Function at 0x180024190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xd8
mov ebx, dword [rbp + 0x67]
lea r12d, [rcx + 0xb]
mov dword [rbp - 0x55], r12d
mov rsi, r8
mov r8, rdx
mov r14d, ecx
cmp ecx, r12d
jae case.0x180024206.164
mov edi, dword [rbp + 0x67]
movzx r15d, byte [rbp + 0x67]
lea eax, [r14 - 0x94]
movabs r9, 0x400bc28f5c28f5c3
lea rdx, [0x180000000]
cmp eax, 0x17
ja case.0x180024206.151
mov ecx, dword [rdx + rax*4 + 0x246c4]
add rcx, rdx
jmp rcx
mov r8, rsi
xor edx, edx
mov ecx, 0x9c
call fcn.180021430
mov dword [rsi + 0x90], 0x3c
jmp case.0x180024206.151
xor r9d, r9d
mov dword [rsi + 0x94], 0x3840
xor r8d, r8d
mov edx, 0xc1
xor ecx, ecx
call fcn.1800099f0
mov qword [rsi + 0x98], rax
jmp case.0x180024206.151
mov qword [rsi + 0x88], r9
jmp case.0x180024206.151
dec dword [rsi]
add r8, 8
mov edx, dword [rsi]
mov qword [rbp + 0x6f], r8
test edx, edx
jle case.0x180024206.151
mov rax, qword [r8]
cmp byte [rax], 0x2d
jne case.0x180024206.151
cmp byte [rax + 1], 0x72
jne case.0x180024206.151
cmp byte [rax + 2], 0
jne case.0x180024206.151
mov ecx, 0xe9
mov eax, ecx
sub eax, 0xe7
je 0x1800242b1
sub eax, 1
je 0x1800242ab
cmp eax, 1
jne 0x1800242b5
mov byte [rbp + 0x7f], al
jmp 0x1800242b5
add r8, 8
jmp 0x1800242b5
dec edx
mov dword [rsi], edx
dec ecx
cmp ecx, 0xe6
ja 0x180024293
mov qword [rbp + 0x6f], r8
jmp case.0x180024206.151
mov dword [rbp - 0x59], 5
mov byte [rbp + 0x7f], 0
jmp case.0x180024206.151
mov eax, dword [rsi]
mov edx, 0xed
mov dword [rbp - 0x51], eax
mov eax, edx
sub eax, 0xed
je 0x180024302
cmp eax, 2
jne 0x180024311
mov r8, rsi
lea edx, [rax + 0x34]
xor ecx, ecx
call fcn.18000fca0
jmp case.0x180024206.151
imul ecx, dword [rsi], 0x2c9277b5
mov eax, esi
or eax, 1
add ecx, eax
mov dword [rsi], ecx
inc edx
cmp edx, 0xef
jb 0x1800242e2
jmp case.0x180024206.151
cmp byte [rbp + 0x7f], 0
je 0x1800243e0
mov esi, 0x54
nop
mov eax, esi
sub eax, 0x54
je 0x18002434a
sub eax, 0x6b
je 0x180024380
sub eax, 0x3b
je 0x180024390
cmp eax, 0x184a
je 0x180024390
jmp 0x180024368
mov r9d, 0x67
mov qword [rbp - 0x79], 0x20
xor r8d, r8d
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 0x79]
call fcn.18001d4b0
add esi, 0x18f0
cmp esi, 0x63c0
jbe 0x180024330
jmp 0x180024390
lea r8, [rbp - 0x41]
xor edx, edx
mov ecx, 0xaa
call fcn.180024190
mov rax, qword [rbp - 0x29]
lea r9, [rbp - 0x61]
mov qword [rbp - 0x79], rax
lea rdx, [rbp - 0x49]
mov rax, qword [rbp - 0x31]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], rax
mov r8d, 0x108
mov rax, qword [rbp - 0x39]
mov qword [rbp - 0x61], rax
mov rax, qword [rbp - 0x41]
mov qword [rbp - 0x49], rax
lea rax, [rbp - 0x79]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
call fcn.180022400
jmp case.0x180024206.151
lea rax, [rsp + 0x38]
mov qword [rsp + 0x38], 0x36
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x49]
lea rax, [rbp - 9]
mov qword [rbp - 0x61], 0x36
mov r8d, 0x108
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x79]
mov qword [rbp - 0x49], 0x2a
lea rcx, [rbp - 0x61]
mov qword [rbp - 0x79], 0x2a
call fcn.180022400
jmp case.0x180024206.151
cmp dword [rsi], 0
jle case.0x180024206.151
mov rcx, qword [r8]
call fcn.18002dd64
mov dword [rbp - 0x59], eax
jmp case.0x180024206.151
mov eax, dword [rbp - 0x59]
cmp eax, 1
jl 0x180024619
mov qword [rbp - 0x79], rax
nop dword [rax]
mov esi, 0xf
mov r13d, reloc.COMCTL32.dll_MakeDragList
mov qword [rbp - 0x61], rsi
nop
cmp r13d, 0xb
ja case.0x180024487.0
mov eax, r13d
mov ecx, dword [rdx + rax*4 + 0x24724]
add rcx, rdx
jmp rcx
mov r14d, 0x34
lea rsi, [rbp - 0xe]
lea r12d, [r14 - 1]
nop word [rax + rax]
mov ebx, 0x109
mov eax, ebx
sub eax, 0x106
je 0x1800244f2
sub eax, 1
je 0x1800244e6
sub eax, 1
je 0x1800244db
cmp eax, 1
jne 0x1800244f5
mov r8d, 0x9a
mov qword [rsp + 0x38], r14
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 9]
call fcn.18001b930
mov rdi, rax
jmp 0x1800244f5
movsxd rax, edi
movzx r15d, byte [rbp + rax - 0x41]
jmp 0x1800244f5
movzx eax, byte [rsi]
movsxd rcx, edi
mov byte [rbp + rcx - 0x41], al
jmp 0x1800244f5
mov byte [rsi], r15b
dec ebx
cmp ebx, 0x105
ja 0x1800244a5
dec r14
dec rsi
sub r12, 1
jne 0x1800244a0
mov rsi, qword [rbp - 0x61]
lea rdx, [0x180000000]
jmp case.0x180024487.0
mov ebx, 0xeb
mov eax, ebx
sub eax, 0xe9
je 0x180024580
cmp eax, 2
jne 0x180024566
lea r8d, [rax + 0x2b]
mov qword [rsp + 0x38], 0xfffffffffffffffa
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 9]
call fcn.180022840
mov r8d, 0x2d
mov qword [rsp + 0x38], 0xfffffffffffffffa
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 7]
call fcn.180022840
dec ebx
cmp ebx, 0xe9
ja 0x180024520
lea rdx, [0x180000000]
jmp case.0x180024487.0
lea rdx, [rbp - 9]
mov ecx, 0x3a
call fcn.180023cb0
cmp eax, 6
jb 0x180024580
lea rdx, [0x180000000]
jmp case.0x180024487.0
xor eax, eax
lea rcx, [rbp - 0x41]
mov byte [rcx], al
lea rcx, [rcx + 1]
inc eax
cmp eax, 0x34
jl 0x1800245a2
jmp case.0x180024487.0
mov dword [rbp - 0x69], 0x514a5439
mov eax, dword [rbp - 0x69]
mov dword [rbp - 0x71], 0x34333241
mov dword [rbp - 0x6d], 0x38373635
movsd xmm0, qword [rbp - 0x71]
mov dword [0x18005cf20], eax
mov dword [rsp + 0x30], 0x73646368
mov eax, dword [rsp + 0x30]
mov dword [0x18005cf28], eax
movsd qword [0x18005cf18], xmm0
mov byte [0x18005cf24], 0x4b
dec r13d
sub rsi, 1
mov qword [rbp - 0x61], rsi
jne 0x180024470
sub qword [rbp - 0x79], 1
jne 0x180024460
mov r14d, dword [rbp + 0x67]
mov r12d, dword [rbp - 0x55]
xor ebx, ebx
inc r14d
mov dword [rbp + 0x67], r14d
cmp r14d, r12d
jae case.0x180024206.164
mov rsi, qword [rbp + 0x77]
mov r8, qword [rbp + 0x6f]
jmp 0x1800241db
mov r10d, dword [rbp - 0x51]
mov r8d, 0x1d
mov dword [rbp + 0x67], r10d
mov r9d, r10d
mov edx, dword [rbp + 0x67]
mov ecx, dword [rbp + 0x67]
shr r9d, 0x1c
mov eax, r8d
sub eax, 0x19
je 0x180024692
sub eax, 2
je 0x1800246a9
sub eax, 1
je 0x18002467e
cmp eax, 1
jne 0x180024685
lea ecx, [r9 + 4]
mov eax, r10d
shr eax, cl
xor eax, r10d
imul ecx, eax, 0x108ef2d9
jmp 0x180024685
mov edx, ecx
shr edx, 0x16
xor edx, ecx
dec r8d
cmp r8d, 0x19
ja 0x180024653
mov eax, edx
jmp 0x1800246af
xor edx, edx
lea r8, [rbp + 0x67]
lea ecx, [rdx + 1]
call fcn.180009600
xor edx, edx
div dword [0]
mov eax, edx
jmp 0x1800246af
mov eax, ebx
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret