Function at 0x140001290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x180], rax
xor edi, edi
call fcn.140001cc0
mov rbx, qword [rax + 0x18]
mov rdx, rax
lea rcx, [0x140027e90]
call fcn.140001070
lea rax, [rbx + 0x20]
mov qword [rsp + 0x28], rax
mov r13, qword [rax]
mov esi, edi
mov qword [rsp + 0x20], rdi
cmp r13, rax
je 0x14000166f
movabs r12, 0x7ffffffffffffffe
movabs r14, 0x7fffffffffffffff
lea r15d, [rdi + 0xa]
nop word [rax + rax]
mov r8, qword [r13 + 0x40]
lea rbx, [r13]
mov r13, qword [r13]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.14000ce84
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.14000d294
lea rdx, str.kernel32.dll
lea rcx, [rsp + 0x70]
call fcn.1400038c0
test rax, rax
je 0x14000136e
mov rsi, qword [rbx + 0x20]
mov qword [rsp + 0x20], rsi
jmp 0x140001664
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
lea rax, [rsp + 0x70]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140001390
cmp rbx, r12
ja 0x140001ba7
cmp rbx, 7
ja 0x1400013d6
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], 7
add rbx, rbx
mov r8, rbx
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14001dd30
mov word [rsp + rbx + 0x50], di
jmp 0x140001471
mov rsi, rbx
or rsi, 7
cmp rsi, r12
jbe 0x1400013eb
mov rsi, r12
lea rcx, [r14 + r14]
jmp 0x14000140c
cmp rsi, 0xa
cmovb rsi, r15
lea rcx, [rsi + 1]
cmp rcx, r14
ja 0x140001bc5
add rcx, rcx
cmp rcx, 0x1000
jb 0x140001438
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001bc5
mov rcx, rax
call fcn.14000209c
test rax, rax
je 0x140001bb9
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14000144a
test rcx, rcx
je 0x140001447
call fcn.14000209c
mov r14, rax
jmp 0x14000144a
mov r14, rdi
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
add rbx, rbx
mov r8, rbx
lea rdx, [rsp + 0x70]
mov rcx, r14
call fcn.14001dd30
mov word [r14 + rbx], di
mov r15, qword [rsp + 0x60]
mov rax, r12
sub rax, r15
cmp rax, 0xa
jb 0x140001bbf
lea r12, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova r12, qword [rsp + 0x50]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
lea r14, [r15 + 0xa]
mov esi, 7
lea rbx, [rsp + 0x30]
cmp r14, rsi
jbe 0x140001552
mov rsi, r14
or rsi, 7
movabs rax, 0x7ffffffffffffffe
cmp rsi, rax
jbe 0x1400014df
mov rsi, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14000150f
cmp rsi, 0xa
mov eax, 0xa
cmovb rsi, rax
lea rcx, [rsi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140001bad
add rcx, rcx
cmp rcx, 0x1000
jb 0x14000153b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001bad
mov rcx, rax
call fcn.14000209c
test rax, rax
je 0x140001bb3
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14000154d
test rcx, rcx
je 0x14000154a
call fcn.14000209c
mov rbx, rax
jmp 0x14000154d
mov rbx, rdi
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rsi
movups xmm0, xmmword [str.not_found]
movups xmmword [rbx], xmm0
mov eax, dword [0x140027ec8]
mov dword [rbx + 0x10], eax
lea rcx, [rbx + 0x14]
lea r8, [r15 + r15]
mov rdx, r12
call fcn.14001dd30
mov word [rbx + r14*2], di
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x1400015c6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400015c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001bb3
call fcn.1400020d8
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [rsp + 0x60], xmm1
lea rdx, [rsp + 0x50]
movq rcx, xmm0
psrldq xmm1, 8
movq rax, xmm1
cmp rax, 7
cmova rdx, rcx
lea rcx, str._ls_n
call fcn.140001010
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x140001645
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001640
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001bb9
call fcn.1400020d8
mov r15d, 0xa
movabs r14, 0x7fffffffffffffff
movabs r12, 0x7ffffffffffffffe
mov rsi, qword [rsp + 0x20]
cmp r13, qword [rsp + 0x28]
jne 0x140001320
lea rax, [0x140027ef0]
lea rcx, [0x140027ee0]
test rsi, rsi
cmove rcx, rax
call fcn.140001070
movsxd rax, dword [rsi + 0x3c]
mov ecx, dword [rax + rsi + 0x88]
add rcx, rsi
mov ebx, dword [rcx + 0x20]
add rbx, rsi
mov r15d, dword [rcx + 0x24]
add r15, rsi
mov r12d, dword [rcx + 0x1c]
add r12, rsi
mov esi, edi
mov r14d, dword [rcx + 0x18]
test r14d, r14d
je 0x140001b77
mov r13, qword [rsp + 0x20]
nop
mov ecx, dword [rbx]
add rcx, r13
lea rdx, [0x140027f00]
call fcn.14001d890
test eax, eax
je 0x1400016e5
inc esi
add rbx, 4
cmp esi, r14d
jb 0x1400016c0
jmp 0x140001b77
mov eax, esi
movzx ecx, word [r15 + rax*2]
mov esi, dword [r12 + rcx*4]
add rsi, r13
lea rdx, str.HeapCreate
mov rcx, r13
call rsi
mov r15, rax
lea rdx, [0x140027f20]
mov rcx, r13
call rsi
mov r12, rax
mov ecx, 0x12
inc ecx
call fcn.14000d874
mov rbx, rax
mov r11, rdi
mov r10d, 2
lea r14, [0x140000000]
movzx r8d, byte [r14 + rdi + 0x27f40]
cmp r8b, 0x41
jl 0x140001749
and r8b, 0xdf
sub r8b, 0x37
jmp 0x14000174d
sub r8b, 0x30
movzx r9d, byte [rdi + r14 + 0x27f41]
cmp r9b, 0x41
jl 0x140001766
and r9b, 0xdf
sub r9b, 0x37
jmp 0x14000176a
sub r9b, 0x30
lea ecx, [r10 - 2]
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xb
sub ecx, eax
movsxd rax, ecx
shl r8b, 4
or r8b, r9b
xor r8b, byte [rax + r14 + 0x27f30]
mov byte [r11 + rbx], r8b
movzx r8d, byte [rdi + r14 + 0x27f42]
cmp r8b, 0x41
jl 0x1400017b2
and r8b, 0xdf
sub r8b, 0x37
jmp 0x1400017b6
sub r8b, 0x30
movzx r9d, byte [rdi + r14 + 0x27f43]
cmp r9b, 0x41
jl 0x1400017cf
and r9b, 0xdf
sub r9b, 0x37
jmp 0x1400017d3
sub r9b, 0x30
lea ecx, [r10 - 1]
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xb
sub ecx, eax
movsxd rax, ecx
shl r8b, 4
or r8b, r9b
xor r8b, byte [rax + r14 + 0x27f30]
mov byte [r11 + rbx + 1], r8b
movzx r8d, byte [rdi + r14 + 0x27f44]
cmp r8b, 0x41
jl 0x14000181c
and r8b, 0xdf
sub r8b, 0x37
jmp 0x140001820
sub r8b, 0x30
movzx r9d, byte [rdi + r14 + 0x27f45]
cmp r9b, 0x41
jl 0x140001839
and r9b, 0xdf
sub r9b, 0x37
jmp 0x14000183d
sub r9b, 0x30
mov eax, 0x2e8ba2e9
imul r10d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xb
mov ecx, r10d
sub ecx, eax
movsxd rax, ecx
shl r8b, 4
or r8b, r9b
xor r8b, byte [rax + r14 + 0x27f30]
mov byte [r11 + rbx + 2], r8b
movzx r8d, byte [rdi + r14 + 0x27f46]
cmp r8b, 0x41
jl 0x140001886
and r8b, 0xdf
sub r8b, 0x37
jmp 0x14000188a
sub r8b, 0x30
movzx r9d, byte [rdi + r14 + 0x27f47]
cmp r9b, 0x41
jl 0x1400018a3
and r9b, 0xdf
sub r9b, 0x37
jmp 0x1400018a7
sub r9b, 0x30
lea ecx, [r10 + 1]
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xb
sub ecx, eax
movsxd rax, ecx
shl r8b, 4
or r8b, r9b
xor r8b, byte [rax + r14 + 0x27f30]
mov byte [r11 + rbx + 3], r8b
movzx r8d, byte [rdi + r14 + 0x27f48]
cmp r8b, 0x41
jl 0x1400018f0
and r8b, 0xdf
sub r8b, 0x37
jmp 0x1400018f4
sub r8b, 0x30
movzx r9d, byte [rdi + r14 + 0x27f49]
cmp r9b, 0x41
jl 0x14000190d
and r9b, 0xdf
sub r9b, 0x37
jmp 0x140001911
sub r9b, 0x30
lea ecx, [r10 + 2]
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xb
sub ecx, eax
movsxd rax, ecx
shl r8b, 4
or r8b, r9b
xor r8b, byte [rax + r14 + 0x27f30]
mov byte [r11 + rbx + 4], r8b
movzx r8d, byte [rdi + r14 + 0x27f4a]
cmp r8b, 0x41
jl 0x14000195a
and r8b, 0xdf
sub r8b, 0x37
jmp 0x14000195e
sub r8b, 0x30
movzx r9d, byte [rdi + r14 + 0x27f4b]
cmp r9b, 0x41
jl 0x140001977
and r9b, 0xdf
sub r9b, 0x37
jmp 0x14000197b
sub r9b, 0x30
lea ecx, [r10 + 3]
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xb
sub ecx, eax
movsxd rax, ecx
shl r8b, 4
or r8b, r9b
xor r8b, byte [rax + r14 + 0x27f30]
mov byte [r11 + rbx + 5], r8b
movzx r8d, byte [rdi + r14 + 0x27f4c]
cmp r8b, 0x41
jl 0x1400019c4
and r8b, 0xdf
sub r8b, 0x37
jmp 0x1400019c8
sub r8b, 0x30
movzx r9d, byte [rdi + r14 + 0x27f4d]
cmp r9b, 0x41
jl 0x1400019e1
and r9b, 0xdf
sub r9b, 0x37
jmp 0x1400019e5
sub r9b, 0x30
lea ecx, [r10 + 4]
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xb
sub ecx, eax
movsxd rax, ecx
shl r8b, 4
or r8b, r9b
xor r8b, byte [rax + r14 + 0x27f30]
mov byte [r11 + rbx + 6], r8b
movzx r8d, byte [rdi + r14 + 0x27f4e]
cmp r8b, 0x41
jl 0x140001a2e
and r8b, 0xdf
sub r8b, 0x37
jmp 0x140001a32
sub r8b, 0x30
movzx r9d, byte [rdi + r14 + 0x27f4f]
cmp r9b, 0x41
jl 0x140001a4b
and r9b, 0xdf
sub r9b, 0x37
jmp 0x140001a4f
sub r9b, 0x30
lea ecx, [r10 + 5]
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xb
sub ecx, eax
movsxd rax, ecx
shl r8b, 4
or r8b, r9b
xor r8b, byte [rax + r14 + 0x27f30]
mov byte [r11 + rbx + 7], r8b
movzx r8d, byte [rdi + r14 + 0x27f50]
cmp r8b, 0x41
jl 0x140001a98
and r8b, 0xdf
sub r8b, 0x37
jmp 0x140001a9c
sub r8b, 0x30
movzx r9d, byte [rdi + r14 + 0x27f51]
cmp r9b, 0x41
jl 0x140001ab5
and r9b, 0xdf
sub r9b, 0x37
jmp 0x140001ab9
sub r9b, 0x30
lea ecx, [r10 + 6]
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xb
sub ecx, eax
movsxd rax, ecx
shl r8b, 4
or r8b, r9b
xor r8b, byte [rax + r14 + 0x27f30]
mov byte [r11 + rbx + 8], r8b
add r10d, 9
add r11, 9
add rdi, 0x12
cmp rdi, 0x24
jl 0x140001730
mov byte [rbx + 0x12], 0
mov rdx, rbx
mov rcx, r13
call rsi
mov r14, rax
xor r8d, r8d
xor edx, edx
mov ecx, 0x40000
call r15
xor edx, edx
mov r8d, 0x100000
mov rcx, rax
call r12
mov rsi, rax
mov rdi, rax
lea rbx, str.e48348fc_e8f0_00c8_0000_415141505251
lea r15, [0x140028160]
nop dword [rax]
mov rdx, rdi
mov rcx, qword [rbx]
call qword [sym.imp.RPCRT4.dll_UuidFromStringA]
test eax, eax
jne 0x140001b67
add rdi, 0x10
add rbx, 8
cmp rbx, r15
jl 0x140001b40
xor edx, edx
mov rcx, rsi
call r14
jmp 0x140001b77
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, 0xffffffffffffffff
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140001de0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001270
nop
call fcn.1400011d0
nop
call fcn.14000d7fc
nop
call fcn.14000d7fc
nop
call fcn.140001270
nop
call fcn.1400011d0
int3