Function at 0x18002a080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1800b6040]
xor rax, rsp
mov qword [rbp], rax
xor r15d, r15d
mov ebx, r15d
mov dword [rsp + 0x30], ebx
lea r12, section..text
mov qword [rbp - 0x20], r12
lea rax, [0x1800288e0]
mov qword [rbp - 0x18], rax
xor eax, eax
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x28], r15
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18008dee0
mov qword [rbp - 0x20], r12
lea rax, [0x180029940]
mov qword [rbp - 0x18], rax
xor eax, eax
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x28], r15
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18008dee0
mov rdi, 0xffffffffffffffff
lea r14, [0x180a421e8]
cmp byte [0x1800b60e8], 1
jne 0x18002a30b
cmp dword [0x180a42094], 7
jne 0x18002a1ce
mov word [rsp + 0x35], 0x34
mov dword [rsp + 0x30], 0x30303731
mov byte [rsp + 0x34], 0x33
mov byte [rsp + 0x37], bl
lea rcx, [rsp + 0x30]
mov rax, rdi
inc rax
cmp byte [rcx + rax], bl
jne 0x18002a170
mov rcx, r14
cmp qword [0x180a42200], 0xf
cmova rcx, qword [0x180a421e8]
mov r8, qword [0x180a421f8]
cmp r8, rax
jne 0x18002a1ce
lea rdx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x18002a1ce
cmp byte [0x180a42091], 1
jne 0x18002a1ce
lea rdx, [0x180a42208]
lea rcx, [rbp - 0x60]
call fcn.18000faf0
mov ebx, 1
cmp qword [rax + 0x10], r15
je 0x18002a1ce
movzx esi, bl
jmp 0x18002a1d1
xor sil, sil
test bl, 1
je 0x18002a1e2
and ebx, 0xfffffffe
lea rcx, [rbp - 0x60]
call fcn.18000fc20
test sil, sil
je 0x18002a30b
mov rdx, qword [0x180a42150]
cmp byte [rdx + 0x50], r15b
je 0x18002a2c8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
add rdx, 0x78
lea rcx, [rsp + 0x60]
call fcn.18000faf0
or ebx, 0x20
lea rcx, [rbp - 0x80]
call fcn.180011db0
or ebx, 0x40
or ebx, 2
mov dword [rsp + 0x30], ebx
mov dword [rbp - 0x14], 0x35316e
mov dword [rbp - 0x20], 0x69646963
mov dword [rbp - 0x1c], 0x65765f61
mov dword [rbp - 0x18], 0x6f697372
mov byte [rbp - 0x10], 0
lea r8, [rbp - 0x80]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x40]
call fcn.180017b80
nop
lea r9, [rsp + 0x60]
mov r8, rax
lea rdx, [rsp + 0x40]
call fcn.180011590
mov rsi, rax
or ebx, 4
mov dword [rsp + 0x30], ebx
mov rdx, qword [0x180a42150]
add rdx, 0x58
lea rcx, [rbp - 0x20]
call fcn.18000faf0
or ebx, 0x88
mov rax, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
jbe 0x18002a2a0
mov rsi, qword [rsi]
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rcx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
cmp r8, rax
jne 0x18002a2c8
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x18002a2c8
mov sil, 1
jmp 0x18002a2cb
xor sil, sil
test bl, 8
je 0x18002a2dd
and ebx, 0xfffffff7
lea rcx, [rbp - 0x20]
call fcn.18000fc20
nop
test bl, 4
je 0x18002a2f0
and ebx, 0xfffffffb
lea rcx, [rsp + 0x40]
call fcn.18000fc20
nop
test bl, 2
je 0x18002a301
and ebx, 0xfffffffd
lea rcx, [rbp - 0x80]
call fcn.18000fc20
test sil, sil
je 0x18002a30b
call fcn.1800841b0
cmp dword [0x180a42094], 7
jne 0x18002a395
mov word [rsp + 0x35], 0x34
mov dword [rsp + 0x30], 0x30303731
mov byte [rsp + 0x34], 0x33
mov byte [rsp + 0x37], 0
lea rax, [rsp + 0x30]
inc rdi
cmp byte [rax + rdi], 0
jne 0x18002a336
cmp qword [0x180a42200], 0xf
cmova r14, qword [0x180a421e8]
mov r8, qword [0x180a421f8]
cmp r8, rdi
jne 0x18002a395
lea rdx, [rsp + 0x30]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x18002a395
cmp byte [0x180a42091], 1
jne 0x18002a395
lea rdx, [0x180a42208]
lea rcx, [rsp + 0x40]
call fcn.18000faf0
or ebx, 0x10
cmp qword [rax + 0x10], 0
je 0x18002a395
mov dil, 1
jmp 0x18002a398
xor dil, dil
test bl, 0x10
je 0x18002a3a7
lea rcx, [rsp + 0x40]
call fcn.18000fc20
test dil, dil
je 0x18002a481
call fcn.1800785c0
call fcn.18007b5f0
call fcn.18007c610
call fcn.18000e190
call fcn.18008b370
call fcn.180087560
movzx eax, byte [0x1800b7a2f]
test al, al
je 0x18002a405
cmp qword [0x1800b7c50], 0
je 0x18002a401
cmp byte [0x1800b7c2c], 0
jne 0x18002a401
mov dl, 1
call fcn.18007deb0
mov byte [0x1800b7c2c], 1
movzx eax, byte [0x1800b7a2f]
test al, al
jne 0x18002a41c
cmp byte [0x1800b7c2c], 0
je 0x18002a41c
xor edx, edx
call fcn.18007deb0
mov byte [0x1800b7c2c], 0
movzx eax, byte [0x1800b7c2e]
test al, al
je 0x18002a457
cmp byte [0x1800b7c2d], 0
jne 0x18002a453
lea rcx, [0x1800b8688]
cmp qword [0x1800b86a0], 0xf
cmova rcx, qword [0x1800b8688]
call fcn.180081d90
movzx eax, byte [0x1800b7c2e]
test al, al
jne 0x18002a47c
cmp byte [0x1800b7c2d], 0
je 0x18002a47c
lea rcx, [0x1800b8668]
cmp qword [0x1800b8680], 0xf
cmova rcx, qword [0x1800b8668]
call fcn.180081d90
call fcn.180086350
mov qword [rbp - 0x20], r12
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov qword [rbp - 0x18], rax
xor eax, eax
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x28], r15
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, dword [0x1800b6238]
call fcn.18008dee0
test al, 1
je 0x18002a4c9
cmp byte [0x1800b60e8], 0
sete byte [0x1800b60e8]
mov qword [rbp - 0x20], r12
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov qword [rbp - 0x18], rax
xor eax, eax
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x28], r15
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x12
call fcn.18008dee0
test ax, ax
jns 0x18002a54a
mov qword [rbp - 0x20], r12
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov qword [rbp - 0x18], rax
xor eax, eax
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x28], r15
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x77
call fcn.18008dee0
test al, 1
je 0x18002a54a
cmp byte [0x1800b60e8], 0
sete byte [0x1800b60e8]
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.18008f450
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret