Function at 0x140005230
Capabilities:
Access peb ldr_data
Check if file exists
Contain obfuscated stackstrings
Get file attributes
Get ntdll base address
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
mov rax, qword [0x14003a018]
xor rax, rsp
mov qword [rsp + 0x118], rax
lea rcx, str.hid_CSV_fi_bSDPsJXyWRsm
mov dword [rsp + 0x60], 0x6220746f
mov dword [rsp + 0x64], 0x706f2065
mov dword [rsp + 0x68], 0x64656e65
mov word [rsp + 0x6c], 0x3a
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.hid_DLL_ba_NEx5bLmYgCUY
mov dword [rsp + 0xd0], 0x61206576
mov dword [rsp + 0xd4], 0x65726464
mov dword [rsp + 0xd8], 0xa7373
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
movdqa xmm0, xmmword [str.0x_p__ws__ws____n0x_p__ws__ws__s_NtProtectVirtual]
lea rcx, str.hid__x_p___M1pBOS0fa3xv
movdqu xmmword [rsp + 0xe0], xmm0
mov byte [rsp + 0xf0], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
movdqa xmm0, xmmword [0x1400358b0]
lea rcx, str.hid__x_p___bVBYiRP4i6gL
movdqa xmm1, xmmword [str.0x_p__ws0x_tx_n]
movdqu xmmword [rsp + 0xf8], xmm0
movdqu xmmword [rsp + 0x108], xmm1
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 8
xor ebx, ebx
mov ecx, eax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x28], ebx
lea edx, [rax + 0x18]
call fcn.14000d400
mov qword [rsp + 0x20], rax
mov r8, rax
test rax, rax
je 0x140005787
mov rax, qword gs:[0x60]
xor r9d, r9d
xor ebp, ebp
mov qword [rsp + 0x30], r9
xor r15d, r15d
mov esi, 1
mov dword [rsp + 0x38], esi
mov rcx, qword [rax + 0x18]
mov rdi, qword [rcx + 0x10]
mov qword [rsp + 0x48], rdi
test rdi, rdi
je 0x140005639
movups xmm0, xmmword [rdi + 0x58]
psrldq xmm0, 8
movq rax, xmm0
test rax, rax
je 0x1400055df
test esi, esi
jne 0x1400053eb
test r9, r9
je 0x1400053a1
mov rcx, r9
call fcn.14000e90c
mov qword [rsp + 0x30], 0
test r15, r15
je 0x1400053c4
mov rcx, qword [r15 + 0x70]
test rcx, rcx
je 0x1400053bc
call fcn.14000e90c
mov qword [r15 + 0x70], 0
mov rcx, r15
call fcn.14000e90c
test rbp, rbp
je 0x1400053f1
mov rcx, qword [rbp + 0x70]
test rcx, rcx
je 0x1400053df
call fcn.14000e90c
mov qword [rbp + 0x70], 0
mov rcx, rbp
call fcn.14000e90c
xor ebp, ebp
jmp 0x1400053f1
xor esi, esi
mov dword [rsp + 0x38], esi
mov rcx, qword [rdi + 0x30]
mov edx, 1
call fcn.140007890
mov r15, rax
test rax, rax
je 0x140005773
cmp qword [rax + 0x40], 0
je 0x140005773
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140005773
test al, 0x10
jne 0x140005773
mov rcx, qword [rdi + 0x50]
call fcn.140003630
mov qword [rsp + 0x30], rax
mov r9, rax
test rax, rax
je 0x14000577d
xor edx, edx
mov rcx, rax
call fcn.140007890
mov rbp, rax
test rax, rax
je 0x140005773
mov rdx, qword [r15 + 0x10]
mov rcx, rax
call fcn.140007670
xor r13d, r13d
cmp dword [rbp + 0x50], r13d
jbe 0x140005773
nop word [rax + rax]
mov rax, qword [rbp + 0x48]
mov rcx, rbp
mov edx, dword [rax + r13*4]
call fcn.1400075e0
mov rdx, rax
mov rcx, rbp
mov r12, rax
call fcn.1400079d0
mov r11, qword [rbp + 0x38]
mov r9d, eax
mov rax, qword [rbp + 0x20]
xor r8d, r8d
movzx r10d, word [rax + 6]
test r10d, r10d
je 0x1400054db
lea rdx, [r11 + 8]
nop word [rax + rax]
mov ecx, dword [rdx + 4]
cmp ecx, r9d
ja 0x1400054cf
add ecx, dword [rdx]
cmp r9d, ecx
jb 0x1400054fe
inc r8d
add rdx, 0x28
cmp r8d, r10d
jb 0x1400054c0
xor eax, eax
test dword [rax + 0x24], 0x20000000
je 0x1400055bf
mov rdx, r12
mov rcx, rbp
call fcn.1400079d0
test eax, eax
jne 0x140005508
xor r14d, r14d
jmp 0x140005515
lea rcx, [r8 + r8*4]
lea rax, [r11 + rcx*8]
jmp 0x1400054dd
mov edx, eax
mov rcx, rbp
call fcn.1400075e0
mov r14, rax
mov rdx, r12
mov rcx, r15
call fcn.1400079d0
test eax, eax
jne 0x140005528
xor edi, edi
jmp 0x140005535
mov edx, eax
mov rcx, r15
call fcn.1400075e0
mov rdi, rax
xor ecx, ecx
mov esi, ebx
test ebx, ebx
je 0x140005557
mov r8, qword [rsp + 0x20]
lea rax, [r8 + 8]
cmp qword [rax], rdi
je 0x1400055c4
inc rcx
add rax, 0x20
cmp rcx, rsi
jb 0x140005546
mov rdx, r12
mov rcx, rbp
call fcn.1400079d0
test eax, eax
jne 0x14000556a
xor ebx, ebx
jmp 0x140005577
mov edx, eax
mov rcx, rbp
call fcn.1400075e0
mov rbx, rax
mov rdx, r12
mov rcx, r15
call fcn.1400079d0
test eax, eax
jne 0x14000558a
xor edx, edx
jmp 0x140005597
mov edx, eax
mov rcx, r15
call fcn.1400075e0
mov rdx, rax
mov rax, rbx
sub rdx, rbx
nop dword [rax]
movzx ecx, byte [rdx + rax]
cmp byte [rax], cl
jne 0x14000568d
inc rax
mov rcx, rax
sub rcx, rbx
cmp rcx, 0x18
jb 0x1400055a0
mov ebx, dword [rsp + 0x28]
mov r8, qword [rsp + 0x20]
inc r13d
cmp r13d, dword [rbp + 0x50]
jb 0x140005480
mov rdi, qword [rsp + 0x48]
mov esi, dword [rsp + 0x38]
mov r9, qword [rsp + 0x30]
mov rax, qword gs:[0x60]
mov rdi, qword [rdi]
mov qword [rsp + 0x48], rdi
mov rcx, qword [rax + 0x18]
cmp rdi, qword [rcx + 0x10]
je 0x140005603
test rdi, rdi
jne 0x140005370
mov rax, qword [rsp + 0x40]
cmp ebx, eax
jb 0x140005639
lea edx, [rax + 1]
mov rcx, 0xffffffffffffffff
mov eax, 0x20
mul rdx
cmovo rax, rcx
mov rcx, r8
mov rdx, rax
call fcn.14000ed28
mov r8, rax
test rax, rax
je 0x140005787
mov eax, ebx
shl rax, 5
mov qword [rax + r8 + 8], 0
mov qword [rax + r8], 0
mov qword [rax + r8 + 0x10], 0
mov rax, r8
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
call fcn.14000b000
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rcx, rdi
mov dword [rsp + 0x38], 1
call fcn.140005170
mov r9, rax
test rax, rax
je 0x1400055bb
mov rax, qword gs:[0x60]
mov r10, 0xffffffffffffffff
mov r8, r10
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
test rdx, rdx
je 0x140005701
nop dword [rax]
mov rcx, qword [rdx + 0x30]
cmp rcx, r9
ja 0x1400056e6
mov rax, r9
sub rax, rcx
cmp rax, r8
cmovb r8, rax
mov rax, qword gs:[0x60]
mov rdx, qword [rdx]
mov rcx, qword [rax + 0x18]
cmp rdx, qword [rcx + 0x10]
je 0x140005701
test rdx, rdx
jne 0x1400056d0
mov rax, qword [rsp + 0x40]
mov ebx, dword [rsp + 0x28]
cmp ebx, eax
jb 0x14000573c
add eax, eax
mov ecx, eax
mov qword [rsp + 0x40], rax
mov eax, 0x20
mul rcx
mov rcx, qword [rsp + 0x20]
cmovo rax, r10
mov rdx, rax
call fcn.14000ed28
mov qword [rsp + 0x20], rax
test rax, rax
je 0x140005787
jmp 0x140005741
mov rax, qword [rsp + 0x20]
shl rsi, 5
mov rdx, r14
mov rcx, rdi
mov qword [rsi + rax + 8], rdi
mov qword [rsi + rax], r14
mov qword [rsi + rax + 0x10], r12
call fcn.140004790
mov r8, qword [rsp + 0x20]
inc ebx
mov dword [rsp + 0x28], ebx
mov qword [rsi + r8 + 0x18], rax
jmp 0x1400055c4
mov r8, qword [rsp + 0x20]
jmp 0x1400055da
mov r8, qword [rsp + 0x20]
jmp 0x1400055df
mov ecx, 1
call fcn.14000d3f4
int3