Function at 0x18003af29
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push rax
pushf
mov eax, 0xb60d2eb0
pushf
not eax
add eax, 0xf872b179
xor eax, 0xa9732c30
rol eax, 0x88
popf
pushf
not eax
add eax, 0xd83eb10b
xor eax, 0xcd88cc3a
rol eax, 0x80
popf
pushf
not eax
add eax, 0xde484536
xor eax, 0xd240d110
rol eax, 0xc9
popf
cmp eax, 4
jne 0x18003af79
popf
pop rax
jmp 0x18003b292
cmp eax, 0
jne 0x18003af88
popf
pop rax
jmp 0x18003afd3
cmp eax, 3
jne 0x18003af97
popf
pop rax
jmp 0x18003b1e1
cmp eax, 1
jne 0x18003afa6
popf
pop rax
jmp 0x18003b0a9
cmp eax, 5
jne 0x18003afb5
popf
pop rax
jmp 0x18003b34f
cmp eax, 2
jne 0x18003afc4
popf
pop rax
jmp 0x18003b14e
cmp eax, 6
jne 0x18003afd3
popf
pop rax
jmp 0x18003b3af
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov dword [rbp - 0x30], 0x35
mov eax, dword [rbp - 0x30]
xor eax, 0x6e
mov byte [rbp - 0x2c], al
mov eax, dword [rbp - 0x30]
inc al
xor eax, 0x74
mov byte [rbp - 0x2b], al
mov eax, dword [rbp - 0x30]
add al, 2
xor eax, 0x64
mov byte [rbp - 0x2a], al
mov eax, dword [rbp - 0x30]
add al, 3
xor eax, 0x6c
mov byte [rbp - 0x29], al
mov eax, dword [rbp - 0x30]
add al, 4
xor eax, 0x6c
mov byte [rbp - 0x28], al
mov eax, dword [rbp - 0x30]
add al, 5
xor eax, 0x2e
mov byte [rbp - 0x27], al
mov eax, dword [rbp - 0x30]
add al, 6
xor eax, 0x64
mov byte [rbp - 0x26], al
mov eax, dword [rbp - 0x30]
add al, 7
xor eax, 0x6c
mov byte [rbp - 0x25], al
mov eax, dword [rbp - 0x30]
add al, 8
xor eax, 0x6c
mov byte [rbp - 0x24], al
xor eax, eax
mov byte [rbp - 0x23], al
xor ebx, ebx
movzx eax, byte [rbp - 0x2c]
mov eax, ebx
nop dword [rax]
nop word [rax + rax]
push rax
pushf
mov eax, 0x229d1be2
pushf
not eax
add eax, 0xdbee9a39
xor eax, 0xb2ef166e
rol eax, 0x21
popf
pushf
not eax
add eax, 0xcaf18fbd
xor eax, 0xa923e488
rol eax, 0x5a
popf
pushf
not eax
add eax, 0xbef6004c
xor eax, 0xae8ca6dc
rol eax, 0x56
popf
jmp 0x18003af6a
movsx ecx, byte [rbp + rax - 0x2c]
mov edx, dword [rbp - 0x30]
add dl, al
xor edx, ecx
mov byte [rbp + rax - 0x2c], dl
inc rax
cmp rax, 9
jb 0x18003b0f5
push rax
pushf
mov eax, 0x8c897b70
pushf
not eax
add eax, 0x9055bca8
xor eax, 0x93cefb1d
rol eax, 0xa7
popf
pushf
not eax
add eax, 0xb85c14ef
xor eax, 0xb6faffa6
rol eax, 0x2f
popf
jmp 0x18003af6a
push rax
pushf
mov eax, 0x7b6b44e0
pushf
not eax
add eax, 0xcb6ddfce
xor eax, 0xdc61f4d7
rol eax, 0xf5
popf
pushf
not eax
add eax, 0x9083331e
xor eax, 0x8b15f38a
rol eax, 0x17
popf
pushf
not eax
add eax, 0xb1e973e2
xor eax, 0xf671a8a9
rol eax, 0x71
popf
pushf
not eax
add eax, 0x846cd44a
xor eax, 0xf02f0ed6
rol eax, 0xc7
popf
jmp 0x18003af6a
lea rcx, [rbp - 0x2c]
mov byte [rbp - 0x23], bl
jmp 0x18003b156
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r9, rax
test rax, rax
je 0x18003b19b
push rax
pushf
mov eax, 0x5fac81b7
pushf
not eax
add eax, 0xe165b20b
xor eax, 0xf90a4e3c
rol eax, 0xc8
popf
pushf
not eax
add eax, 0x9cc74407
xor eax, 0xe548d48e
rol eax, 6
popf
jmp 0x18003af6a
push rax
pushf
mov eax, 0x497bbcc0
pushf
not eax
add eax, 0xae4e82f8
xor eax, 0xe3666f75
rol eax, 0x28
popf
pushf
not eax
add eax, 0x9a53fb8c
xor eax, 0xd97043ff
rol eax, 0x39
popf
pushf
not eax
add eax, 0x9087c3a3
xor eax, 0x9a6e0dad
rol eax, 0xc
popf
jmp 0x18003af6a
mov dword [rbp - 0x20], 0x2b
xor eax, eax
mov byte [rbp - 0x1c], 0x65
mov r8, rbx
mov byte [rbp - 0x1b], 0x5f
mov byte [rbp - 0x1a], 0x7a
mov byte [rbp - 0x19], 0x5e
mov byte [rbp - 0x18], 0x4e
mov byte [rbp - 0x17], 0x59
mov byte [rbp - 0x16], 0x52
mov byte [rbp - 0x15], 0x78
mov byte [rbp - 0x14], 0x52
mov byte [rbp - 0x13], 0x58
mov byte [rbp - 0x12], 0x5f
mov byte [rbp - 0x11], 0x4e
mov byte [rbp - 0x10], 0x46
mov byte [rbp - 0xf], 0x62
mov byte [rbp - 0xe], 0x45
mov byte [rbp - 0xd], 0x4d
mov byte [rbp - 0xc], 0x44
mov byte [rbp - 0xb], 0x59
mov byte [rbp - 0xa], 0x46
mov byte [rbp - 9], 0x4a
mov byte [rbp - 8], 0x5f
mov byte [rbp - 7], 0x42
mov byte [rbp - 6], 0x44
mov byte [rbp - 5], 0x45
mov byte [rbp - 4], al
movzx eax, byte [rbp - 0x1c]
nop word [rax + rax]
push rax
pushf
mov eax, 0x1b460759
pushf
not eax
add eax, 0xc5403359
xor eax, 0xf104b609
rol eax, 0x57
popf
pushf
not eax
add eax, 0xcdcf64b1
xor eax, 0xd2a2e762
rol eax, 0x59
popf
jmp 0x18003af6a
movsx edx, byte [rbp + r8 - 0x1c]
mov eax, dword [rbp - 0x20]
movsx ecx, al
mov eax, edx
xor eax, ecx
mov byte [rbp + r8 - 0x1c], al
inc r8
cmp r8, 0x18
jb 0x18003b309
push rax
pushf
mov eax, 0x95a557c1
pushf
not eax
add eax, 0xac9fe9a1
xor eax, 0xe7978a1f
rol eax, 0xee
popf
pushf
not eax
add eax, 0xe01067b5
xor eax, 0xb31e91ec
rol eax, 0x89
popf
pushf
not eax
add eax, 0x93711e46
xor eax, 0x96b9f423
rol eax, 0x49
popf
pushf
not eax
add eax, 0x80cb5d18
xor eax, 0xfc3bba91
rol eax, 0x99
popf
jmp 0x18003af6a
push rax
pushf
mov eax, 0x13fca93c
pushf
not eax
add eax, 0x8575550d
xor eax, 0xdcca1a1a
rol eax, 0xd2
popf
pushf
not eax
add eax, 0xc5b5aa1d
xor eax, 0xda30c86f
rol eax, 0xd3
popf
pushf
not eax
add eax, 0xd59bf399
xor eax, 0xfbb2cfc7
rol eax, 0x39
popf
jmp 0x18003af6a
lea rdx, [rbp - 0x1c]
mov byte [rbp - 4], bl
mov rcx, r9
jmp 0x18003b35a
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r9d, r9d
mov word [rbp + 0x10], bx
lea rdx, [rbp + 0x10]
lea r8d, [r9 + 2]
lea ecx, [r9 + 0x23]
jmp 0x18003b374
call rax
cmp byte [rbp + 0x10], bl
setne al
push rax
pushf
mov eax, 0x1158134a
pushf
not eax
add eax, 0xeb80500e
xor eax, 0x94bbc13d
rol eax, 0x57
popf
pushf
not eax
add eax, 0xe864a30d
xor eax, 0xe93d5908
rol eax, 0xc0
popf
jmp 0x18003af6a
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret