Function at 0x180002fd0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xe8
mov byte [rsp + 0x28], 0x53
mov byte [rsp + 0x29], 0x5b
mov byte [rsp + 0x2a], 0x41
mov byte [rsp + 0x2b], 0x54
mov byte [rsp + 0x2c], 0x44
mov byte [rsp + 0x2d], 0x53
mov byte [rsp + 0x2e], 0x56
mov byte [rsp + 0x2f], 0x1c
mov byte [rsp + 0x30], 0x45
mov byte [rsp + 0x31], 0x55
mov byte [rsp + 0x32], 0x45
mov byte [rsp + 0x33], 0x5b
mov byte [rsp + 0x34], 0x4c
mov byte [rsp + 0x35], 0x4e
mov byte [rsp + 0x36], 0x51
mov byte [rsp + 0x37], 0x59
mov byte [rsp + 0x38], 0x33
mov byte [rsp + 0x39], 0x6f
mov byte [rsp + 0x3a], 0x26
mov byte [rsp + 0x3b], 0x22
mov byte [rsp + 0x3c], 0x3c
mov byte [rsp + 0x3d], 0x23
mov byte [rsp + 0x3e], 0x66
mov byte [rsp + 0x3f], 0x25
mov byte [rsp + 0x40], 0x2b
mov byte [rsp + 0x41], 0x2c
mov byte [rsp + 0x42], 0x46
mov eax, 0x30
mov edx, 4
movabs rsi, 0x3c15fc9f6e3ae730
nop word [rax + rax]
lea ecx, [rdx - 4]
and cl, 0x38
mov rdi, rsi
shr rdi, cl
and edi, 0xf
mov ecx, eax
xor ecx, edi
xor byte [rsp + rax - 8], cl
cmp rax, 0x4a
je 0x1800030be
lea edi, [rax + 1]
mov ecx, edx
and cl, 0x3c
mov rbx, rsi
shr rbx, cl
and ebx, 0xf
xor ebx, edi
xor byte [rsp + rax - 7], bl
add rax, 2
add rdx, 8
jmp 0x180003080
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180003259
mov r14, rax
mov byte [rsp + 0x28], 0xc7
mov byte [rsp + 0x29], 0xd7
mov byte [rsp + 0x2a], 0xc7
mov byte [rsp + 0x2b], 0x8a
mov byte [rsp + 0x2c], 0xcb
mov byte [rsp + 0x2d], 0xc6
mov byte [rsp + 0x2e], 0xde
mov byte [rsp + 0x2f], 0x8f
mov byte [rsp + 0x30], 0xd0
mov byte [rsp + 0x31], 0xd2
mov byte [rsp + 0x32], 0xc4
mov byte [rsp + 0x33], 0xda
mov byte [rsp + 0x34], 0x9a
mov byte [rsp + 0x35], 0xd7
mov byte [rsp + 0x36], 0xd8
mov byte [rsp + 0x37], 0xdf
mov byte [rsp + 0x38], 0xb0
mov eax, 0xa8
mov edx, 4
movabs rsi, 0x4260c0a6d4e9cca8
nop
lea ecx, [rdx - 4]
and cl, 0x38
mov rdi, rsi
shr rdi, cl
and edi, 0xf
mov ecx, eax
xor ecx, edi
xor byte [rsp + rax - 0x80], cl
cmp rax, 0xb8
je 0x180003180
lea edi, [rax + 1]
mov ecx, edx
and cl, 0x3c
mov rbx, rsi
shr rbx, cl
and ebx, 0xf
xor ebx, edi
xor byte [rsp + rax - 0x7f], bl
add rax, 2
add rdx, 8
jmp 0x180003140
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18000342a
add r14, 0xae6c0
mov qword [0x180058788], r14
je 0x1800035f8
mov rcx, rax
mov al, 1
add rcx, 0x1f41d8
mov qword [0x180058780], rcx
jne 0x18000388a
mov byte [rsp + 0x28], 0x1e
mov byte [rsp + 0x29], 0x11
mov byte [rsp + 0x2a], 0x57
mov byte [rsp + 0x2b], 0x1a
mov byte [rsp + 0x2c], 0x1a
mov byte [rsp + 0x2d], 1
mov byte [rsp + 0x2e], 0x7c
xor byte [rsp + 0x28], 0x70
xor byte [rsp + 0x29], 0x7e
xor byte [rsp + 0x2a], 0x77
xor byte [rsp + 0x2b], 0x74
xor byte [rsp + 0x2c], 0x7f
xor byte [rsp + 0x2d], 0x75
xor byte [rsp + 0x2e], 0x7c
xorps xmm0, xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x28]
call fcn.180026e90
test rax, rax
js 0x180003897
mov rsi, rax
cmp rax, 0xf
ja 0x1800037d9
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], 0xf
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x28]
mov r8, rsi
call fcn.18001c5c0
jmp 0x18000387e
mov byte [rsp + 0x28], 0xe3
mov byte [rsp + 0x29], 0xcc
mov byte [rsp + 0x2a], 0xdd
mov byte [rsp + 0x2b], 0xc2
mov byte [rsp + 0x2c], 0xc6
mov byte [rsp + 0x2d], 0xcc
mov byte [rsp + 0x2e], 0x84
mov byte [rsp + 0x2f], 0xd2
mov byte [rsp + 0x30], 0x94
mov byte [rsp + 0x31], 0xd3
mov byte [rsp + 0x32], 0xd9
mov byte [rsp + 0x33], 0xcd
mov byte [rsp + 0x34], 0x92
mov byte [rsp + 0x35], 0xd8
mov byte [rsp + 0x36], 0xda
mov byte [rsp + 0x37], 0xcd
mov byte [rsp + 0x38], 0xd5
mov byte [rsp + 0x39], 0x93
mov byte [rsp + 0x3a], 0xd9
mov byte [rsp + 0x3b], 0xda
mov byte [rsp + 0x3c], 0xd6
mov byte [rsp + 0x3d], 0xc0
mov byte [rsp + 0x3e], 0xd6
mov byte [rsp + 0x3f], 0xc5
mov byte [rsp + 0x40], 0xb7
mov byte [rsp + 0x41], 0xe4
mov byte [rsp + 0x42], 0xa3
mov byte [rsp + 0x43], 0xaf
mov byte [rsp + 0x44], 0xe2
mov byte [rsp + 0x45], 0xa9
mov byte [rsp + 0x46], 0xa2
mov byte [rsp + 0x47], 0xba
mov byte [rsp + 0x48], 0xa9
mov byte [rsp + 0x49], 0xb9
mov byte [rsp + 0x4a], 0xad
mov byte [rsp + 0x4b], 0xa0
mov byte [rsp + 0x4c], 0xe2
mov byte [rsp + 0x4d], 0xb0
mov byte [rsp + 0x4e], 0xa6
mov byte [rsp + 0x4f], 0xb5
mov byte [rsp + 0x50], 0xbb
mov byte [rsp + 0x51], 0xa1
mov byte [rsp + 0x52], 0xae
mov byte [rsp + 0x53], 0xba
mov byte [rsp + 0x54], 0xb7
mov byte [rsp + 0x55], 0xa9
mov byte [rsp + 0x56], 0xfb
mov byte [rsp + 0x57], 0xbd
mov byte [rsp + 0x58], 0xbf
mov byte [rsp + 0x59], 0xa1
mov byte [rsp + 0x5a], 0xbd
mov byte [rsp + 0x5b], 0xde
mov eax, 0xa9
mov edx, 4
movabs r8, 0x9df6ae549dfe52a8
nop word cs:[rax + rax]
lea ebx, [rax - 1]
lea ecx, [rdx - 4]
and cl, 0x38
mov rdi, r8
shr rdi, cl
and edi, 0xf
xor edi, ebx
xor byte [rsp + rax - 0x81], dil
mov ecx, edx
and cl, 0x3c
mov rsi, r8
shr rsi, cl
and esi, 0xf
xor esi, eax
xor byte [rsp + rax - 0x80], sil
add rax, 2
add rdx, 8
cmp rax, 0xdd
jne 0x180003380
xorps xmm0, xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
lea rcx, [rsp + 0x28]
call fcn.180026e90
test rax, rax
js 0x180003897
mov rsi, rax
cmp rax, 0xf
ja 0x1800035bd
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0xd8], 0xf
lea rcx, [rsp + 0xc0]
lea rdx, [rsp + 0x28]
mov r8, rsi
call fcn.18001c5c0
lea rcx, [rsp + 0xc0]
jmp 0x180003883
mov byte [rsp + 0x28], 0x83
mov byte [rsp + 0x29], 0xaa
mov byte [rsp + 0x2a], 0xb9
mov byte [rsp + 0x2b], 0xa7
mov byte [rsp + 0x2c], 0xae
mov byte [rsp + 0x2d], 0xa0
mov byte [rsp + 0x2e], 0xe3
mov byte [rsp + 0x2f], 0xbf
mov byte [rsp + 0x30], 0xfe
mov byte [rsp + 0x31], 0xb3
mov byte [rsp + 0x32], 0xbf
mov byte [rsp + 0x33], 0xad
mov byte [rsp + 0x34], 0xfd
mov byte [rsp + 0x35], 0xbc
mov byte [rsp + 0x36], 0xb7
mov byte [rsp + 0x37], 0xa6
mov byte [rsp + 0x38], 0xb5
mov byte [rsp + 0x39], 0xf5
mov byte [rsp + 0x3a], 0xbd
mov byte [rsp + 0x3b], 0xbf
mov byte [rsp + 0x3c], 0xbe
mov byte [rsp + 0x3d], 0xac
mov byte [rsp + 0x3e], 0xb1
mov byte [rsp + 0x3f], 0xa8
mov byte [rsp + 0x40], 0x9d
mov byte [rsp + 0x41], 0xc4
mov byte [rsp + 0x42], 0x85
mov byte [rsp + 0x43], 0x8f
mov byte [rsp + 0x44], 0xcd
mov byte [rsp + 0x45], 0x89
mov byte [rsp + 0x46], 0x92
mov byte [rsp + 0x47], 0x84
mov byte [rsp + 0x48], 0xc0
mov byte [rsp + 0x49], 0x8b
mov byte [rsp + 0x4a], 0x89
mov byte [rsp + 0x4b], 0x9f
mov byte [rsp + 0x4c], 0xca
mov byte [rsp + 0x4d], 0x88
mov byte [rsp + 0x4e], 0x8d
mov byte [rsp + 0x4f], 0x9d
mov byte [rsp + 0x50], 0x9b
mov byte [rsp + 0x51], 0xf4
mov eax, 0xc9
mov edx, 4
movabs r8, 0x20b9a85e4a3606c8
lea ebx, [rax - 1]
lea ecx, [rdx - 4]
and cl, 0x38
mov rdi, r8
shr rdi, cl
and edi, 0xf
xor edi, ebx
xor byte [rsp + rax - 0xa1], dil
mov ecx, edx
and cl, 0x3c
mov rsi, r8
shr rsi, cl
and esi, 0xf
xor esi, eax
xor byte [rsp + rax - 0xa0], sil
add rax, 2
add rdx, 8
cmp rax, 0xf3
jne 0x180003510
xorps xmm0, xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
lea rcx, [rsp + 0x28]
call fcn.180026e90
test rax, rax
js 0x180003897
mov rsi, rax
cmp rax, 0xf
ja 0x1800036d9
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xb8], 0xf
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x28]
mov r8, rsi
call fcn.18001c5c0
lea rcx, [rsp + 0xa0]
jmp 0x180003883
mov rax, rsi
or rax, 0xf
cmp rax, 0x17
mov ebx, 0x16
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x180003714
lea rcx, [rbx + 0x28]
call fcn.180018c0c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180003720
mov byte [rsp + 0x28], 0xae
mov byte [rsp + 0x29], 0xaa
mov byte [rsp + 0x2a], 0xe2
mov byte [rsp + 0x2b], 0xba
mov byte [rsp + 0x2c], 0xa0
mov byte [rsp + 0x2d], 0xb1
mov byte [rsp + 0x2e], 0xa1
mov byte [rsp + 0x2f], 0xb1
mov byte [rsp + 0x30], 0xa3
mov byte [rsp + 0x31], 0xb3
mov byte [rsp + 0x32], 0xb9
mov byte [rsp + 0x33], 0xd2
xor byte [rsp + 0x28], 0xc0
xor byte [rsp + 0x29], 0xc5
xor byte [rsp + 0x2a], 0xc2
xor byte [rsp + 0x2b], 0xc8
xor byte [rsp + 0x2c], 0xc5
xor byte [rsp + 0x2d], 0xc2
xor byte [rsp + 0x2e], 0xce
xor byte [rsp + 0x2f], 0xc4
xor byte [rsp + 0x30], 0xd1
xor byte [rsp + 0x31], 0xd0
xor byte [rsp + 0x32], 0xdc
xor byte [rsp + 0x33], 0xd2
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
lea rcx, [rsp + 0x28]
call fcn.180026e90
test rax, rax
js 0x180003897
mov rsi, rax
cmp rax, 0xf
ja 0x180003759
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], 0xf
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x28]
mov r8, rsi
call fcn.18001c5c0
lea rcx, [rsp + 0x80]
jmp 0x180003883
mov rax, rsi
or rax, 0xf
cmp rax, 0x17
mov ebx, 0x16
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x180003794
lea rcx, [rbx + 0x28]
call fcn.180018c0c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1800037a0
lea rcx, [rbx + 1]
call fcn.180018c0c
mov rdi, rax
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0xd8], rbx
lea rdx, [rsp + 0x28]
mov rcx, rdi
mov r8, rsi
call fcn.18001c5c0
mov byte [rdi + rsi], 0
lea rcx, [rsp + 0xc0]
jmp 0x180003883
mov rax, rsi
or rax, 0xf
cmp rax, 0x17
mov ebx, 0x16
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x18000380d
lea rcx, [rbx + 0x28]
call fcn.180018c0c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180003819
lea rcx, [rbx + 1]
call fcn.180018c0c
mov rdi, rax
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xb8], rbx
lea rdx, [rsp + 0x28]
mov rcx, rdi
mov r8, rsi
call fcn.18001c5c0
mov byte [rdi + rsi], 0
lea rcx, [rsp + 0xa0]
jmp 0x180003883
mov rax, rsi
or rax, 0xf
cmp rax, 0x17
mov ebx, 0x16
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x18000384f
lea rcx, [rbx + 0x28]
call fcn.180018c0c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18000385b
lea rcx, [rbx + 1]
call fcn.180018c0c
mov rdi, rax
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rbx
lea rdx, [rsp + 0x28]
mov rcx, rdi
mov r8, rsi
call fcn.18001c5c0
mov byte [rdi + rsi], 0
lea rcx, [rsp + 0x80]
jmp 0x180003883
lea rcx, [rbx + 1]
call fcn.180018c0c
mov rdi, rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rbx
lea rdx, [rsp + 0x28]
mov rcx, rdi
mov r8, rsi
call fcn.18001c5c0
mov byte [rdi + rsi], 0
lea rcx, [rsp + 0x60]
call fcn.180002d80
xor eax, eax
add rsp, 0xe8
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.18000c700
int3