Function at 0x180001cd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rdi
push r14
push r15
lea rbp, [rsp - 0x1c8]
sub rsp, 0x2c8
mov rax, qword [0x18000f040]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rax, r8
mov r14, r9
mov rdi, rdx
mov r15, rcx
mov qword [rsp + 0x38], rax
test rdx, rdx
jne 0x180001d1e
test rax, rax
je 0x180001d17
test r9, r9
jne 0x180001d1e
xor al, al
jmp 0x180001ef2
mov qword [rsp + 0x2c0], rsi
xor esi, esi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
test rdx, rdx
jne 0x180001ded
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x4c], sil
mov dword [rsp + 0x40], 0x6e72656b
mov dword [rsp + 0x44], 0x32336c65
mov dword [rsp + 0x4d], 0x67657255
mov dword [rsp + 0x48], 0x6c6c642e
mov dword [rsp + 0x51], 0x7161784a
mov byte [rsp + 0x55], 0x43
mov dword [rsp + 0x60], 0x4d746547
mov dword [rsp + 0x64], 0x6c75646f
mov dword [rsp + 0x68], 0x6c694665
mov byte [rsp + 0x7c], 0x43
mov dword [rsp + 0x6c], 0x6d614e65
mov dword [rsp + 0x74], 0x676d0070
mov dword [rsp + 0x70], 0x6e005765
mov word [rsp + 0x79], 0x5470
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [r15 + 0x18]
lea rdx, [rbp - 0x70]
mov r8d, 0x104
call rax
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
lea rcx, [rbp - 0x70]
call fcn.1800015b0
test al, al
jne 0x180001e07
jmp 0x180001eea
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.1800015b0
test al, al
je 0x180001eea
mov qword [rsp + 0x2b8], r12
mov r12, qword [rsp + 0x28]
mov qword [rsp + 0x2b0], r13
test r12, r12
je 0x180001fdd
mov r13d, dword [rsp + 0x20]
test r13d, r13d
je 0x180001fdd
mov qword [rsp + 0x300], rbx
test rdi, rdi
jne 0x180001eb6
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r14
repne scasb al, byte [rdi]
mov ebx, esi
mov rdi, rsi
not rcx
mov esi, r13d
dec rcx
test r13d, r13d
je 0x180001ec8
mov r13d, ecx
lea rcx, [rdi + r12]
mov r8, r13
mov rdx, r14
call fcn.1800035c0
test eax, eax
jne 0x180001e7b
cmp ebx, 1
je 0x180001e85
inc ebx
inc rdi
cmp rdi, rsi
jb 0x180001e61
jmp 0x180001ec8
lea rsi, [r13 + rdi]
mov r13d, dword [rsi + r12]
mov ecx, r13d
call fcn.180003004
lea rdx, [rsi + r12 + 4]
mov r8d, r13d
mov rcx, rax
mov rbx, rax
call fcn.1800031d0
mov rcx, r12
call fcn.180002fc4
mov r12, rbx
xor esi, esi
mov rcx, qword [rsp + 0x38]
lea rdx, [rbp - 0x70]
call fcn.180001820
test al, al
jne 0x180001f0f
mov rcx, r12
call fcn.180002fc4
xor al, al
mov rbx, qword [rsp + 0x300]
mov r12, qword [rsp + 0x2b8]
mov r13, qword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x2c0]
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.180002b50
add rsp, 0x2c8
pop r15
pop r14
pop rdi
pop rbp
ret
lea r9, [rsp + 0x20]
lea rcx, [rbp - 0x70]
mov r8d, r13d
mov rdx, r12
mov dword [rsp + 0x20], esi
call fcn.180001a60
mov rcx, r12
mov rsi, rax
call fcn.180002fc4
test rsi, rsi
je 0x180001ed0
mov edi, dword [rsp + 0x20]
mov ecx, 0x400
lea eax, [rdi + rdi*4]
lea edx, [rax + rax]
cmp rdx, rcx
cmova ecx, edx
mov qword [rsp + 0x30], rcx
call fcn.180003004
lea r9, [rsp + 0x30]
mov r8d, edi
mov rcx, rsi
mov rdx, rax
mov rbx, rax
call fcn.180001b80
mov rcx, rsi
test eax, eax
setne dil
call fcn.180002fc4
test dil, dil
jne 0x180001f87
mov rcx, rbx
jmp 0x180001ecb
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
call fcn.180003004
mov r8, rdi
mov rdx, rbx
mov rcx, rax
mov qword [r15 + 0x10], rax
call fcn.1800031d0
mov rcx, rbx
call fcn.180002fc4
mov rcx, qword [r15 + 0x10]
call fcn.180002a20
mov qword [r15 + 8], rax
test rax, rax
je 0x180001fc7
mov al, 1
jmp 0x180001ed2
mov rcx, qword [r15 + 0x10]
call fcn.180002fc4
mov qword [r15 + 0x10], 0
jmp 0x180001ed0
xor al, al
jmp 0x180001eda