Function at 0x405bb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
xor r8d, r8d
movabs rax, 0x3233697061737457
mov rbx, rcx
lea rbp, [rsp + 0x70]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x50], 0
lea rdi, [rsp + 0x90]
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x98], 0x6c6c642e
mov qword [rsp + 0x88], 0xc
mov byte [rsp + 0x9c], 0
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x58], 0x16
call fcn.004abbf0
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
movabs rcx, 0x636f725065746172
mov r15, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x70], rdx
movabs rdx, 0x656d756e45535457
mov qword [rax], rdx
mov edx, 0x4173
mov qword [rax + 8], rcx
mov dword [rax + 0x10], 0x65737365
mov word [rax + 0x14], dx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
mov byte [rdx + rax], 0
mov rcx, qword [rsp + 0x80]
call r15
mov rcx, rax
test rax, rax
je 0x405e38
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
call rax
test rax, rax
je 0x405e6d
lea rdx, [rsp + 0x4c]
lea r9, [rsp + 0x50]
mov r8d, 1
xor ecx, ecx
mov qword [rsp + 0x20], rdx
xor edx, edx
call rax
mov rcx, qword [rsp + 0x60]
mov esi, eax
cmp rcx, rbp
je 0x405cf0
call fcn.004bee60
mov rcx, qword [rsp + 0x80]
cmp rcx, rdi
je 0x405d02
call fcn.004bee60
test esi, esi
je 0x405e30
mov r12d, dword [rsp + 0x4c]
mov r13, qword [rsp + 0x50]
test r12d, r12d
je 0x405d54
lea eax, [r12 - 1]
mov rsi, qword [rbx]
lea r14, [r13 + 4]
xor r12d, r12d
lea rax, [rax + rax*2]
lea rbx, [r13 + rax*8 + 0x1c]
nop dword [rax]
mov rcx, qword [r14 + 4]
mov rdx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x405d4b
mov r12d, dword [r14]
add r14, 0x18
cmp rbx, r14
jne 0x405d38
test r13, r13
je 0x405e10
movabs rax, 0x3233697061737457
mov rcx, rdi
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x90], rax
movabs rax, 0x4d65657246535457
mov dword [rsp + 0x98], 0x6c6c642e
mov qword [rsp + 0x88], 0xc
mov byte [rsp + 0x9c], 0
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0x726f6d65
mov byte [rsp + 0x7c], 0x79
mov qword [rsp + 0x68], 0xd
mov byte [rsp + 0x7d], 0
call r15
mov rcx, rax
test rax, rax
je 0x405e50
mov rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x38]
call rax
test rax, rax
je 0x405e9f
mov rcx, qword [rsp + 0x50]
call rax
mov rcx, qword [rsp + 0x60]
cmp rcx, rbp
je 0x405dfe
call fcn.004bee60
mov rcx, qword [rsp + 0x80]
cmp rcx, rdi
je 0x405e10
call fcn.004bee60
mov eax, r12d
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor r12d, r12d
jmp 0x405e10
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
jmp 0x405ca8
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
jmp 0x405dd3
mov ecx, 0x10
call fcn.004bef90
lea rdx, str.Invalid_API
mov rcx, rax
mov r13, rax
call fcn.00499640
lea r8, [fcn.00499770]
lea rdx, [0x004cd760]
mov rcx, r13
call fcn.004bf7b0
mov ecx, 0x10
call fcn.004bef90
lea rdx, str.Invalid_API
mov rcx, rax
mov r13, rax
call fcn.00499640
lea r8, [fcn.00499770]
lea rdx, [0x004cd760]
mov rcx, r13
call fcn.004bf7b0
mov rcx, r13
mov r12, rax
call fcn.004bf2e0
mov rcx, qword [rsp + 0x60]
cmp rcx, rbp
je 0x405eeb
call fcn.004bee60
mov rcx, qword [rsp + 0x80]
cmp rcx, rdi
je 0x405efd
call fcn.004bee60
mov rcx, r12
call fcn.0041d3d0
jmp 0x405ed1