Function at 0x180001b58
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r10, qword gs:[0x60]
xor r12d, r12d
mov dword [rbp - 9], 0x65006b
mov dword [rbp - 5], 0x6e0072
mov dword [rbp - 1], 0x6c0065
mov dword [rbp + 3], 0x320033
mov dword [rbp + 7], 0x64002e
mov dword [rbp + 0xb], 0x6c006c
mov word [rbp + 0xf], r12w
test r10, r10
je 0x180001c3c
mov r10, qword [r10 + 0x18]
test r10, r10
je 0x180001c3c
add r10, 0x10
mov rdx, qword [r10]
jmp 0x180001c37
mov rbx, qword [rdx + 0x60]
lea r11, [rbp - 9]
movzx ecx, word [rbx]
lea rbx, [rbx + 2]
lea eax, [rcx - 0x41]
cmp ax, 0x19
lea r9d, [rcx + 0x20]
cmova r9w, cx
movzx ecx, word [r11]
lea r11, [r11 + 2]
lea eax, [rcx - 0x42]
cmp ax, 0x17
lea r8d, [rcx + 0x20]
cmova r8w, cx
test r9w, r9w
je 0x180001c2a
cmp r9w, r8w
je 0x180001be3
movzx eax, r8w
movzx ecx, r9w
sub ecx, eax
jmp 0x180001c30
movzx ecx, r8w
neg ecx
test ecx, ecx
je 0x180001c6b
mov rdx, qword [rdx]
cmp rdx, r10
jne 0x180001bdb
xor eax, eax
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.180002520
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rdi, qword [rdx + 0x30]
test rdi, rdi
je 0x180001c3c
lea rdx, [rbp - 0x29]
mov dword [rbp - 0x29], 0x50746547
mov rcx, rdi
mov dword [rbp - 0x25], 0x41636f72
mov dword [rbp - 0x21], 0x65726464
mov word [rbp - 0x1d], 0x7373
mov byte [rbp - 0x1b], r12b
call fcn.180001aa4
mov rsi, rax
mov dword [rbp - 0x49], 0x626f6c47
lea rax, [fcn.180001aa4]
mov dword [rbp - 0x45], 0x6c416c61
test rsi, rsi
mov dword [rbp - 0x41], 0x636f6c
lea rdx, [rbp - 0x49]
mov dword [rbp - 0x39], 0x626f6c47
mov rcx, rdi
mov dword [rbp - 0x35], 0x72466c61
cmove rsi, rax
mov word [rbp - 0x31], 0x6565
mov byte [rbp - 0x2f], r12b
call fcn.180001aa4
lea rdx, [rbp - 0x39]
mov rcx, rdi
mov r15, rax
call fcn.180001aa4
mov r14, rax
test r15, r15
je 0x180001c3c
test rax, rax
je 0x180001c3c
mov ecx, 0x40
mov edx, ecx
call r15
mov rbx, rax
test rax, rax
je 0x180001c3c
movdqa xmm0, xmmword [str.GetModuleHandleA_]
lea rdx, [rbp + 0x17]
mov rcx, rdi
mov qword [rax], rsi
movdqu xmmword [rbp + 0x17], xmm0
mov qword [rax + 0x30], r15
mov qword [rax + 0x38], r14
mov byte [rbp + 0x27], r12b
call rsi
mov qword [rbx + 8], rax
test rax, rax
je 0x180001c3c
lea rdx, [rbp - 0x39]
mov dword [rbp - 0x39], 0x64616f4c
mov rcx, rdi
mov dword [rbp - 0x35], 0x7262694c
mov dword [rbp - 0x31], 0x41797261
mov byte [rbp - 0x2d], r12b
call rsi
mov qword [rbx + 0x10], rax
test rax, rax
je 0x180001c3c
lea rdx, [rbp - 0x29]
mov dword [rbp - 0x29], 0x74726956
mov rcx, rdi
mov dword [rbp - 0x25], 0x416c6175
mov dword [rbp - 0x21], 0x636f6c6c
mov byte [rbp - 0x1d], r12b
call rsi
mov qword [rbx + 0x18], rax
test rax, rax
je 0x180001c3c
lea rdx, [rbp - 0x49]
mov dword [rbp - 0x49], 0x74726956
mov rcx, rdi
mov dword [rbp - 0x45], 0x466c6175
mov dword [rbp - 0x41], 0x656572
call rsi
mov qword [rbx + 0x20], rax
test rax, rax
je 0x180001c3c
lea rdx, [rbp - 0x19]
mov dword [rbp - 0x19], 0x74726956
mov rcx, rdi
mov dword [rbp - 0x15], 0x506c6175
mov dword [rbp - 0x11], 0x65746f72
mov word [rbp - 0xd], 0x7463
mov byte [rbp - 0xb], r12b
call rsi
mov qword [rbx + 0x28], rax
test rax, rax
je 0x180001c3c
mov rax, rbx
jmp 0x180001c3e