Function at 0x14000f7a4
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x60
lea rcx, [rax - 0x48]
mov byte [rax - 0x48], 0x6e
mov byte [rax - 0x47], 0x74
mov byte [rax - 0x46], 0x64
mov byte [rax - 0x45], 0x6c
mov byte [rax - 0x44], 0x6c
mov byte [rax - 0x43], 0x2e
mov byte [rax - 0x42], 0x64
mov byte [rax - 0x41], 0x6c
mov byte [rax - 0x40], 0x6c
mov byte [rax - 0x3f], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
je 0x14000fa10
lea rdx, str.LdrQueryImageFileExecutionOptions
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlAllocateHeap
mov rcx, rsi
mov qword [0x140019450], rax
neg rax
sbb bl, bl
and bl, 1
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlEnterCriticalSection
mov qword [0x140019458], rax
neg rax
mov rcx, rsi
sbb dil, dil
and dil, bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlFreeHeap
mov qword [0x140019460], rax
neg rax
mov rcx, rsi
sbb bl, bl
and bl, dil
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlFreeUnicodeString
mov qword [0x140019468], rax
neg rax
mov rcx, rsi
sbb dil, dil
and dil, bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlImageDirectoryEntryToData
mov qword [0x140019470], rax
neg rax
mov rcx, rsi
sbb bl, bl
and bl, dil
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlImageNtHeader
mov qword [0x140019478], rax
neg rax
mov rcx, rsi
sbb dil, dil
and dil, bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlLeaveCriticalSection
mov qword [0x140019480], rax
neg rax
mov rcx, rsi
sbb bl, bl
and bl, dil
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlGetCurrentPeb
mov qword [0x140019488], rax
neg rax
mov rcx, rsi
sbb dil, dil
and dil, bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [rsp + 0x30], 0x52
mov qword [0x140019490], rax
neg rax
mov byte [rsp + 0x31], 0x74
sbb bl, bl
mov byte [rsp + 0x32], 0x6c
mov byte [rsp + 0x33], 0x41
mov byte [rsp + 0x34], 0x64
mov byte [rsp + 0x35], 0x64
mov byte [rsp + 0x36], 0x46
and bl, dil
mov byte [rsp + 0x37], 0x75
mov byte [rsp + 0x38], 0x6e
mov byte [rsp + 0x39], 0x63
mov byte [rsp + 0x3a], 0x74
mov byte [rsp + 0x3b], 0x69
mov byte [rsp + 0x3c], 0x6f
mov byte [rsp + 0x3d], 0x6e
mov byte [rsp + 0x3e], 0x54
mov byte [rsp + 0x3f], 0x61
mov byte [rsp + 0x40], 0x62
mov byte [rsp + 0x41], 0x6c
lea rdx, [rsp + 0x30]
mov rcx, rsi
mov byte [rsp + 0x42], 0x65
mov byte [rsp + 0x43], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x48]
mov rcx, rsi
mov byte [rsp + 0x48], 0x52
mov byte [rsp + 0x49], 0x74
mov qword [0x140019498], rax
mov byte [rsp + 0x4a], 0x6c
mov byte [rsp + 0x4b], 0x44
mov byte [rsp + 0x4c], 0x65
mov byte [rsp + 0x4d], 0x6c
mov byte [rsp + 0x4e], 0x65
mov byte [rsp + 0x4f], 0x74
mov byte [rsp + 0x50], 0x65
mov byte [rsp + 0x51], 0x46
mov byte [rsp + 0x52], 0x75
mov byte [rsp + 0x53], 0x6e
mov byte [rsp + 0x54], 0x63
mov byte [rsp + 0x55], 0x74
mov byte [rsp + 0x56], 0x69
mov byte [rsp + 0x57], 0x6f
mov byte [rsp + 0x58], 0x6e
mov byte [rsp + 0x59], 0x54
mov byte [rsp + 0x5a], 0x61
mov byte [rsp + 0x5b], 0x62
mov byte [rsp + 0x5c], 0x6c
mov byte [rsp + 0x5d], 0x65
mov byte [rsp + 0x5e], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400194a0], rax
mov al, bl
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret