Function at 0x18015fea0
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x488
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xb6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4a8]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0x440], rax
mov r8, qword [rbp + 0x470]
lea rdx, [fcn.1801610b0]
lea rcx, [0x180001004]
call fcn.18015f9a0
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x180160000
mov byte [rbp + 0x328], 0x5b
mov byte [rbp + 0x329], 0x6d
mov byte [rbp + 0x32a], 0x65
mov byte [rbp + 0x32b], 0x6d
mov byte [rbp + 0x32c], 0x6f
mov byte [rbp + 0x32d], 0x72
mov byte [rbp + 0x32e], 0x79
mov byte [rbp + 0x32f], 0x2e
mov byte [rbp + 0x330], 0x63
mov byte [rbp + 0x331], 0x70
mov byte [rbp + 0x332], 0x70
mov byte [rbp + 0x333], 0x3a
mov byte [rbp + 0x334], 0x33
mov byte [rbp + 0x335], 0x30
mov byte [rbp + 0x336], 0x38
mov byte [rbp + 0x337], 0x5d
mov byte [rbp + 0x338], 0x20
mov byte [rbp + 0x339], 0
lea rcx, [rbp + 0x328]
call fcn.1800ceb30
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x428], rax
lea rdx, str.failed_to_get_module_handle_for:__
mov rcx, qword [rbp + 0x428]
call fcn.18015de80
mov qword [rbp + 0x430], rax
mov rdx, qword [rbp + 0x470]
mov rcx, qword [rbp + 0x430]
call fcn.18015ded0
mov qword [rbp + 0x438], rax
lea rdx, [0x180257224]
mov rcx, qword [rbp + 0x438]
call fcn.18015de80
xor eax, eax
jmp 0x180160590
mov rax, qword [rbp + 8]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1801600de
mov byte [rbp + 0x358], 0x5b
mov byte [rbp + 0x359], 0x6d
mov byte [rbp + 0x35a], 0x65
mov byte [rbp + 0x35b], 0x6d
mov byte [rbp + 0x35c], 0x6f
mov byte [rbp + 0x35d], 0x72
mov byte [rbp + 0x35e], 0x79
mov byte [rbp + 0x35f], 0x2e
mov byte [rbp + 0x360], 0x63
mov byte [rbp + 0x361], 0x70
mov byte [rbp + 0x362], 0x70
mov byte [rbp + 0x363], 0x3a
mov byte [rbp + 0x364], 0x33
mov byte [rbp + 0x365], 0x31
mov byte [rbp + 0x366], 0x37
mov byte [rbp + 0x367], 0x5d
mov byte [rbp + 0x368], 0x20
mov byte [rbp + 0x369], 0
lea rcx, [rbp + 0x358]
call fcn.1800ceb30
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x428], rax
lea rdx, str.failed_to_get_module_size__image_is_invalid
mov rcx, qword [rbp + 0x428]
call fcn.18015de80
xor eax, eax
jmp 0x180160590
mov rax, qword [rbp + 0x48]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
cmp dword [rax], 0x4550
je 0x1801601c0
mov byte [rbp + 0x388], 0x5b
mov byte [rbp + 0x389], 0x6d
mov byte [rbp + 0x38a], 0x65
mov byte [rbp + 0x38b], 0x6d
mov byte [rbp + 0x38c], 0x6f
mov byte [rbp + 0x38d], 0x72
mov byte [rbp + 0x38e], 0x79
mov byte [rbp + 0x38f], 0x2e
mov byte [rbp + 0x390], 0x63
mov byte [rbp + 0x391], 0x70
mov byte [rbp + 0x392], 0x70
mov byte [rbp + 0x393], 0x3a
mov byte [rbp + 0x394], 0x33
mov byte [rbp + 0x395], 0x32
mov byte [rbp + 0x396], 0x34
mov byte [rbp + 0x397], 0x5d
mov byte [rbp + 0x398], 0x20
mov byte [rbp + 0x399], 0
lea rcx, [rbp + 0x388]
call fcn.1800ceb30
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x428], rax
lea rdx, str.failed_to_get_module_size__image_is_invalid
mov rcx, qword [rbp + 0x428]
call fcn.18015de80
xor eax, eax
jmp 0x180160590
mov rax, qword [rbp + 0x478]
mov qword [rbp + 0x88], rax
mov rcx, qword [rbp + 0x480]
call fcn.1800cb7f0
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xc8], 0
mov rax, qword [rbp + 0x68]
mov eax, dword [rax + 0x50]
mov rcx, qword [rbp + 0x480]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0xa8]
mov qword [rsp + 0x20], rcx
mov r9, qword [rbp + 0x88]
mov r8d, eax
mov rdx, qword [rbp + 0x28]
lea rcx, [rbp + 0xe8]
call fcn.1801606c0
nop
lea rcx, [rbp + 0xe8]
call fcn.1800d2690
movzx eax, al
test eax, eax
jne 0x1801603e6
lea rcx, [rbp + 0xe8]
call fcn.1800d2b90
cmp rax, 1
jbe 0x1801603ce
mov rax, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0xa8]
lea rax, [rax + rcx*2]
mov rcx, rax
call fcn.1800d2c10
test rax, rax
je 0x1801602ab
mov rax, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0xa8]
lea rax, [rax + rcx*2]
mov rcx, rax
call fcn.1800d2c10
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_malloc]
mov edx, 0xdddd
mov rcx, rax
call fcn.1800d2c70
mov qword [rbp + 0x428], rax
jmp 0x1801602b6
mov qword [rbp + 0x428], 0
mov rax, qword [rbp + 0x428]
mov qword [rbp + 0x128], rax
mov r8, qword [rbp + 0x128]
mov rdx, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0x88]
call fcn.18015fd10
mov qword [rbp + 0x148], rax
mov byte [rbp + 0x3b8], 0x5b
mov byte [rbp + 0x3b9], 0x6d
mov byte [rbp + 0x3ba], 0x65
mov byte [rbp + 0x3bb], 0x6d
mov byte [rbp + 0x3bc], 0x6f
mov byte [rbp + 0x3bd], 0x72
mov byte [rbp + 0x3be], 0x79
mov byte [rbp + 0x3bf], 0x2e
mov byte [rbp + 0x3c0], 0x63
mov byte [rbp + 0x3c1], 0x70
mov byte [rbp + 0x3c2], 0x70
mov byte [rbp + 0x3c3], 0x3a
mov byte [rbp + 0x3c4], 0x33
mov byte [rbp + 0x3c5], 0x34
mov byte [rbp + 0x3c6], 0x36
mov byte [rbp + 0x3c7], 0x5d
mov byte [rbp + 0x3c8], 0x20
mov byte [rbp + 0x3c9], 0
lea rcx, [rbp + 0x3b8]
call fcn.1800ceb30
mov r8, rax
mov dl, 2
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x428], rax
lea rdx, str.found_more_than_one_occurrence_with__
mov rcx, qword [rbp + 0x428]
call fcn.18015de80
mov qword [rbp + 0x430], rax
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x430]
call fcn.18015de80
mov qword [rbp + 0x438], rax
lea rdx, str.__pattern__consider_updating_it_
mov rcx, qword [rbp + 0x438]
call fcn.18015de80
xor edx, edx
lea rcx, [rbp + 0xe8]
call fcn.1800ce170
mov rax, qword [rax]
mov qword [rbp + 0xc8], rax
cmp qword [rbp + 0xc8], 0
jne 0x18016056f
mov rax, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0xa8]
lea rax, [rax + rcx*2]
mov rcx, rax
call fcn.1800d2c10
test rax, rax
je 0x18016044c
mov rax, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0xa8]
lea rax, [rax + rcx*2]
mov rcx, rax
call fcn.1800d2c10
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_malloc]
mov edx, 0xdddd
mov rcx, rax
call fcn.1800d2c70
mov qword [rbp + 0x428], rax
jmp 0x180160457
mov qword [rbp + 0x428], 0
mov rax, qword [rbp + 0x428]
mov qword [rbp + 0x168], rax
mov r8, qword [rbp + 0x168]
mov rdx, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0x88]
call fcn.18015fd10
mov qword [rbp + 0x188], rax
mov byte [rbp + 0x3e8], 0x5b
mov byte [rbp + 0x3e9], 0x6d
mov byte [rbp + 0x3ea], 0x65
mov byte [rbp + 0x3eb], 0x6d
mov byte [rbp + 0x3ec], 0x6f
mov byte [rbp + 0x3ed], 0x72
mov byte [rbp + 0x3ee], 0x79
mov byte [rbp + 0x3ef], 0x2e
mov byte [rbp + 0x3f0], 0x63
mov byte [rbp + 0x3f1], 0x70
mov byte [rbp + 0x3f2], 0x70
mov byte [rbp + 0x3f3], 0x3a
mov byte [rbp + 0x3f4], 0x33
mov byte [rbp + 0x3f5], 0x38
mov byte [rbp + 0x3f6], 0x32
mov byte [rbp + 0x3f7], 0x5d
mov byte [rbp + 0x3f8], 0x20
mov byte [rbp + 0x3f9], 0
lea rcx, [rbp + 0x3e8]
call fcn.1800ceb30
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x428], rax
lea rdx, str.pattern_not_found:__
mov rcx, qword [rbp + 0x428]
call fcn.18015de80
mov qword [rbp + 0x430], rax
mov rdx, qword [rbp + 0x168]
mov rcx, qword [rbp + 0x430]
call fcn.18015de80
mov qword [rbp + 0x438], rax
lea rdx, [0x180257224]
mov rcx, qword [rbp + 0x438]
call fcn.18015de80
mov rax, qword [rbp + 0xc8]
mov qword [rbp + 0x418], rax
lea rcx, [rbp + 0xe8]
call fcn.1800ce0d0
mov rax, qword [rbp + 0x418]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x18026f250]
call fcn.180224a80
mov rax, rdi
mov rcx, qword [rbp + 0x440]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x458]
pop rdi
pop rbp
ret