Function at 0x1400050a0
Capabilities:
Access peb ldr_data
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x400]
sub rsp, 0x500
mov rax, qword [0x14006c080]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rsi, qword [rcx + 0x20]
test rsi, rsi
je 0x140005502
mov r15d, 0x104
lea r14, str.NTDLL.DLL
xor r12d, r12d
movzx eax, word [rsi + 0x48]
test ax, ax
je 0x140005502
cmp ax, r15w
jae 0x140005502
xor edx, edx
lea rcx, [rbp + 0x1e0]
mov r8d, 0x208
call fcn.140036040
mov r8, qword [rsi + 0x50]
test r8, r8
je 0x140005183
mov rdx, r15
lea rcx, [rbp + 0x1e0]
call fcn.14001e39c
movzx eax, word [rbp + 0x1e0]
mov rbx, r12
test ax, ax
je 0x140005183
lea rdi, [rbp + 0x1e0]
nop dword [rax + rax]
movzx ecx, ax
call fcn.140021194
mov word [rdi], ax
lea rbx, [rbx + 1]
lea rdi, [rbp + 0x1e0]
movzx eax, word [rdi + rbx*2]
lea rdi, [rdi + rbx*2]
test ax, ax
jne 0x140005160
lea rdx, [rbp + 0x1e0]
mov rcx, r12
nop dword [rax]
movzx eax, word [r14 + rcx*2]
cmp ax, word [rdx + rcx*2]
jne 0x1400054f6
movzx eax, word [r14 + rcx*2 + 2]
cmp ax, word [rdx + rcx*2 + 2]
jne 0x1400054f6
add rcx, 2
cmp rcx, 0xa
jne 0x140005190
mov r14, qword [rsi + 0x20]
test r14, r14
je 0x140005502
lea rax, str.NtCreateFile
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x38], rax
lea rax, [section..data]
mov qword [rsp + 0x40], rax
lea rax, str.NtWriteFile
mov qword [rsp + 0x58], rax
lea rax, [0x14006c004]
mov qword [rsp + 0x60], rax
lea rax, str.NtWaitForSingleObject
mov qword [rsp + 0x78], rax
lea rax, [0x14006c010]
mov qword [rbp - 0x80], rax
lea rax, str.NtDelayExecution
mov qword [rbp - 0x68], rax
lea rax, [0x14006c014]
mov qword [rbp - 0x60], rax
lea rax, str.NtClose
mov qword [rbp - 0x48], rax
lea rax, [0x14006c008]
mov qword [rbp - 0x40], rax
lea rax, str.NtCreateUserProcess
mov qword [rbp - 0x28], rax
lea rax, [0x14006c00c]
mov qword [rbp - 0x20], rax
lea rax, str.NtQueryPerformanceCounter
mov qword [rbp - 8], rax
lea rax, [0x14006c020]
mov qword [rbp], rax
lea rax, str.NtOpenProcess
mov qword [rbp + 0x18], rax
lea rax, [0x14006c01c]
mov qword [rbp + 0x20], rax
lea rax, str.NtQuerySystemInformation
mov qword [rbp + 0x38], rax
lea rax, [0x14006c018]
mov qword [rbp + 0x40], rax
lea rax, str.NtQueryInformationProcess
mov qword [rbp + 0x58], rax
lea rax, [0x14006c024]
mov qword [rbp + 0x60], rax
lea rax, str.RtlAllocateHeap
mov qword [rbp + 0x78], rax
lea rax, [0x14006ee38]
mov qword [rbp + 0x88], rax
lea rax, str.RtlFreeHeap
mov qword [rbp + 0x98], rax
lea rax, [0x14006ee28]
mov qword [rbp + 0xa8], rax
lea rax, str.RtlCreateProcessParametersEx
mov qword [rbp + 0xb8], rax
lea rax, [0x14006ee40]
mov qword [rbp + 0xc8], rax
lea rax, str.RtlDestroyProcessParameters
mov qword [rbp + 0xd8], rax
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x68], r12
mov dword [rsp + 0x70], 1
mov qword [rbp - 0x78], r12
mov dword [rbp - 0x70], 1
mov qword [rbp - 0x58], r12
mov dword [rbp - 0x50], 1
mov qword [rbp - 0x38], r12
mov dword [rbp - 0x30], 1
mov qword [rbp - 0x18], r12
mov dword [rbp - 0x10], 1
mov qword [rbp + 8], r12
mov dword [rbp + 0x10], 1
mov qword [rbp + 0x28], r12
mov dword [rbp + 0x30], 1
mov qword [rbp + 0x48], r12
mov dword [rbp + 0x50], 1
mov qword [rbp + 0x68], r12
mov dword [rbp + 0x70], r12d
mov qword [rbp + 0x80], r12
mov dword [rbp + 0x90], r12d
mov qword [rbp + 0xa0], r12
mov dword [rbp + 0xb0], r12d
mov qword [rbp + 0xc0], r12
mov dword [rbp + 0xd0], r12d
lea rax, [0x14006ee30]
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], rax
mov eax, 0x5a4d
cmp word [r14], ax
jne 0x140005502
movsxd rax, dword [r14 + 0x3c]
add rax, r14
cmp dword [rax], 0x4550
jne 0x140005502
movups xmm0, xmmword [rax + 0x18]
lea rcx, [rbp + 0xf0]
xor esi, esi
movups xmm1, xmmword [rax + 0x28]
xor edi, edi
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x38]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x48]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x68]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x78]
movups xmmword [rcx + 0x50], xmm1
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax + 0x88]
sub rax, 0xffffffffffffff68
movups xmmword [rcx - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rcx], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm1
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm0
movups xmm0, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm1
movups xmm1, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm1
mov r15d, dword [rbp + 0x160]
add r15, r14
mov r12d, dword [r15 + 0x20]
mov r13d, dword [r15 + 0x1c]
add r12, r14
mov ecx, dword [r15 + 0x24]
add r13, r14
add rcx, r14
mov qword [rsp + 0x20], rcx
cmp dword [r15 + 0x14], esi
jbe 0x140005502
nop dword [rax]
movzx eax, word [rcx + rdi*2]
lea r10, [rsp + 0x38]
mov r11d, dword [r12 + rdi*4]
add r11, r14
mov ebx, dword [r13 + rax*4]
add rbx, r14
xor r9d, r9d
nop dword [rax + rax]
mov rax, qword [r10]
mov r8, r11
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400054e3
inc rax
test ecx, ecx
jne 0x1400054d0
test edx, edx
je 0x140005537
inc r9d
add r10, 0x20
cmp r9d, 0xe
jb 0x1400054c0
jmp 0x140005562
mov rsi, qword [rsi]
test rsi, rsi
jne 0x140005102
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.140018810
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov eax, r9d
shl rax, 5
mov ecx, dword [rsp + rax + 0x30]
cmp ecx, 1
jne 0x140005554
mov rax, qword [rsp + rax + 0x40]
movzx ecx, byte [rbx + 4]
mov dword [rax], ecx
jmp 0x140005560
test ecx, ecx
jne 0x140005560
mov rax, qword [rsp + rax + 0x48]
mov qword [rax], rbx
inc esi
cmp esi, 0xe
je 0x14000557a
mov rcx, qword [rsp + 0x20]
inc edi
cmp edi, dword [r15 + 0x14]
jb 0x1400054a0
jmp 0x140005502
xor eax, eax
jmp 0x140005507