Function at 0x18002e000
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push rbp
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov dword [rbp - 0x78], 0x6c64746e
mov dword [rbp - 0x74], 0x6c642e6c
mov word [rbp - 0x70], 0x6c
mov byte [rbp - 0x6e], 0
mov dword [rbp - 8], 0x575c3a43
mov dword [rbp - 4], 0x6f646e69
mov dword [rbp], 0x535c7377
mov dword [rbp + 4], 0x65747379
mov dword [rbp + 8], 0x5c32336d
mov dword [rbp + 0xc], 0x676e6566
mov dword [rbp + 0x10], 0x6e656873
mov dword [rbp + 0x14], 0x2e757067
mov dword [rbp + 0x18], 0x657865
mov byte [rbp + 0x1c], 0
mov dword [rbp - 0x68], 0x61657243
mov dword [rbp - 0x64], 0x69466574
mov dword [rbp - 0x60], 0x41656c
mov byte [rbp - 0x5c], 0
mov dword [rbp - 0x58], 0x46746547
mov dword [rbp - 0x54], 0x53656c69
mov dword [rbp - 0x50], 0x657a69
mov byte [rbp - 0x4c], 0
mov dword [rsp + 0x78], 0x64616552
mov dword [rsp + 0x7c], 0x656c6946
mov word [rbp - 0x80], 0
mov dword [rbp - 0x48], 0x74726956
mov dword [rbp - 0x44], 0x416c6175
mov dword [rbp - 0x40], 0x636f6c6c
mov word [rbp - 0x3c], 0
mov dword [rbp - 0x20], 0x416c7452
mov dword [rbp - 0x1c], 0x73756a64
mov dword [rbp - 0x18], 0x69725074
mov dword [rbp - 0x14], 0x656c6976
mov dword [rbp - 0x10], 0x6567
mov dword [rbp - 0x38], 0x6152744e
mov dword [rbp - 0x34], 0x48657369
mov dword [rbp - 0x30], 0x45647261
mov dword [rbp - 0x2c], 0x726f7272
mov word [rbp - 0x28], 0
mov rax, qword gs:[0x30]
mov dword [rsp + 0x58], 0x64616f4c
mov dword [rsp + 0x5c], 0x7262694c
mov dword [rsp + 0x60], 0x41797261
mov rcx, qword [rax + 0x60]
mov word [rsp + 0x64], 0
mov dword [rsp + 0x68], 0x50746547
mov dword [rsp + 0x6c], 0x41636f72
mov r8, qword [rcx + 0x18]
mov rcx, qword [r8 + 0x20]
add r8, 0x20
mov dword [rsp + 0x70], 0x65726464
mov dword [rsp + 0x74], 0x7373
mov dword [rsp + 0x40], 0x33613361
mov dword [rsp + 0x44], 0x66317335
mov dword [rsp + 0x48], 0x37613664
mov dword [rsp + 0x4c], 0x73317234
mov word [rsp + 0x50], 0x7a66
cmp rcx, r8
je 0x18002e4cf
movabs r10, 0x4e00520045004b
movabs r9, 0x6e00720065006b
nop dword [rax]
cmp word [rcx + 0x48], 0x18
jne 0x18002e1c8
mov rax, qword [rcx + 0x50]
mov rdx, qword [rax]
cmp rdx, r10
je 0x18002e1d9
cmp rdx, r9
je 0x18002e1d9
mov rcx, qword [rcx]
cmp rcx, r8
jne 0x18002e1b0
add rsp, 0x170
pop rbp
ret
mov qword [rsp + 0x160], rsi
mov rsi, qword [rcx + 0x20]
test rsi, rsi
je 0x18002e4c7
movsxd rax, dword [rsi + 0x3c]
mov qword [rsp + 0x168], rbx
mov qword [rsp + 0x158], rdi
mov qword [rsp + 0x150], r12
mov r10d, dword [rax + rsi + 0x88]
add r10, rsi
mov qword [rsp + 0x148], r13
mov qword [rsp + 0x140], r14
xor r14d, r14d
mov qword [rsp + 0x138], r15
mov r8d, r14d
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x18002e29c
mov ebx, dword [r10 + 0x24]
mov edi, dword [r10 + 0x20]
nop dword [rax]
nop dword [rax + rax]
mov ecx, r8d
lea rax, [rbx + rcx*2]
movzx r11d, word [rax + rsi]
lea rax, [rdi + rcx*4]
mov edx, dword [rax + rsi]
add rdx, rsi
movzx ecx, byte [rdx]
cmp cl, 0x4c
jne 0x18002e294
lea r15, [rsp + 0x58]
sub rdx, r15
lea rax, [rsp + 0x58]
nop dword [rax + rax]
test cl, cl
je 0x18002e3a8
movzx ecx, byte [rdx + rax + 1]
inc rax
cmp cl, byte [rax]
je 0x18002e280
inc r8d
cmp r8d, r9d
jb 0x18002e250
mov r8d, r14d
mov r12, r14
test r9d, r9d
je 0x18002e2fc
mov ebx, dword [r10 + 0x24]
mov edi, dword [r10 + 0x20]
nop
mov ecx, r8d
lea rax, [rbx + rcx*2]
movzx r11d, word [rax + rsi]
lea rax, [rdi + rcx*4]
mov edx, dword [rax + rsi]
add rdx, rsi
movzx ecx, byte [rdx]
cmp cl, 0x47
jne 0x18002e2f4
lea r15, [rsp + 0x68]
sub rdx, r15
lea rax, [rsp + 0x68]
nop dword [rax + rax]
test cl, cl
je 0x18002e3be
movzx ecx, byte [rdx + rax + 1]
inc rax
cmp cl, byte [rax]
je 0x18002e2e0
inc r8d
cmp r8d, r9d
jb 0x18002e2b0
mov r15, r14
lea rcx, [rbp - 0x78]
call r12
lea rdx, [rbp - 0x48]
mov rcx, rsi
mov rbx, rax
call r15
lea rdx, [rbp - 0x68]
mov rcx, rsi
mov r13, rax
call r15
lea rdx, [rbp - 0x58]
mov rcx, rsi
mov rdi, rax
call r15
lea rdx, [rsp + 0x78]
mov qword [rbp + 0x98], rax
mov rcx, rsi
call r15
lea rdx, [rbp - 0x20]
mov qword [rbp + 0x20], rax
mov rcx, rbx
call r15
lea rdx, [rbp - 0x38]
mov rcx, rbx
mov rsi, rax
call r15
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
lea rcx, [rbp - 8]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov r15, rax
lea r8d, [r9 + 1]
call rdi
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x18002e3d1
lea r9, [rbp + 0x80]
xor r8d, r8d
mov dl, 1
lea ecx, [rax + 0x14]
call rsi
mov ecx, 0xc00001b2
jmp 0x18002e478
mov ecx, dword [r10 + 0x1c]
mov r8d, r14d
add rcx, rsi
mov r12d, dword [rcx + r11*4]
add r12, rsi
jmp 0x18002e2a7
mov ecx, dword [r10 + 0x1c]
add rcx, rsi
mov r15d, dword [rcx + r11*4]
add r15, rsi
jmp 0x18002e2ff
xor edx, edx
mov rcx, r12
call qword [rbp + 0x98]
xor ecx, ecx
movsxd rdi, eax
mov rdx, rdi
mov r8d, 0x1000
lea r9d, [rcx + 4]
call r13
lea r9, [rbp + 0x90]
mov dword [rbp + 0x90], r14d
mov r8d, edi
mov qword [rsp + 0x20], r14
mov rdx, rax
mov rcx, r12
mov rbx, rax
call qword [rbp + 0x20]
test eax, eax
jne 0x18002e42f
lea r9, [rbp + 0x80]
xor r8d, r8d
mov dl, 1
lea ecx, [rax + 0x13]
call rsi
mov ecx, 0xc0000374
jmp 0x18002e478
lea eax, [rdi - 0x14]
test eax, eax
jle 0x18002e461
movzx ecx, word [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
cmp qword [rbx], r8
jne 0x18002e456
cmp qword [rbx + 8], rdx
jne 0x18002e456
cmp word [rbx + 0x10], cx
je 0x18002e497
inc rbx
inc r14d
cmp r14d, eax
jl 0x18002e445
xor r8d, r8d
lea r9, [rbp + 0x80]
mov dl, 1
lea ecx, [r8 + 0x13]
call rsi
mov ecx, 0xc00002b4
lea rax, [rbp + 0x88]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 6
call r15
mov r14, qword [rsp + 0x140]
mov r13, qword [rsp + 0x148]
mov r12, qword [rsp + 0x150]
mov rdi, qword [rsp + 0x158]
mov rbx, qword [rsp + 0x168]
mov r15, qword [rsp + 0x138]
mov rsi, qword [rsp + 0x160]
add rsp, 0x170
pop rbp
ret