Function at 0x180160f40
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x488
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xb6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4a8]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x440], rax
mov r8, qword [rbp + 0x470]
lea rdx, [fcn.180162150]
lea rcx, [0x180001004]
call fcn.180160a40
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x1801610a0
mov byte [rbp + 0x328], 0x5b
mov byte [rbp + 0x329], 0x6d
mov byte [rbp + 0x32a], 0x65
mov byte [rbp + 0x32b], 0x6d
mov byte [rbp + 0x32c], 0x6f
mov byte [rbp + 0x32d], 0x72
mov byte [rbp + 0x32e], 0x79
mov byte [rbp + 0x32f], 0x2e
mov byte [rbp + 0x330], 0x63
mov byte [rbp + 0x331], 0x70
mov byte [rbp + 0x332], 0x70
mov byte [rbp + 0x333], 0x3a
mov byte [rbp + 0x334], 0x32
mov byte [rbp + 0x335], 0x39
mov byte [rbp + 0x336], 0x36
mov byte [rbp + 0x337], 0x5d
mov byte [rbp + 0x338], 0x20
mov byte [rbp + 0x339], 0
lea rcx, [rbp + 0x328]
call fcn.1800cefd0
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x428], rax
lea rdx, str.failed_to_get_module_handle_for:__
mov rcx, qword [rbp + 0x428]
call fcn.18015e890
mov qword [rbp + 0x430], rax
mov rdx, qword [rbp + 0x470]
mov rcx, qword [rbp + 0x430]
call fcn.18015e8e0
mov qword [rbp + 0x438], rax
lea rdx, [0x180257fb4]
mov rcx, qword [rbp + 0x438]
call fcn.18015e890
xor eax, eax
jmp 0x180161630
mov rax, qword [rbp + 8]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x18016117e
mov byte [rbp + 0x358], 0x5b
mov byte [rbp + 0x359], 0x6d
mov byte [rbp + 0x35a], 0x65
mov byte [rbp + 0x35b], 0x6d
mov byte [rbp + 0x35c], 0x6f
mov byte [rbp + 0x35d], 0x72
mov byte [rbp + 0x35e], 0x79
mov byte [rbp + 0x35f], 0x2e
mov byte [rbp + 0x360], 0x63
mov byte [rbp + 0x361], 0x70
mov byte [rbp + 0x362], 0x70
mov byte [rbp + 0x363], 0x3a
mov byte [rbp + 0x364], 0x33
mov byte [rbp + 0x365], 0x30
mov byte [rbp + 0x366], 0x35
mov byte [rbp + 0x367], 0x5d
mov byte [rbp + 0x368], 0x20
mov byte [rbp + 0x369], 0
lea rcx, [rbp + 0x358]
call fcn.1800cefd0
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x428], rax
lea rdx, str.failed_to_get_module_size__image_is_invalid
mov rcx, qword [rbp + 0x428]
call fcn.18015e890
xor eax, eax
jmp 0x180161630
mov rax, qword [rbp + 0x48]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
cmp dword [rax], 0x4550
je 0x180161260
mov byte [rbp + 0x388], 0x5b
mov byte [rbp + 0x389], 0x6d
mov byte [rbp + 0x38a], 0x65
mov byte [rbp + 0x38b], 0x6d
mov byte [rbp + 0x38c], 0x6f
mov byte [rbp + 0x38d], 0x72
mov byte [rbp + 0x38e], 0x79
mov byte [rbp + 0x38f], 0x2e
mov byte [rbp + 0x390], 0x63
mov byte [rbp + 0x391], 0x70
mov byte [rbp + 0x392], 0x70
mov byte [rbp + 0x393], 0x3a
mov byte [rbp + 0x394], 0x33
mov byte [rbp + 0x395], 0x31
mov byte [rbp + 0x396], 0x32
mov byte [rbp + 0x397], 0x5d
mov byte [rbp + 0x398], 0x20
mov byte [rbp + 0x399], 0
lea rcx, [rbp + 0x388]
call fcn.1800cefd0
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x428], rax
lea rdx, str.failed_to_get_module_size__image_is_invalid
mov rcx, qword [rbp + 0x428]
call fcn.18015e890
xor eax, eax
jmp 0x180161630
mov rax, qword [rbp + 0x478]
mov qword [rbp + 0x88], rax
mov rcx, qword [rbp + 0x480]
call fcn.1800cbc90
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xc8], 0
mov rax, qword [rbp + 0x68]
mov eax, dword [rax + 0x50]
mov rcx, qword [rbp + 0x480]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0xa8]
mov qword [rsp + 0x20], rcx
mov r9, qword [rbp + 0x88]
mov r8d, eax
mov rdx, qword [rbp + 0x28]
lea rcx, [rbp + 0xe8]
call fcn.180161760
nop
lea rcx, [rbp + 0xe8]
call fcn.1800d2b30
movzx eax, al
test eax, eax
jne 0x180161486
lea rcx, [rbp + 0xe8]
call fcn.1800d3030
cmp rax, 1
jbe 0x18016146e
mov rax, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0xa8]
lea rax, [rax + rcx*2]
mov rcx, rax
call fcn.1800d30b0
test rax, rax
je 0x18016134b
mov rax, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0xa8]
lea rax, [rax + rcx*2]
mov rcx, rax
call fcn.1800d30b0
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_malloc]
mov edx, 0xdddd
mov rcx, rax
call fcn.1800d3110
mov qword [rbp + 0x428], rax
jmp 0x180161356
mov qword [rbp + 0x428], 0
mov rax, qword [rbp + 0x428]
mov qword [rbp + 0x128], rax
mov r8, qword [rbp + 0x128]
mov rdx, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0x88]
call fcn.180160db0
mov qword [rbp + 0x148], rax
mov byte [rbp + 0x3b8], 0x5b
mov byte [rbp + 0x3b9], 0x6d
mov byte [rbp + 0x3ba], 0x65
mov byte [rbp + 0x3bb], 0x6d
mov byte [rbp + 0x3bc], 0x6f
mov byte [rbp + 0x3bd], 0x72
mov byte [rbp + 0x3be], 0x79
mov byte [rbp + 0x3bf], 0x2e
mov byte [rbp + 0x3c0], 0x63
mov byte [rbp + 0x3c1], 0x70
mov byte [rbp + 0x3c2], 0x70
mov byte [rbp + 0x3c3], 0x3a
mov byte [rbp + 0x3c4], 0x33
mov byte [rbp + 0x3c5], 0x33
mov byte [rbp + 0x3c6], 0x34
mov byte [rbp + 0x3c7], 0x5d
mov byte [rbp + 0x3c8], 0x20
mov byte [rbp + 0x3c9], 0
lea rcx, [rbp + 0x3b8]
call fcn.1800cefd0
mov r8, rax
mov dl, 2
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x428], rax
lea rdx, str.found_more_than_one_occurrence_with__
mov rcx, qword [rbp + 0x428]
call fcn.18015e890
mov qword [rbp + 0x430], rax
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x430]
call fcn.18015e890
mov qword [rbp + 0x438], rax
lea rdx, str.__pattern__consider_updating_it_
mov rcx, qword [rbp + 0x438]
call fcn.18015e890
xor edx, edx
lea rcx, [rbp + 0xe8]
call fcn.1800ce610
mov rax, qword [rax]
mov qword [rbp + 0xc8], rax
cmp qword [rbp + 0xc8], 0
jne 0x18016160f
mov rax, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0xa8]
lea rax, [rax + rcx*2]
mov rcx, rax
call fcn.1800d30b0
test rax, rax
je 0x1801614ec
mov rax, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0xa8]
lea rax, [rax + rcx*2]
mov rcx, rax
call fcn.1800d30b0
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_malloc]
mov edx, 0xdddd
mov rcx, rax
call fcn.1800d3110
mov qword [rbp + 0x428], rax
jmp 0x1801614f7
mov qword [rbp + 0x428], 0
mov rax, qword [rbp + 0x428]
mov qword [rbp + 0x168], rax
mov r8, qword [rbp + 0x168]
mov rdx, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0x88]
call fcn.180160db0
mov qword [rbp + 0x188], rax
mov byte [rbp + 0x3e8], 0x5b
mov byte [rbp + 0x3e9], 0x6d
mov byte [rbp + 0x3ea], 0x65
mov byte [rbp + 0x3eb], 0x6d
mov byte [rbp + 0x3ec], 0x6f
mov byte [rbp + 0x3ed], 0x72
mov byte [rbp + 0x3ee], 0x79
mov byte [rbp + 0x3ef], 0x2e
mov byte [rbp + 0x3f0], 0x63
mov byte [rbp + 0x3f1], 0x70
mov byte [rbp + 0x3f2], 0x70
mov byte [rbp + 0x3f3], 0x3a
mov byte [rbp + 0x3f4], 0x33
mov byte [rbp + 0x3f5], 0x37
mov byte [rbp + 0x3f6], 0x30
mov byte [rbp + 0x3f7], 0x5d
mov byte [rbp + 0x3f8], 0x20
mov byte [rbp + 0x3f9], 0
lea rcx, [rbp + 0x3e8]
call fcn.1800cefd0
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x428], rax
lea rdx, str.pattern_not_found:__
mov rcx, qword [rbp + 0x428]
call fcn.18015e890
mov qword [rbp + 0x430], rax
mov rdx, qword [rbp + 0x168]
mov rcx, qword [rbp + 0x430]
call fcn.18015e890
mov qword [rbp + 0x438], rax
lea rdx, [0x180257fb4]
mov rcx, qword [rbp + 0x438]
call fcn.18015e890
mov rax, qword [rbp + 0xc8]
mov qword [rbp + 0x418], rax
lea rcx, [rbp + 0xe8]
call fcn.1800ce570
mov rax, qword [rbp + 0x418]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x18026f780]
call fcn.180225a10
mov rax, rdi
mov rcx, qword [rbp + 0x440]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x458]
pop rdi
pop rbp
ret