Function at 0x180003250
Capabilities:
Contain obfuscated stackstrings
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r11, qword gs:[0x60]
xor r12d, r12d
mov dword [rbp - 9], 0x65006b
mov dword [rbp - 5], 0x6e0072
mov dword [rbp - 1], 0x6c0065
mov dword [rbp + 3], 0x320033
mov dword [rbp + 7], 0x64002e
mov dword [rbp + 0xb], 0x6c006c
mov word [rbp + 0xf], r12w
test r11, r11
je 0x180003337
mov r11, qword [r11 + 0x18]
test r11, r11
je 0x180003337
mov rbx, qword [r11 + 0x10]
add r11, 0x10
cmp rbx, r11
je 0x180003337
mov r10, qword [rbx + 0x60]
lea r9, [rbp - 9]
nop dword [rax + rax]
movzx ecx, word [r10]
lea r10, [r10 + 2]
lea r9, [r9 + 2]
lea eax, [rcx - 0x41]
cmp ax, 0x19
lea edx, [rcx + 0x20]
cmova dx, cx
movzx ecx, word [r9 - 2]
lea eax, [rcx - 0x42]
cmp ax, 0x17
lea r8d, [rcx + 0x20]
cmova r8w, cx
test dx, dx
je 0x180003325
cmp dx, r8w
je 0x1800032e0
movzx eax, r8w
movzx ecx, dx
sub ecx, eax
jmp 0x18000332b
movzx ecx, r8w
neg ecx
test ecx, ecx
je 0x18000335c
mov rbx, qword [rbx]
cmp rbx, r11
jne 0x1800032d0
xor eax, eax
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.180003740
mov rbx, qword [rsp + 0x110]
add rsp, 0xd0
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rbx + 0x30]
test rbx, rbx
je 0x180003337
mov qword [rsp + 0x100], r13
lea rdi, [rbx + 0x3c]
mov qword [rsp + 0x108], r14
mov r13d, 0x5a4d
movzx r14d, word [rbx]
mov dword [rbp - 0x29], 0x50746547
mov dword [rbp - 0x25], 0x41636f72
mov dword [rbp - 0x21], 0x65726464
mov word [rbp - 0x1d], 0x7373
mov byte [rbp - 0x1b], r12b
cmp r14w, r13w
jne 0x18000343c
movsxd rax, dword [rdi]
cmp dword [rax + rbx], 0x4550
jne 0x18000343c
mov ecx, dword [rax + rbx + 0x88]
test ecx, ecx
je 0x18000343c
mov r9d, dword [rbx + rcx + 0x20]
lea rsi, [rbx + rcx]
mov r11d, dword [rsi + 0x18]
add r9, rbx
mov r10d, r12d
test r11d, r11d
je 0x18000343c
nop
mov ecx, dword [r9]
lea r8, [rbp - 0x29]
add rcx, rbx
sub r8, rcx
nop dword [rax]
movzx edx, byte [r8 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
je 0x18000340a
cmp dl, al
je 0x1800033f0
mov ecx, edx
sub ecx, eax
jmp 0x18000340e
mov ecx, eax
neg ecx
test ecx, ecx
je 0x180003420
inc r10d
add r9, 4
cmp r10d, r11d
jb 0x1800033e0
jmp 0x18000343c
mov eax, dword [rsi + 0x24]
add rax, rbx
mov ecx, r10d
movzx edx, word [rax + rcx*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov r15d, dword [rcx + rdx*4]
add r15, rbx
jne 0x180003443
lea r15, [0x180003170]
cmp r14w, r13w
mov dword [rbp - 0x69], 0x626f6c47
mov r14, qword [rsp + 0x108]
mov r13, qword [rsp + 0x100]
mov dword [rbp - 0x65], 0x6c416c61
mov dword [rbp - 0x61], 0x636f6c
mov dword [rbp - 0x79], 0x626f6c47
mov dword [rbp - 0x75], 0x72466c61
mov word [rbp - 0x71], 0x6565
mov byte [rbp - 0x6f], r12b
jne 0x180003337
movsxd rax, dword [rdi]
cmp dword [rax + rbx], 0x4550
jne 0x1800034fe
mov ecx, dword [rax + rbx + 0x88]
test ecx, ecx
je 0x1800034fe
mov r9d, dword [rbx + rcx + 0x20]
lea rsi, [rbx + rcx]
mov r11d, dword [rsi + 0x18]
add r9, rbx
mov r10d, r12d
test r11d, r11d
je 0x1800034fe
nop dword [rax]
mov ecx, dword [r9]
lea r8, [rbp - 0x69]
add rcx, rbx
sub r8, rcx
nop dword [rax]
movzx edx, byte [r8 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
je 0x1800034ea
cmp dl, al
je 0x1800034d0
mov ecx, edx
sub ecx, eax
jmp 0x1800034ee
mov ecx, eax
neg ecx
test ecx, ecx
je 0x18000356a
inc r10d
add r9, 4
cmp r10d, r11d
jb 0x1800034c0
mov rsi, r12
movsxd rax, dword [rdi]
cmp dword [rax + rbx], 0x4550
jne 0x1800035b8
mov ecx, dword [rax + rbx + 0x88]
test ecx, ecx
je 0x1800035b8
mov r9d, dword [rbx + rcx + 0x20]
lea rdi, [rbx + rcx]
mov r11d, dword [rdi + 0x18]
add r9, rbx
mov r10d, r12d
test r11d, r11d
je 0x1800035b8
nop dword [rax]
mov ecx, dword [r9]
lea r8, [rbp - 0x79]
add rcx, rbx
sub r8, rcx
nop dword [rax]
movzx edx, byte [r8 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
je 0x180003588
cmp dl, al
je 0x180003550
mov ecx, edx
sub ecx, eax
jmp 0x18000358c
mov eax, dword [rsi + 0x24]
add rax, rbx
mov ecx, r10d
movzx edx, word [rax + rcx*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov esi, dword [rcx + rdx*4]
add rsi, rbx
jmp 0x180003501
mov ecx, eax
neg ecx
test ecx, ecx
je 0x18000359e
inc r10d
add r9, 4
cmp r10d, r11d
jb 0x180003540
jmp 0x1800035b8
mov eax, dword [rdi + 0x24]
add rax, rbx
mov ecx, r10d
movzx edx, word [rax + rcx*2]
mov ecx, dword [rdi + 0x1c]
add rcx, rbx
mov r12d, dword [rcx + rdx*4]
add r12, rbx
test rsi, rsi
je 0x180003337
test r12, r12
je 0x180003337
mov edx, 0x40
mov ecx, edx
call rsi
mov rdi, rax
test rax, rax
je 0x180003337
movdqa xmm0, xmmword [str.GetModuleHandleA]
lea rdx, [rbp + 0x17]
mov rcx, rbx
mov qword [rax], r15
movdqu xmmword [rbp + 0x17], xmm0
mov qword [rax + 0x30], rsi
mov qword [rax + 0x38], r12
mov byte [rbp + 0x27], 0
call r15
mov qword [rdi + 8], rax
test rax, rax
je 0x180003337
lea rdx, [rbp - 0x49]
mov dword [rbp - 0x49], 0x64616f4c
mov rcx, rbx
mov dword [rbp - 0x45], 0x7262694c
mov dword [rbp - 0x41], 0x41797261
mov byte [rbp - 0x3d], 0
call r15
mov qword [rdi + 0x10], rax
test rax, rax
je 0x180003337
lea rdx, [rbp - 0x39]
mov dword [rbp - 0x39], 0x74726956
mov rcx, rbx
mov dword [rbp - 0x35], 0x416c6175
mov dword [rbp - 0x31], 0x636f6c6c
mov byte [rbp - 0x2d], 0
call r15
mov qword [rdi + 0x18], rax
test rax, rax
je 0x180003337
lea rdx, [rbp - 0x59]
mov dword [rbp - 0x59], 0x74726956
mov rcx, rbx
mov dword [rbp - 0x55], 0x466c6175
mov dword [rbp - 0x51], 0x656572
call r15
mov qword [rdi + 0x20], rax
test rax, rax
je 0x180003337
lea rdx, [rbp - 0x19]
mov dword [rbp - 0x19], 0x74726956
mov rcx, rbx
mov dword [rbp - 0x15], 0x506c6175
mov dword [rbp - 0x11], 0x65746f72
mov word [rbp - 0xd], 0x7463
mov byte [rbp - 0xb], 0
call r15
mov qword [rdi + 0x28], rax
test rax, rax
je 0x180003337
mov rax, rdi
jmp 0x180003339