Function at 0x140001000
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get process filename
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x140020008]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov r13d, ebx
mov rax, qword gs:[0x60]
mov r10d, ebx
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x20]
mov rcx, qword [rax]
mov rax, qword [rcx]
mov r15, qword [rax + 0x20]
movsxd rax, dword [r15 + 0x3c]
mov ecx, dword [rax + r15 + 0x88]
add rcx, r15
mov r11d, dword [rcx + 0x20]
mov esi, dword [rcx + 0x1c]
add r11, r15
mov ebp, dword [rcx + 0x24]
add rsi, r15
mov edi, dword [rcx + 0x18]
add rbp, r15
test edi, edi
je 0x1400010c9
nop dword [rax]
mov r8d, dword [r11]
mov edx, ebx
add r8, r15
movzx r9d, byte [r8]
test r9b, r9b
je 0x1400010bd
movsx ecx, r9b
lea r8, [r8 + 1]
ror edx, 0xd
cmp r9b, 0x61
movzx r9d, byte [r8]
lea eax, [rcx - 0x20]
cmovl eax, ecx
add edx, eax
test r9b, r9b
jne 0x140001091
cmp edx, 0x8a8b4676
je 0x140001347
inc r10d
add r11, 4
cmp r10d, edi
jb 0x140001080
mov rax, rbx
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x61766461
mov dword [rsp + 0x44], 0x32336970
mov dword [rsp + 0x48], 0x6c6c642e
mov byte [rsp + 0x4c], bl
call rax
mov rbp, rax
mov r10d, ebx
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + rbp + 0x88]
add rcx, rbp
mov r11d, dword [rcx + 0x20]
mov esi, dword [rcx + 0x1c]
add r11, rbp
mov r14d, dword [rcx + 0x24]
add rsi, rbp
mov edi, dword [rcx + 0x18]
add r14, rbp
test edi, edi
je 0x140001169
nop
mov r8d, dword [r11]
mov edx, ebx
add r8, rbp
movzx r9d, byte [r8]
test r9b, r9b
je 0x14000115d
movsx ecx, r9b
lea r8, [r8 + 1]
ror edx, 0xd
cmp r9b, 0x61
movzx r9d, byte [r8]
lea eax, [rcx - 0x20]
cmovl eax, ecx
add edx, eax
test r9b, r9b
jne 0x140001131
cmp edx, 0xe79d18d6
je 0x14000135a
inc r10d
add r11, 4
cmp r10d, edi
jb 0x140001120
mov rsi, rbx
movsxd rax, dword [r15 + 0x3c]
mov r10d, ebx
mov ecx, dword [rax + r15 + 0x88]
add rcx, r15
mov r11d, dword [rcx + 0x20]
mov r14d, dword [rcx + 0x1c]
add r11, r15
mov r12d, dword [rcx + 0x24]
add r14, r15
mov edi, dword [rcx + 0x18]
add r12, r15
test edi, edi
je 0x1400011e9
nop word [rax + rax]
mov r8d, dword [r11]
mov edx, ebx
add r8, r15
movzx r9d, byte [r8]
test r9b, r9b
je 0x1400011dd
movsx ecx, r9b
lea r8, [r8 + 1]
ror edx, 0xd
cmp r9b, 0x61
movzx r9d, byte [r8]
lea eax, [rcx - 0x20]
cmovl eax, ecx
add edx, eax
test r9b, r9b
jne 0x1400011b1
cmp edx, 0x1a4b89aa
je 0x14000136d
inc r10d
add r11, 4
cmp r10d, edi
jb 0x1400011a0
mov rax, rbx
call rax
mov rcx, rax
lea r8, [rsp + 0x30]
mov edx, 8
call rsi
test eax, eax
je 0x1400012b4
movsxd rax, dword [rbp + 0x3c]
mov r10d, ebx
mov dword [rsp + 0x38], 4
mov ecx, dword [rax + rbp + 0x88]
add rcx, rbp
mov r11d, dword [rcx + 0x20]
mov esi, dword [rcx + 0x1c]
add r11, rbp
mov r14d, dword [rcx + 0x24]
add rsi, rbp
mov edi, dword [rcx + 0x18]
add r14, rbp
test edi, edi
je 0x140001289
nop dword [rax]
mov r8d, dword [r11]
mov edx, ebx
add r8, rbp
movzx r9d, byte [r8]
test r9b, r9b
je 0x14000127d
movsx ecx, r9b
lea r8, [r8 + 1]
ror edx, 0xd
cmp r9b, 0x61
movzx r9d, byte [r8]
lea eax, [rcx - 0x20]
cmovl eax, ecx
add edx, eax
test r9b, r9b
jne 0x140001251
cmp edx, 0x69f7df2a
je 0x140001381
inc r10d
add r11, 4
cmp r10d, edi
jb 0x140001240
mov rax, rbx
mov r9d, 4
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x3c]
mov rcx, qword [rsp + 0x30]
lea edx, [r9 + 0x10]
call rax
test eax, eax
cmovne r13d, dword [rsp + 0x3c]
mov rsi, qword [rsp + 0x30]
test rsi, rsi
je 0x1400013a8
movsxd rax, dword [r15 + 0x3c]
mov r10d, ebx
mov ecx, dword [rax + r15 + 0x88]
add rcx, r15
mov r11d, dword [rcx + 0x20]
mov ebp, dword [rcx + 0x1c]
add r11, r15
mov r14d, dword [rcx + 0x24]
add rbp, r15
mov edi, dword [rcx + 0x18]
add r14, r15
test edi, edi
je 0x1400013a3
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [r11]
mov edx, ebx
add r8, r15
movzx r9d, byte [r8]
test r9b, r9b
je 0x140001339
movsx ecx, r9b
lea r8, [r8 + 1]
ror edx, 0xd
cmp r9b, 0x61
movzx r9d, byte [r8]
lea eax, [rcx - 0x20]
cmovl eax, ecx
add edx, eax
test r9b, r9b
jne 0x140001311
cmp edx, 0xae7a8bda
je 0x140001394
inc r10d
add r11, 4
cmp r10d, edi
jb 0x140001300
jmp 0x1400013a3
mov eax, r10d
movzx ecx, word [rbp + rax*2]
mov eax, dword [rsi + rcx*4]
add rax, r15
jmp 0x1400010cc
mov eax, r10d
movzx ecx, word [r14 + rax*2]
mov esi, dword [rsi + rcx*4]
add rsi, rbp
jmp 0x14000116c
mov eax, r10d
movzx ecx, word [r12 + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r15
jmp 0x1400011ec
mov eax, r10d
movzx ecx, word [r14 + rax*2]
mov eax, dword [rsi + rcx*4]
add rax, rbp
jmp 0x14000128c
mov eax, r10d
movzx ecx, word [r14 + rax*2]
mov ebx, dword [rbp + rcx*4]
add rbx, r15
mov rcx, rsi
call rbx
mov eax, r13d
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140006d70
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret