Function at 0x180003e70
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
xor ebx, ebx
movaps xmmword [rsp + 0x50], xmm7
cmp byte [0x1800071b4], bl
mov r14, r9
mov rdi, r8
mov rsi, rdx
je 0x18000425a
mov rcx, qword [r9]
xor r8d, r8d
lea r9d, [rbx + 0x2e]
xor edx, edx
mov rax, qword [rcx]
mov r10, qword [rax + 0xc0]
call r10
test rax, rax
je 0x180003ffa
cmp dword [rax + 0x14], 4
jne 0x180003ffa
xor eax, eax
mov dword [0x18000708c], 0x64
mov byte [rbp - 0x32], al
mov edx, ebx
mov dword [rbp - 0x40], 0x7b7c7a42
mov dword [rbp - 0x3c], 0x7f797f61
mov dword [rbp - 0x38], 0x7b697b4d
mov word [rbp - 0x34], 0x6a78
nop
movsxd rcx, edx
lea eax, [rdx + 0x11]
inc edx
xor byte [rbp + rcx - 0x40], al
cmp edx, 0xe
jb 0x180003f00
lea rdx, [rbp - 0x40]
mov byte [rbp - 0x32], bl
mov rcx, rsi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x180003ffa
xor eax, eax
mov dword [rbp - 0x40], 0x67607d53
mov byte [rbp - 0x36], al
mov edx, ebx
mov dword [rbp - 0x3c], 0x77657e41
mov word [rbp - 0x38], 0x6e78
nop word [rax + rax]
movsxd rcx, edx
lea eax, [rdx + 0x11]
inc edx
xor byte [rbp + rcx - 0x40], al
cmp edx, 0xa
jb 0x180003f50
lea rdx, [rbp - 0x40]
mov byte [rbp - 0x36], bl
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1800043fa
mov dword [rbp + 0x20], 0x67607d53
mov edx, ebx
mov dword [rbp + 0x24], 0x726f50
nop word [rax + rax]
movsxd rcx, edx
lea eax, [rdx + 0x11]
inc edx
xor byte [rbp + rcx + 0x20], al
cmp edx, 7
jb 0x180003f90
lea rdx, [rbp + 0x20]
mov byte [rbp + 0x27], bl
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1800043fa
movdqa xmm0, xmmword [0x1800011d0]
mov edx, ebx
movdqu xmmword [rbp - 0x2d], xmm0
mov dword [rbp - 0x1d], 0x5a5a4e
movsxd rcx, edx
lea eax, [rdx + 0x11]
inc edx
xor byte [rbp + rcx - 0x2d], al
cmp edx, 0x13
jb 0x180003fd0
lea rdx, [rbp - 0x2d]
mov byte [rbp - 0x1a], bl
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1800043fa
movss xmm7, dword [0x18000112c]
comiss xmm7, dword [rbp + 0x40]
jb 0x1800040aa
xor eax, eax
mov dword [0x18000708c], 0x14
mov byte [rbp - 0x32], al
mov edx, ebx
mov dword [rbp - 0x40], 0x7b7c7a42
mov dword [rbp - 0x3c], 0x7f797f61
mov dword [rbp - 0x38], 0x7b697b4d
mov word [rbp - 0x34], 0x6a78
nop dword [rax + rax]
movsxd rcx, edx
lea eax, [rdx + 0x11]
inc edx
xor byte [rbp + rcx - 0x40], al
cmp edx, 0xe
jb 0x180004040
lea rdx, [rbp - 0x40]
mov byte [rbp - 0x32], bl
mov rcx, rsi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x1800040aa
xor eax, eax
mov dword [rbp + 0x20], 0x71657b59
mov byte [rbp + 0x24], al
mov edx, ebx
nop dword [rax]
nop dword [rax + rax]
movsxd rcx, edx
lea eax, [rdx + 0x11]
inc edx
xor byte [rbp + rcx + 0x20], al
cmp edx, 4
jb 0x180004080
lea rdx, [rbp + 0x20]
mov byte [rbp + 0x24], bl
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1800043fa
movss xmm0, dword [0x180001128]
comiss xmm0, dword [rbp + 0x40]
jb 0x18000416a
xor eax, eax
mov dword [0x18000708c], 5
mov byte [rbp - 0x32], al
mov edx, ebx
mov dword [rbp - 0x40], 0x7b7c7a42
mov dword [rbp - 0x3c], 0x7f797f61
mov dword [rbp - 0x38], 0x7b697b4d
mov word [rbp - 0x34], 0x6a78
nop dword [rax + rax]
movsxd rcx, edx
lea eax, [rdx + 0x11]
inc edx
xor byte [rbp + rcx - 0x40], al
cmp edx, 0xe
jb 0x1800040f0
lea rdx, [rbp - 0x40]
mov byte [rbp - 0x32], bl
mov rcx, rsi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x18000416a
mov dword [rbp - 0x40], 0x66617d52
mov edx, ebx
mov dword [rbp - 0x3c], 0x6a78727c
mov dword [rbp - 0x38], 0x6c724a46
mov word [rbp - 0x34], 0x78
nop dword [rax]
nop word [rax + rax]
movsxd rcx, edx
lea eax, [rdx + 0x11]
inc edx
xor byte [rbp + rcx - 0x40], al
cmp edx, 0xd
jb 0x180004140
lea rdx, [rbp - 0x40]
mov byte [rbp - 0x33], bl
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1800043fa
comiss xmm7, dword [rbp + 0x40]
jb 0x18000425a
xor eax, eax
mov dword [0x18000708c], 0x64
mov byte [rbp - 0x32], al
mov edx, ebx
mov dword [rbp - 0x40], 0x7b7c7a42
mov dword [rbp - 0x3c], 0x7f797f61
mov dword [rbp - 0x38], 0x79717856
mov word [rbp - 0x34], 0x6a7e
movsxd rcx, edx
lea eax, [rdx + 0x11]
inc edx
xor byte [rbp + rcx - 0x40], al
cmp edx, 0xe
jb 0x1800041a0
lea rdx, [rbp - 0x40]
mov byte [rbp - 0x32], bl
mov rcx, rsi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x18000425a
xor eax, eax
mov dword [rbp - 0x40], 0x67607d53
mov byte [rbp - 0x38], al
mov edx, ebx
mov dword [rbp - 0x3c], 0x7d6e534a
nop
movsxd rcx, edx
lea eax, [rdx + 0x11]
inc edx
xor byte [rbp + rcx - 0x40], al
cmp edx, 8
jb 0x1800041e0
lea rdx, [rbp - 0x40]
mov byte [rbp - 0x38], bl
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1800043fa
mov dword [rbp - 0x40], 0x67607d53
mov edx, ebx
mov dword [rbp - 0x3c], 0x7765524a
mov dword [rbp - 0x38], 0x73594577
mov word [rbp - 0x34], 0x6779
mov byte [rbp - 0x32], al
nop word [rax + rax]
movsxd rcx, edx
lea eax, [rdx + 0x11]
inc edx
xor byte [rbp + rcx - 0x40], al
cmp edx, 0xe
jb 0x180004230
lea rdx, [rbp - 0x40]
mov byte [rbp - 0x32], bl
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1800043fa
mov rcx, qword [r14]
mov r9d, 0x2f
xor r8d, r8d
xor edx, edx
mov rax, qword [rcx]
mov r10, qword [rax + 0xc0]
call r10
test rax, rax
je 0x1800043fe
cmp dword [rax + 0x14], 4
jne 0x1800043fe
xor eax, eax
mov dword [0x18000708c], 0xf
mov byte [rbp - 0x32], al
mov edx, ebx
mov dword [rbp - 0x40], 0x7b7c7a42
mov dword [rbp - 0x3c], 0x7f797f61
mov dword [rbp - 0x38], 0x7b697b4d
mov word [rbp - 0x34], 0x6a78
nop dword [rax]
nop dword [rax + rax]
movsxd rcx, edx
lea eax, [rdx + 0x11]
inc edx
xor byte [rbp + rcx - 0x40], al
cmp edx, 0xe
jb 0x1800042c0
lea rdx, [rbp - 0x40]
mov byte [rbp - 0x32], bl
mov rcx, rsi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x1800043fe
xor eax, eax
mov dword [rbp + 0x20], 0x61606270
mov byte [rbp + 0x26], al
mov edx, ebx
mov word [rbp + 0x24], 0x7379
nop
movsxd rcx, edx
lea eax, [rdx + 0x11]
inc edx
xor byte [rbp + rcx + 0x20], al
cmp edx, 6
jb 0x180004300
lea rdx, [rbp + 0x20]
mov byte [rbp + 0x26], bl
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1800043fa
movdqa xmm0, xmmword [0x180001180]
mov edx, ebx
movdqu xmmword [rbp - 0x2d], xmm0
mov dword [rbp - 0x1d], 0x125644
movsxd rcx, edx
lea eax, [rdx + 0x11]
inc edx
xor byte [rbp + rcx - 0x2d], al
cmp edx, 0x13
jb 0x180004340
lea rdx, [rbp - 0x2d]
mov byte [rbp - 0x1a], bl
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1800043fa
movdqa xmm0, xmmword [0x180001170]
mov edx, ebx
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x30], 0x5644
mov byte [rbp - 0x2e], al
nop dword [rax]
nop word [rax + rax]
movsxd rcx, edx
lea eax, [rdx + 0x11]
inc edx
xor byte [rbp + rcx - 0x40], al
cmp edx, 0x12
jb 0x180004390
lea rdx, [rbp - 0x40]
mov byte [rbp - 0x2e], bl
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1800043fa
movdqa xmm0, xmmword [0x180001160]
movdqu xmmword [rbp - 0x2d], xmm0
mov word [rbp - 0x1d], 0x5644
mov byte [rbp - 0x1b], al
nop dword [rax]
movsxd rcx, ebx
lea eax, [rbx + 0x11]
inc ebx
xor byte [rbp + rcx - 0x2d], al
cmp ebx, 0x12
jb 0x1800043d0
lea rdx, [rbp - 0x2d]
mov byte [rbp - 0x1b], 0
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
setne al
jmp 0x180004400
mov al, 1
jmp 0x180004400
xor al, al
movaps xmm7, xmmword [rsp + 0x50]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret