Function at 0x1401a7810
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x48
mov rsi, rdx
mov rdi, rcx
call fcn.1401a76e0
xor ebx, ebx
mov r11, rax
test rax, rax
jne 0x1401a78a6
mov dword [rbp - 0x1b], 0x67636e4c
mov ecx, ebx
mov dword [rbp - 0x17], 0x75646c48
mov dword [rbp - 0x13], 0x4a737b69
mov byte [rbp - 0xf], al
nop dword [rax + rax]
movsxd rax, ecx
xor byte [rbp + rax - 0x1b], cl
inc ecx
cmp ecx, 0xc
jb 0x1401a7850
xor eax, eax
mov byte [rbp - 0xf], bl
mov byte [rbp - 0x1c], al
mov ecx, ebx
mov dword [rbp - 0x28], 0x6d70646b
mov dword [rbp - 0x24], 0x35356961
mov dword [rbp - 0x20], 0x67666d26
nop dword [rax]
movsxd rax, ecx
xor byte [rbp + rax - 0x28], cl
inc ecx
cmp ecx, 0xc
jb 0x1401a7880
lea rdx, [rbp - 0x1b]
mov byte [rbp - 0x1c], bl
lea rcx, [rbp - 0x28]
call fcn.1401a7810
mov rcx, rdi
call rax
mov r11, rax
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x40], r15
test r11, r11
je 0x1401a79f3
mov rdx, r11
mov rcx, r11
and edx, 1
and rcx, 0xfffffffffffffffe
test rdx, rdx
cmove rcx, r11
xor edx, 1
test rcx, rcx
je 0x1401a79f3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401a79f3
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x1401a79f3
movzx r8d, word [rax + 0x18]
mov r9d, 0x20b
cmp r8w, r9w
jne 0x1401a792d
cmp dword [rax + 0x84], ebx
jbe 0x1401a79f3
mov r8d, dword [rax + 0x88]
jmp 0x1401a794a
mov r9d, 0x10b
cmp r8w, r9w
jne 0x1401a79f3
cmp dword [rax + 0x74], ebx
jbe 0x1401a79f3
mov r8d, dword [rax + 0x78]
test r8, r8
je 0x1401a79f3
test edx, edx
jne 0x1401a7963
mov eax, dword [rax + 0x54]
cmp r8, rax
jae 0x1401a79f3
lea r10, [rcx + r8]
test r10, r10
je 0x1401a79f3
mov r15d, dword [r10 + 0x24]
mov r8d, ebx
mov r12d, dword [r10 + 0x20]
add r15, r11
mov r13d, dword [r10 + 0x1c]
add r12, r11
mov r14d, dword [r10 + 0x14]
add r13, r11
test r14d, r14d
je 0x1401a79f3
cmp rsi, 0xffff
ja 0x1401a79ab
movzx edi, r8w
mov ecx, edi
movzx eax, si
add ecx, dword [r10 + 0x10]
cmp eax, ecx
jmp 0x1401a79e5
cmp r8d, dword [r10 + 0x18]
jae 0x1401a7a93
mov eax, r8d
mov r9, rsi
mov ecx, dword [r12 + rax*4]
movzx edi, word [r15 + rax*2]
add rcx, r11
sub r9, rcx
nop word [rax + rax]
movzx edx, byte [rcx]
movzx eax, byte [rcx + r9]
sub edx, eax
jne 0x1401a79e3
inc rcx
test eax, eax
jne 0x1401a79d0
test edx, edx
je 0x1401a7ab5
inc r8d
cmp r8d, r14d
jb 0x1401a7991
mov dword [rbp - 0x1b], 0x7071644d
mov ecx, ebx
mov dword [rbp - 0x17], 0x45636265
mov dword [rbp - 0x13], 0x4b7167
nop word [rax + rax]
movsxd rax, ecx
xor byte [rbp + rax - 0x1b], cl
inc ecx
cmp ecx, 0xb
jb 0x1401a7a10
xor eax, eax
mov byte [rbp - 0x10], bl
mov byte [rbp - 0x1e], al
mov ecx, ebx
mov dword [rbp - 0x28], 0x71677275
mov dword [rbp - 0x24], 0x63283737
mov word [rbp - 0x20], 0x6564
nop dword [rax]
movsxd rax, ecx
xor byte [rbp + rax - 0x28], cl
inc ecx
cmp ecx, 0xa
jb 0x1401a7a40
lea rdx, [rbp - 0x1b]
mov byte [rbp - 0x1e], bl
lea rcx, [rbp - 0x28]
call fcn.1401a7810
xor ecx, ecx
mov dword [rbp + 0x38], 0x776b6f49
mov byte [rbp + 0x3c], cl
nop word [rax + rax]
movsxd rcx, ebx
xor byte [rbp + rcx + 0x38], bl
inc ebx
cmp ebx, 4
jb 0x1401a7a70
mov r9d, 0x10
mov byte [rbp + 0x3c], 0
lea r8, [rbp + 0x38]
mov rdx, rsi
xor ecx, ecx
call rax
xor eax, eax
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x88]
mov r13, qword [rsp + 0x78]
mov r12, qword [rsp + 0x70]
add rsp, 0x48
pop rdi
pop rsi
pop rbx
pop rbp
ret
movzx eax, di
mov eax, dword [r13 + rax*4]
add rax, r11
jmp 0x1401a7a95