Function at 0x4014f0
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
mov r11, rsp
sub rsp, 0x498
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x30], r13
mov qword [r11 - 0x38], r14
mov qword [r11 - 0x40], r15
mov rax, qword [0x00413040]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, r9
mov r14, r8
mov rbp, rcx
mov qword [r11 - 0x358], r9
mov rax, qword [r9 + 0x20]
cmp rax, 0x10
jb 0x401558
lea rbx, [r9 + 8]
mov rcx, qword [rbx]
jmp 0x40155f
lea rbx, [r9 + 8]
mov rcx, rbx
mov rdx, qword [r9 + 0x18]
lea rsi, [rcx + rdx]
test rsi, rsi
je 0x401595
cmp rax, 0x10
jb 0x401577
mov rcx, qword [rbx]
jmp 0x40157a
mov rcx, rbx
cmp rcx, rsi
ja 0x401595
cmp rax, 0x10
jb 0x40158a
mov rax, qword [rbx]
jmp 0x40158d
mov rax, rbx
add rax, rdx
cmp rsi, rax
jbe 0x40159a
call fcn.00404090
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rsi
mov rax, qword [rdi + 0x20]
cmp rax, 0x10
jb 0x4015b3
mov rsi, qword [rbx]
jmp 0x4015b6
mov rsi, rbx
test rsi, rsi
je 0x4015e5
cmp rax, 0x10
jb 0x4015c6
mov rcx, qword [rbx]
jmp 0x4015c9
mov rcx, rbx
cmp rcx, rsi
ja 0x4015e5
cmp rax, 0x10
jb 0x4015d9
mov rcx, qword [rbx]
jmp 0x4015dc
mov rcx, rbx
add rcx, qword [rdi + 0x18]
cmp rsi, rcx
jbe 0x4015ea
call fcn.00404090
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x138], 7
xor r15d, r15d
mov qword [rsp + 0x130], r15
mov word [rsp + 0x120], r15w
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
movzx r9d, byte [rsp + 0x4c]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x118]
call fcn.00403390
nop
mov byte [rsp + 0x148], r15b
mov byte [rsp + 0x149], 0xa
mov byte [rsp + 0x14a], 0x38
mov byte [rsp + 0x14b], 0x3a
mov byte [rsp + 0x14c], 0x23
mov byte [rsp + 0x14d], 0x10
mov byte [rsp + 0x14e], 0x27
mov byte [rsp + 0x14f], 0x2c
mov byte [rsp + 0x150], 0x26
mov byte [rsp + 0x151], 0x17
mov byte [rsp + 0x152], 0x39
mov byte [rsp + 0x153], r15b
mov byte [rsp + 0x40], 0x57
mov byte [rsp + 0x41], 0x63
mov byte [rsp + 0x42], 0x56
mov byte [rsp + 0x43], r15b
mov byte [rsp + 0x44], 0x72
mov byte [rsp + 0x45], 0x57
mov byte [rsp + 0x46], 0x64
mov byte [rsp + 0x47], r15b
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
lea r8d, [r15 + 0xb]
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0xa0]
call fcn.00401060
mov r12, rax
cmp qword [rax + 0x20], 0x10
jb 0x40170b
lea rsi, [rax + 8]
mov rdx, qword [rsi]
jmp 0x401712
lea rsi, [rax + 8]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
cmp qword [r12 + 0x20], 0x10
jb 0x40172e
mov rcx, qword [rsi]
call fcn.00403c20
mov qword [r12 + 0x20], 0xf
mov qword [r12 + 0x18], r15
mov byte [rsi], 0
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call r13
mov r15, rax
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x158], 0xf
mov byte [rsp + 0x159], 6
mov byte [rsp + 0x15a], 0xc
mov byte [rsp + 0x15b], 0x2b
mov byte [rsp + 0x15c], 0x15
mov byte [rsp + 0x15d], 0x24
mov byte [rsp + 0x15e], 0x28
mov byte [rsp + 0x15f], 0x2c
mov byte [rsp + 0x160], 0xd
mov byte [rsp + 0x161], 0xd
mov byte [rsp + 0x162], 0xf
mov byte [rsp + 0x163], 0x35
mov byte [rsp + 0x164], 0x3b
mov byte [rsp + 0x165], 0x1b
mov byte [rsp + 0x166], 0
lea rcx, [rsp + 0x40]
lea rdx, [0x00400000]
movzx eax, word [rdx + 0xff78]
mov word [rcx], ax
movzx eax, byte [rdx + 0xff7a]
mov byte [rcx + 2], al
lea rcx, [rsp + 0x44]
movzx eax, word [rdx + 0xff7c]
mov word [rcx], ax
movzx eax, byte [rdx + 0xff7e]
mov byte [rcx + 2], al
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
mov r8d, 0xe
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0xf0]
call fcn.00401060
mov r12, rax
cmp qword [rax + 0x20], 0x10
jb 0x401847
lea rsi, [rax + 8]
mov rdx, qword [rsi]
jmp 0x40184e
lea rsi, [rax + 8]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
cmp qword [r12 + 0x20], 0x10
jb 0x40186a
mov rcx, qword [rsi]
call fcn.00403c20
mov qword [r12 + 0x20], 0xf
mov qword [r12 + 0x18], 0
mov byte [rsi], 0
xor r9d, r9d
mov r8w, 0x50
lea rdx, [0x0040ff80]
mov rcx, r15
call r13
mov qword [rsp + 0x50], rax
mov word [rsp + 0x1d8], 0x47
mov word [rsp + 0x1da], 0x45
mov word [rsp + 0x1dc], 0x54
mov word [rsp + 0x1de], 0
mov byte [rsp + 0x178], 0x24
mov byte [rsp + 0x179], 0x1b
mov byte [rsp + 0x17a], 8
mov byte [rsp + 0x17b], 0x2f
mov byte [rsp + 0x17c], 0
mov byte [rsp + 0x17d], 0x1c
mov byte [rsp + 0x17e], 3
mov byte [rsp + 0x17f], 0x3d
mov byte [rsp + 0x180], 0x16
mov byte [rsp + 0x181], 2
mov byte [rsp + 0x182], 0x1a
mov byte [rsp + 0x183], 0x3a
mov byte [rsp + 0x184], 0x16
mov byte [rsp + 0x185], 3
mov byte [rsp + 0x186], 0x13
mov byte [rsp + 0x187], 2
mov byte [rsp + 0x188], 7
mov byte [rsp + 0x189], 0x1c
mov byte [rsp + 0x18a], 0
lea rcx, [rsp + 0x40]
lea rdx, [0x00400000]
movzx eax, word [rdx + 0xff94]
mov word [rcx], ax
movzx eax, byte [rdx + 0xff96]
mov byte [rcx + 2], al
lea rcx, [rsp + 0x44]
movzx eax, word [rdx + 0xff98]
mov word [rcx], ax
movzx eax, byte [rdx + 0xff9a]
mov byte [rcx + 2], al
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
mov r8d, 0x12
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0xc8]
call fcn.00401060
mov r12, rax
lea r15, [rsp + 0x120]
cmp qword [rsp + 0x138], 8
cmovae r15, qword [rsp + 0x120]
cmp qword [rax + 0x20], 0x10
jb 0x4019e9
lea rsi, [rax + 8]
mov rdx, qword [rsi]
jmp 0x4019f0
lea rsi, [rax + 8]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
cmp qword [r12 + 0x20], 0x10
jb 0x401a0c
mov rcx, qword [rsi]
call fcn.00403c20
mov qword [r12 + 0x20], 0xf
xor eax, eax
mov qword [r12 + 0x18], rax
mov byte [rsi], al
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, r15
lea rdx, [rsp + 0x1d8]
mov rcx, qword [rsp + 0x50]
call r13
mov r15, rax
mov byte [rsp + 0x190], 0x10
mov byte [rsp + 0x191], 0x3e
mov byte [rsp + 0x192], 0x24
mov byte [rsp + 0x193], 0x3b
mov byte [rsp + 0x194], 0x27
mov byte [rsp + 0x195], 0x1b
mov byte [rsp + 0x196], 0x37
mov byte [rsp + 0x197], 4
mov byte [rsp + 0x198], 0x2f
mov byte [rsp + 0x199], 0x1d
mov byte [rsp + 0x19a], 0x37
mov byte [rsp + 0x19b], 0x3d
mov byte [rsp + 0x19c], 0x22
mov byte [rsp + 0x19d], 0x26
mov byte [rsp + 0x19e], 0x3f
mov byte [rsp + 0x19f], 0x16
mov byte [rsp + 0x1a0], 0x20
mov byte [rsp + 0x1a1], 0x1b
mov byte [rsp + 0x1a2], 0
lea rcx, [rsp + 0x40]
lea rdx, [0x00400000]
movzx eax, word [rdx + 0xff9c]
mov word [rcx], ax
movzx eax, byte [rdx + 0xff9e]
mov byte [rcx + 2], al
lea rcx, [rsp + 0x44]
movzx eax, word [rdx + 0xffa0]
mov word [rcx], ax
movzx eax, byte [rdx + 0xffa2]
mov byte [rcx + 2], al
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
mov r8d, 0x12
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x78]
call fcn.00401060
mov r12, rax
cmp qword [rax + 0x20], 0x10
jb 0x401b50
lea rsi, [rax + 8]
mov rdx, qword [rsi]
jmp 0x401b57
lea rsi, [rax + 8]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
cmp qword [r12 + 0x20], 0x10
jb 0x401b73
mov rcx, qword [rsi]
call fcn.00403c20
mov qword [r12 + 0x20], 0xf
xor eax, eax
mov qword [r12 + 0x18], rax
mov byte [rsi], al
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call r13
mov byte [rsp + 0x1c0], 0x2e
mov byte [rsp + 0x1c1], 1
mov byte [rsp + 0x1c2], 8
mov byte [rsp + 0x1c3], 0x3a
mov byte [rsp + 0x1c4], 0
mov byte [rsp + 0x1c5], 0x10
mov byte [rsp + 0x1c6], 9
mov byte [rsp + 0x1c7], 0x3a
mov byte [rsp + 0x1c8], 3
mov byte [rsp + 0x1c9], 0x11
mov byte [rsp + 0x1ca], 0x11
mov byte [rsp + 0x1cb], 0xd
mov byte [rsp + 0x1cc], 0xf
mov byte [rsp + 0x1cd], 0xd
mov byte [rsp + 0x1ce], 0x34
mov byte [rsp + 0x1cf], 0x17
mov byte [rsp + 0x1d0], 7
mov byte [rsp + 0x1d1], 0x14
mov byte [rsp + 0x1d2], 0x16
mov byte [rsp + 0x1d3], 6
mov byte [rsp + 0x1d4], 0x15
mov byte [rsp + 0x1d5], 0x17
mov byte [rsp + 0x1d6], 0
lea rcx, [rsp + 0x40]
lea rdx, [0x00400000]
movzx eax, word [rdx + 0xffa4]
mov word [rcx], ax
movzx eax, byte [rdx + 0xffa6]
mov byte [rcx + 2], al
lea rcx, [rsp + 0x44]
movzx eax, word [rdx + 0xffa8]
mov word [rcx], ax
movzx eax, byte [rdx + 0xffaa]
mov byte [rcx + 2], al
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
mov r8d, 0x16
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x78]
call fcn.00401060
mov r12, rax
cmp qword [rax + 0x20], 0x10
jb 0x401ccb
lea rsi, [rax + 8]
mov rdx, qword [rsi]
jmp 0x401cd2
lea rsi, [rax + 8]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
cmp qword [r12 + 0x20], 0x10
jb 0x401cee
mov rcx, qword [rsi]
call fcn.00403c20
mov qword [r12 + 0x20], 0xf
mov qword [r12 + 0x18], 0
mov byte [rsi], 0
xor edx, edx
mov rcx, r15
call r13
mov edx, 8
mov r8d, 0x60e
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp], rax
mov byte [rsp + 0x168], 0xd
mov byte [rsp + 0x169], 0x1e
mov byte [rsp + 0x16a], 0x2d
mov byte [rsp + 0x16b], 0x11
mov byte [rsp + 0x16c], 0x25
mov byte [rsp + 0x16d], 0x3b
mov byte [rsp + 0x16e], 0x2a
mov byte [rsp + 0x16f], 0x25
mov byte [rsp + 0x170], 0x26
mov byte [rsp + 0x171], 0x38
mov byte [rsp + 0x172], 0x35
mov byte [rsp + 0x173], 0xb
mov byte [rsp + 0x174], 0x3b
mov byte [rsp + 0x175], 3
mov byte [rsp + 0x176], 0x22
mov byte [rsp + 0x177], 0
lea rcx, [rsp + 0x40]
lea rdx, [0x00400000]
movzx eax, word [rdx + 0xffac]
mov word [rcx], ax
movzx eax, byte [rdx + 0xffae]
mov byte [rcx + 2], al
lea rcx, [rsp + 0x44]
movzx eax, word [rdx + 0xffb0]
mov word [rcx], ax
movzx eax, byte [rdx + 0xffb2]
mov byte [rcx + 2], al
mov dword [rsp + 0x48], 0
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
mov r8d, 0xf
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x78]
call fcn.00401060
mov r12, rax
cmp qword [rax + 0x20], 0x10
jb 0x401e1f
lea rsi, [rax + 8]
mov rdx, qword [rsi]
jmp 0x401e26
lea rsi, [rax + 8]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
cmp qword [r12 + 0x20], 0x10
jb 0x401e42
mov rcx, qword [rsi]
call fcn.00403c20
mov qword [r12 + 0x20], 0xf
mov qword [r12 + 0x18], 0
mov byte [rsi], 0
lea r9, [rsp + 0x48]
mov r8d, 0x258
lea rdx, [rsp + 0x1e0]
mov rcx, r15
call r13
test eax, eax
je 0x401eb9
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x401eb9
mov r8, rax
mov ecx, dword [rbp + 8]
add rcx, qword [rbp]
lea rdx, [rsp + 0x1e0]
call fcn.00404aa0
mov r11d, dword [rsp + 0x48]
add dword [rbp + 8], r11d
lea r9, [rsp + 0x48]
mov r8d, 0x258
lea rdx, [rsp + 0x1e0]
mov rcx, r15
call r13
test eax, eax
jne 0x401e74
mov byte [rsp + 0x1a8], 0x2e
mov byte [rsp + 0x1a9], 0x1c
mov byte [rsp + 0x1aa], 9
mov byte [rsp + 0x1ab], 0x1f
mov byte [rsp + 0x1ac], 0x27
mov byte [rsp + 0x1ad], 0x31
mov byte [rsp + 0x1ae], 9
mov byte [rsp + 0x1af], 0x36
mov byte [rsp + 0x1b0], 0xb
mov byte [rsp + 0x1b1], 0x38
mov byte [rsp + 0x1b2], 0x20
mov byte [rsp + 0x1b3], 0x20
mov byte [rsp + 0x1b4], 0x31
mov byte [rsp + 0x1b5], 0x14
mov byte [rsp + 0x1b6], 9
mov byte [rsp + 0x1b7], 0x33
mov byte [rsp + 0x1b8], 0x3f
mov byte [rsp + 0x1b9], 0x20
mov byte [rsp + 0x1ba], 0
lea rcx, [rsp + 0x40]
lea rdx, [0x00400000]
movzx eax, word [rdx + 0xffb4]
mov word [rcx], ax
movzx eax, byte [rdx + 0xffb6]
mov byte [rcx + 2], al
lea rcx, [rsp + 0x44]
movzx eax, word [rdx + 0xffb8]
mov word [rcx], ax
movzx eax, byte [rdx + 0xffba]
mov byte [rcx + 2], al
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
mov r8d, 0x12
lea rdx, [rsp + 0x1a8]
lea rcx, [rsp + 0x78]
call fcn.00401060
mov rbp, rax
cmp qword [rax + 0x20], 0x10
jb 0x401fc4
lea rsi, [rax + 8]
mov rdx, qword [rsi]
jmp 0x401fcb
lea rsi, [rax + 8]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
cmp qword [rbp + 0x20], 0x10
jb 0x401fe6
mov rcx, qword [rsi]
call fcn.00403c20
mov qword [rbp + 0x20], 0xf
xor r13d, r13d
mov qword [rbp + 0x18], r13
mov byte [rsi], r13b
mov rcx, r15
call r12
mov rcx, qword [rsp + 0x50]
call r12
mov rcx, qword [rsp + 0x60]
call r12
nop
cmp qword [rsp + 0x138], 8
jb 0x402027
mov rcx, qword [rsp + 0x120]
call fcn.00403c20
mov qword [rsp + 0x138], 7
mov qword [rsp + 0x130], r13
mov word [rsp + 0x120], 0
cmp qword [rdi + 0x20], 0x10
jb 0x402054
mov rcx, qword [rbx]
call fcn.00403c20
mov qword [rdi + 0x20], 0xf
mov qword [rdi + 0x18], r13
mov byte [rbx], 0
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.004039d0
mov rbx, qword [rsp + 0x490]
mov rbp, qword [rsp + 0x488]
mov rsi, qword [rsp + 0x480]
mov rdi, qword [rsp + 0x478]
mov r12, qword [rsp + 0x470]
mov r13, qword [rsp + 0x468]
mov r14, qword [rsp + 0x460]
mov r15, qword [rsp + 0x458]
add rsp, 0x498
ret