Function at 0x140005ad0
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x140026040]
xor rax, rsp
mov qword [rbp + 0x90], rax
movzx edx, byte [str.mAliciou_]
movzx ecx, byte [0x140026a81]
movzx eax, dl
movzx r13d, byte [0x140026a82]
xor al, 0x26
movzx r12d, byte [0x140026a83]
movzx r15d, byte [0x140026a84]
movzx r14d, byte [0x140026a85]
movzx r11d, r15b
movzx esi, byte [0x140026a86]
xor r11b, 0x2f
movzx edi, byte [0x140026a87]
movzx r10d, sil
movzx ebx, byte [0x140026a88]
xor r10b, 0xd
mov byte [rsp + 0x50], al
movzx r9d, dil
movzx eax, cl
mov byte [rsp + 0x5c], 0
xor al, 4
mov byte [rsp + 0x6c], 0
mov byte [rsp + 0x51], al
xor r9b, 7
movzx eax, r13b
mov byte [rsp + 0x4b], 0
xor al, 0x3e
mov byte [rbp - 0x78], 0
mov byte [rsp + 0x52], al
movzx r8d, bl
movzx eax, r12b
mov byte [rsp + 0x64], r11b
xor al, 0x27
mov byte [rsp + 0x65], r14b
mov byte [rsp + 0x53], al
xor r8b, 0x45
movzx eax, r15b
mov byte [rsp + 0x66], r10b
xor al, 0x26
mov byte [rsp + 0x67], r9b
mov byte [rsp + 0x54], al
movzx eax, r14b
xor al, 0x25
mov byte [rsp + 0x68], r8b
mov byte [rsp + 0x55], al
movzx eax, sil
xor al, 0x5c
mov byte [rsp + 0x56], al
movzx eax, dil
xor al, 0x47
mov byte [rsp + 0x57], al
movzx eax, bl
xor al, 0xa
mov byte [rsp + 0x58], al
movzx eax, dl
xor al, 0x29
mov byte [rsp + 0x59], al
movzx eax, cl
xor al, 0xd
mov byte [rsp + 0x5a], al
movzx eax, r13b
xor al, 0x20
mov byte [rsp + 0x5b], al
movzx eax, dl
xor al, 0x21
xor dl, 0x1f
mov byte [rsp + 0x60], al
movzx eax, cl
xor al, 0x2e
mov byte [rsp + 0x69], dl
mov byte [rsp + 0x61], al
xor cl, 0x38
movzx eax, r13b
mov byte [rsp + 0x6a], cl
xor al, 0xd
mov byte [rsp + 0x62], al
movzx eax, r12b
xor al, 0xd
mov byte [rsp + 0x63], al
movzx eax, r13b
xor al, 0x2d
mov byte [rsp + 0x6b], al
movzx eax, byte [str.mAliciou_]
xor al, 0x2b
mov byte [rsp + 0x48], r8b
movzx r8d, byte [str.mAliciou_]
mov byte [rsp + 0x40], al
movzx eax, byte [0x140026a81]
xor al, 0x33
mov byte [rsp + 0x49], dl
movzx edx, byte [0x140026a81]
mov byte [rsp + 0x41], al
movzx eax, r13b
xor al, 9
mov byte [rsp + 0x4a], cl
mov byte [rsp + 0x42], al
movzx ecx, r14b
movzx eax, r12b
mov byte [rsp + 0x45], r14b
xor al, 0xc
mov byte [rsp + 0x44], r11b
mov byte [rsp + 0x43], al
xor cl, 0xc
movzx eax, r8b
mov byte [rsp + 0x46], r10b
xor al, 0x2a
mov byte [rsp + 0x47], r9b
mov byte [rsp + 0x70], al
xor r14b, 0x3c
movzx eax, dl
mov byte [rsp + 0x75], cl
xor al, 0x24
mov byte [rsp + 0x7e], r14b
mov byte [rsp + 0x71], al
movzx eax, r13b
xor al, 0x18
mov byte [rbp - 0x79], cl
mov byte [rsp + 0x72], al
xor r13b, 0x19
movzx eax, r12b
mov byte [rsp + 0x7b], r13b
xor al, 0x3c
mov byte [rbp - 0x7c], r13b
mov byte [rsp + 0x73], al
movzx eax, r15b
xor al, 0x10
mov byte [rsp + 0x74], al
movzx eax, sil
xor al, 0x1d
xor sil, 0x26
mov byte [rsp + 0x76], al
movzx eax, dil
xor al, 0x31
mov byte [rsp + 0x7f], sil
mov byte [rsp + 0x77], al
xor dil, 0x39
movzx eax, bl
mov byte [rbp - 0x80], dil
xor al, 0x41
xor bl, 0x45
mov byte [rsp + 0x78], al
movzx eax, r8b
xor al, 0xb
mov byte [rbp - 0x7f], bl
mov byte [rsp + 0x79], al
xor r8b, 3
movzx eax, dl
mov byte [rbp - 0x7e], r8b
xor al, 0x20
xor dl, 0x26
mov byte [rsp + 0x7a], al
movzx eax, r12b
xor al, 5
mov byte [rbp - 0x7d], dl
mov byte [rsp + 0x7c], al
xor r12b, 8
movzx eax, r15b
mov byte [rbp - 0x7b], r12b
xor al, 0x17
xor r15b, 4
mov byte [rsp + 0x7d], al
mov byte [rbp - 0x7a], r15b
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rsi, qword [rcx + 0x18]
add rsi, 0x20
mov rbx, qword [rsi]
nop dword [rax]
movzx edi, word [rbx + 0x38]
shr edi, 1
cmp rdi, 0x100
jae 0x140005def
mov r8, qword [rbx + 0x40]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x38], 0
mov r9d, edi
mov qword [rsp + 0x30], 0
xor edx, edx
mov dword [rsp + 0x28], 0x100
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rdx, [rsp + 0x50]
mov byte [rbp + rdi - 0x70], 0
lea rcx, [rbp - 0x70]
call fcn.140007f50
test rax, rax
jne 0x140005f75
mov rbx, qword [rbx]
cmp rbx, rsi
jne 0x140005d90
xor edi, edi
movsxd rax, dword [rdi + 0x3c]
xor ebx, ebx
mov qword [0x140027c00], rdi
mov r14d, dword [rax + rdi + 0x88]
add r14, rdi
mov r15d, dword [r14 + 0x20]
mov r12d, dword [r14 + 0x24]
add r15, rdi
mov r13d, dword [r14 + 0x1c]
add r12, rdi
add r13, rdi
cmp dword [r14 + 0x18], ebx
jbe 0x140005e5a
nop dword [rax]
movzx eax, word [r12 + rbx*2]
lea rdx, [rsp + 0x60]
mov ecx, dword [r15 + rbx*4]
add rcx, rdi
mov esi, dword [r13 + rax*4]
add rsi, rdi
call fcn.14000d6fc
test eax, eax
je 0x140005e5c
inc ebx
cmp ebx, dword [r14 + 0x18]
jb 0x140005e30
xor esi, esi
mov rdi, qword [0x140027c00]
xor ebx, ebx
mov qword [0x140027c10], rsi
movsxd rax, dword [rdi + 0x3c]
mov r14d, dword [rax + rdi + 0x88]
add r14, rdi
mov r15d, dword [r14 + 0x20]
mov r12d, dword [r14 + 0x24]
add r15, rdi
mov r13d, dword [r14 + 0x1c]
add r12, rdi
add r13, rdi
cmp dword [r14 + 0x18], ebx
jbe 0x140005eca
nop word [rax + rax]
movzx eax, word [r12 + rbx*2]
lea rdx, [rsp + 0x40]
mov ecx, dword [r15 + rbx*4]
add rcx, rdi
mov esi, dword [r13 + rax*4]
add rsi, rdi
call fcn.14000d6fc
test eax, eax
je 0x140005ecc
inc ebx
cmp ebx, dword [r14 + 0x18]
jb 0x140005ea0
xor esi, esi
mov rdi, qword [0x140027c00]
xor ebx, ebx
mov qword [0x140027c30], rsi
movsxd rax, dword [rdi + 0x3c]
mov r14d, dword [rax + rdi + 0x88]
add r14, rdi
mov r15d, dword [r14 + 0x20]
mov r12d, dword [r14 + 0x24]
add r15, rdi
mov r13d, dword [r14 + 0x1c]
add r12, rdi
add r13, rdi
cmp dword [r14 + 0x18], ebx
jbe 0x140005f3a
nop word [rax + rax]
movzx eax, word [r12 + rbx*2]
lea rdx, [rsp + 0x70]
mov ecx, dword [r15 + rbx*4]
add rcx, rdi
mov esi, dword [r13 + rax*4]
add rsi, rdi
call fcn.14000d6fc
test eax, eax
je 0x140005f7e
inc ebx
cmp ebx, dword [r14 + 0x18]
jb 0x140005f10
mov qword [0x140027c78], 0
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.1400074b0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rdi, qword [rbx + 0x20]
jmp 0x140005df9
mov qword [0x140027c78], rsi
jmp 0x140005f45