Function at 0x180003aa0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x980]
sub rsp, 0xa80
mov rax, qword [section._________2]
xor rax, rsp
mov qword [rbp + 0x960], rax
cmp edx, 1
jne 0x18000429f
call qword [sym.imp.kernel32.dll_DisableThreadLibraryCalls]
call fcn.1800042c0
mov r8d, 0x104
lea rdx, [rbp + 0x750]
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleFileNameA]
mov qword [rsp + 0x40], 0x100
lea rax, [rbp + 0x650]
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x860]
lea rax, [rbp + 0x550]
mov qword [rsp + 0x30], 0x100
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x40]
mov r8d, 3
mov qword [rsp + 0x20], 0x100
lea rcx, [rbp + 0x750]
call fcn.1800084ec
mov r9d, 0x100
lea r8, [rbp + 0x650]
mov edx, r9d
lea rcx, [rbp + 0x550]
call fcn.180007ec8
lea rdx, [0x18001a468]
lea rcx, [rbp + 0x550]
call fcn.180010320
test eax, eax
jne 0x180004249
lea rcx, [0x18001a480]
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x180004249
mov qword [rsp + 0xa98], rbx
lea rcx, [0x18001a468]
mov qword [rsp + 0xaa0], rsi
mov qword [rsp + 0xa78], rdi
mov qword [rsp + 0xa70], r14
call fcn.180005b30
mov dword [rbp + 0x440], 0x245c8948
mov dword [rbp + 0x444], 0x74894808
mov dword [rbp + 0x448], 0x894c1024
mov dword [rbp + 0x44c], 0x5720244c
mov dword [rbp + 0x450], 0x30b8
mov byte [rbp + 0x454], 0
mov dword [rsp + 0x50], 0x2de8130
mov dword [rsp + 0x54], 0xb217a40
mov dword [rsp + 0x58], 0xba637551
mov dword [rsp + 0x5c], 0x407dadea
mov dword [rsp + 0x60], 0xf4a9075b
mov dword [rsp + 0x64], 0xca7d9ec7
mov dword [rsp + 0x68], 0xbd810c90
mov dword [rsp + 0x6c], 0x574fa573
mov dword [rsp + 0x70], 0x2e188198
mov dword [rsp + 0x74], 0x5e639090
mov dword [rsp + 0x78], 0x1d29b407
mov dword [rsp + 0x7c], 0x255d7b04
mov dword [rbp - 0x80], 0xf45c9d53
mov dword [rbp - 0x7c], 0xb07bcfbf
mov dword [rbp - 0x78], 0xb0d2c165
mov dword [rbp - 0x74], 0x82bebd67
mov dword [rbp - 0x70], 0x8ea2722a
mov dword [rbp - 0x6c], 0x4102c0
mov dword [rbp - 0x68], 0x34934ac3
mov dword [rbp - 0x64], 0x2b8bc400
mov dword [rbp - 0x60], 0xe81b0ad1
mov dword [rbp - 0x5c], 0xc1c168a8
mov dword [rbp - 0x58], 0xae14b727
mov dword [rbp - 0x54], 0x771b3375
mov dword [rbp - 0x50], 0xceee8f02
mov dword [rbp - 0x4c], 0xfd56f43
mov dword [rbp - 0x48], 0xd2775307
mov dword [rbp - 0x44], 0x2e37f169
mov dword [rbp - 0x40], 0xe608b211
mov dword [rbp - 0x3c], 0x460d0614
mov dword [rbp - 0x38], 0x6be61697
mov dword [rbp - 0x34], 0xb9ed6956
mov dword [rbp - 0x30], 0x8ac87809
mov dword [rbp - 0x2c], 0x79e11fdb
mov dword [rbp - 0x28], 0xc9001502
mov dword [rbp - 0x24], 0xd756158
mov dword [rbp - 0x20], 0x8e6d5f6f
mov dword [rbp - 0x1c], 0xe03cf487
mov dword [rbp - 0x18], 0xb0ec6808
mov dword [rbp - 0x14], 0x20bb9e1
mov dword [rbp - 0x10], 0x77c21b40
mov dword [rbp - 0xc], 0xa37984af
mov dword [rbp - 8], 0x68932627
mov dword [rbp - 4], 0x317ff7ea
mov dword [rbp], 0xd5c359ce
mov dword [rbp + 4], 0x315245d6
mov dword [rbp + 8], 0x37a0346a
mov dword [rbp + 0xc], 0x3938da12
mov dword [rbp + 0x10], 0x183d00f
mov dword [rbp + 0x14], 0xb590463c
mov dword [rbp + 0x18], 0xe046bf7b
mov dword [rbp + 0x1c], 0x50adf1ba
mov dword [rbp + 0x20], 0x8f87c24a
mov dword [rbp + 0x24], 0xcbf4b701
mov dword [rbp + 0x28], 0xabd59f44
mov dword [rbp + 0x2c], 0xf296c8be
mov byte [rbp + 0x30], 0x61
mov dword [rbp + 0x460], 0x2de8130
mov dword [rbp + 0x464], 0xabe44740
mov dword [rbp + 0x468], 0xa70dd4fa
mov dword [rbp + 0x46c], 0x9c620b7f
mov dword [rbp + 0x470], 0x39155c13
mov dword [rbp + 0x474], 0x3004582b
mov dword [rbp + 0x478], 0x9fa9e774
mov dword [rbp + 0x47c], 0x85af1698
mov dword [rbp + 0x480], 0x4e014be5
mov dword [rbp + 0x484], 0x536a5d8f
mov dword [rbp + 0x488], 0x5c9623e9
mov dword [rbp + 0x48c], 0x94a1e732
xor edx, edx
mov dword [rbp + 0x490], 0x811c0821
lea rcx, [rbp + 0x54]
mov dword [rbp + 0x494], 0xa1488dae
mov dword [rbp + 0x498], 0xcae96576
mov dword [rbp + 0x49c], 0x7bb254f9
lea r8d, [rdx + 0x50]
mov dword [rbp + 0x4a0], 0xbd4657c6
mov dword [rbp + 0x4a4], 0x410242
mov dword [rbp + 0x4a8], 0x2825e9c8
mov dword [rbp + 0x4ac], 0xd8eb2556
mov dword [rbp + 0x4b0], 0x92686877
mov dword [rbp + 0x4b4], 0x55e720a0
mov dword [rbp + 0x4b8], 0x9a48e17f
mov dword [rbp + 0x4bc], 0x587d6763
mov dword [rbp + 0x4c0], 0xc32a204
mov dword [rbp + 0x4c4], 0xff9df234
mov dword [rbp + 0x4c8], 0x400e6b5a
mov dword [rbp + 0x4cc], 0xf9533568
mov dword [rbp + 0x4d0], 0xa91923c3
mov dword [rbp + 0x4d4], 0xdd6a62b9
mov dword [rbp + 0x4d8], 0x4005feb9
mov dword [rbp + 0x4dc], 0x13fd27da
mov dword [rbp + 0x4e0], 0xaef07e79
mov dword [rbp + 0x4e4], 0x45b60fb6
mov dword [rbp + 0x4e8], 0x80001502
mov dword [rbp + 0x4ec], 0xbe10c67c
mov dword [rbp + 0x4f0], 0x536656c8
mov dword [rbp + 0x4f4], 0x7ee9e49a
mov dword [rbp + 0x4f8], 0xbc83bf43
mov dword [rbp + 0x4fc], 0x2ab028c
mov dword [rbp + 0x500], 0x49dc2e40
mov dword [rbp + 0x504], 0xbfb09d59
mov dword [rbp + 0x508], 0xc74112a2
mov dword [rbp + 0x50c], 0x58a8e57
mov dword [rbp + 0x510], 0xc9e00148
mov dword [rbp + 0x514], 0xb361ee6e
mov dword [rbp + 0x518], 0xc5dfae76
mov dword [rbp + 0x51c], 0x8204eda5
mov dword [rbp + 0x520], 0xcb1c4702
mov dword [rbp + 0x524], 0xf040ab65
mov dword [rbp + 0x528], 0x28166475
mov dword [rbp + 0x52c], 0xb589a639
mov dword [rbp + 0x530], 0x9ae5175b
mov dword [rbp + 0x534], 0xa80b2c46
mov dword [rbp + 0x538], 0x951e3aa2
mov dword [rbp + 0x53c], 0xace7a6d2
mov byte [rbp + 0x540], 0x94
call fcn.180007600
or ebx, 0xffffffff
lea r8, [rbp + 0x440]
mov ecx, ebx
mov dword [rbp + 0x50], ebx
lea rdx, [rbp + 0x50]
lea r9d, [rbx + 2]
cmp ecx, 0xffffffff
je 0x180004004
movsxd rax, ecx
movzx r10d, byte [rbp + rax + 0x440]
cmp byte [r8], r10b
je 0x180004004
cmp r10b, 0xff
je 0x180004004
mov ecx, dword [rbp + rax*4 + 0x50]
jmp 0x18000402c
inc ecx
inc r8
movsxd r10, ecx
inc r9d
add rdx, 4
movzx eax, byte [rbp + r10 + 0x440]
cmp byte [r8], al
je 0x180004025
mov dword [rdx], ecx
jmp 0x18000402c
mov eax, dword [rbp + r10*4 + 0x50]
mov dword [rdx], eax
cmp r9d, 0x15
jl 0x180003fe2
mov rsi, qword [0x18001ebf0]
xor edi, edi
mov r14, qword [0x18001ebe8]
mov ecx, edi
sub rsi, r14
mov eax, edi
test rsi, rsi
jle 0x180004081
nop
cmp rax, 0xffffffffffffffff
je 0x180004070
movzx edx, byte [rbp + rax + 0x440]
cmp byte [rcx + r14], dl
je 0x180004070
cmp dl, 0xff
je 0x180004070
movsxd rax, dword [rbp + rax*4 + 0x50]
jmp 0x18000407c
inc rcx
inc rax
cmp rax, 0x15
je 0x180004081
cmp rcx, rsi
jl 0x180004050
xor edx, edx
lea rcx, [rbp + 0xb4]
mov r8d, 0x380
call fcn.180007600
mov r9d, 1
mov dword [rbp + 0xb0], ebx
lea rdx, [rbp + 0x460]
lea rcx, [rbp + 0xb0]
nop
cmp ebx, 0xffffffff
je 0x1800040d3
movsxd r8, ebx
movzx eax, byte [rbp + r8 + 0x460]
cmp byte [rdx], al
je 0x1800040d3
cmp al, 0xff
je 0x1800040d3
mov ebx, dword [rbp + r8*4 + 0xb0]
jmp 0x1800040fd
inc ebx
inc rdx
movsxd r8, ebx
inc r9d
add rcx, 4
movzx eax, byte [rbp + r8 + 0x460]
cmp byte [rdx], al
je 0x1800040f3
mov dword [rcx], ebx
jmp 0x1800040fd
mov eax, dword [rbp + r8*4 + 0xb0]
mov dword [rcx], eax
cmp r9d, 0xe1
jl 0x1800040b0
mov rax, rdi
test rsi, rsi
jle 0x180004207
cmp rax, 0xffffffffffffffff
je 0x180004135
movzx ecx, byte [rbp + rax + 0x460]
cmp byte [rdi + r14], cl
je 0x180004135
cmp cl, 0xff
je 0x180004135
movsxd rax, dword [rbp + rax*4 + 0xb0]
jmp 0x180004143
inc rdi
inc rax
cmp rax, 0xe1
je 0x18000414d
cmp rdi, rsi
jl 0x180004112
jmp 0x180004207
add rdi, 0xffffffffffffff1f
cmp rdi, 0xffffffffffffffff
je 0x180004207
lea rbx, [rdi + r14]
mov dword [0x18001eba0], 1
mov rcx, rbx
lea r9, [rbp + 0x44]
mov edx, 0xe1
mov r8d, 0x40
call qword [sym.imp.kernel32.dll_VirtualProtect]
lea rax, [rsp + 0x50]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rbx], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rbx + 0x10], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rbx + 0x20], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rbx + 0x30], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rbx + 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rbx + 0x50], xmm1
movups xmm1, xmmword [rax]
movups xmmword [rbx + 0x60], xmm0
sub rbx, 0xffffffffffffff80
movups xmm0, xmmword [rax - 0x10]
movups xmmword [rbx - 0x10], xmm0
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbx], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbx + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rbx + 0x20], xmm1
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rbx + 0x30], xmm0
movups xmm0, xmmword [rax + 0x50]
movzx eax, byte [rax + 0x60]
movups xmmword [rbx + 0x40], xmm1
movups xmmword [rbx + 0x50], xmm0
mov byte [rbx + 0x60], al
cmp dword [0x18001eba0], 1
mov r14, qword [rsp + 0xa70]
mov rdi, qword [rsp + 0xa78]
mov rsi, qword [rsp + 0xaa0]
mov rbx, qword [rsp + 0xa98]
je 0x180004249
xor r9d, r9d
lea r8, [0x18001a4ac]
lea rdx, [0x18001a4b0]
xor ecx, ecx
call qword [sym.imp.user32.dll_MessageBoxW]
call fcn.180002580
call qword [sym.imp.kernel32.dll_GetCurrentThread]
mov rcx, rax
call fcn.180002c80
lea rdx, [0x180004630]
lea rcx, [0x18001ec08]
call fcn.180002d30
call fcn.1800027d0
call fcn.180002580
call qword [sym.imp.kernel32.dll_GetCurrentThread]
mov rcx, rax
call fcn.180002c80
lea rdx, [0x180005720]
lea rcx, [0x18001ec18]
call fcn.180002d30
call fcn.1800027d0
mov eax, 1
mov rcx, qword [rbp + 0x960]
xor rcx, rsp
call fcn.180005bc0
add rsp, 0xa80
pop rbp
ret