mov word [rsp + 0x69], 0
lea rdx, [rsp + 0x21]
lea rcx, [rbp - 0x20]
call fcn.180002930
mov rcx, rax
call fcn.1800028c0
lea rdx, [rbp + 0x48]
mov rcx, r15
call fcn.1800037f0
jmp 0x18000657b
movdqa xmm0, xmmword [0x180024750]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x180024280]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmmword [0x1800244e0]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x180024220]
movdqa xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x60], 0x5f695a69
mov dword [rsp + 0x64], 0x50695169
mov byte [rsp + 0x68], 0x69
xor eax, eax
mov word [rsp + 0x69], ax
mov rax, rsi
movzx ecx, byte [rsp + 0x20]
xor byte [rsp + rax + 0x21], cl
movzx ecx, byte [rsp + 0x20]
xor byte [rsp + rax + 0x22], cl
add rax, 2
cmp rax, 0x48
jb 0x180006541
lea rcx, [rbp - 0x20]
mov word [rsp + 0x69], 0
lea rdx, [rsp + 0x21]
call fcn.180002930
mov rcx, rax
call fcn.1800028c0
nop
lea rcx, [rbp + 0x48]
call fcn.1800028c0
lea rdx, [rbp + 0x90]
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x180005f80
movdqa xmm0, xmmword [0x180024b30]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x180023f20]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmmword [0x180024820]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [str.O_nO_tO]
movdqa xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x60], 0x794f7c4f
mov dword [rsp + 0x64], 0x764f774f
mov byte [rsp + 0x68], 0x4f
xor eax, eax
mov word [rsp + 0x69], ax
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rsi + 0x21], al
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rsi + 0x22], al
add rsi, 2
cmp rsi, 0x48
jb 0x1800065f0
mov word [rsp + 0x69], 0
lea rdx, [rsp + 0x21]
lea rcx, [rbp - 0x20]
call fcn.180002930
mov rcx, rax
call fcn.1800028c0
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_FindClose]
nop
lea rcx, [rbp + 0x68]
call fcn.1800028c0
nop
mov rcx, r12
call fcn.1800028c0
mov al, 1
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.18000e080
mov rbx, qword [rsp + 0x430]
add rsp, 0x3f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret