Function at 0x4015e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov r11, rsp
sub rsp, 0x98
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov qword [r11 - 8], rdi
mov qword [r11 - 0x10], r12
mov qword [r11 - 0x18], r13
mov qword [r11 - 0x20], r14
mov rax, qword [0x006835c0]
xor rax, rsp
mov qword [rsp + 0x60], rax
movzx r13d, dl
mov rbx, rcx
mov byte [rsp + 0x40], 0x77
mov byte [rsp + 0x41], 0x58
mov byte [rsp + 0x42], 0x52
mov byte [rsp + 0x43], 0x79
mov byte [rsp + 0x44], 0x4a
mov byte [rsp + 0x45], 0x4a
mov byte [rsp + 0x46], VarDateFromDisp
mov byte [rsp + 0x47], 0x77
mov byte [rsp + 0x48], 0x53
mov byte [rsp + 0x49], 0x42
mov byte [rsp + 0x4a], 0x49
mov byte [rsp + 0x4b], 0x56
mov byte [rsp + 0x4c], 0x50
mov byte [rsp + 0x4d], 0x54
mov byte [rsp + 0x4e], VarCyFromDisp
mov byte [rsp + 0x4f], 0x4e
mov byte [rsp + 0x50], 0x44
mov byte [rsp + 0x51], 0x52
mov byte [rsp + 0x52], 0x61
mov byte [rsp + 0x53], 0x43
mov byte [rsp + 0x54], 0
mov rsi, qword [rcx + 0x20]
xor r14d, r14d
test rsi, rsi
je 0x401818
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [r11 - 0x58]
repne scasb al, byte [rdi]
not rcx
lea r12, [rcx - 1]
cmp qword [rbx + 0x28], 0x10
jb 0x4016c0
lea rdi, [rbx + 0x10]
mov rcx, qword [rdi]
jmp 0x4016c7
lea rdi, [rbx + 0x10]
mov rcx, rdi
mov r8, r12
cmp rsi, r12
cmovb r8, rsi
mov dword [rsp + 0x20], 1
mov r9d, 1
lea rdx, [rsp + 0x40]
call fcn.00558b10
movsxd rcx, eax
test eax, eax
jne 0x401700
cmp rsi, r12
jb 0x401708
mov eax, r14d
cmp rsi, r12
setne al
mov ecx, eax
test ecx, ecx
je 0x401818
test r13b, r13b
je 0x40179b
cmp qword [rbx + 0x28], 0x10
jb 0x40171d
mov rcx, qword [rdi]
jmp 0x401720
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
cmp qword [rbx + 0x28], 0x10
jb 0x401738
mov rcx, qword [rdi]
call fcn.00406bd0
mov qword [rbx + 0x28], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbx + 0x20], r14
mov byte [rdi], 0
mov edx, 3
lea rcx, [rsp + 0x30]
call fcn.00586700
mov rdx, qword [rbx]
cmp rdx, 0xfffffffffffffffd
je 0x401789
test rdx, rdx
je 0x401786
nop
nop
nop
mov rax, qword [rbx]
mov qword [rax], r14
mov rax, qword [rbx]
mov rcx, qword [rax + 8]
mov qword [rbx], rcx
cmp rcx, 0
jne 0x401770
mov qword [rbx], r14
lea rcx, [rsp + 0x30]
call fcn.00586750
mov rax, rsi
jmp 0x401885
cmp qword [rbx + 0x28], 0x10
jb 0x4017a7
mov rcx, qword [rdi]
jmp 0x4017aa
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
cmp qword [rbx + 0x28], 0x10
jb 0x4017c2
mov rcx, qword [rdi]
call fcn.00406bd0
mov qword [rbx + 0x28], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbx + 0x20], r14
mov byte [rdi], 0
mov edx, 3
lea rcx, [rsp + 0x30]
call fcn.00586700
mov rdx, qword [rbx]
cmp rdx, 0xfffffffffffffffd
je 0x401809
test rdx, rdx
je 0x401806
nop
mov rax, qword [rbx]
mov qword [rax], r14
mov rax, qword [rbx]
mov rcx, qword [rax + 8]
mov qword [rbx], rcx
cmp rcx, 0
jne 0x4017f0
mov qword [rbx], r14
lea rcx, [rsp + 0x30]
call fcn.00586750
mov rax, rsi
jmp 0x401885
cmp qword [rbx + 0x28], 0x10
jb 0x401828
mov rcx, qword [rbx + 0x10]
call fcn.00406bd0
mov qword [rbx + 0x28], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbx + 0x20], r14
mov byte [rbx + 0x10], 0
mov edx, 3
lea rcx, [rsp + 0x30]
call fcn.00586700
mov rdx, qword [rbx]
cmp rdx, 0xfffffffffffffffd
je 0x401879
test rdx, rdx
je 0x401876
nop
nop
nop
mov rax, qword [rbx]
mov qword [rax], r14
mov rax, qword [rbx]
mov rcx, qword [rax + 8]
mov qword [rbx], rcx
cmp rcx, 0
jne 0x401860
mov qword [rbx], r14
lea rcx, [rsp + 0x30]
call fcn.00586750
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.0054ec60
mov rbx, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xb8]
mov rdi, qword [rsp + 0x90]
mov r12, qword [rsp + 0x88]
mov r13, qword [rsp + 0x80]
mov r14, qword [rsp + 0x78]
add rsp, 0x98
ret