Function at 0x140004730
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rbx, qword gs:[0x60]
xor r15d, r15d
mov dword [rbp + 7], 0x65006b
mov dword [rbp + 0xb], 0x6e0072
mov dword [rbp + 0xf], 0x6c0065
mov dword [rbp + 0x13], 0x320033
mov dword [rbp + 0x17], 0x64002e
mov dword [rbp + 0x1b], 0x6c006c
mov word [rbp + 0x1f], r15w
test rbx, rbx
je 0x140004817
mov rbx, qword [rbx + 0x18]
test rbx, rbx
je 0x140004817
mov r9, qword [rbx + 0x10]
add rbx, 0x10
cmp r9, rbx
je 0x140004817
nop word [rax + rax]
mov r11, qword [r9 + 0x60]
lea r10, [rbp + 7]
nop dword [rax + rax]
movzx ecx, word [r11]
lea r11, [r11 + 2]
lea r10, [r10 + 2]
lea eax, [rcx - 0x41]
cmp ax, 0x19
lea r8d, [rcx + 0x20]
cmova r8w, cx
movzx ecx, word [r10 - 2]
lea eax, [rcx - 0x42]
cmp ax, 0x17
lea edx, [rcx + 0x20]
cmova dx, cx
test r8w, r8w
je 0x140004806
cmp r8w, dx
je 0x1400047c0
movzx eax, dx
movzx ecx, r8w
sub ecx, eax
jmp 0x14000480b
movzx ecx, dx
neg ecx
test ecx, ecx
je 0x140004836
mov r9, qword [r9]
cmp r9, rbx
jne 0x1400047b0
xor eax, eax
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rdi, qword [r9 + 0x30]
test rdi, rdi
je 0x140004817
mov qword [rsp + 0xf0], r13
mov r13d, 0x5a4d
mov dword [rbp - 0x19], 0x50746547
mov dword [rbp - 0x15], 0x41636f72
mov dword [rbp - 0x11], 0x65726464
mov word [rbp - 0xd], 0x7373
mov byte [rbp - 0xb], r15b
cmp word [rdi], r13w
jne 0x14000490c
movsxd rax, dword [rdi + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14000490c
mov ecx, dword [rax + rdi + 0x88]
test ecx, ecx
je 0x14000490c
mov r9d, dword [rdi + rcx + 0x20]
lea rbx, [rdi + rcx]
mov r11d, dword [rbx + 0x18]
add r9, rdi
mov r10d, r15d
test r11d, r11d
je 0x14000490c
nop word [rax + rax]
mov ecx, dword [r9]
lea r8, [rbp - 0x19]
add rcx, rdi
sub r8, rcx
nop dword [rax]
movzx edx, byte [r8 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
je 0x1400048da
cmp dl, al
je 0x1400048c0
mov ecx, edx
sub ecx, eax
jmp 0x1400048de
mov ecx, eax
neg ecx
test ecx, ecx
je 0x1400048f0
inc r10d
add r9, 4
cmp r10d, r11d
jb 0x1400048b0
jmp 0x14000490c
mov eax, dword [rbx + 0x24]
add rax, rdi
mov ecx, r10d
movzx edx, word [rax + rcx*2]
mov ecx, dword [rbx + 0x1c]
add rcx, rdi
mov r14d, dword [rcx + rdx*4]
add r14, rdi
jne 0x140004913
lea r14, [0x140004590]
mov dword [rbp - 0x59], 0x626f6c47
mov dword [rbp - 0x55], 0x6c416c61
mov dword [rbp - 0x51], 0x636f6c
mov dword [rbp - 0x69], 0x626f6c47
mov dword [rbp - 0x65], 0x72466c61
mov word [rbp - 0x61], 0x6565
mov byte [rbp - 0x5f], r15b
cmp word [rdi], r13w
jne 0x1400049c2
movsxd rax, dword [rdi + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x1400049c2
mov ecx, dword [rax + rdi + 0x88]
test ecx, ecx
je 0x1400049c2
mov r9d, dword [rdi + rcx + 0x20]
lea rbx, [rdi + rcx]
mov r11d, dword [rbx + 0x18]
add r9, rdi
mov r10d, r15d
test r11d, r11d
je 0x1400049c2
nop word [rax + rax]
mov ecx, dword [r9]
lea r8, [rbp - 0x59]
add rcx, rdi
sub r8, rcx
nop dword [rax]
movzx edx, byte [r8 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
je 0x1400049aa
cmp dl, al
je 0x140004990
mov ecx, edx
sub ecx, eax
jmp 0x1400049ae
mov ecx, eax
neg ecx
test ecx, ecx
je 0x140004a3a
inc r10d
add r9, 4
cmp r10d, r11d
jb 0x140004980
mov rsi, r15
cmp word [rdi], r13w
mov r13, qword [rsp + 0xf0]
jne 0x140004a88
movsxd rax, dword [rdi + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140004a88
mov ecx, dword [rax + rdi + 0x88]
test ecx, ecx
je 0x140004a88
mov r9d, dword [rdi + rcx + 0x20]
lea rbx, [rdi + rcx]
mov r11d, dword [rbx + 0x18]
add r9, rdi
mov r10d, r15d
test r11d, r11d
je 0x140004a88
nop
mov ecx, dword [r9]
lea r8, [rbp - 0x69]
add rcx, rdi
sub r8, rcx
nop dword [rax]
movzx edx, byte [r8 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
je 0x140004a58
cmp dl, al
je 0x140004a20
mov ecx, edx
sub ecx, eax
jmp 0x140004a5c
mov eax, dword [rbx + 0x24]
add rax, rdi
mov ecx, r10d
movzx edx, word [rax + rcx*2]
mov ecx, dword [rbx + 0x1c]
add rcx, rdi
mov esi, dword [rcx + rdx*4]
add rsi, rdi
jmp 0x1400049c5
mov ecx, eax
neg ecx
test ecx, ecx
je 0x140004a6e
inc r10d
add r9, 4
cmp r10d, r11d
jb 0x140004a10
jmp 0x140004a88
mov eax, dword [rbx + 0x24]
add rax, rdi
mov ecx, r10d
movzx edx, word [rax + rcx*2]
mov ecx, dword [rbx + 0x1c]
add rcx, rdi
mov r15d, dword [rcx + rdx*4]
add r15, rdi
test rsi, rsi
je 0x140004817
test r15, r15
je 0x140004817
mov edx, pe_nt_image_headers64
mov ecx, edx
call rsi
mov rbx, rax
test rax, rax
je 0x140004817
movdqa xmm0, xmmword [0x140002810]
lea rdx, [rbp + 0x27]
mov rcx, rdi
mov qword [rax], r14
movdqu xmmword [rbp + 0x27], xmm0
mov qword [rax + 0x30], rsi
mov qword [rax + 0x38], r15
mov byte [rbp + 0x37], 0
call r14
mov qword [rbx + 8], rax
test rax, rax
je 0x140004817
lea rdx, [rbp - 0x39]
mov dword [rbp - 0x39], 0x64616f4c
mov rcx, rdi
mov dword [rbp - 0x35], 0x7262694c
mov dword [rbp - 0x31], 0x41797261
mov byte [rbp - 0x2d], 0
call r14
cmp qword [rbx + 8], 0
mov qword [rbx + 0x10], rax
je 0x140004817
lea rdx, [rbp - 0x29]
mov dword [rbp - 0x29], 0x74726956
mov rcx, rdi
mov dword [rbp - 0x25], 0x416c6175
mov dword [rbp - 0x21], 0x636f6c6c
mov byte [rbp - 0x1d], 0
call r14
cmp qword [rbx + 8], 0
mov qword [rbx + 0x18], rax
je 0x140004817
lea rdx, [rbp - 0x49]
mov dword [rbp - 0x49], 0x74726956
mov rcx, rdi
mov dword [rbp - 0x45], 0x466c6175
mov dword [rbp - 0x41], 0x656572
call r14
cmp qword [rbx + 8], 0
mov qword [rbx + 0x20], rax
je 0x140004817
lea rdx, [rbp - 9]
mov dword [rbp - 9], 0x74726956
mov rcx, rdi
mov dword [rbp - 5], 0x506c6175
mov dword [rbp - 1], 0x65746f72
mov word [rbp + 3], 0x7463
mov byte [rbp + 5], 0
call r14
cmp qword [rbx + 8], 0
mov qword [rbx + 0x28], rax
je 0x140004817
mov rax, rbx
jmp 0x140004819