Function at 0x1800383b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x398
mov rax, qword [0x1800842c0]
xor rax, rsp
mov qword [rsp + 0x388], rax
mov dword [rsp + 0x3c], 0
mov ecx, 0x20
call fcn.18004133c
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x18003840e
mov rdi, qword [rsp + 0x40]
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x40]
call fcn.1800099e0
mov qword [rsp + 0x48], rax
jmp 0x180038417
mov qword [rsp + 0x48], 0
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.1800119c0
nop
mov byte [rsp + 0x298], 0x63
mov byte [rsp + 0x299], 0x30
mov byte [rsp + 0x29a], 0x6c
mov byte [rsp + 0x29b], 0x6b
mov byte [rsp + 0x29c], 0x4e
mov byte [rsp + 0x29d], 0x55
mov byte [rsp + 0x29e], 0x70
mov byte [rsp + 0x29f], 0x73
mov byte [rsp + 0x2a0], 0x56
mov byte [rsp + 0x2a1], 0x32
mov byte [rsp + 0x2a2], 0x74
mov byte [rsp + 0x2a3], 0x7a
mov byte [rsp + 0x2a4], 0x65
mov byte [rsp + 0x2a5], 0x47
mov byte [rsp + 0x2a6], 0x56
mov byte [rsp + 0x2a7], 0x42
mov byte [rsp + reloc.SHELL32.dll_IsUserAnAdmin], 0x56
mov byte [rsp + 0x2a9], 0x56
mov byte [rsp + 0x2aa], 0x41
mov byte [rsp + 0x2ab], 0x34
mov byte [rsp + 0x2ac], 0x55
mov byte [rsp + 0x2ad], 0x6a
mov byte [rsp + 0x2ae], 0x45
mov byte [rsp + 0x2af], 0x7a
mov byte [rsp + 0x2b0], 0x51
mov byte [rsp + 0x2b1], 0x56
mov byte [rsp + 0x2b2], 0x64
mov byte [rsp + 0x2b3], 0x45
mov byte [rsp + 0x2b4], 0x56
mov byte [rsp + 0x2b5], 0x31
mov byte [rsp + 0x2b6], 0x64
mov byte [rsp + 0x2b7], 0x61
mov byte [rsp + 0x2b8], 0x65
mov byte [rsp + 0x2b9], 0x6b
mov byte [rsp + 0x2ba], 0x77
mov byte [rsp + 0x2bb], 0x7a
mov byte [rsp + 0x2bc], 0x56
mov byte [rsp + 0x2bd], 0x6e
mov byte [rsp + 0x2be], 0x46
mov byte [rsp + 0x2bf], 0x70
mov byte [rsp + 0x2c0], 0x55
mov byte [rsp + 0x2c1], 0x31
mov byte [rsp + 0x2c2], 0x51
mov byte [rsp + 0x2c3], 0x3d
mov byte [rsp + 0x2c4], 0x3d
lea rax, [rsp + 0x2c5]
mov r8, rax
lea rdx, [rsp + 0x298]
lea rcx, [rsp + 0x1d8]
call fcn.180004ea0
lea rcx, [rsp + 0x100]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x38]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x1a8]
call fcn.180004f90
nop
lea rcx, [rsp + 0x30]
call fcn.180002730
lea r8, [rsp + 0x1a8]
lea rdx, [rsp + 0x2e8]
mov rcx, rax
call fcn.18003d170
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x30]
call fcn.180002730
mov r8, qword [rsp + 0x60]
lea rdx, [rsp + 0x368]
mov rcx, rax
call fcn.18003cd00
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x30]
call fcn.180002730
mov r8, qword [rsp + 0x70]
lea rdx, [rsp + 0x190]
mov rcx, rax
call fcn.18003d070
nop
lea rcx, [rsp + 0x368]
call fcn.180004630
nop
lea rcx, [rsp + 0x2e8]
call fcn.180004630
nop
mov byte [rsp + 0x250], 0x42
mov byte [rsp + 0x251], 0x4f
mov byte [rsp + 0x252], 0x78
mov byte [rsp + 0x253], 0x6b
mov byte [rsp + 0x254], 0x39
mov byte [rsp + 0x255], 0x71
mov byte [rsp + 0x256], 0x52
mov byte [rsp + 0x257], 0x61
mov byte [rsp + 0x258], 0x49
mov byte [rsp + 0x259], 0x55
mov byte [rsp + 0x25a], 0x67
mov byte [rsp + 0x25b], 0x7a
mov byte [rsp + 0x25c], 0x2c
mov byte [rsp + 0x25d], 0x34
mov byte [rsp + 0x25e], 0x5a
mov byte [rsp + 0x25f], 0x4d
lea rax, [rsp + 0x260]
mov r8, rax
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x1e8]
call fcn.180004ea0
lea rcx, [rsp + 0x110]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x39]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x178]
call fcn.180004f90
nop
mov edx, 2
lea rcx, [rsp + 0xd8]
call fcn.1800013e0
nop
mov byte [rsp + 0x268], 0x73
mov byte [rsp + 0x269], 0x37
mov byte [rsp + 0x26a], 0x77
mov byte [rsp + 0x26b], 0x78
mov byte [rsp + 0x26c], 0x30
mov byte [rsp + 0x26d], 0x61
mov byte [rsp + 0x26e], 0x47
mov byte [rsp + 0x26f], 0x46
mov byte [rsp + 0x270], 0x49
mov byte [rsp + 0x271], 0x71
mov byte [rsp + 0x272], 0x57
mov byte [rsp + 0x273], 0x5a
mov byte [rsp + 0x274], 0x6b
mov byte [rsp + 0x275], 0x6d
mov byte [rsp + 0x276], 0x59
mov byte [rsp + 0x277], 0x59
mov byte [rsp + 0x278], 0x61
mov byte [rsp + 0x279], 0x54
mov byte [rsp + 0x27a], 0x66
mov byte [rsp + 0x27b], 0x64
mov byte [rsp + 0x27c], 0x6d
mov byte [rsp + 0x27d], 0x37
mov byte [rsp + 0x27e], 0x54
mov byte [rsp + 0x27f], 0x75
mov byte [rsp + 0x280], 0x41
mov byte [rsp + 0x281], 0x54
mov byte [rsp + 0x282], 0x78
mov byte [rsp + 0x283], 0x77
mov byte [rsp + 0x284], 0x2f
mov byte [rsp + 0x285], 0x75
mov byte [rsp + 0x286], 0x63
mov byte [rsp + 0x287], 0x70
mov byte [rsp + 0x288], 0x65
mov byte [rsp + 0x289], 0x61
mov byte [rsp + 0x28a], 0x31
mov byte [rsp + 0x28b], 0x2f
mov byte [rsp + 0x28c], 0x5a
mov byte [rsp + 0x28d], 0x55
mov byte [rsp + 0x28e], 0x74
mov byte [rsp + 0x28f], 0x52
mov byte [rsp + 0x290], 0x72
mov byte [rsp + 0x291], 0x30
mov byte [rsp + 0x292], 0x51
mov byte [rsp + 0x293], 0x3d
lea rax, [rsp + 0x294]
mov r8, rax
lea rdx, [rsp + 0x268]
lea rcx, [rsp + 0x1f8]
call fcn.180004ea0
lea rcx, [rsp + 0x120]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x3a]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x160]
call fcn.180004f90
nop
lea rcx, [rsp + 0x30]
call fcn.180002730
lea r8, [rsp + 0x160]
lea rdx, [rsp + 0x328]
mov rcx, rax
call fcn.18003d170
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x30]
call fcn.180002730
mov r8, qword [rsp + 0x80]
lea rdx, [rsp + 0x308]
mov rcx, rax
call fcn.18003cd00
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x30]
call fcn.180002730
mov r8, qword [rsp + 0x90]
lea rdx, [rsp + 0x148]
mov rcx, rax
call fcn.18003d070
nop
lea rcx, [rsp + 0x308]
call fcn.180004630
nop
lea rcx, [rsp + 0x328]
call fcn.180004630
nop
lea rax, [rsp + 0x208]
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x220]
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0x238]
mov qword [rsp + 0xb8], rax
lea rdx, [rsp + 0x178]
mov rcx, qword [rsp + 0x98]
call fcn.180013ce0
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xc0], rax
lea rdx, [rsp + 0x190]
mov rcx, qword [rsp + 0xa8]
call fcn.180013ce0
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xc8], rax
lea rdx, [rsp + 0x148]
mov rcx, qword [rsp + 0xb8]
call fcn.180013ce0
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xc8]
mov r8, qword [rsp + 0xd0]
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0xd8]
call fcn.180002340
nop
lea rdx, [0x180077e14]
lea rcx, [rsp + 0x2c8]
call fcn.1800160c0
nop
lea rcx, [rsp + 0x30]
call fcn.180002730
lea r8, [rsp + 0x130]
lea rdx, [rsp + 0x348]
mov rcx, rax
call fcn.18003d170
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0xe8], rax
lea rcx, [rsp + 0x30]
call fcn.180002730
lea r9, [rsp + 0x2c8]
mov r8, qword [rsp + 0xe8]
lea rdx, [rsp + 0x1c0]
mov rcx, rax
call fcn.18003d300
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0xf8], rax
xor edx, edx
mov rcx, qword [rsp + 0xf8]
call fcn.180017220
mov rdx, rax
mov rcx, qword [rsp + 0x3b0]
call fcn.180016280
mov eax, dword [rsp + 0x3c]
or eax, 1
mov dword [rsp + 0x3c], eax
lea rcx, [rsp + 0x1c0]
call fcn.18000f910
nop
lea rcx, [rsp + 0x348]
call fcn.180004630
nop
lea rcx, [rsp + 0x2c8]
call fcn.180004630
nop
lea rcx, [rsp + 0x130]
call fcn.180003930
nop
lea rcx, [rsp + 0x148]
call fcn.180003930
nop
lea rcx, [rsp + 0x160]
call fcn.180003930
nop
lea rcx, [rsp + 0x178]
call fcn.180003930
nop
lea rcx, [rsp + 0x190]
call fcn.180003930
nop
lea rcx, [rsp + 0x1a8]
call fcn.180003930
nop
lea rcx, [rsp + 0x30]
call fcn.18000f7e0
nop
mov rax, qword [rsp + 0x3b0]
mov rcx, qword [rsp + 0x388]
xor rcx, rsp
call fcn.1800412e0
add rsp, 0x398
pop rdi
pop rsi
ret