Function at 0x140018010
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Encode data using xor
Get file attributes
Get process image filename
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x1400b6060]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rbx, rdx
mov r15, rcx
mov qword [rsp + 0x68], rdx
lea rsi, [rcx + 8]
mov rcx, rsi
cmp qword [r15 + 0x20], 0x10
jb 0x14001805e
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea rcx, [0x1400b7840]
cmp eax, 0xffffffff
jne 0x1400180f1
mov edx, 4
call fcn.140016f60
mov r8, rax
movdqa xmm0, xmmword [str._S:22]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400ad550]
movdqu xmmword [rsp + 0x30], xmm1
mov dword [rsp + 0x40], 0x32373f38
mov dword [rsp + 0x44], 0x235e3a3b
mov word [rsp + 0x48], 0x5e
xor edi, edi
mov ecx, edi
nop dword [rax + rax]
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x21], al
inc rcx
cmp rcx, 0x28
jb 0x1400180c0
mov byte [rsp + 0x49], dil
lea rdx, [rsp + 0x21]
mov rcx, r8
call fcn.14000d920
mov rcx, rax
call fcn.14000dbe0
jmp 0x14001865d
mov edx, 6
call fcn.140016f60
mov r8, rax
mov cl, 0x39
mov dword [rsp + 0x20], 0x64126239
mov dword [rsp + 0x24], 0x75757d19
mov dword [rsp + 0x28], 0x4c565f19
mov word [rsp + 0x2c], 0x5d57
mov byte [rsp + 0x2e], 0
xor edi, edi
mov eax, edi
nop dword [rax + rax]
xor byte [rsp + rax + 0x21], cl
inc rax
cmp rax, 0xd
jae 0x140018144
movzx ecx, byte [rsp + 0x20]
jmp 0x140018130
mov byte [rsp + 0x2e], dil
lea rdx, [rsp + 0x21]
mov rcx, r8
call fcn.14000d920
mov rcx, rax
call fcn.14000dbe0
mov rcx, rbx
call fcn.140018c40
mov r14, rax
lea rcx, [0x1400b7840]
test rax, rax
jne 0x1400181dc
lea edx, [rax + 4]
call fcn.140016f60
mov r8, rax
movdqa xmm0, xmmword [0x1400ad4f0]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400ad460]
movdqu xmmword [rsp + 0x30], xmm1
mov dword [rsp + 0x40], 0x651e1049
mov dword [rsp + 0x44], 0x777f781e
mov dword [rsp + 0x48], 0x1e7a7b72
mov word [rsp + 0x4c], 0x63
mov rcx, rdi
nop
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x21], al
inc rcx
cmp rcx, 0x2c
jb 0x1400181c0
mov byte [rsp + 0x4d], dil
jmp 0x1400180d7
mov edx, 6
call fcn.140016f60
mov r8, rax
mov cl, 0x77
mov dword [rsp + 0x20], 0x2183177
mov dword [rsp + 0x24], 0x3571319
mov dword [rsp + 0x28], 0x12100516
mov word [rsp + 0x2c], 0x5903
mov byte [rsp + 0x2e], dil
mov rax, rdi
xor byte [rsp + rax + 0x21], cl
inc rax
cmp rax, 0xd
jae 0x140018226
movzx ecx, byte [rsp + 0x20]
jmp 0x140018212
mov byte [rsp + 0x2e], dil
lea rdx, [rsp + 0x21]
mov rcx, r8
call fcn.14000d920
mov rcx, rax
call fcn.14000dbe0
mov dword [rsp + 0x70], edi
lea rdx, [rsp + 0x70]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r12d, eax
test eax, eax
jne 0x1400182dc
lea edx, [rax + 4]
lea rcx, [0x1400b7840]
call fcn.140016f60
mov r8, rax
movdqa xmm0, xmmword [str.h3E5H_a]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400ad3d0]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmmword [0x1400acf10]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x3348461f
mov dword [rsp + 0x54], 0x21292e48
mov dword [rsp + 0x58], 0x482c2d24
mov word [rsp + 0x5c], 0x35
mov rcx, rdi
nop dword [rax + rax]
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x21], al
inc rcx
cmp rcx, 0x3c
jb 0x1400182c0
mov byte [rsp + 0x5d], dil
jmp 0x1400180d7
mov qword [rsp + 0x60], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
lea r8, [rsp + 0x60]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400185fc
mov edx, 2
call fcn.140018710
mov r8, rax
movdqa xmm0, xmmword [0x1400ad440]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x6a677e73
mov dword [rsp + 0x34], 0x6f6e7f
mov rcx, rdi
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x21], al
inc rcx
cmp rcx, 0x16
jb 0x140018350
mov byte [rsp + 0x37], dil
lea rdx, [rsp + 0x21]
mov rcx, r8
call fcn.140018850
mov rcx, rax
call fcn.1400173d0
cmp qword [r15 + 0x20], 0x10
jb 0x140018386
mov rsi, qword [rsi]
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
jne 0x14001840c
lea edx, [rax + 4]
lea rcx, [0x1400b7840]
call fcn.140016f60
mov r8, rax
movdqa xmm0, xmmword [0x1400ad450]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [str.W_eUTOeYe_TNU_]
movdqu xmmword [rsp + 0x30], xmm1
mov dword [rsp + 0x40], 0x7d1b601b
mov dword [rsp + 0x44], 0x7e77727a
mov dword [rsp + 0x48], 0x661b7f
mov rcx, rdi
nop word [rax + rax]
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x21], al
inc rcx
cmp rcx, 0x2a
jb 0x1400183f0
mov byte [rsp + 0x4b], dil
jmp 0x1400180d7
mov r8d, 0x104
lea rdx, [rbp - 0x80]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x1400184b8
mov edx, 6
call fcn.140018710
mov r8, rax
movdqa xmm0, xmmword [0x1400ad230]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400ad280]
movdqu xmmword [rsp + 0x30], xmm1
mov dword [rsp + 0x40], 0x30642021
mov dword [rsp + 0x44], 0x2521362c
mov dword [rsp + 0x48], 0x372d6420
mov word [rsp + 0x4c], 0x647e
mov byte [rsp + 0x4e], dil
mov rcx, rdi
nop word [rax + rax]
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x21], al
inc rcx
cmp rcx, 0x2d
jb 0x140018480
mov byte [rsp + 0x4e], dil
lea rdx, [rsp + 0x21]
mov rcx, r8
call fcn.140018850
mov rcx, rax
lea rdx, [rbp - 0x80]
call fcn.140017100
mov rcx, rax
call fcn.1400173d0
mov al, 0x7b
mov dword [rsp + 0x20], 0x31e357b
mov dword [rsp + 0x24], 0x1414330f
mov word [rsp + 0x28], 0x10
mov rcx, rdi
nop dword [rax]
nop dword [rax + rax]
xor byte [rsp + rcx + 0x21], al
inc rcx
cmp rcx, 8
jae 0x1400184f4
movzx eax, byte [rsp + 0x20]
jmp 0x1400184e0
mov byte [rsp + 0x29], dil
lea rdx, [rsp + 0x21]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14001857c
lea edx, [rax + 4]
lea rcx, [0x1400b7840]
call fcn.140016f60
mov r8, rax
movdqa xmm0, xmmword [0x1400ad800]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400ad310]
movdqu xmmword [rsp + 0x30], xmm1
mov dword [rsp + 0x40], 0x52344f34
mov dword [rsp + 0x44], 0x51585d55
mov dword [rsp + 0x48], 0x493450
mov rcx, rdi
nop word [rax + rax]
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x21], al
inc rcx
cmp rcx, 0x2a
jb 0x140018560
mov byte [rsp + 0x4b], dil
jmp 0x1400180d7
mov r9d, r12d
mov r8, rsi
mov rdx, rax
mov ecx, 3
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
test rax, rax
jne 0x1400186a2
lea edx, [rax + 4]
lea rcx, [0x1400b7840]
call fcn.140016f60
mov r8, rax
movdqa xmm0, xmmword [0x1400ad650]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400ad3a0]
movdqu xmmword [rsp + 0x30], xmm1
mov dword [rsp + 0x40], 0x2d494841
mov word [rsp + 0x44], 0x50
mov rcx, rdi
nop dword [rax]
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x21], al
inc rcx
cmp rcx, 0x24
jb 0x1400185e0
mov byte [rsp + 0x45], dil
jmp 0x1400180d7
mov edx, 4
call fcn.140018710
movdqa xmm0, xmmword [0x1400ad5e0]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [str.bxqsq4Qlaxu_q]
movdqu xmmword [rsp + 0x30], xmm1
mov rdx, rdi
nop word [rax + rax]
movzx ecx, byte [rsp + 0x20]
xor byte [rsp + rdx + 0x21], cl
inc rdx
cmp rdx, 0x1e
jb 0x140018630
mov byte [rsp + 0x3f], dil
lea rdx, [rsp + 0x21]
mov rcx, rax
call fcn.140018850
mov rcx, rax
call fcn.1400173d0
nop
mov rcx, rbx
call fcn.14000b780
mov rcx, qword [rbx]
mov qword [rbx], rdi
mov edx, 0x10
call fcn.14000e800
xor al, al
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1400216a0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, r12d
call qword [sym.imp.USER32.dll_PostThreadMessageW]
lea rcx, [0x1400acd00]
call fcn.1400451c0
call fcn.1400193b0
lea rdx, str.___Loaded_successfully___
lea rcx, [rsp + 0x20]
call fcn.140009d40
nop
mov edx, 2
lea rcx, [rsp + 0x20]
call fcn.1400192f0
nop
lea rcx, [rsp + 0x20]
call fcn.140009b70
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call fcn.140048e50
int3