Function at 0x401110
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
jmp 0x401110
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x210
mov rdi, rsp
movabs rcx, 0x84
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x220]
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x30], 0
mov byte [rsp + 0x48], 0x57
mov byte [rsp + 0x49], 0x69
mov byte [rsp + 0x4a], 0x6e
mov byte [rsp + 0x4b], 0x68
mov byte [rsp + 0x4c], 0x74
mov byte [rsp + 0x4d], 0x74
mov byte [rsp + 0x4e], 0x70
mov byte [rsp + 0x4f], 0x2e
mov byte [rsp + 0x50], 0x64
mov byte [rsp + 0x51], 0x6c
mov byte [rsp + 0x52], 0x6c
mov byte [rsp + 0x53], 0
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x78], 0x34
mov byte [rsp + 0x79], 0xf
mov byte [rsp + 0x7a], 6
mov byte [rsp + 0x7b], 0x2f
mov byte [rsp + 0x7c], 0x18
mov byte [rsp + 0x7d], 0x1f
mov byte [rsp + 0x7e], 0x13
mov byte [rsp + 0x7f], 0x29
mov byte [rsp + 0x80], 0x18
mov byte [rsp + 0x81], 2
mov byte [rsp + 0x82], 2
mov byte [rsp + 0x83], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 2
mov r9d, 1
xor r8d, r8d
mov edx, 0xc
lea rcx, [rsp + 0x78]
call fcn.0040100a
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x220]
mov qword [rcx], rax
mov byte [rsp + 0xa8], 0x34
mov byte [rsp + 0xa9], 0xf
mov byte [rsp + 0xaa], 6
mov byte [rsp + 0xab], 0x2f
mov byte [rsp + 0xac], 0x18
mov byte [rsp + 0xad], 0x1f
mov byte [rsp + 0xae], 0x13
mov byte [rsp + 0xaf], 0x25
mov byte [rsp + 0xb0], 7
mov byte [rsp + 0xb1], 9
mov byte [rsp + 0xb2], 2
mov byte [rsp + 0xb3], 0xe
mov byte [rsp + 0xb4], 0
mov byte [rsp + 0xb5], 0x12
mov byte [rsp + 0xb6], 0
mov dword [rsp + 0x28], 6
mov dword [rsp + 0x20], 5
mov r9d, 4
xor r8d, r8d
mov edx, 0xf
lea rcx, [rsp + 0xa8]
call fcn.0040100a
lea rdx, [rsp + 0xa8]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x220]
mov qword [rcx + 0x10], rax
mov byte [rsp + 0xd8], 0x34
mov byte [rsp + 0xd9], 0xf
mov byte [rsp + 0xda], 6
mov byte [rsp + 0xdb], 0x2f
mov byte [rsp + 0xdc], 0x18
mov byte [rsp + 0xdd], 0x1f
mov byte [rsp + 0xde], 0x13
mov byte [rsp + 0xdf], 0x29
mov byte [rsp + 0xe0], 0x18
mov byte [rsp + 0xe1], 2
mov byte [rsp + 0xe2], 2
mov byte [rsp + 0xe3], 0x39
mov byte [rsp + 0xe4], 6
mov byte [rsp + 0xe5], 0x17
mov byte [rsp + 0xe6], 0x1d
mov byte [rsp + 0xe7], 2
mov byte [rsp + 0xe8], 0x1f
mov byte [rsp + 0xe9], 0x1f
mov byte [rsp + 0xea], 0
mov dword [rsp + 0x28], 9
mov dword [rsp + 0x20], 8
mov r9d, 7
xor r8d, r8d
mov edx, 0x13
lea rcx, [rsp + 0xd8]
call fcn.0040100a
lea rdx, [rsp + 0xd8]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x220]
mov qword [rcx + 0x20], rax
mov byte [rsp + 0x108], 0x34
mov byte [rsp + 0x109], 0xf
mov byte [rsp + 0x10a], 6
mov byte [rsp + 0x10b], 0x2f
mov byte [rsp + 0x10c], 0x18
mov byte [rsp + 0x10d], 0x1f
mov byte [rsp + 0x10e], 0x13
mov byte [rsp + 0x10f], 0x35
mov byte [rsp + 0x110], 0xd
mov byte [rsp + 0x111], 9
mov byte [rsp + 0x112], 8
mov byte [rsp + 0x113], 0x39
mov byte [rsp + 0x114], 6
mov byte [rsp + 0x115], 0x17
mov byte [rsp + 0x116], 0x1d
mov byte [rsp + 0x117], 2
mov byte [rsp + 0x118], 0x1f
mov byte [rsp + 0x119], 0x1f
mov byte [rsp + 0x11a], 0
mov dword [rsp + 0x28], 0xc
mov dword [rsp + 0x20], 0xb
mov r9d, 0xa
lea r8, str.baiodu
mov edx, 0x13
lea rcx, [rsp + 0x108]
call fcn.0040100a
lea rdx, [rsp + 0x108]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x220]
mov qword [rcx + 0x28], rax
mov byte [rsp + 0x138], 0x34
mov byte [rsp + 0x139], 0xf
mov byte [rsp + 0x13a], 6
mov byte [rsp + 0x13b], 0x2f
mov byte [rsp + 0x13c], 0x18
mov byte [rsp + 0x13d], 0x1f
mov byte [rsp + 0x13e], 0x13
mov byte [rsp + 0x13f], 0x34
mov byte [rsp + 0x140], 0xd
mov byte [rsp + 0x141], 4
mov byte [rsp + 0x142], 9
mov byte [rsp + 0x143], 2
mov byte [rsp + 0x144], 0x15
mov byte [rsp + 0x145], 3
mov byte [rsp + 0x146], 0x3a
mov byte [rsp + 0x147], 2
mov byte [rsp + 0x148], 0x1f
mov byte [rsp + 0x149], 0x1b
mov byte [rsp + 0x14a], 0xc
mov byte [rsp + 0x14b], 8
mov byte [rsp + 0x14c], 0x1b
mov byte [rsp + 0x14d], 2
mov byte [rsp + 0x14e], 0
mov dword [rsp + 0x28], 0xf
mov dword [rsp + 0x20], 0xe
mov r9d, 0xd
xor r8d, r8d
mov edx, 0x17
lea rcx, [rsp + 0x138]
call fcn.0040100a
lea rdx, [rsp + 0x138]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x220]
mov qword [rcx + 0x38], rax
mov byte [rsp + 0x168], 0x34
mov byte [rsp + 0x169], 0xf
mov byte [rsp + 0x16a], 6
mov byte [rsp + 0x16b], 0x2f
mov byte [rsp + 0x16c], 0x18
mov byte [rsp + 0x16d], 0x1f
mov byte [rsp + 0x16e], 0x13
mov byte [rsp + 0x16f], 0x37
mov byte [rsp + 0x170], 0x1d
mov byte [rsp + 0x171], 2
mov byte [rsp + 0x172], 0x1e
mov byte [rsp + 0x173], 0x12
mov byte [rsp + 0x174], 0x27
mov byte [rsp + 0x175], 7
mov byte [rsp + 0x176], 0x1c
mov byte [rsp + 0x177], 6
mov byte [rsp + 0x178], 0x2d
mov byte [rsp + 0x179], 0x1d
mov byte [rsp + 0x17a], 2
mov byte [rsp + 0x17b], 0xf
mov byte [rsp + 0x17c], 4
mov byte [rsp + 0x17d], 6
mov byte [rsp + 0x17e], 0xe
mov byte [rsp + 0x17f], 7
mov byte [rsp + 0x180], 6
mov byte [rsp + 0x181], 0
mov dword [rsp + 0x28], 0x12
mov dword [rsp + 0x20], 0x11
mov r9d, 0x10
xor r8d, r8d
mov edx, 0x1a
lea rcx, [rsp + 0x168]
call fcn.0040100a
lea rdx, [rsp + 0x168]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x220]
mov qword [rcx + 0x40], rax
mov byte [rsp + 0x1a8], 0x34
mov byte [rsp + 0x1a9], 0xf
mov byte [rsp + 0x1aa], 6
mov byte [rsp + 0x1ab], 0x2f
mov byte [rsp + 0x1ac], 0x18
mov byte [rsp + 0x1ad], 0x1f
mov byte [rsp + 0x1ae], 0x13
mov byte [rsp + 0x1af], 0x34
mov byte [rsp + 0x1b0], 0xd
mov byte [rsp + 0x1b1], 6
mov byte [rsp + 0x1b2], 8
mov byte [rsp + 0x1b3], 0x2f
mov byte [rsp + 0x1b4], 2
mov byte [rsp + 0x1b5], 0x12
mov byte [rsp + 0x1b6], 9
mov byte [rsp + 0x1b7], 0
mov dword [rsp + 0x28], 0x15
mov dword [rsp + 0x20], 0x14
mov r9d, 0x13
xor r8d, r8d
mov edx, 0x10
lea rcx, [rsp + 0x1a8]
call fcn.0040100a
lea rdx, [rsp + 0x1a8]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x220]
mov qword [rcx + 0x50], rax
mov byte [rsp + 0x1d8], 0x34
mov byte [rsp + 0x1d9], 0xf
mov byte [rsp + 0x1da], 6
mov byte [rsp + 0x1db], 0x2f
mov byte [rsp + 0x1dc], 0x18
mov byte [rsp + 0x1dd], 0x1f
mov byte [rsp + 0x1de], 0x13
mov byte [rsp + 0x1df], 0x25
mov byte [rsp + 0x1e0], 4
mov byte [rsp + 0x1e1], 8
mov byte [rsp + 0x1e2], 0x1f
mov byte [rsp + 0x1e3], 0xe
mov byte [rsp + 0x1e4], 0x2b
mov byte [rsp + 0x1e5], 7
mov byte [rsp + 0x1e6], 6
mov byte [rsp + 0x1e7], 3
mov byte [rsp + 0x1e8], 0
mov byte [rsp + 0x1e9], 0xe
mov byte [rsp + 0x1ea], 0
mov dword [rsp + 0x28], 0x18
mov dword [rsp + 0x20], 0x17
mov r9d, 0x16
xor r8d, r8d
mov edx, 0x13
lea rcx, [rsp + 0x1d8]
call fcn.0040100a
lea rdx, [rsp + 0x1d8]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x220]
mov qword [rcx + 0x58], rax
mov eax, 1
mov rdi, rax
mov rcx, rsp
lea rdx, [0x00470140]
call fcn.004020a0
mov rax, rdi
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.00402080
add rsp, 0x210
pop rdi
ret