Function at 0x1800baa90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x1800e72b8]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov r13d, r9d
mov rsi, r8
mov qword [rsp + 0x60], r8
mov r9, rdx
mov qword [rsp + 0x40], rdx
mov r14, rcx
mov qword [rsp + 0x70], rcx
mov r15, qword [rbp + 0x118]
mov qword [rsp + 0x78], r15
mov r12, qword [rbp + 0x120]
mov qword [rbp - 0x70], r12
mov rax, qword [rbp + 0x110]
mov qword [rsp + 0x68], rax
lea eax, [r13 + 0x10]
mov dword [rsp + 0x48], eax
cmp r13d, eax
jae 0x1800baeb0
movsxd rdi, dword [rsp + 0x54]
mov rbx, rdi
mov qword [rbp - 0x78], rbx
lea rdx, [0x180000000]
mov r8d, 0x5c
nop dword [rax + rax]
lea eax, [r13 - 0xe3]
cmp eax, 0x52
ja case.0x1800bab52.243
movzx eax, byte [rdx + rax + 0xbb5d8]
mov ecx, dword [rdx + rax*4 + 0xbb594]
add rcx, rdx
jmp rcx
movsxd r8, dword [rbp - 0x80]
mov ecx, r8d
and ecx, 7
mov edx, 1
shl edx, cl
mov rax, r8
sar rax, 3
test byte [rax + r14], dl
je 0x1800bad7d
mov ecx, 0xf0
nop dword [rax + rax]
mov eax, ecx
sub eax, 0xf0
je 0x1800bab98
cmp eax, 0x1e
jne 0x1800bab9b
mov eax, 1
jmp 0x1800baeb4
inc dword [rsi + 0xc]
add ecx, 0x1e
cmp ecx, 0x12c
jb 0x1800bab80
jmp 0x1800bad7d
mov eax, 0xb
cmp eax, 0xb
je 0x1800bb0a0
add eax, 0x108
cmp eax, 0x108
jbe 0x1800babb0
mov rsi, qword [rsi]
mov r15, qword [rsp + 0x60]
mov r15, qword [r15 + 8]
cmp rsi, r15
je 0x1800bb51b
nop word [rax + rax]
mov r14, qword [r14]
mov rbx, qword [r14 + 8]
mov qword [rbp + 0x60], rbx
mov dword [rbp + 0x68], 0
mov rdi, r14
cmp byte [rbx + 0x19], 0
jne 0x1800bac37
nop dword [rax + rax]
mov qword [rbp + 0x60], rbx
lea rcx, [rbx + 0x20]
mov rdx, rsi
call fcn.1800403f0
shr eax, 0x1f
test al, al
je 0x1800bac24
mov dword [rbp + 0x68], 0
mov rbx, qword [rbx + 0x10]
jmp 0x1800bac31
mov dword [rbp + 0x68], 1
mov rdi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1800bac00
cmp byte [rdi + 0x19], 0
jne 0x1800bac50
lea rdx, [rdi + 0x20]
mov rcx, rsi
call fcn.1800403f0
shr eax, 0x1f
test al, al
je 0x1800bacbf
mov rax, qword [rsp + 0x70]
movabs rcx, 0x3ffffffffffffff
cmp qword [rax + 8], rcx
je 0x1800bb58d
mov qword [rbp - 0x68], rax
xor edi, edi
mov qword [rbp - 0x60], rdi
lea ecx, [rdi + 0x40]
call fcn.1800bc584
mov rbx, rax
mov qword [rbp - 0x60], rax
lea rcx, [rax + 0x20]
mov rdx, rsi
call fcn.1800029e0
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov word [rbx + 0x18], di
mov qword [rbp - 0x60], rdi
movups xmm0, xmmword [rbp + 0x60]
movaps xmmword [rbp + 0x60], xmm0
mov r8, rbx
lea rdx, [rbp + 0x60]
mov r14, qword [rsp + 0x70]
mov rcx, r14
call fcn.180025ec0
jmp 0x1800bacc4
mov r14, qword [rsp + 0x70]
add rsi, 0x28
cmp rsi, r15
jne 0x1800babe0
mov r15, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x60]
jmp 0x1800bad78
xor r9d, r9d
lea r8, [0x1800fae30]
lea edx, [r9 + 0x41]
lea rcx, [rbp + 0x80]
call fcn.18009f6b0
mov r8d, 0x20
lea rdx, [0x1800fadf0]
lea rcx, [rbp + 0x80]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1800bad78
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rax, str.Failed_to_allocate_buffer_to_download_files_into.
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [0x1800c867b]
lea rdx, str.TryNextUrl
call fcn.1800bc2a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
xor r9d, r9d
lea r8, [rbp - 8]
mov rdx, r12
mov ecx, 0x143
call fcn.18001a9f0
mov r9d, 0x12f
lea r8, [rbp - 8]
lea rdx, [rbp + 0x28]
mov rcx, r12
call fcn.180053eb0
mov r9, qword [rsp + 0x40]
mov r8d, 0x5c
lea rdx, [0x180000000]
inc r13d
cmp r13d, dword [rsp + 0x48]
jae 0x1800baeb0
mov rbx, qword [rbp - 0x78]
mov edi, dword [rsp + 0x54]
jmp 0x1800bab30
movsxd rcx, dword [rsi + 0xc]
mov rax, qword [rsi]
movzx edx, byte [rcx + rax]
mov dword [rbp - 0x80], edx
jmp 0x1800bad83
mov r9d, 0x12f
mov r8, r14
mov rdx, rsi
lea rcx, [rbp - 8]
call fcn.180053eb0
lea r8, [r14 + 0x30]
lea rdx, [rsi + 0x30]
mov r9d, 0x12f
lea rcx, [rbp + 0x28]
jmp 0x1800bad73
xor r9d, r9d
mov r8d, 0xc7
lea rdx, [rbp - 0x28]
lea rcx, [0x1800fae30]
call fcn.1800a6190
mov r8d, 0x20
lea rdx, [0x1800fae10]
lea rcx, [rbp - 0x28]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1800bad78
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rax, str.invalid_client_field_in_MediaSessionService_SetClient_Params
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [0x1800c867b]
lea rdx, str.ci3i20ncds
call fcn.1800bc2a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
cmp dword [r14 + 8], 0
jle 0x1800baf89
mov r11d, 0xf0
nop dword [rax]
cmp r11d, 0xf0
je 0x1800baf13
cmp r11d, 0x32a0
je 0x1800baf6f
cmp r11d, 0x6450
je 0x1800baf0b
cmp r11d, 0x9600
jne 0x1800baf75
cmp edi, dword [r14 + 8]
jge 0x1800baf75
mov edx, 0xa
cmp edx, 0xa
je 0x1800baede
cmp edx, 0xe6
jne 0x1800baefb
mov eax, dword [rsp + 0x48]
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.1800bcd70
mov rbx, qword [rsp + 0x208]
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rbx + rbx*4]
mov rax, qword [r14 + 0x10]
movups xmm0, xmmword [r15]
movups xmmword [rax + rcx*8 + 8], xmm0
movsd xmm1, qword [r15 + 0x10]
movsd qword [rax + rcx*8 + 0x18], xmm1
add edx, 0xdc
cmp edx, 0x1b8
jbe 0x1800baea3
jmp 0x1800baf75
mov r13d, 0x103
jmp 0x1800baf75
xor edi, edi
mov dword [rsp + 0x54], edi
xor ebx, ebx
mov qword [rbp - 0x78], rbx
movsxd rax, dword [r14 + 8]
test eax, eax
jle 0x1800baf75
mov r10, rax
mov r9, qword [r14 + 0x10]
nop
mov rax, qword [r9]
mov r8, r12
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1800baf53
inc rax
test ecx, ecx
jne 0x1800baf40
test edx, edx
je 0x1800baf6f
inc edi
mov dword [rsp + 0x54], edi
inc rbx
mov qword [rbp - 0x78], rbx
add r9, 0x28
cmp rbx, r10
jl 0x1800baf30
jmp 0x1800baf75
mov r11d, 0x32a0
add r11d, 0x31b0
cmp r11d, 0xc6c0
jbe 0x1800bae60
mov dword [rbp + 0x60], 0
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r12
mov r9d, 0x30
mov r8, r15
mov rdx, rsi
lea rcx, [rbp + 0x60]
call fcn.1800a9eb0
jmp 0x1800bad78
lea r8, [rbp - 0x58]
mov edx, 0x39
lea rcx, [0x1800fadf0]
call fcn.18008d220
test eax, eax
jne 0x1800bb027
mov ebx, 0xf9
cmp ebx, 0xf9
je 0x1800bafe9
cmp ebx, 0x6afe
jne 0x1800bb019
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rax, str.Duplicate_formats_in_avfilter_merge_formats___detected
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [0x1800c867b]
lea rdx, str.SearchPane
call fcn.1800bc2a0
add ebx, 0x6a05
cmp ebx, 0xd40a
jbe 0x1800bafd2
lea r8, [rbp - 0x58]
lea rdx, [0x1800fae30]
mov ecx, 0x5e
call fcn.18008b9f0
test eax, eax
jne 0x1800bad78
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rax, str.ULONG_ID3D11VideoProcessorOutputView::AddRef____0x_I32x
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [0x1800c867b]
lea rdx, str.ExtractPCA
call fcn.1800bc2a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
mov eax, dword [rsi + 0x10]
cmp dword [rsi + 0xc], eax
jl case.0x1800bab52.243
mov r9, rsi
xor r8d, r8d
lea edx, [r8 + 0x36]
xor ecx, ecx
call fcn.1800ab1a0
test eax, eax
jne 0x1800bad78
nop
xor eax, eax
jmp 0x1800baeb4
xor esi, esi
cmp word [r12], si
je 0x1800bb520
nop dword [rax]
nop dword [rax + rax]
movsxd rdx, esi
movsxd rax, esi
movzx ecx, word [r12 + rax*2]
cmp cx, 0x5c
je 0x1800bb0ec
mov word [rbp + 0x60], cx
mov rcx, r9
lea rdx, [rbp + 0x60]
mov r8d, 0x98
call fcn.1800897e0
jmp 0x1800bb335
inc esi
lea rbx, [rdx + 1]
cmp word [r12 + rbx*2], 0x5c
jne 0x1800bb101
mov word [rbp + 0x60], r8w
jmp 0x1800bb0d5
xor edi, edi
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r12 + rbx*2]
mov word [rbp + 0x60], ax
mov edx, 0xd6
lea rcx, [rbp + 0x60]
call fcn.180019730
test eax, eax
je 0x1800bb163
mov eax, 0x10b
cmp eax, 0x10b
je 0x1800bb155
cmp eax, 0xcf8d
je 0x1800bb14c
cmp eax, 0x19e0f
jne 0x1800bb155
inc esi
inc rbx
jmp 0x1800bb155
movzx ecx, byte [r12 + rbx*2]
mov byte [rsp + rdi + 0x58], cl
add eax, 0xce82
cmp eax, 0x26b86
jbe 0x1800bb130
jmp 0x1800bb179
mov eax, 0x11
cmp eax, 0x11
je 0x1800bb184
add eax, 0x792
cmp eax, 0x792
jbe 0x1800bb168
inc rdi
cmp rdi, 3
jl 0x1800bb110
jmp 0x1800bb186
dec esi
mov r13d, 0xf3
mov dword [rbp - 0x7c], r13d
test rdi, rdi
jne 0x1800bb1b5
mov eax, 0x5c
mov word [rbp + 0x60], ax
mov rcx, qword [rsp + 0x40]
lea rdx, [rbp + 0x60]
lea r8d, [r13 - 0x5b]
call fcn.1800897e0
jmp 0x1800bb335
cmp rdi, 4
jae 0x1800bb587
mov byte [rsp + rdi + 0x58], 0
lea r8, [rsp + 0x50]
lea rdx, [0x1800d284c]
lea rcx, [rsp + 0x58]
call fcn.1800bc400
mov ebx, eax
cmp eax, 1
jne 0x1800bb52a
mov eax, dword [rsp + 0x50]
test eax, eax
jle 0x1800bb1fb
mov rdx, qword [rsp + 0x68]
cmp eax, dword [rdx + 4]
jl 0x1800bb2b4
mov ebx, 0xe5
mov rdi, qword [rsp + 0x40]
mov r12, qword [rsp + 0x68]
nop word [rax + rax]
mov eax, ebx
sub eax, 0xe5
je 0x1800bb27c
sub eax, 0x2d
je 0x1800bb277
cmp eax, 0x2d
jne 0x1800bb298
mov dword [rbp + 0x60], 1
lea r8, [rbp + 0x60]
mov edx, 0xf7
mov rcx, r12
call fcn.1800b2b50
mov dword [rsp + 0x38], 6
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x30], eax
lea rax, str.g_idx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 0x33
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rsp + 0x60]
call fcn.18004d440
jmp 0x1800bb298
mov rcx, qword [rdi]
jmp 0x1800bb27f
mov rcx, r15
mov rax, qword [0x1800e5008]
mov qword [rbp + 0x60], rax
lea r8, [rbp + 0x60]
mov edx, 0x2f
call fcn.1800b0f70
add ebx, 0x2d
cmp ebx, 0x16c
jb 0x1800bb210
mov eax, dword [rsp + 0x50]
mov r12, qword [rbp - 0x70]
mov rdx, qword [rsp + 0x68]
cdqe
lea rcx, [rax*8]
mov rax, qword [rdx + 8]
movsxd rdi, dword [rcx + rax]
mov rbx, rdi
mov rax, qword [rdx + 0x10]
cmp rdi, qword [rcx + rax]
jge 0x1800bb335
mov r14, qword [rsp + 0x40]
mov r12, qword [rsp + 0x68]
mov r13d, pe_nt_image_headers64
movzx edx, byte [r15 + rbx]
movzx ecx, r13w
imul edx, ecx
movzx eax, byte [r15 + rbx + 1]
add dx, ax
mov word [rbp + 0x60], dx
mov r8d, 0x98
lea rdx, [rbp + 0x60]
mov rcx, r14
call fcn.1800897e0
add edi, 2
lea rbx, [rbx + 2]
movsxd rdx, edi
movsxd rcx, dword [rsp + 0x50]
mov rax, qword [r12 + 0x10]
cmp rdx, qword [rax + rcx*8]
jl 0x1800bb2e3
mov r13d, dword [rbp - 0x7c]
mov r12, qword [rbp - 0x70]
mov r14, qword [rsp + 0x70]
inc esi
movsxd rax, esi
cmp word [r12 + rax*2], 0
mov r9, qword [rsp + 0x40]
mov r8d, 0x5c
jne 0x1800bb0c0
mov rsi, qword [rsp + 0x60]
jmp 0x1800bad83
mov dword [rbp + 0x60], 0x3020100
mov dword [rbp + 0x64], 0x7060504
mov dword [rbp + 0x68], 0x14131211
mov dword [rbp + 0x6c], 0x18171615
mov dword [rbp + 0x70], 0x25242322
mov dword [rbp + 0x74], 0x29282726
mov dword [rbp + 0x78], 0x36353433
mov dword [rbp + 0x7c], 0x40393837
movups xmm0, xmmword [rbp + 0x60]
movups xmmword [0x1800fadf0], xmm0
movups xmm1, xmmword [rbp + 0x70]
movups xmmword [0x1800fae00], xmm1
mov dword [0x1800fae10], 0x37383940
mov dword [0x1800fae14], 0x33343536
mov dword [0x1800fae18], 0x26272829
mov dword [0x1800fae1c], 0x22232425
mov dword [0x1800fae20], 0x15161718
mov dword [0x1800fae24], 0x11121314
mov dword [0x1800fae28], 0x4050607
mov dword [0x1800fae2c], 0x10203
jmp case.0x1800bab52.243
mov dword [0x1800fae30], 0x3383940
mov dword [0x1800fae34], 0x10d4d8d
mov dword [0x1800fae38], 0x2829333
mov dword [0x1800fae3c], 0x94989c
mov dword [0x1800fae40], 0x222324
mov dword [0x1800fae44], 0x14585c6
mov dword [0x1800fae48], 0x1213141
mov dword [0x1800fae4c], 0x181c44
mov dword [0x1800fae50], 0x2030405
mov dword [0x1800fae54], 0x40
mov dword [0x1800fae58], 1
mov dword [0x1800fae5c], 1
jmp case.0x1800bab52.243
mov r8d, 0xea
lea rdx, [rbp - 0x58]
lea rcx, [0x1800fae10]
call fcn.180020590
lea r8, [rbp - 0x58]
lea rdx, [0x1800fae30]
mov ecx, 0x5e
call fcn.18008b9f0
test eax, eax
jne 0x1800bad78
mov ebx, 0xac
cmp ebx, 0xac
je 0x1800bb4c9
cmp ebx, 0x5350
je 0x1800bafe2
jmp 0x1800bb4f9
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rax, str.Collections::UInt32Vector__positionToNodeIdVector__0
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [0x1800c867b]
lea rdx, str.SC_TYPEDEF
call fcn.1800bc2a0
add ebx, 0x52a4
cmp ebx, 0xa548
jbe 0x1800bb4b3
jmp 0x1800bad78
mov eax, dword [r14 + 0x90]
mov dword [rsi + 0x60], eax
jmp case.0x1800bab52.243
mov r15, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x60]
jmp case.0x1800bab52.243
xor edi, edi
mov dword [rsp + 0x48], edi
mov rax, qword [section..data]
mov qword [rsp + 0x78], rax
lea r9, [rsp + 0x48]
lea r8, [0x1800c867b]
mov edx, 0xe6
lea rcx, [rsp + 0x78]
call fcn.18009f6b0
mov dword [rsp + 0x20], 0xa3
xor r9d, r9d
lea r8, str.DEVICE_DISCONNECT
xor edx, edx
xor ecx, ecx
call fcn.18000ea70
mov r8d, ebx
lea rdx, [rsp + 0x58]
lea rcx, str.UpdatusUtil::WaitForNVTrayShutdown
call fcn.18000dac0
int3
call fcn.1800bca58
int3
call fcn.1800261f0
int3