Function at 0x180003c70
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2a8]
sub rsp, 0x380
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x250], rax
xor esi, esi
mov ecx, 0xde09b7c7
call fcn.180007a90
test rax, rax
je 0x180004835
mov edx, 0xc400327c
mov rcx, rax
call fcn.180007ba0
mov rbx, rax
test rax, rax
je 0x180004835
mov ecx, 0x1cdeaa54
call fcn.180007a90
test rax, rax
je 0x180004835
mov edx, 0x8d54b222
mov rcx, rax
call fcn.180007ba0
mov rdi, rax
test rax, rax
je 0x180004835
mov rcx, rbx
call fcn.180001360
test eax, eax
je 0x180004835
mov rcx, rdi
call fcn.180001360
test eax, eax
je 0x180004835
mov ecx, 0x6741a23d
call fcn.180007a90
mov rbx, rax
test rax, rax
je 0x180004835
mov edx, 0xcd6d1ef1
mov rcx, rax
call fcn.180007ba0
mov r13, rax
mov edx, 0x2c21399c
mov rcx, rbx
call fcn.180007ba0
mov rdi, rax
mov qword [rsp + 0x70], rax
mov edx, 0xca74a9fd
mov rcx, rbx
call fcn.180007ba0
mov r14, rax
mov qword [rsp + 0x50], rax
mov edx, 0x9e4a7ebd
mov rcx, rbx
call fcn.180007ba0
mov qword [rsp + 0x48], rax
mov edx, 0x9e29b7c3
mov rcx, rbx
call fcn.180007ba0
mov qword [rsp + 0x68], rax
mov edx, 0xfd113db2
mov rcx, rbx
call fcn.180007ba0
mov r12, rax
mov edx, 0x5af48346
mov rcx, rbx
call fcn.180007ba0
mov r15, rax
mov edx, 0x9ef0ef63
mov rcx, rbx
call fcn.180007ba0
mov qword [rsp + 0x60], rax
mov edx, 0xfe4e43f
mov rcx, rbx
call fcn.180007ba0
mov qword [rbp - 0x50], rax
test r13, r13
je 0x18000482c
test rdi, rdi
je 0x18000482c
test r14, r14
je 0x18000482c
cmp qword [rsp + 0x48], rsi
je 0x18000482c
test r12, r12
je 0x18000482c
test r15, r15
je 0x18000482c
cmp qword [rsp + 0x60], rsi
je 0x18000482c
test rax, rax
je 0x18000482c
cmp qword [rsp + 0x68], rsi
je 0x18000482c
mov ecx, 0xfce1ee71
call fcn.180007a90
mov r14, rax
test rax, rax
je 0x18000482c
mov edx, 0x38c0766b
mov rcx, rax
call fcn.180007ba0
mov qword [rsp + 0x78], rax
mov edx, 0xda6e3ae2
mov rcx, r14
call fcn.180007ba0
mov qword [rsp + 0x58], rax
mov r10, qword [rsp + 0x78]
test r10, r10
je 0x180004823
test rax, rax
je 0x180004823
mov qword [rbp - 0x80], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x18000b4e0]
lea rcx, [rbp - 0x80]
call r10
test eax, eax
js 0x180004823
xor r9d, r9d
mov r8d, 0x20
lea rdx, [rbp + 0x230]
mov rcx, qword [rbp - 0x80]
call qword [rsp + 0x58]
test eax, eax
js 0x180004823
mov ecx, 0x202
lea rdx, [rbp - 0x20]
call r13
test eax, eax
jne 0x180004823
mov edx, 1
mov ecx, 2
mov r8d, 6
call rdi
mov rdi, rax
mov qword [rsp + 0x58], rax
cmp rax, 0xffffffffffffffff
je 0x180004812
mov eax, 2
mov word [rbp - 0x30], ax
mov ecx, 0x401
call qword [rbp - 0x50]
mov word [rbp - 0x2e], ax
mov dword [rbp + 0x180], 0xd9c4ccc5
mov dword [rbp + 0x184], 0xd5c2cfc9
mov dword [rbp + 0x188], 0xcfccd3cd
mov word [rbp + 0x18c], 0x139
movdqa xmm7, xmmword [0x18000b570]
movdqa xmm2, xmmword [str._f_f_f_f_f_f_f_f_f_f_f_f_f_f_f_f]
movdqa xmmword [rbp - 0x50], xmm2
mov eax, dword [0x18000b530]
movzx eax, ax
movd xmm1, eax
psubb xmm1, xmm2
movzx eax, word [rbp + 0x180]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbp + 0x180], ax
mov eax, dword [0x18000b540]
movzx eax, ax
movd xmm1, eax
psubb xmm1, xmm2
movzx eax, word [rbp + 0x182]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbp + 0x182], ax
mov eax, dword [0x18000b550]
movzx eax, ax
movd xmm1, eax
psubb xmm1, xmm2
movzx eax, word [rbp + 0x184]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbp + 0x184], ax
mov eax, dword [0x18000b560]
movzx eax, ax
movd xmm1, eax
psubb xmm1, xmm2
movzx eax, word [rbp + 0x186]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbp + 0x186], ax
mov ecx, 8
nop
lea eax, [rcx - 0xc]
xor byte [rbp + rcx + 0x180], al
inc rcx
cmp rcx, 0xe
jb 0x180004000
mov dword [rbp - 0x78], 0xf7869680
mov rcx, rsi
movdqa xmm6, xmmword [0x18000b590]
movzx edx, word [rbp - 0x50]
nop dword [rax]
movq xmm1, rcx
punpcklqdq xmm1, xmm1
paddq xmm1, xmm7
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd xmm0, edx
psubb xmm1, xmm0
movzx eax, word [rbp + rcx - 0x78]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbp + rcx - 0x78], ax
add rcx, 2
cmp rcx, 4
jb 0x180004030
lea r8, [rbp - 0x2c]
lea rdx, [rbp + 0x180]
mov ecx, 2
call qword [rsp + 0x60]
test eax, eax
jle 0x18000480c
mov r8d, 0x10
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [rsp + 0x50]
test eax, eax
js 0x18000480c
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
mov qword [rbp - 0x60], rsi
mov r8d, 4
lea rdx, [0x18000b424]
lea rcx, [rbp - 0x78]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x1800041a6
mov qword [rbp - 0x50], 0x22
mov rcx, qword [rbp - 0x60]
mov rax, rcx
sub rax, qword [rbp - 0x70]
cmp rax, 0x22
jae 0x1800040fd
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x70]
call fcn.180005040
mov rcx, qword [rbp - 0x60]
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, rcx
je 0x18000411b
mov byte [rdx], 0
mov rdx, qword [rbp - 0x68]
inc rdx
mov qword [rbp - 0x68], rdx
jmp 0x18000412d
lea r8, [rsp + 0x40]
lea rcx, [rbp - 0x70]
call fcn.180005600
mov rdx, qword [rbp - 0x68]
mov byte [rsp + 0x40], 6
cmp rdx, qword [rbp - 0x60]
je 0x180004148
mov byte [rdx], 6
mov rcx, qword [rbp - 0x68]
inc rcx
mov qword [rbp - 0x68], rcx
jmp 0x18000415a
lea r8, [rsp + 0x40]
lea rcx, [rbp - 0x70]
call fcn.180005600
mov rcx, qword [rbp - 0x68]
lea rdi, [rbp + 0x230]
movzx eax, byte [rdi]
mov byte [rsp + 0x40], al
cmp rcx, qword [rbp - 0x60]
je 0x18000417d
mov byte [rcx], al
mov rcx, qword [rbp - 0x68]
inc rcx
mov qword [rbp - 0x68], rcx
jmp 0x180004192
lea r8, [rsp + 0x40]
mov rdx, rcx
lea rcx, [rbp - 0x70]
call fcn.180005600
mov rcx, qword [rbp - 0x68]
inc rdi
lea rax, [rbp + 0x250]
cmp rdi, rax
jne 0x180004161
jmp 0x180004520
mov dword [rbp + 0x190], 0xa3a5baa4
mov dword [rbp + 0x194], 0x8b9bd6d8
mov dword [rbp + 0x198], 0xce88d295
mov dword [rbp + 0x19c], 0x6467732f
mov dword [rbp + 0x1a0], 0x6272766d
mov dword [rbp + 0x1a4], 0x5f42297a
mov dword [rbp + 0x1a8], 0x3e215d58
mov dword [rbp + 0x1ac], 0x191f203e
mov dword [rbp + 0x1b0], 0x63657a5c
mov dword [rbp + 0x1b4], 0x222b3922
mov dword [rbp + 0x1b8], 0x292f332e
mov dword [rbp + 0x1bc], 0xd130f18
mov dword [rbp + 0x1c0], 0x271f1516
mov dword [rbp + 0x1c4], 0x191a1812
mov dword [rbp + 0x1c8], 0x6e242019
mov dword [rbp + 0x1cc], 0x43575253
mov dword [rbp + 0x1d0], 0x59731840
mov dword [rbp + 0x1d4], 0x525e565b
mov dword [rbp + 0x1d8], 0x1f045a52
mov dword [rbp + 0x1dc], 0x332b3b27
mov dword [rbp + 0x1e0], 0x22226568
mov dword [rbp + 0x1e4], 0x3f2b252e
mov dword [rbp + 0x1e8], 0x356e6129
mov dword [rbp + 0x1ec], 0x5e362523
mov dword [rbp + 0x1f0], 0x3435145e
mov dword [rbp + 0x1f4], 0x612e293d
mov dword [rbp + 0x1f8], 0x7571777c
mov dword [rbp + 0x1fc], 0xc216b6d
mov dword [rbp + 0x200], 0x4030b0a
mov dword [rbp + 0x204], 0x505001c
mov dword [rbp + 0x208], 0xa054d56
mov dword [rbp + 0x20c], 0x125f0115
mov dword [rbp + 0x210], 0x12001c18
mov dword [rbp + 0x214], 0x14397375
mov dword [rbp + 0x218], 0x111b0912
mov dword [rbp + 0x21c], 0xe6ceacf4
mov dword [rbp + 0x220], 0xeff2e2ea
mov dword [rbp + 0x224], 0xb8b9a9b2
mov dword [rbp + 0x228], 0x85838781
mov word [rbp + 0x22c], 0x9196
mov rdx, rsi
movzx r8d, word [rbp - 0x50]
nop dword [rax]
movq xmm1, rdx
punpcklqdq xmm1, xmm1
paddq xmm1, xmm7
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd xmm0, r8d
psubb xmm1, xmm0
movzx eax, word [rbp + rdx + 0x190]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbp + rdx + 0x190], ax
lea rax, [rdx + 3]
lea rcx, [rdx + 2]
movq xmm0, rax
movq xmm1, rcx
punpcklqdq xmm1, xmm0
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd xmm0, r8d
psubb xmm1, xmm0
movzx eax, word [rbp + rdx + 0x192]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbp + rdx + 0x192], ax
lea rax, [rdx + 5]
lea rcx, [rdx + 4]
movq xmm0, rax
movq xmm1, rcx
punpcklqdq xmm1, xmm0
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd xmm0, r8d
psubb xmm1, xmm0
movzx eax, word [rbp + rdx + 0x194]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbp + rdx + 0x194], ax
lea rax, [rdx + 7]
lea rcx, [rdx + 6]
movq xmm0, rax
movq xmm1, rcx
punpcklqdq xmm1, xmm0
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd xmm0, r8d
psubb xmm1, xmm0
movzx eax, word [rbp + rdx + 0x196]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbp + rdx + 0x196], ax
add rdx, 8
cmp rdx, 0x98
jb 0x180004340
cmp rdx, 0x9e
jae 0x180004496
nop word [rax + rax]
lea eax, [rdx - 0xc]
xor byte [rbp + rdx + 0x190], al
inc rdx
cmp rdx, 0x9e
jb 0x180004480
lea rdi, [rbp + 0x190]
mov rcx, qword [rbp - 0x68]
cmp rcx, qword [rbp - 0x60]
je 0x1800044b9
movzx eax, byte [rdi]
mov byte [rcx], al
mov rcx, qword [rbp - 0x68]
inc rcx
mov qword [rbp - 0x68], rcx
jmp 0x1800044cc
mov r8, rdi
mov rdx, rcx
lea rcx, [rbp - 0x70]
call fcn.180005600
mov rcx, qword [rbp - 0x68]
inc esi
inc rdi
cmp esi, 0x9d
jb 0x1800044a1
lea rdi, [rbp + 0x230]
movzx eax, byte [rdi]
mov byte [rsp + 0x40], al
cmp rcx, qword [rbp - 0x60]
je 0x1800044fc
mov byte [rcx], al
mov rcx, qword [rbp - 0x68]
inc rcx
mov qword [rbp - 0x68], rcx
jmp 0x180004511
lea r8, [rsp + 0x40]
mov rdx, rcx
lea rcx, [rbp - 0x70]
call fcn.180005600
mov rcx, qword [rbp - 0x68]
inc rdi
lea rax, [rbp + 0x250]
cmp rdi, rax
jne 0x1800044e0
mov rdx, qword [rbp - 0x70]
sub ecx, edx
xor r9d, r9d
mov r8d, ecx
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
call qword [rsp + 0x48]
test eax, eax
jns 0x180004556
mov rcx, rdi
call r12
call r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
jmp 0x180004713
mov rax, qword [rbp - 0x70]
cmp rax, qword [rbp - 0x68]
je 0x180004564
mov qword [rbp - 0x68], rax
mov rcx, rdi
call r12
call r15
mov ecx, 0x3a32ca43
call fcn.180007a90
mov rcx, rax
mov edx, 0x550dd740
call fcn.180007ba0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rax
mov rsi, rax
mov ecx, 0x202
lea rdx, [rbp - 0x20]
call r13
test eax, eax
jne 0x1800046fe
nop word [rax + rax]
mov edx, 1
mov ecx, 2
mov r8d, 6
call qword [rsp + 0x70]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1800047f1
mov r8d, 0x10
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [rsp + 0x50]
test eax, eax
js 0x1800047eb
mov edx, 0xea60
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rax
lea rax, [rbp + 0x230]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r12
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x48]
lea r8, [rbp - 0x78]
mov rdx, rdi
lea rcx, [rbp - 0x50]
call fcn.180002610
nop
mov rcx, qword [rbp - 0x50]
cmp rcx, qword [rbp - 0x48]
je 0x1800046b4
mov ecx, 0x202
lea rdx, [rbp - 0x20]
call r13
test eax, eax
jne 0x180004789
mov edx, 1
mov ecx, 2
mov r8d, 6
call qword [rsp + 0x70]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180004778
mov r8d, 0x10
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [rsp + 0x50]
mov rcx, rdi
test eax, eax
js 0x180004775
mov r8d, dword [rbp - 0x48]
mov rdx, qword [rbp - 0x50]
sub r8d, edx
xor r9d, r9d
call qword [rsp + 0x48]
test eax, eax
js 0x18000475e
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x1800046ea
mov rdx, qword [rbp - 0x40]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800046e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800047e4
call fcn.180009860
mov ecx, 0x202
lea rdx, [rbp - 0x20]
call r13
test eax, eax
je 0x1800045b0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x180004835
mov rdx, qword [rbp - 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004805
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180004805
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, rdi
call r12
call r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
jmp 0x18000479e
call r12
call r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
jmp 0x180004795
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x18000471a
mov rdx, qword [rbp - 0x40]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800047da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800047e4
call fcn.180009860
jmp 0x18000471a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call r12
call r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
jmp 0x18000470a
call fcn.180009860
jmp 0x180004835
mov rcx, rdi
call r12
call r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
jmp 0x18000482f
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.180009840
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret