Function at 0x140011375
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
jmp 0x140013170
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x4e8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xce
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x508]
mov rax, qword [0x1400250c0]
xor rax, rbp
mov qword [rbp + 0x4a8], rax
lea rcx, [0x14002b166]
call fcn.140011488
nop
mov byte [rbp + 8], 0x41
mov byte [rbp + 9], 0x64
mov byte [rbp + 0xa], 0x76
mov byte [rbp + 0xb], 0x61
mov byte [rbp + 0xc], 0x70
mov byte [rbp + 0xd], 0x69
mov byte [rbp + 0xe], 0x33
mov byte [rbp + 0xf], 0x32
mov byte [rbp + 0x10], 0
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp + 0x38], rax
cmp qword [rbp + 0x38], 0
jne 0x140013222
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
lea rdx, str.____Failed_to_load_requried_library_n
mov rcx, rax
call fcn.140011438
nop
jmp 0x140013827
mov byte [rbp + 0xb8], 0x43
mov byte [rbp + 0xb9], 0x72
mov byte [rbp + 0xba], 0x79
mov byte [rbp + 0xbb], 0x70
mov byte [rbp + 0xbc], 0x74
mov byte [rbp + 0xbd], 0x41
mov byte [rbp + 0xbe], 0x63
mov byte [rbp + 0xbf], 0x71
mov byte [rbp + 0xc0], 0x75
mov byte [rbp + 0xc1], 0x69
mov byte [rbp + 0xc2], 0x72
mov byte [rbp + 0xc3], 0x65
mov byte [rbp + 0xc4], 0x43
mov byte [rbp + 0xc5], 0x6f
mov byte [rbp + 0xc6], 0x6e
mov byte [rbp + 0xc7], 0x74
mov byte [rbp + 0xc8], 0x65
mov byte [rbp + 0xc9], 0x78
mov byte [rbp + 0xca], 0x74
mov byte [rbp + 0xcb], 0x57
mov byte [rbp + 0xcc], 0
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0xb8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xe8], rax
mov dword [rsp + 0x20], 0xf0000000
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetElement
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x58]
call qword [rbp + 0xe8]
test eax, eax
jne 0x140013311
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptAcquireContextW___u__n
call fcn.140011226
nop
jmp 0x140013827
mov byte [rbp + 0x108], 0x43
mov byte [rbp + 0x109], 0x72
mov byte [rbp + 0x10a], 0x79
mov byte [rbp + 0x10b], 0x70
mov byte [rbp + 0x10c], 0x74
mov byte [rbp + 0x10d], 0x43
mov byte [rbp + 0x10e], 0x72
mov byte [rbp + 0x10f], 0x65
mov byte [rbp + 0x110], 0x61
mov byte [rbp + 0x111], 0x74
mov byte [rbp + 0x112], 0x65
mov byte [rbp + 0x113], 0x48
mov byte [rbp + 0x114], 0x61
mov byte [rbp + 0x115], 0x73
mov byte [rbp + 0x116], 0x68
mov byte [rbp + 0x117], 0
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x108]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x138], rax
lea rax, [rbp + 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
mov rcx, qword [rbp + 0x58]
call qword [rbp + 0x138]
test eax, eax
jne 0x1400133de
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CreateHash___u__n
call fcn.140011226
nop
jmp 0x140013827
mov byte [rbp + 0x158], 0x43
mov byte [rbp + 0x159], 0x72
mov byte [rbp + 0x15a], 0x79
mov byte [rbp + 0x15b], 0x70
mov byte [rbp + 0x15c], 0x74
mov byte [rbp + 0x15d], 0x48
mov byte [rbp + 0x15e], 0x61
mov byte [rbp + 0x15f], 0x73
mov byte [rbp + 0x160], 0x68
mov byte [rbp + 0x161], 0x44
mov byte [rbp + 0x162], 0x61
mov byte [rbp + 0x163], 0x74
mov byte [rbp + 0x164], 0x61
mov byte [rbp + 0x165], 0
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x158]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x188], rax
xor r9d, r9d
mov r8d, dword [rbp + 0x4e8]
mov rdx, qword [rbp + 0x4e0]
mov rcx, qword [rbp + 0x78]
call qword [rbp + 0x188]
test eax, eax
jne 0x14001349a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptHashData___u__n
call fcn.140011226
nop
jmp 0x140013827
mov byte [rbp + 0x1a8], 0x43
mov byte [rbp + 0x1a9], 0x72
mov byte [rbp + 0x1aa], 0x79
mov byte [rbp + 0x1ab], 0x70
mov byte [rbp + 0x1ac], 0x74
mov byte [rbp + 0x1ad], 0x44
mov byte [rbp + 0x1ae], 0x65
mov byte [rbp + 0x1af], 0x72
mov byte [rbp + 0x1b0], 0x69
mov byte [rbp + 0x1b1], 0x76
mov byte [rbp + 0x1b2], 0x65
mov byte [rbp + 0x1b3], 0x4b
mov byte [rbp + 0x1b4], 0x65
mov byte [rbp + 0x1b5], 0x79
mov byte [rbp + 0x1b6], 0
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x1a8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x1d8], rax
lea rax, [rbp + 0x98]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rbp + 0x78]
mov edx, 0x6610
mov rcx, qword [rbp + 0x58]
call qword [rbp + 0x1d8]
test eax, eax
jne 0x140013564
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptDeriveKey___u__n
call fcn.140011226
nop
jmp 0x140013827
mov byte [rbp + 0x1f8], 0x43
mov byte [rbp + 0x1f9], 0x72
mov byte [rbp + 0x1fa], 0x79
mov byte [rbp + 0x1fb], 0x70
mov byte [rbp + 0x1fc], 0x74
mov byte [rbp + 0x1fd], 0x44
mov byte [rbp + 0x1fe], 0x65
mov byte [rbp + 0x1ff], 0x63
mov byte [rbp + 0x200], 0x72
mov byte [rbp + 0x201], 0x79
mov byte [rbp + 0x202], 0x70
mov byte [rbp + 0x203], 0x74
mov byte [rbp + 0x204], 0
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x1f8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x228], rax
lea rax, [rbp + 0x4d8]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x4d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x98]
call qword [rbp + 0x228]
test eax, eax
jne 0x14001362b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptDecrypt___u__n
call fcn.140011226
nop
jmp 0x140013827
mov byte [rbp + 0x248], 0x43
mov byte [rbp + 0x249], 0x72
mov byte [rbp + 0x24a], 0x79
mov byte [rbp + 0x24b], 0x70
mov byte [rbp + 0x24c], 0x74
mov byte [rbp + 0x24d], 0x52
mov byte [rbp + 0x24e], 0x65
mov byte [rbp + 0x24f], 0x6c
mov byte [rbp + 0x250], 0x65
mov byte [rbp + 0x251], 0x61
mov byte [rbp + 0x252], 0x73
mov byte [rbp + 0x253], 0x65
mov byte [rbp + 0x254], 0x43
mov byte [rbp + 0x255], 0x6f
mov byte [rbp + 0x256], 0x6e
mov byte [rbp + 0x257], 0x74
mov byte [rbp + 0x258], 0x65
mov byte [rbp + 0x259], 0x78
mov byte [rbp + 0x25a], 0x74
mov byte [rbp + 0x25b], 0
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x248]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x278], rax
mov byte [rbp + 0x298], 0x43
mov byte [rbp + 0x299], 0x72
mov byte [rbp + 0x29a], 0x79
mov byte [rbp + 0x29b], 0x70
mov byte [rbp + 0x29c], 0x74
mov byte [rbp + 0x29d], 0x44
mov byte [rbp + 0x29e], 0x65
mov byte [rbp + 0x29f], 0x73
mov byte [rbp + 0x2a0], 0x74
mov byte [rbp + 0x2a1], 0x72
mov byte [rbp + 0x2a2], 0x6f
mov byte [rbp + 0x2a3], 0x79
mov byte [rbp + 0x2a4], 0x48
mov byte [rbp + 0x2a5], 0x61
mov byte [rbp + 0x2a6], 0x73
mov byte [rbp + 0x2a7], 0x68
mov byte [rbp + 0x2a8], 0
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x298]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x2c8], rax
mov byte [rbp + 0x2e8], 0x43
mov byte [rbp + 0x2e9], 0x72
mov byte [rbp + 0x2ea], 0x79
mov byte [rbp + 0x2eb], 0x70
mov byte [rbp + 0x2ec], 0x74
mov byte [rbp + 0x2ed], 0x44
mov byte [rbp + 0x2ee], 0x65
mov byte [rbp + 0x2ef], 0x73
mov byte [rbp + 0x2f0], 0x74
mov byte [rbp + 0x2f1], 0x72
mov byte [rbp + 0x2f2], 0x6f
mov byte [rbp + 0x2f3], 0x79
mov byte [rbp + 0x2f4], 0x4b
mov byte [rbp + 0x2f5], 0x65
mov byte [rbp + 0x2f6], 0x79
mov byte [rbp + 0x2f7], 0
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x2e8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x318], rax
xor edx, edx
mov rcx, qword [rbp + 0x58]
call qword [rbp + 0x278]
nop
mov rcx, qword [rbp + 0x78]
call qword [rbp + 0x2c8]
nop
mov rcx, qword [rbp + 0x98]
call qword [rbp + 0x318]
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x140020930]
call fcn.140011401
mov rcx, qword [rbp + 0x4a8]
xor rcx, rbp
call fcn.14001123f
lea rsp, [rbp + 0x4b8]
pop rdi
pop rbp
ret