Function at 0x180095dc9
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
test rcx, rcx
je 0x18009649a
mov r11, rsp
push rbx
push rbp
sub rsp, 0xf8
mov rax, qword [0x18013e1e0]
xor rax, rsp
mov qword [rsp + 0xc8], rax
mov rbp, rdx
mov rbx, rcx
test rdx, rdx
je 0x180096481
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r13
mov qword [r11 - 0x30], r14
mov qword [r11 - 0x38], r15
call fcn.180099130
mov byte [rsp + 0x28], 0x49
mov byte [rsp + 0x29], 0x48
mov byte [rsp + 0x2a], 0x44
mov byte [rsp + 0x2b], 0x52
mov byte [rsp + 0x2c], 0
mov byte [rsp + 0x78], 0x49
mov byte [rsp + 0x79], 0x44
mov byte [rsp + 0x7a], 0x41
mov byte [rsp + 0x7b], 0x54
mov byte [rsp + 0x7c], 0
mov byte [rsp + 0x38], 0x49
mov byte [rsp + 0x39], 0x45
mov byte [rsp + 0x3a], 0x4e
mov byte [rsp + 0x3b], 0x44
mov byte [rsp + 0x3c], 0
mov byte [rsp + 0xb8], 0x50
mov byte [rsp + 0xb9], 0x4c
mov byte [rsp + 0xba], 0x54
mov byte [rsp + 0xbb], 0x45
mov byte [rsp + 0xbc], 0
mov byte [rsp + 0x48], 0x62
mov byte [rsp + 0x49], 0x4b
mov byte [rsp + 0x4a], 0x47
mov byte [rsp + 0x4b], 0x44
mov byte [rsp + 0x4c], 0
mov byte [rsp + 0x88], 0x63
mov byte [rsp + 0x89], 0x48
mov byte [rsp + 0x8a], 0x52
mov byte [rsp + 0x8b], 0x4d
mov byte [rsp + 0x8c], 0
mov byte [rsp + 0x58], 0x67
mov byte [rsp + 0x59], 0x41
mov byte [rsp + 0x5a], 0x4d
mov byte [rsp + 0x5b], 0x41
mov byte [rsp + 0x5c], 0
mov byte [rsp + 0xa8], 0x68
mov byte [rsp + 0xa9], 0x49
mov byte [rsp + 0xaa], 0x53
mov byte [rsp + 0xab], 0x54
mov byte [rsp + 0xac], 0
mov byte [rsp + 0x60], 0x69
mov byte [rsp + 0x61], 0x43
mov byte [rsp + 0x62], 0x43
mov byte [rsp + 0x63], 0x50
mov byte [rsp + 0x64], 0
mov byte [rsp + 0xc0], 0x69
mov byte [rsp + 0xc1], 0x54
mov byte [rsp + 0xc2], 0x58
mov byte [rsp + 0xc3], 0x74
mov byte [rsp + 0xc4], 0
mov byte [rsp + 0x68], 0x6f
mov byte [rsp + 0x69], 0x46
mov byte [rsp + 0x6a], 0x46
mov byte [rsp + 0x6b], 0x73
mov byte [rsp + 0x6c], 0
mov byte [rsp + 0x98], 0x70
mov byte [rsp + 0x99], 0x43
mov byte [rsp + 0x9a], 0x41
mov byte [rsp + 0x9b], 0x4c
mov byte [rsp + 0x9c], 0
mov byte [rsp + 0x30], 0x70
mov byte [rsp + 0x31], 0x48
mov byte [rsp + 0x32], 0x59
mov byte [rsp + 0x33], 0x73
mov byte [rsp + 0x34], 0
mov byte [rsp + 0x40], 0x73
mov byte [rsp + 0x41], 0x42
mov byte [rsp + 0x42], 0x49
mov byte [rsp + 0x43], 0x54
mov byte [rsp + 0x44], 0
mov byte [rsp + 0x20], 0x73
mov byte [rsp + 0x21], 0x43
mov byte [rsp + 0x22], 0x41
mov byte [rsp + 0x23], 0x4c
mov r14d, dword [rsp + 0x28]
mov r12d, dword [rsp + 0x78]
mov r15d, dword [rsp + 0x38]
mov r13d, dword [rsp + 0xb8]
mov byte [rsp + 0x24], 0
mov byte [rsp + 0x70], 0x73
mov byte [rsp + 0x71], 0x50
mov byte [rsp + 0x72], 0x4c
mov byte [rsp + 0x73], 0x54
mov byte [rsp + 0x74], 0
mov byte [rsp + 0x50], 0x73
mov byte [rsp + 0x51], 0x52
mov byte [rsp + 0x52], 0x47
mov byte [rsp + 0x53], 0x42
mov byte [rsp + 0x54], 0
mov byte [rsp + 0x80], 0x74
mov byte [rsp + 0x81], 0x45
mov byte [rsp + 0x82], 0x58
mov byte [rsp + 0x83], 0x74
mov byte [rsp + 0x84], 0
mov byte [rsp + 0x90], 0x74
mov byte [rsp + 0x91], 0x49
mov byte [rsp + 0x92], 0x4d
mov byte [rsp + 0x93], 0x45
mov byte [rsp + 0x94], 0
mov byte [rsp + 0xa0], 0x74
mov byte [rsp + 0xa1], 0x52
mov byte [rsp + 0xa2], 0x4e
mov byte [rsp + 0xa3], 0x53
mov byte [rsp + 0xa4], 0
mov byte [rsp + 0xb0], 0x7a
mov byte [rsp + 0xb1], 0x54
mov byte [rsp + 0xb2], 0x58
mov byte [rsp + 0xb3], 0x74
mov byte [rsp + 0xb4], 0
nop
mov rcx, rbx
call fcn.18009a3d0
mov esi, eax
cmp dword [rbx + 0x246], r12d
jne 0x1800960e8
mov ecx, dword [rbx + 0x152]
test cl, 8
je 0x1800960e8
bts ecx, 0xd
mov dword [rbx + 0x152], ecx
cmp dword [rbx + 0x246], r14d
jne 0x180096101
mov r8d, eax
mov rdx, rbp
mov rcx, rbx
call fcn.18009a550
jmp 0x1800960c0
cmp dword [rbx + 0x246], r15d
jne 0x18009611a
mov r8d, eax
mov rdx, rbp
mov rcx, rbx
call fcn.18009a8f0
jmp 0x1800960c0
lea rdx, [rbx + 0x246]
mov rcx, rbx
call fcn.180094a30
test eax, eax
je 0x18009618b
cmp dword [rbx + 0x246], r12d
jne 0x18009613d
or dword [rbx + 0x152], 4
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.18009cea0
cmp dword [rbx + 0x246], r13d
jne 0x180096160
or dword [rbx + 0x152], 2
jmp 0x1800960c0
cmp dword [rbx + 0x246], r12d
jne 0x1800960c0
mov eax, dword [rbx + 0x152]
test al, 1
jne 0x1800963ee
lea rdx, str.Missing_IHDR_before_IDAT
mov rcx, rbx
call fcn.1800942c0
int3
cmp dword [rbx + 0x246], r13d
jne 0x1800961a7
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.18009a6e0
jmp 0x1800960c0
cmp dword [rbx + 0x246], r12d
je 0x18009640b
mov eax, dword [rsp + 0x48]
cmp dword [rbx + 0x246], eax
jne 0x1800961d3
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.18009ba00
jmp 0x1800960c0
mov eax, dword [rsp + 0x88]
cmp dword [rbx + 0x246], eax
jne 0x1800961f5
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.18009ac50
jmp 0x1800960c0
mov eax, dword [rsp + 0x58]
cmp dword [rbx + 0x246], eax
jne 0x180096214
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.18009a950
jmp 0x1800960c0
mov eax, dword [rsp + 0xa8]
cmp dword [rbx + 0x246], eax
jne 0x180096236
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.18009bc00
jmp 0x1800960c0
mov eax, dword [rsp + 0x68]
cmp dword [rbx + 0x246], eax
jne 0x180096255
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.18009bec0
jmp 0x1800960c0
mov eax, dword [rsp + 0x98]
cmp dword [rbx + 0x246], eax
jne 0x180096277
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.18009c000
jmp 0x1800960c0
mov eax, dword [rsp + 0x20]
cmp dword [rbx + 0x246], eax
jne 0x180096296
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.18009c3d0
jmp 0x1800960c0
mov eax, dword [rsp + 0x30]
cmp dword [rbx + 0x246], eax
jne 0x1800962b5
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.18009bd80
jmp 0x1800960c0
mov eax, dword [rsp + 0x40]
cmp dword [rbx + 0x246], eax
jne 0x1800962d4
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.18009aaf0
jmp 0x1800960c0
mov eax, dword [rsp + 0x50]
cmp dword [rbx + 0x246], eax
jne 0x1800962f3
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.18009af80
jmp 0x1800960c0
mov eax, dword [rsp + 0x60]
cmp dword [rbx + 0x246], eax
jne 0x180096312
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.18009b1c0
jmp 0x1800960c0
mov eax, dword [rsp + 0x70]
cmp dword [rbx + 0x246], eax
jne 0x180096331
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.18009b480
jmp 0x1800960c0
mov eax, dword [rsp + 0x80]
cmp dword [rbx + 0x246], eax
jne 0x180096353
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.18009c6e0
jmp 0x1800960c0
mov eax, dword [rsp + 0x90]
cmp dword [rbx + 0x246], eax
jne 0x180096375
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.18009c5c0
jmp 0x1800960c0
mov eax, dword [rsp + 0xa0]
cmp dword [rbx + 0x246], eax
jne 0x180096397
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.18009b7e0
jmp 0x1800960c0
mov eax, dword [rsp + 0xb0]
cmp dword [rbx + 0x246], eax
jne 0x1800963b9
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.18009c8f0
jmp 0x1800960c0
mov eax, dword [rsp + 0xc0]
cmp dword [rbx + 0x246], eax
jne 0x1800963db
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.18009cb50
jmp 0x1800960c0
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.18009cea0
jmp 0x1800960c0
cmp byte [rbx + 0x250], 3
jne 0x180096451
test al, 2
jne 0x180096451
lea rdx, str.Missing_PLTE_before_IDAT
mov rcx, rbx
call fcn.1800942c0
int3
mov eax, dword [rbx + 0x152]
test al, 1
jne 0x180096425
lea rdx, str.Missing_IHDR_before_IDAT
mov rcx, rbx
call fcn.1800942c0
int3
cmp byte [rbx + 0x250], 3
jne 0x180096442
test al, 2
jne 0x180096442
lea rdx, str.Missing_PLTE_before_IDAT
mov rcx, rbx
call fcn.1800942c0
int3
or eax, 4
mov dword [rbx + 0x232], esi
mov dword [rbx + 0x152], eax
mov r14, qword [rsp + 0xd8]
mov r13, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xf0]
mov rsi, qword [rsp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal]
mov r15, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.1800bf8d0
add rsp, 0xf8
pop rbp
pop rbx
repz ret