Function at 0x18000aaf0
Capabilities:
Check for peb ntglobalflag flag
Contain obfuscated stackstrings
Get number of processors
Get process heap flags
Get process heap force flags
Parse pe header

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x6d8
mov dword [rsp + 0x428], 0x1c5529fb
mov byte [rsp + 0x191], 0xd1
movabs rax, 0x62cdd118365e32d
mov qword [rsp + 0x4d0], rax
cmp dword [rsp + 0x6e8], 1
je 0x18000104e
mov eax, 1
jmp 0x180002bbd
movabs rax, 0x15244efccce91f8a
mov qword [rsp + 0x6b8], rax
movabs rax, 0x18631f5b1c98d4e9
mov qword [rsp + 0x488], rax
mov byte [rsp + 0x19e], VarDecRound
mov qword [rsp + 0x2f0], 0
add byte [rax], al
add byte [rax], al
add byte [rax], al
mov dword [rsp + 0x42c], 0xdff39792
mov byte [rsp + 0x150], 0x34
mov byte [rsp + 0x151], 0xa9
mov dword [rsp + 0x430], 0xec05fda4
mov rax, qword gs:[0x30]
mov qword [rsp + 0x2f0], rax
mov byte [rsp + 0x152], 0x59
mov byte [rsp + 0x153], 0xa5
mov dword [rsp + 0x434], 0xcc0e4490
mov dword [rsp + 0x438], 0x1e3f8393
mov byte [rsp + 0x154], 0x1e
mov dword [rsp + 0x480], 0x6cbc5132
mov byte [rsp + 0x155], SetErrorInfo
movabs rax, 0xdb977677827894e
mov qword [rdi], r12
js 0x18000116c
ja 0x1800010c0
or eax, 0x24848948
nop
add al, 0
add byte [rax - 0x48], cl
adc ebp, dword [rax - 0x40a0537b]
invalid
cmp al, 0x48
mov dword [rsp + 0x498], eax
mov byte [rsp + 0x156], 0xb6
mov dword [rsp + 0x484], 0x48d8ef04
mov rax, qword [rsp + 0x2f0]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x440], rax
movabs rax, 0x3eb7b76bac2d3177
mov qword [rsp + 0x4a0], rax
mov dword [rsp + 0x2f8], 0x78caa4b2
mov dword [rsp + 0x2fc], 0x4b0b2f76
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x440]
mov rax, qword [rcx + rax + 8]
mov qword [rsp + 0x1a0], rax
mov byte [rsp + 0x157], 0xd3
movabs rax, 0x99499398d95b3039
mov qword [rsp + 0x4a8], rax
movabs rax, 0x3d67e2db42ec0830
mov qword [rsp + 0x4b0], rax
movabs rax, 0x4e3ed197d0f720f4
mov qword [rsp + 0x4b8], rax
mov dword [rsp + 0x300], 0xb7b4af8d
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x1e0], 0x4b
mov dword [rsp + 0x304], 0x1e9150fc
mov dword [rsp + 0x308], 0x73632ff4
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x1e0], 0x45
mov byte [rsp + 0x158], 0x97
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x1e0], 0x52
mov dword [rsp + 0x30c], 0xb5cb0da3
mov dword [rsp + 0x310], 0x8a98689a
mov dword [rsp + 0x314], 0xb574fc4a
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x1e0], 0x4e
mov byte [rsp + 0x159], 0x54
mov dword [rsp + 0x318], 0x16e6e25c
mov dword [rsp + 0x31c], 0xc82bd0af
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x1e0], 0x45
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x1e0], 0x4c
mov byte [rsp + 0x15a], 0xb1
add byte [rax], al
mov cl, 0xb8
add dword [rax], eax
add byte [rax], al
imul rax, rax, 6
mov byte [rsp + rax + 0x1e0], 0x33
mov dword [rsp + 0x320], 0xe47f4088
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x1e0], 0x32
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x1e0], 0x2e
movabs rax, 0x798028d4f5c6638f
mov qword [rsp + 0x4c0], rax
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x1e0], 0x44
movabs rax, 0x1b618d65b73a576c
mov qword [rsp + 0x4c8], rax
mov dword [rsp + 0x324], 0x74fbd286
mov dword [rsp + 0x328], 0xebff92e9
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x1e0], 0x4c
mov byte [rsp + 0x15b], 0x9c
mov byte [rsp + 0x15c], 0x2f
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x1e0], 0x4c
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x1e0], 0
lea rcx, [rsp + 0x1e0]
mov rax, qword [rsp + 0x1a0]
call qword [rax + 0x4496d0]
mov qword [rsp + 0x1b0], rax
mov dword [rsp + 0x32c], 0xaba7dab6
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x1e0], 0x43
mov dword [rsp + 0x330], 0x7c5aa331
xor dword [rbx + 0x1b87c5a], esp
add byte [rax], al
add byte [rax + 0x6b], cl
rol byte [rcx], 0xc6
test byte [rax + riz*8], al
add dword [rax], eax
add byte [rax + rcx*2 - 0x48], ch
mov bl, 0x1e
enter 0x7e19, 0x78
xchg esp, eax
out dx, al
mov qword [rsp + 0x5c8], rax
movabs rax, 0x17555f059428410c
mov qword [rsp + 0x4d8], rax
movabs rax, 0xdb3d41aa3ce26428
mov qword [rsp + 0x4e0], rax
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x1e0], 0x6f
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x1e0], 0x73
mov byte [rsp + 0x15d], 0xd7
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x1e0], 0x65
mov byte [rsp + 0x15e], 0xbb
mov byte [rsp + 0x15f], 0xc0
movabs rax, 0xaa0494be99b03bd4
mov qword [rsp + 0x4e8], rax
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x1e0], 0x48
mov dword [rsp + 0x334], 0xdb6b4816
mov byte [rsp + 0x160], 0x31
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x1e0], 0x61
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x1e0], 0x6e
mov byte [rsp + 0x161], 0x76
movabs rax, 0x7c74ab64f4a3db86
mov qword [rsp + 0x4f0], rax
movabs rax, 0x8f78dc813b44cb6d
mov qword [rsp + 0x4f8], rax
mov byte [rsp + 0x162], 0x4e
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x1e0], 0x64
mov dword [rsp + 0x338], 0x3bc4bea9
mov byte [rsp + 0x163], 0x67
mov byte [rsp + 0x164], 0x5e
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x1e0], 0x6c
mov byte [rsp + 0x165], 0x89
mov byte [rsp + 0x166], 0xb0
mov dword [rsp + 0x33c], 0x5aa50c5f
movabs rax, 0x5930044b126c2d90
mov qword [rsp + 0x500], rax
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x1e0], 0x65
mov eax, 1
add byte [rax], al
imul rax, rax, 0xb
mov byte [rsp + rax + 0x1e0], 0
mov byte [rsp + 0x167], 0x39
movabs rax, 0x449fb8de1ddd733f
mov qword [rsp + 0x508], rax
lea rdx, [rsp + 0x1e0]
mov rcx, qword [rsp + 0x1b0]
mov rax, qword [rsp + 0x1a0]
call qword [rax + 0x4494d0]
mov qword [rsp + 0x470], rax
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x1e0], 0x43
mov byte [rsp + 0x168], 0x42
mov dword [rsp + 0x340], 0x6b7c348b
movabs rax, 0x3779ac3cd2a7654b
mov qword [rsp + 0x510], rax
mov byte [rsp + 0x169], 0xd
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x1e0], 0x72
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x1e0], 0x65
movabs rax, 0xec2d426f3c0a97a1
mov qword [rsp + 0x518], rax
movabs rax, 0xa409087f020f68a4
mov qword [rsp + 0x520], rax
movabs rax, 0xa1a0978ceedb4c32
mov qword [rsp + 0x528], rax
mov dword [rsp + 0x344], 0x360b8165
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x1e0], 0x61
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x1e0], 0x74
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x1e0], 0x65
mov byte [rsp + 0x16a], 0xab
mov dword [rsp + 0x348], 0x3d39c44e
mov dword [rsp + 0x34c], 0xc33ec090
mov dword [rsp + 0x350], 0xef2d712c
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x1e0], 0x46
mov byte [rsp + 0x16b], 0x59
mov dword [rsp + 0x354], 0x9b730ab2
mov dword [rsp + 0x358], 0xaf6ac8d0
test byte [rax + rbx*2], ah
add eax, dword [rax]
add al, dl
enter 0xffffffffffffaf6a, 0xffffffffffffffc7
test byte [rsp + rbx*2], ah
add eax, dword [rax]
add ch, bl
xchg edi, eax
xchg ebp, eax
invalid
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x1e0], 0x69
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x1e0], 0x6c
mov dword [rsp + 0x360], 0xdd0ef861
invalid
ffree st(6)
test byte [rsp + rbp*2], ah
add dword [rax], eax
add bl, cl
movabs rax, 0x204e1c53f44567dd
mov qword [rsp + 0x530], rax
movabs rax, 0x7569f5b37ca03e4b
mov qword [rsp + 0x538], rax
mov eax, 1
add byte [rax], al
add byte [rax + 0x6b], cl
ror byte [rcx], 0xc6
test byte [rax + riz*8], al
add dword [rax], eax
add byte [rbp - 0x3a], ah
test byte [rbp*2 + 0x52000001], ah
movabs rax, 0x71869914149da32b
mov qword [rsp + 0x540], rax
mov byte [rsp + 0x16e], 0x43
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x1e0], 0x41
mov byte [rsp + 0x16f], 0x1a
mov byte [rsp + 0x170], 0x66
mov dword [rsp + 0x364], 0x209317d4
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x1e0], 0
mov dword [rsp + 0x368], 0x9dbc504a
movabs rax, 0xc4b2f7797c4b998f
mov qword [rsp + 0x548], rax
movabs rax, 0xe907d4afc8823fe0
mov qword [rsp + 0x550], rax
lea rdx, [rsp + 0x1e0]
mov rcx, qword [rsp + 0x1b0]
mov rax, qword [rsp + 0x1a0]
call qword [rax + 0x4494d0]
mov qword [rsp + 0x450], rax
mov byte [rsp + 0x171], 0xf5
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x1e0], 0x47
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x1e0], 0x65
mov dword [rsp + 0x36c], 0xa5324e7b
movabs rax, 0xb0e11af776574d59
mov qword [rsp + 0x558], rax
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x1e0], 0x74
movabs rax, 0x10d7f3e3a20b23c5
mov qword [rsp + 0x560], rax
movabs rax, 0xdcad3b5b6642a30d
mov qword [rsp + 0x568], rax
mov eax, 1
add dword [rax], eax
add byte [rax], al
imul rax, rax, 3
mov byte [rsp + rax + 0x1e0], 0x4d
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x1e0], 0x6f
mov dword [rsp + 0x370], 0xff51472e
movabs rax, 0xf23cdad8ac9885a
mov qword [rsp + 0x570], rax
movabs rax, 0x3da4adf9ece93f9b
mov qword [rsp + 0x578], rax
mov byte [rsp + 0x172], 0x98
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x1e0], 0x64
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x1e0], 0x75
movabs rax, 0xa928b92f3e4a3bfb
mov qword [rsp + 0x580], rax
mov byte [rsp + 0x173], 0xd1
mov dword [rsp + 0x374], 0xe6a8937
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x1e0], 0x6c
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x1e0], 0x65
mov dword [rsp + 0x378], 0xbf543380
movabs rax, 0xb96df12b4ab8efc3
mov qword [rsp + 0x588], rax
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x1e0], 0x46
mov byte [rsp + 0x174], 0x73
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x1e0], 0x69
mov dword [rsp + 0x37c], 0x6a9d6f40
outsd dx, dword [rsi]
popfq
push 0xffffffffffffffc6
test byte [rsi*2 + 0x68000001], ah
mov dword [rsp + 0x380], 0x70b4dc6d
movabs rax, 0x3c92e38f582fb795
mov qword [rsp + 0x590], rax
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x1e0], 0x6c
mov byte [rsp + 0x176], 0x4e
mov dword [rsp + 0x384], 0x10b8fd6e
mov dword [rsp + 0x388], 0xde15e31c
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x1e0], 0x65
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x1e0], 0x4e
mov byte [rsp + 0x177], 0xa1
mov byte [rsp + 0x178], 0x4d
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x1e0], 0x61
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x1e0], 0x6d
mov dword [rsp + 0x38c], 0x7483be7
mov dword [rsp + 0x390], 0x61603d39
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x1e0], 0x65
mov eax, 1
imul rax, rax, 0x11
mov byte [rsp + rax + 0x1e0], 0x41
movabs rax, 0xcb0e8fb2621ba4d
mov qword [rsp + 0x598], rax
mov byte [rsp + 0x179], 0xc0
movabs rax, 0x9579b6f47114645a
adc al, 0x71
hlt
mov dh, 0x79
xchg ebp, eax
mov qword [rsp + 0x5a0], rax
mov eax, 1
imul rax, rax, 0x12
mov byte [rsp + rax + 0x1e0], 0
movabs rax, 0xd37e68672f129fb1
mov qword [rsp + 0x5a8], rax
movabs rax, 0x7b1a8b338d3472bb
mov qword [rsp + 0x5b0], rax
mov dword [rsp + 0x394], 0x39953c64
mov dword [rsp + 0x398], 0x80a2ed6a
mov dword [rsp + 0x39c], 0x3bdbe7a9
mov byte [rsp + 0x17a], 0x9c
mov byte [rsp + 0x17b], 0xe
mov byte [rsp + 0x17c], SysAllocStringByteLen
lea rdx, [rsp + 0x1e0]
mov rcx, qword [rsp + 0x1b0]
mov rax, qword [rsp + 0x1a0]
call qword [rax + 0x4494d0]
mov qword [rsp + 0x448], rax
mov dword [rsp + 0x3a0], 0x5e059d38
mov dword [rsp + 0x3a4], 0xdae6e1d7
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x1e0], 0x52
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x1e0], 0x65
mov byte [rsp + 0x17d], 0x69
movabs rax, 0x8bb6e7c441a87877
mov qword [rsp + 0x5b8], rax
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x1e0], 0x61
movabs rax, 0x84840b6f97d6f897
add rsp, 0x6d8
ret
jmp 0x180001005