Function at 0x140001b00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x98
mov byte [rsp + 0x40], ILFindChild
mov byte [rsp + 0x41], 0x5a
mov byte [rsp + 0x42], 3
mov byte [rsp + 0x43], reloc.SHELL32.dll_ILFree
mov byte [rsp + 0x44], 0x67
mov byte [rsp + 0x45], ILCreateFromPathW
mov byte [rsp + 0x46], 0x9e
mov byte [rsp + 0x47], 0x7c
mov byte [rsp + 0x48], 0xee
mov byte [rsp + 0x49], reloc.SHELL32.dll_ILIsParent
mov byte [rsp + 0x4a], 0xc7
mov byte [rsp + 0x4b], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x4c], 0xd1
mov byte [rsp + 0x50], 7
mov byte [rsp + 0x51], reloc.SHELL32.dll_SHUpdateImageW
mov byte [rsp + 0x52], 0x50
mov byte [rsp + 0x53], reloc.SHELL32.dll_ILSaveToStream
mov byte [rsp + 0x54], 0x66
mov byte [rsp + 0x55], reloc.SHELL32.dll_SHDoDragDrop
mov byte [rsp + 0x56], 0xce
mov byte [rsp + 0x57], 0xb6
mov byte [rsp + 0x58], 0xab
mov byte [rsp + 0x59], 0xaf
mov byte [rsp + 0x5a], 0x63
mov byte [rsp + 0x5b], 0x38
mov byte [rsp + 0x5c], 0x23
mov byte [rsp + 0x30], 0xff
mov byte [rsp + 0x31], 0x25
mov byte [rsp + 0x32], 0x9c
mov byte [rsp + 0x33], 0x79
mov byte [rsp + 0x34], 0xd7
mov byte [rsp + 0x35], 0xc6
mov byte [rsp + 0x36], 0x8f
mov byte [rsp + 0x37], 0x66
mov byte [rsp + 0x38], 0x6c
mov byte [rsp + 0x39], 0xa3
mov byte [rsp + 0x60], 7
mov byte [rsp + 0x61], reloc.SHELL32.dll_SHUpdateImageW
mov byte [rsp + 0x62], 0xd2
mov byte [rsp + 0x63], ILSaveToStream
mov byte [rsp + 0x64], 0xe6
mov byte [rsp + 0x65], 0x79
mov byte [rsp + 0x66], 0xe6
mov byte [rsp + 0x67], SHDoDragDrop
mov byte [rsp + 0x68], 0xaf
mov byte [rsp + 0x69], PathMakeUniqueName
mov byte [rsp + 0x6a], 0xaf
mov byte [rsp + 0x6b], 0x22
mov byte [rsp + 0x6c], PathYetAnotherMakeUniqueName
mov byte [rsp + 0x6d], 0xd7
mov byte [rsp + 0x6e], 0xc7
mov byte [rsp + 0x6f], 0xee
mov byte [rsp + 0x70], 0xdf
mov byte [rsp + 0x71], 0x4e
mov byte [rsp + 0x72], 0x6d
mov byte [rsp + 0x73], 0xa4
mov dword [rsp + 0x24], 0xe1ce384d
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
movsxd rax, dword [rsp + 0x20]
cmp rax, 0xd
jae 0x140001c86
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, byte [rcx + rax]
xor eax, dword [rsp + 0x24]
movzx ecx, byte [rsp + 0x24]
rol al, cl
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov byte [rdx + rcx], al
mov eax, dword [rsp + 0x24]
ror eax, 3
sub eax, 0x85fd
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
jmp 0x140001c39
mov dword [rsp + 0x24], 0xd3982d6d
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
movsxd rax, dword [rsp + 0x20]
cmp rax, 0xd
jae 0x140001ced
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, byte [rcx + rax]
xor eax, dword [rsp + 0x24]
movzx ecx, byte [rsp + 0x24]
rol al, cl
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov byte [rdx + rcx], al
mov eax, dword [rsp + 0x24]
ror eax, 3
sub eax, 0x85fd
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
jmp 0x140001ca0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x24], 0x21a26d46
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
movsxd rax, dword [rsp + 0x20]
cmp rax, 0xa
jae 0x140001d75
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, byte [rcx + rax]
xor eax, dword [rsp + 0x24]
movzx ecx, byte [rsp + 0x24]
rol al, cl
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov byte [rdx + rcx], al
mov eax, dword [rsp + 0x24]
ror eax, 3
sub eax, 0x85fd
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
jmp 0x140001d28
mov dword [rsp + 0x24], 0xd3982d6d
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
movsxd rax, dword [rsp + 0x20]
cmp rax, 0x14
jae 0x140001ddc
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, byte [rcx + rax]
xor eax, dword [rsp + 0x24]
movzx ecx, byte [rsp + 0x24]
rol al, cl
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov byte [rdx + rcx], al
mov eax, dword [rsp + 0x24]
ror eax, 3
sub eax, 0x85fd
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
jmp 0x140001d8f
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
test rax, rax
je 0x140001e22
mov dword [rsp + 0x78], 1
jmp 0x140001e2a
mov dword [rsp + 0x78], 0
mov eax, dword [rsp + 0x78]
add rsp, 0x98
ret