Function at 0x18001fa00
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x3f0
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x3e8], rbx
mov qword [rbp + 0x3f0], rsi
mov qword [rbp + 0x3f8], rdi
mov rax, qword [0x180031010]
xor rax, rbp
mov qword [rbp + 0x3b0], rax
mov r15, rcx
mov word [rbp + 0x68], 0x4f53
lea rcx, [rbp + 0x80]
mov dword [rbp + 0x6d], 0x5c455241
xor edx, edx
mov byte [rbp + 0x71], 0
mov r8d, 0x104
mov word [rbp + 0x6b], 0x5754
mov byte [rbp + 0x6a], 0x46
mov dword [rbp + 0x59], 0x732573
mov byte [rbp + 0x58], 0x25
call fcn.180003100
lea rcx, str.RSpeedupTab
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x18001fa83
inc eax
xor edi, edi
cmp eax, 0x3fffffff
jle 0x18001fa9c
mov eax, edi
jmp 0x18001fad7
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x18001fab8
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180014b70
sub rsp, rcx
mov r9d, 3
lea rcx, [rsp + 0x30]
call fcn.180001580
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x58]
lea rax, [rbp + 0x68]
mov edx, 0x104
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x80]
call fcn.180001510
lea rcx, [rbp + 0x20]
mov dword [rbp + 0x19], 0x6c6c64
mov esi, 1
mov dword [rbp + 0x15], 0x2e323369
mov word [rbp + 0x13], 0x7061
mov word [rbp + 0x10], 0x6441
mov byte [rbp + 0x12], 0x76
mov word [rbp + 0x3a], 0x4179
mov dword [rbp + 0x35], 0x61726269
mov dword [rbp + 0x30], 0x64616f4c
mov byte [rbp + 0x3c], dil
mov byte [rbp + 0x39], 0x72
mov byte [rbp + 0x34], 0x4c
mov dword [rbp + 0x27], 0x6c642e32
mov word [rbp + 0x2b], 0x6c
mov dword [rbp + 0x21], 0x656e7265
mov word [rbp + 0x25], 0x336c
mov byte [rbp + 0x20], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001fe59
lea rcx, [rbp + 0x10]
call rax
mov rbx, rax
test rax, rax
je 0x18001fe59
lea rdx, [rbp + 0x40]
mov dword [rbp + 0x4a], 0x417845
mov rcx, rax
mov word [rbp + 0x40], 0x6552
mov dword [rbp + 0x43], 0x6e65704f
mov word [rbp + 0x47], 0x654b
mov byte [rbp + 0x42], 0x67
mov byte [rbp + 0x49], 0x79
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001fbec
lea rcx, [rbp + 8]
mov r9d, 0x20019
mov qword [rsp + 0x20], rcx
lea rdx, [rbp + 0x80]
mov rcx, 0xffffffff80000001
xor r8d, r8d
call rax
mov esi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
jne 0x18001fe59
xor edx, edx
lea rcx, [rbp + 0x2a0]
mov r8d, 0x104
call fcn.180003100
mov r14, qword [rbp + 8]
lea rcx, [rbp + 0x10]
mov dword [rbp + 0x62], 0x736c61
mov esi, 1
mov word [rbp + 0x60], 0x7668
mov dword [rbp + 0x39], 0x6c6c64
mov dword [rbp + 0x35], 0x2e323369
mov word [rbp + 0x33], 0x7061
mov word [rbp + 0x30], 0x6441
mov byte [rbp + 0x32], 0x76
mov word [rbp + 0x2a], 0x4179
mov dword [rbp + 0x25], 0x61726269
mov dword [rbp + 0x20], 0x64616f4c
mov byte [rbp + 0x2c], dil
mov byte [rbp + 0x29], 0x72
mov byte [rbp + 0x24], 0x4c
mov dword [rbp + 0x17], 0x6c642e32
mov word [rbp + 0x1b], 0x6c
mov dword [rbp + 0x11], 0x656e7265
mov word [rbp + 0x15], 0x336c
mov byte [rbp + 0x10], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001fe50
lea rcx, [rbp + 0x30]
call rax
mov rbx, rax
test rax, rax
je 0x18001fe50
lea rdx, [rbp + 0x40]
mov dword [rbp + 0x4c], 0x41784565
mov rcx, rax
mov dword [rbp + 0x48], 0x756c6156
mov word [rbp + 0x43], 0x7551
mov word [rbp + 0x40], 0x6552
mov word [rbp + 0x45], 0x7265
mov byte [rbp + 0x47], 0x79
mov byte [rbp + 0x42], 0x67
mov byte [rbp + 0x50], dil
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001fd19
lea rcx, [rbp + 4]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x2a0]
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, r14
call rax
mov esi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
jne 0x18001fe50
cmp dword [rbp + 4], edi
jbe 0x18001fe50
xor edx, edx
lea rcx, [rbp + 0x190]
mov r8d, 0x104
call fcn.180003100
lea r9, [rbp]
mov word [rbp], 0x6425
mov edx, 0x104
mov byte [rbp + 2], dil
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], r15
lea rcx, [rbp + 0x190]
call fcn.180001510
lea rcx, [rbp + 0x10]
mov dword [rbp + 0x20], 0x776c6853
mov dword [rbp + 0x24], 0x2e697061
mov word [rbp + 0x29], 0x6c6c
mov byte [rbp + 0x2b], dil
mov byte [rbp + 0x28], 0x64
mov word [rbp + 0x4a], 0x4179
mov dword [rbp + 0x45], 0x61726269
mov dword [rbp + 0x40], 0x64616f4c
mov byte [rbp + 0x4c], dil
mov byte [rbp + 0x49], 0x72
mov byte [rbp + 0x44], 0x4c
mov dword [rbp + 0x17], 0x6c642e32
mov word [rbp + 0x1b], 0x6c
mov dword [rbp + 0x11], 0x656e7265
mov word [rbp + 0x15], 0x336c
mov byte [rbp + 0x10], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001fe50
lea rcx, [rbp + 0x20]
call rax
mov rbx, rax
test rax, rax
je 0x18001fe50
lea rdx, [rbp + 0x30]
mov dword [rbp + 0x35], 0x414972
mov rcx, rax
mov word [rbp + 0x33], 0x7453
mov word [rbp + 0x30], 0x7453
mov byte [rbp + 0x32], 0x72
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001fe32
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x2a0]
call rax
mov rdi, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rdi, rdi
je 0x18001fe50
mov rcx, qword [rbp + 8]
call fcn.18001ee10
mov eax, 1
jmp 0x18001fe62
mov rcx, qword [rbp + 8]
call fcn.18001ee10
mov rcx, r15
call qword [0x18005c8d8]
mov rcx, qword [rbp + 0x3b0]
xor rcx, rbp
call fcn.180001600
mov rbx, qword [rbp + 0x3e8]
mov rsi, qword [rbp + 0x3f0]
mov rdi, qword [rbp + 0x3f8]
lea rsp, [rbp + 0x3c0]
pop r15
pop r14
pop rbp
ret