Function at 0x180001310
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x180052010]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor ebx, ebx
mov rax, qword [0x180052f40]
or dword [rax + 0x1ab8], 2
mov dword [rax + 0x1ad8], 0x44034000
mov dword [rax + 0x1adc], 0x43af0000
mov edi, 1
mov dword [rax + 0x1ac0], edi
movdqa xmm0, xmmword [0x18004aea0]
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp - 0x29], 0x616c5065
mov word [rbp - 0x25], 0x7379
mov byte [rbp - 0x23], bl
xor edx, edx
lea r8d, [rbx + 0x22]
lea rcx, [rbp - 0x38]
call fcn.18000c260
mov dword [rbp - 0x39], 0x43160000
mov dword [rbp - 0x35], 0x41c80000
mov dword [rbp + 0x37], 0x73695637
mov dword [rbp + 0x3b], 0x736c6175
mov byte [rbp + 0x3f], bl
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 0x38]
call fcn.180029690
movzx ecx, byte [0x180052258]
test al, al
cmovne ecx, edi
mov byte [0x180052258], cl
movss xmm1, dword [0x18004a9e0]
xorps xmm0, xmm0
call fcn.18000fa50
mov dword [rbp - 0x39], 0x43160000
mov dword [rbp - 0x35], 0x41c80000
mov dword [rbp + 0x37], 0x6d694117
mov byte [rbp + 0x3b], bl
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 0x38]
call fcn.180029690
movzx ecx, byte [0x180052258]
mov edx, 2
test al, al
cmovne ecx, edx
mov byte [0x180052258], cl
movss xmm1, dword [0x18004a9e0]
xorps xmm0, xmm0
call fcn.18000fa50
mov dword [rbp + 0x37], 0x43160000
mov dword [rbp + 0x3b], 0x41c80000
mov dword [rbp - 0x39], 0x73694d4b
mov word [rbp - 0x35], 0x63
lea rdx, [rbp + 0x37]
lea rcx, [rbp - 0x38]
call fcn.180029690
test al, al
je 0x180001462
mov byte [0x180052258], 4
jmp 0x180001ade
movzx eax, byte [0x180052258]
test al, al
jne 0x1800015ac
movdqa xmm0, xmmword [str.yiz_nyf_ngOD__nhS_n]
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmm1, xmmword [0x18004ae50]
movdqa xmmword [rbp - 9], xmm1
movdqa xmm0, xmmword [0x18004ae20]
movdqa xmmword [rbp + 7], xmm0
movdqa xmm1, xmmword [0x18004ae40]
movdqa xmmword [rbp + 0x17], xmm1
mov dword [rbp + 0x27], 0x4f470459
mov byte [rbp + 0x2b], bl
nop
movzx eax, byte [rbp - 0x19]
xor byte [rbp + rbx - 0x18], al
inc rbx
cmp rbx, 0x43
jb 0x1800014b0
mov byte [rbp + 0x2b], 0
lea rcx, [rbp - 0x18]
call fcn.180028e50
call fcn.18002ac20
movdqa xmm0, xmmword [0x18004ae70]
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp - 0x29], 0x74726573
mov byte [rbp - 0x25], 0
lea rcx, [rbp - 0x38]
call fcn.180028e50
movdqa xmm0, xmmword [0x18004ae60]
movdqu xmmword [rbp - 0x39], xmm0
mov byte [rbp - 0x29], 0
lea rcx, [rbp - 0x38]
call fcn.180028e50
movdqa xmm0, xmmword [0x18004ae90]
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp - 0x29], 0x74616c75
mov dword [rbp - 0x25], 0x6e6f69
lea rcx, [rbp - 0x38]
call fcn.180028e50
movdqa xmm0, xmmword [0x18004aeb0]
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp - 0x29], 0x20656220
mov dword [rbp - 0x25], 0x62616e65
mov dword [rbp - 0x21], 0x2964656c
mov byte [rbp - 0x1d], 0
lea rcx, [rbp - 0x38]
call fcn.180028e50
call fcn.18002ac20
movdqa xmm0, xmmword [0x18004ae30]
movdqu xmmword [rbp - 0x19], xmm0
movdqa xmm1, xmmword [0x18004ae00]
movdqu xmmword [rbp - 9], xmm1
mov dword [rbp + 7], 0x44454d4d
mov word [rbp + 0xb], 0x21
movaps xmm0, xmmword [0x18004ac50]
movups xmmword [rbp - 0x39], xmm0
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x39]
call fcn.180028f50
movzx eax, byte [0x180052258]
cmp al, dil
jne 0x1800018ea
mov dword [rbp + 0x37], 0x50534563
mov byte [rbp + 0x3b], 0
lea rdx, [0x180052259]
lea rcx, [rbp + 0x38]
call fcn.18002a580
mov dword [rbp - 0x39], 0x636f4c24
mov dword [rbp - 0x35], 0x6f697461
mov word [rbp - 0x31], 0x736e
mov byte [rbp - 0x2f], 0
lea rdx, [0x18005225d]
lea rcx, [rbp - 0x38]
call fcn.18002a580
mov dword [rbp - 0x39], 0x6574494d
mov word [rbp - 0x35], 0x736d
mov byte [rbp - 0x33], 0
lea rdx, [0x180052267]
lea rcx, [rbp - 0x38]
call fcn.18002a580
test al, al
je 0x1800017ac
mov rax, qword [0x180053580]
cmp qword [0x180053578], rax
cmovne rax, qword [0x180053578]
mov qword [0x180053580], rax
mov rax, qword [0x180052580]
mov rbx, qword [0x180053668]
mov rcx, qword [0x180053670]
cmp rbx, rcx
je 0x18000166d
cmp qword [rbx + 0x28], rax
je 0x180001682
cmp qword [rbx + 0x20], rax
je 0x180001682
add rbx, 0x38
cmp rbx, rcx
jne 0x180001658
mov rax, qword [rbp - 0x39]
mov rcx, qword [rax + 0x20]
cmp byte [0x180052267], 0
je 0x1800016b1
mov edx, edi
jmp 0x1800016b3
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.1800361f0
mov rax, qword [rbx + 0x20]
mov qword [rbp + 7], rax
mov rax, qword [rbx + 0x28]
mov qword [rbp + 0xf], rax
mov eax, dword [rbx + 0x30]
mov dword [rbp + 0x17], eax
movzx eax, byte [rbx + 0x34]
mov byte [rbp + 0x1b], al
lea rax, [rbp - 0x19]
jmp 0x180001671
xor edx, edx
call fcn.180033c00
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x1800016f4
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800016ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001e33
call fcn.18003d2a8
mov rax, qword [0x180052588]
mov rbx, qword [0x180053668]
mov rcx, qword [0x180053670]
cmp rbx, rcx
je 0x180001725
nop
cmp qword [rbx + 0x28], rax
je 0x18000173a
cmp qword [rbx + 0x20], rax
je 0x18000173a
add rbx, 0x38
cmp rbx, rcx
jne 0x180001710
mov rax, qword [rbp - 0x39]
mov rcx, qword [rax + 0x20]
cmp byte [0x180052267], 0
je 0x180001769
mov edx, edi
jmp 0x18000176b
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.1800361f0
mov rax, qword [rbx + 0x20]
mov qword [rbp + 7], rax
mov rax, qword [rbx + 0x28]
mov qword [rbp + 0xf], rax
mov eax, dword [rbx + 0x30]
mov dword [rbp + 0x17], eax
movzx eax, byte [rbx + 0x34]
mov byte [rbp + 0x1b], al
lea rax, [rbp - 0x19]
jmp 0x180001729
xor edx, edx
call fcn.180033c00
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x1800017ac
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800017a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001e33
call fcn.18003d2a8
mov dword [rbp - 0x39], 0x61684370
mov word [rbp - 0x35], 0x736d
mov byte [rbp - 0x33], 0
lea rdx, [0x18005225b]
lea rcx, [rbp - 0x38]
call fcn.18002a580
test al, al
je 0x1800017d6
call fcn.180037530
mov dword [rbp - 0x39], 0x6c754670
mov dword [rbp - 0x35], 0x6972626c
mov dword [rbp - 0x31], 0x746867
lea rdx, [0x18005225a]
lea rcx, [rbp - 0x38]
call fcn.18002a580
test al, al
je 0x1800018bc
mov rax, qword [0x180052538]
mov rbx, qword [0x180053668]
mov rcx, qword [0x180053670]
cmp rbx, rcx
je 0x180001835
nop dword [rax]
cmp qword [rbx + 0x28], rax
je 0x18000184a
cmp qword [rbx + 0x20], rax
je 0x18000184a
add rbx, 0x38
cmp rbx, rcx
jne 0x180001820
mov rax, qword [rbp - 0x39]
mov rcx, qword [rax + 0x20]
cmp byte [0x18005225a], 0
je 0x180001879
mov edx, edi
jmp 0x18000187b
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.1800361f0
mov rax, qword [rbx + 0x20]
mov qword [rbp + 7], rax
mov rax, qword [rbx + 0x28]
mov qword [rbp + 0xf], rax
mov eax, dword [rbx + 0x30]
mov dword [rbp + 0x17], eax
movzx eax, byte [rbx + 0x34]
mov byte [rbp + 0x1b], al
lea rax, [rbp - 0x19]
jmp 0x180001839
xor edx, edx
call fcn.180033c00
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x1800018bc
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800018b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001e33
call fcn.18003d2a8
mov dword [rbp - 0x39], 0x616c502f
mov dword [rbp - 0x35], 0x20726579
mov dword [rbp - 0x31], 0x7473694c
mov byte [rbp - 0x2d], 0
lea rdx, [0x18005225c]
lea rcx, [rbp - 0x38]
call fcn.18002a580
jmp 0x180001e8d
cmp al, 2
jne 0x180001ad6
mov dword [rbp - 0x39], 0x6c695366
mov dword [rbp - 0x35], 0x20746e65
mov dword [rbp - 0x31], 0x6d6941
lea rdx, [0x180052263]
lea rcx, [rbp - 0x38]
call fcn.18002a580
cmp byte [0x180052263], 0
je 0x1800019e7
mov dword [rbp - 0x39], 0x73695608
mov dword [rbp - 0x35], 0x656c6269
mov byte [rbp - 0x31], 0
lea rdx, [0x180052262]
lea rcx, [rbp - 0x38]
call fcn.18002a580
mov dword [rbp - 0x39], 0x7261544d
mov dword [rbp - 0x35], 0x20746567
mov dword [rbp - 0x31], 0x6d616554
mov byte [rbp - 0x2d], 0
lea rdx, [0x180052261]
lea rcx, [rbp - 0x38]
call fcn.18002a580
mov dword [rbp - 0x39], 0x766f4646
mov byte [rbp - 0x35], 0
mov dword [rbp + 0x47], 0x44548000
mov dword [rbp + 0x37], 0
movss xmm3, dword [0x18004a914]
movss dword [rsp + 0x30], xmm3
lea rax, [rbp + 0x47]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x37]
lea r8, [0x180052274]
lea rcx, [rbp - 0x38]
call fcn.18002ae00
movss xmm1, dword [0x18004a9e0]
xorps xmm0, xmm0
call fcn.18000fa50
mov dword [rbp - 0x39], 0x6172440b
mov dword [rbp - 0x35], 0x6f462077
mov word [rbp - 0x31], 0x76
lea rdx, [0x180052264]
lea rcx, [rbp - 0x38]
call fcn.18002a580
mov dword [rbp - 0x39], 0x206f4e3c
mov dword [rbp - 0x35], 0x6f636552
mov word [rbp - 0x31], 0x6c69
mov byte [rbp - 0x2f], 0
lea rdx, [0x18005225f]
lea rcx, [rbp - 0x38]
call fcn.18002a580
test al, al
je 0x180001e8d
mov rax, qword [0x180052578]
mov rbx, qword [0x180053668]
mov rcx, qword [0x180053670]
cmp rbx, rcx
je 0x180001a46
cmp qword [rbx + 0x28], rax
je 0x180001a5b
cmp qword [rbx + 0x20], rax
je 0x180001a5b
add rbx, 0x38
cmp rbx, rcx
jne 0x180001a31
mov rax, qword [rbp - 0x39]
mov rcx, qword [rax + 0x20]
cmp byte [0x18005225f], 0
je 0x180001a8a
mov edx, edi
jmp 0x180001a8c
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.1800361f0
mov rax, qword [rbx + 0x20]
mov qword [rbp + 7], rax
mov rax, qword [rbx + 0x28]
mov qword [rbp + 0xf], rax
mov eax, dword [rbx + 0x30]
mov dword [rbp + 0x17], eax
movzx eax, byte [rbx + 0x34]
mov byte [rbp + 0x1b], al
lea rax, [rbp - 0x19]
jmp 0x180001a4a
xor edx, edx
call fcn.180033c00
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x180001e8d
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001acc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001e33
call fcn.18003d2a8
jmp 0x180001e8d
cmp al, 4
jne 0x180001e8d
movdqa xmm0, xmmword [0x18004ae80]
movdqu xmmword [rbp - 0x39], xmm0
mov word [rbp - 0x29], 0x72
lea rdx, [0x18005226d]
lea rcx, [rbp - 0x38]
call fcn.18002a580
test al, al
je 0x180001d32
mov rax, qword [0x180052620]
mov rbx, qword [0x180053668]
mov rcx, qword [0x180053670]
cmp rbx, rcx
je 0x180001b38
cmp qword [rbx + 0x28], rax
je 0x180001b4d
cmp qword [rbx + 0x20], rax
je 0x180001b4d
add rbx, 0x38
cmp rbx, rcx
jne 0x180001b23
mov rax, qword [rbp - 0x39]
mov rcx, qword [rax + 0x20]
cmp byte [0x18005226d], 0
je 0x180001b7c
mov edx, edi
jmp 0x180001b7e
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.1800361f0
mov rax, qword [rbx + 0x20]
mov qword [rbp + 7], rax
mov rax, qword [rbx + 0x28]
mov qword [rbp + 0xf], rax
mov eax, dword [rbx + 0x30]
mov dword [rbp + 0x17], eax
movzx eax, byte [rbx + 0x34]
mov byte [rbp + 0x1b], al
lea rax, [rbp - 0x19]
jmp 0x180001b3c
xor edx, edx
call fcn.180033c00
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x180001bbf
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001bba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001e33
call fcn.18003d2a8
mov rax, qword [0x180052630]
mov rbx, qword [0x180053668]
mov rcx, qword [0x180053670]
cmp rbx, rcx
je 0x180001bf5
nop dword [rax]
cmp qword [rbx + 0x28], rax
je 0x180001c0a
cmp qword [rbx + 0x20], rax
je 0x180001c0a
add rbx, 0x38
cmp rbx, rcx
jne 0x180001be0
mov rax, qword [rbp - 0x39]
mov rcx, qword [rax + 0x20]
cmp byte [0x18005226d], 0
je 0x180001c39
mov edx, edi
jmp 0x180001c3b
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.1800361f0
mov rax, qword [rbx + 0x20]
mov qword [rbp + 7], rax
mov rax, qword [rbx + 0x28]
mov qword [rbp + 0xf], rax
mov eax, dword [rbx + 0x30]
mov dword [rbp + 0x17], eax
movzx eax, byte [rbx + 0x34]
mov byte [rbp + 0x1b], al
lea rax, [rbp - 0x19]
jmp 0x180001bf9
xor edx, edx
call fcn.180033c00
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x180001c7c
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001c77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001e33
call fcn.18003d2a8
mov rax, qword [0x180052638]
mov rbx, qword [0x180053668]
mov rcx, qword [0x180053670]
cmp rbx, rcx
je 0x180001cab
cmp qword [rbx + 0x28], rax
je 0x180001cc0
cmp qword [rbx + 0x20], rax
je 0x180001cc0
add rbx, 0x38
cmp rbx, rcx
jne 0x180001c96
mov rax, qword [rbp - 0x39]
mov rcx, qword [rax + 0x20]
cmp byte [0x18005226d], 0
je 0x180001cef
mov edx, edi
jmp 0x180001cf1
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.1800361f0
mov rax, qword [rbx + 0x20]
mov qword [rbp + 7], rax
mov rax, qword [rbx + 0x28]
mov qword [rbp + 0xf], rax
mov eax, dword [rbx + 0x30]
mov dword [rbp + 0x17], eax
movzx eax, byte [rbx + 0x34]
mov byte [rbp + 0x1b], al
lea rax, [rbp - 0x19]
jmp 0x180001caf
xor edx, edx
call fcn.180033c00
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x180001d32
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001d2d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001e33
call fcn.18003d2a8
mov dword [rbp - 0x39], 0x206f4e41
mov dword [rbp - 0x35], 0x70696c43
mov byte [rbp - 0x31], 0
lea rdx, [0x180052269]
lea rcx, [rbp - 0x38]
call fcn.18002a580
mov dword [rbp - 0x39], 0x746e416c
mov dword [rbp - 0x35], 0x65542069
mov dword [rbp - 0x31], 0x616c73
lea rdx, [0x18005225e]
lea rcx, [rbp - 0x38]
call fcn.18002a580
test al, al
je 0x180001e3f
mov rax, qword [0x180052570]
mov rbx, qword [0x180053668]
mov rcx, qword [0x180053670]
cmp rbx, rcx
je 0x180001db5
nop dword [rax + rax]
cmp qword [rbx + 0x28], rax
je 0x180001dca
cmp qword [rbx + 0x20], rax
je 0x180001dca
add rbx, 0x38
cmp rbx, rcx
jne 0x180001da0
mov rax, qword [rbp - 0x39]
mov rcx, qword [rax + 0x20]
cmp byte [0x18005225e], 0
je 0x180001df9
mov edx, edi
jmp 0x180001dfb
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.1800361f0
mov rax, qword [rbx + 0x20]
mov qword [rbp + 7], rax
mov rax, qword [rbx + 0x28]
mov qword [rbp + 0xf], rax
mov eax, dword [rbx + 0x30]
mov dword [rbp + 0x17], eax
movzx eax, byte [rbx + 0x34]
mov byte [rbp + 0x1b], al
lea rax, [rbp - 0x19]
jmp 0x180001db9
xor edx, edx
call fcn.180033c00
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x180001e3f
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001e3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180001e3a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d2a8
mov dword [rbp - 0x39], 0x6d614332
mov dword [rbp - 0x35], 0x20617265
mov dword [rbp - 0x31], 0x766f46
mov dword [rbp + 0x37], 0x437a0000
movss xmm1, dword [0x18004a914]
mov dword [rbp + 0x47], 0x3f800000
movss dword [rsp + 0x30], xmm1
lea rax, [rbp + 0x37]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x47]
lea r8, [0x180052278]
lea rcx, [rbp - 0x38]
call fcn.18002ae00
call fcn.18000e5b0
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.18003d280
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret