Function at 0x1400072e0
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
push r12
push r14
sub rsp, 0x60
mov qword [rax + 8], rbp
xor r12d, r12d
mov qword [rax + 0x18], r15
mov r15, rcx
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov r14, qword [rdx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x14000739b
nop dword [rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x140007393
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
mov r8d, r12d
test r10d, r10d
je 0x140007393
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
mov ebx, r8d
lea rax, [rsi + rbx*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x14000738b
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x140007370
cmp eax, 0xcb0c2130
je 0x14000756f
inc r8d
cmp r8d, r10d
jb 0x140007350
mov r11, qword [r11]
cmp r11, r14
jne 0x140007320
mov rbp, qword [rsp + 0x98]
jmp 0x14077c4bc
mov ecx, dword [rdi + 0x24]
add rcx, r9
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r9
mov ebp, dword [rcx + rdx*4]
add rbp, r9
jmp 0x1400073a3
call 0x14037ad97
push 0x2eff9fa1
push r11
mov r11, rsp
add r11, 8
sub r11, 8
xchg qword [rsp], r11
pop rsp
push rdx
pop qword [rsp]
pop qword [rsp]
sub rsp, 8
push rax
mov rax, rsp
add rax, 8
sub rax, 8
xchg qword [rsp], rax
pop rsp
mov qword [rsp], rbx
pop qword [rsp]
push 0x7d2e41d8
push rbx
mov rbx, rsp
add rbx, 8
sub rbx, 8
xchg qword [rsp], rbx
pop rsp
push rbx
pop qword [rsp]
pop qword [rsp]
push 0x7eff6819
push r14
push rsp
pop r14
add r14, 8
sub r14, 8
xchg qword [rsp], r14
pop rsp
mov qword [rsp], rbp
pop qword [rsp]
push 0x1fbf2b93
push 0x7bdd4e38
push r9
mov r9, rsi
mov qword [rsp + 8], r9
mov r9, qword [rsp]
add rsp, 8
pop qword [rsp]
push 0x7eee5017
sub rsp, 8
push 0x5bef9354
mov qword [rsp], rdi
pop qword [rsp]
pop qword [rsp]
push rdi
mov rdi, rsp
add rdi, 8
sub rdi, 8
xor rdi, qword [rsp]
xor qword [rsp], rdi
xor rdi, qword [rsp]
mov rsp, qword [rsp]
mov qword [rsp], r15
sub rsp, 8
sub rsp, 8
mov qword [rsp], r12
mov r12, rsp
add r12, 8
sub r12, 8
xchg qword [rsp], r12
pop rsp
mov qword [rsp], r14
pop qword [rsp]
push 0x6cffd8a6
sub rsp, 8
mov qword [rsp], r13
pop qword [rsp]
sub rsp, 8
sub rsp, 8
push r11
mov r11, r12
push r11
pop qword [rsp + 8]
pop r11
pop qword [rsp]
push 0x23df1a4c
push 0x7dff52ce
mov qword [rsp], r11
pop qword [rsp]
push 0x777eb71e
sub rsp, 8
mov qword [rsp], rcx
mov rcx, rsp
add rcx, 8
sub rcx, 8
xchg qword [rsp], rcx
pop rsp
mov qword [rsp], r10
pop qword [rsp]
sub rsp, 8
sub rsp, 8
sub rsp, 8
mov qword [rsp], r9
pop qword [rsp]
pop qword [rsp]
sub rsp, 8
sub rsp, 8
mov qword [rsp], rbx
mov rbx, rsp
add rbx, 8
sub rbx, 8
xchg qword [rsp], rbx
pop rsp
mov qword [rsp], r8
pop qword [rsp]
push rcx
push rcx
movabs rcx, 0x22ff4ef0
push r14
mov r14, rcx
add qword [rsp + 0x10], r14
pop r14
pop rcx
push qword [rsp]
pop r8
add rsp, 8
sub r8, 0x22ff4ef0
push qword [rsp + 0x78]
push qword [rsp]
push qword [rsp]
pop r9
add rsp, 8
add rsp, 8
push qword [rsp + 0x70]
push qword [rsp]
push qword [rsp]
pop rcx
add rsp, 8
add rsp, 8
sub rsp, 8
push r10
mov r10, rsp
add r10, 8
sub r10, 8
xchg qword [rsp], r10
pop rsp
mov qword [rsp], rax
pop qword [rsp]
pop qword [rsp + 0x78]
sub rcx, 5
sub rcx, 0x37ad92
push 0x7be1cc31
mov qword [rsp], r10
push rcx
mov rcx, rcx
mov qword [rsp], 0x5fbbad19
pop r10
shr r10d, 3
shl r10d, 7
sub r10d, 0xfb282fe0
mov ebp, r10d
mov r10, qword [rsp]
push rdi
mov rdi, rsp
add rdi, 8
add rdi, 8
xchg qword [rsp], rdi
pop rsp
add rbp, 0x3f2d26a9
add rbp, 0x2ddfec5c
add rbp, 0x6eb178bb
add rbp, 0x3fff1f0e
add rbp, 0x30367cd7
add rbp, rcx
sub rbp, 0x30367cd7
sub rbp, 0x3fff1f0e
sub rbp, 0x6eb178bb
sub rbp, 0x2ddfec5c
sub rbp, 0x3f2d26a9
push rbx
push rsp
pop rbx
add rbx, 8
sub rbx, 8
xchg qword [rsp], rbx
pop rsp
sub rsp, 8
mov qword [rsp], rcx
pop qword [rsp]
push rsi
mov esi, 0x6a774e68
mov ecx, esi
pop rsi
not ecx
sub ecx, 1
push 0x6d5f6245
mov qword [rsp], r10
mov r10d, 0x4eaed438
add ecx, r10d
pop r10
add ecx, 0x1bc87a33
push r9
mov r9d, 0x6df04cd0
inc r9d
push r12
mov r12d, 0x661fb2b1
and r12d, 0x6dbd691b
push rbp
push r12
mov r12d, 0x7eff1421
mov ebp, 0xe8be41f5
sub ebp, r12d
pop r12
xor r12d, ebp
pop rbp
add r12d, 0x584b3f17
or r9d, r12d
pop r12
shr r9d, 6
or r9d, 0x35ff9bad
push rsi
mov esi, 0xca000141
add r9d, esi
pop rsi
mov ebx, r9d
pop r9
xor eax, eax
lock cmpxchg dword [rbx + rbp], ecx
je 0x14037b0f6
pause
jmp 0x14037b0e2
push qword [rsp]
push qword [rsp]
pop rcx
add rsp, 8
add rsp, 8
sub rsp, 8
mov qword [rsp], r12
mov r12d, 0x277f3284
shl r12d, 4
push 0x3d5bd9e7
mov qword [rsp], rdi
mov edi, 1
add r12d, edi
pop rdi
dec r12d
xor r12d, 0x6ff5a210
xor r12d, 0x18068a39
mov ebx, r12d
pop r12
push 0x5ffccf68
push 0x6630d194
push rcx
pop qword [rsp]
pop qword [rsp]
pop qword [rbx + rbp]
push r9
sub rsp, 8
mov qword [rsp], r12
mov r12d, 0x2f57d059
shr r12d, 3
inc r12d
push r14
mov r14d, 0x73e3f57b
dec r14d
or r14d, 0x1bd8c07f
sub r14d, 0x7d795ebd
sub r14d, 0x7f9d8dd5
xor r12d, r14d
pop r14
not r12d
add r12d, 0xdb0f9ca4
mov r9d, r12d
mov r12, qword [rsp]
add rsp, 8
mov edx, 0x5fffa9c3
sub edx, r9d
pop r9
test edx, edx
je 0x14037b2d9
push 0x4df704ee
sub rsp, 8
push 0x7ddf7608
mov qword [rsp], rcx
pop qword [rsp]
pop qword [rsp]
push rsi
mov esi, 0x6ede0c0d
push r12
push r9
mov r9d, 0x1dbd0f65
sub r9d, 0xa1cb62f7
push r9
xor dword [rsp], 0x3bff7cd5
pop r12
push r8
mov r8d, 0x75ff649f
neg r8d
dec r8d
and r8d, 0x35eb0bbf
and r8d, 0x5dd9e53e
add r8d, 0x3bff7bb5
xor r12d, r8d
pop r8
pop r9
or esi, r12d
pop r12
xor esi, 0x7ffeeaba
mov ebx, esi
pop rsi
add rbx, 0x7f3c911e
sub rbx, 0x3fdf87f7
sub rbx, 0x73dd3816
add rbx, 0x6adaca53
sub rbx, 0x71fc49f8
add rbx, rcx
add rbx, 0x71fc49f8
sub rbx, 0x6adaca53
add rbx, 0x73dd3816
add rbx, 0x3fdf87f7
sub rbx, 0x7f3c911e
push 0x7afc2fdf
push 0x7ff724c7
mov qword [rsp], r10
pop qword [rsp]
mov r10d, reloc.WLDAP32.dll_Ordinal_200
mov ecx, r10d
mov r10, qword [rsp]
add rsp, 8
sub rsp, 8
mov qword [rsp], rsi
push rdx
mov rdx, rbx
mov rsi, rdx
pop rdx
mov qword [rcx + rbp], rsi
push qword [rsp]
pop rsi
add rsp, 8
mov rcx, qword [rsp]
push rsi
push rsp
pop rsi
add rsi, 8
add rsi, 8
push 0xf192299
mov qword [rsp], rsi
push qword [rsp + 8]
pop rsi
pop qword [rsp]
pop rsp
push r10
push r15
push 0x3f6fac16
pop r15
sub r15d, 0xdf987233
push r15
add dword [rsp], 0x43baa8b9
pop r10
sub r10d, 0x43baa8b9
pop r15
mov ebx, 0x28285985
xor ebx, r10d
pop r10
shr ebx, 2
inc ebx
neg ebx
add ebx, 0x1e5f42fa
push r9
mov r9d, 0x7ed41fde
and ebx, r9d
pop r9
xor ebx, 0xc6a9dc
push 0x3e7dde84
mov qword [rsp], r14
push 0x3997bcd2
push qword [rsp]
pop r14
add rsp, 8
or r14d, 0x3effea08
sub r14d, 0x3ffffed9
push r14
add dword [rsp], 0x73d7c90f
pop rax
sub eax, 0x73d7c90f
pop r14
test eax, eax
je 0x14037b3ee
sub rsp, 8
mov qword [rsp], rdx
mov edx, 0x7743b0ab
push r9
mov r9d, 0x337b12a9
dec r9d
shl r9d, 7
shr r9d, 4
xor r9d, 0x5d7dc65d
not r9d
add r9d, 0xc6949bc0
add edx, r9d
pop r9
push r13
mov r13d, 0x7bff8ad3
add edx, r13d
pop r13
or edx, 0x5c4fac40
add edx, 0x808053a0
push rdx
sub dword [rsp], 0x7bd7d801
pop rax
add eax, 0x7bd7d801
pop rdx
test eax, eax
je 0x14037b3e3
movabs rax, qword gs:[0x188]
jmp 0x14037b3ee
movabs rax, qword gs:[0x30]
shl rax, 0x20
xor edx, edx
push 0x7f9a955b
push rbx
mov rbx, rax
push rbx
pop qword [rsp + 8]
mov rbx, qword [rsp]
add rsp, 8
pop rdx
sub rsp, 8
push r9
pop qword [rsp]
push r8
mov r8d, 0x2ffdad4f
add dword [rsp + 8], r8d
pop r8
mov rax, qword [rsp]
add rsp, 8
sub eax, 0x2ffdad4f
or rdx, rax
sub rsp, 8
sub rsp, 8
push rdx
pop qword [rsp]
pop qword [rsp]
pop qword [rcx + rbx]
push r8
mov r8d, 0x3efe6cf9
shr r8d, 6
add r8d, 0xffffffff
sub r8d, 1
sub r8d, 0xfbf889
mov edx, r8d
push qword [rsp]
pop r8
add rsp, 8
push rbx
sub rsp, 8
mov qword [rsp], rsi
mov esi, 0x7edfe6e5
add dword [rsp + 8], esi
pop rsi
pop rax
sub rsp, 8
mov qword [rsp], rdi
mov edi, 0x4aec7b3e
xor edi, 0x59ff6bc3
sub edi, 0x739fc0c9
shl edi, 5
shr edi, 6
sub edi, 0x84d9c135
sub eax, edi
pop rdi
add rax, 0x7bf77dd3
add rax, 0x7fac0bba
add rax, 0x3fcfc684
sub rax, 0x4dfb73e8
add rax, 0x7dd3dfdc
add rax, rcx
sub rax, 0x7dd3dfdc
add rax, 0x4dfb73e8
sub rax, 0x3fcfc684
sub rax, 0x7fac0bba
sub rax, 0x7bf77dd3
push 0x35ddb7a7
mov qword [rsp], r11
push r10
mov r10, rax
mov r11, r10
pop r10
mov qword [rdx + rbp], r11
push qword [rsp]
pop r11
add rsp, 8
push 0x6d7387bf
sub rsp, 8
push r8
pop qword [rsp]
pop qword [rsp]
pop qword [rsp + 0x70]
sub rsp, 8
mov qword [rsp], r12
mov r12d, 0x5fbf6654
mov ebx, 0x5fbf66d2
add ebx, 0xcfbc1d0
sub ebx, r12d
sub ebx, 0xcfbc1d0
push qword [rsp]
pop r12
add rsp, 8
push qword [rsp + 0x50]
push qword [rsp]
push qword [rsp]
pop rax
add rsp, 8
add rsp, 8
push rax
sub rsp, 8
mov qword [rsp], rdi
movabs rdi, 0x5faf1323
sub qword [rsp + 8], rdi
pop rdi
pop qword [rbx + rbp]
add qword [rbx + rbp], 0x5faf1323
push r9
push 0x67ef2439
mov r9, qword [rsp]
add rsp, 8
push rdi
mov edi, 0x5efbb49f
xor r9d, edi
mov rdi, qword [rsp]
add rsp, 8
or r9d, 0x6e7f0009
add r9d, 0x80806fd7
mov ebx, r9d
mov r9, qword [rsp]
add rsp, 8
push qword [rsp + 0x90]
mov rax, qword [rsp]
push 0x7aff1caf
mov qword [rsp], r15
mov r15, rsp
add r15, 8
add r15, 8
xchg qword [rsp], r15
pop rsp
add rax, 0x5ffd0789
sub rax, 0x7ffa0e77
sub rax, 0x1ffc3180
add rax, 0x2bcfa1ad
add rax, rcx
sub rax, 0x2bcfa1ad
add rax, 0x1ffc3180
add rax, 0x7ffa0e77
sub rax, 0x5ffd0789
push rax
mov rax, rsp
add rax, 8
sub rax, 8
xor rax, qword [rsp]
push rsi
mov rsi, rax
xor qword [rsp + 8], rsi
pop rsi
xor rax, qword [rsp]
pop rsp
mov qword [rsp], rax
sub qword [rsp], 0x6bf9fa48
pop qword [rbx + rbp]
add qword [rbx + rbp], 0x6bf9fa48
push r13
mov r13d, 0x5df7e5ba
neg r13d
push 0x38dbd075
mov qword [rsp], rax
mov eax, 0x6fe5fc20
xor eax, 0x1f77889f
sub eax, 0x1207ebe1
add r13d, eax
mov rax, qword [rsp]
add rsp, 8
mov eax, r13d
mov r13, qword [rsp]
add rsp, 8
sub rax, 0x3e36cc12
add rax, 0x7adff2ed
sub rax, 0x3d9b75be
sub rax, 0x7ef7a844
sub rax, 0x7feb29db
add rax, rcx
add rax, 0x7feb29db
add rax, 0x7ef7a844
add rax, 0x3d9b75be
sub rax, 0x7adff2ed
add rax, 0x3e36cc12
push 0x57d74652
mov qword [rsp], rdi
push rbp
mov rbp, rbp
mov qword [rsp], 0x5dfecbf5
pop rdi
neg edi
sub rsp, 8
mov qword [rsp], rbx
mov ebx, 0x7eff2914
or ebx, 0x57d7a447
shr ebx, 3
shl ebx, 6
xor ebx, 0xa203a61b
add edi, ebx
pop rbx
mov ebx, edi
pop rdi
push qword [rbx + rbp]
push r13
movabs r13, 0x6ffed9c0
sub qword [rsp + 8], r13
pop r13
pop rdx
add rdx, 0x6ffed9c0
cmp rdx, rax
je 0x14037b861
sub rsp, 8
push r10
mov r10, rbx
push r8
push r10
xor qword [rsp], 0x3ffa5122
pop r8
xor r8, 0x3ffa5122
push r8
pop qword [rsp + 0x10]
pop r8
pop r10
push rdx
push rbx
push rbx
pop rbx
mov qword [rsp], 0x3cd33493
mov rdx, qword [rsp]
add rsp, 8
sub edx, 0x3cd326c3
push rdx
sub dword [rsp], 0x57d73ab6
pop rbx
add ebx, 0x57d73ab6
pop rdx
shr ebx, 3
sub rsp, 8
sub rsp, 8
push 0x4baff9a5
mov qword [rsp], rsi
mov rsi, rax
mov qword [rsp + 8], rsi
pop rsi
pop qword [rsp]
test rbx, rbx
je 0x14037b7fc
sub qword [rax], 0x343df818
push rdx
mov rdx, 0
sub rdx, 0x3f772d05
add rdx, rax
add rdx, 0x3f772d05
add qword [rdx], rcx
push qword [rsp]
pop rdx
add rsp, 8
add qword [rax], 0x343df818
add rax, 8
sub ebx, 1
jmp 0x14037b7b2
push qword [rsp]
push qword [rsp]
mov rax, qword [rsp]
add rsp, 8
add rsp, 8
add rsp, 8
push qword [rsp]
push qword [rsp]
pop rbx
push r15
mov r15, rsp
add r15, 8
add r15, 8
xchg qword [rsp], r15
pop rsp
add rsp, 8
push rax
push r12
push 0x27bff225
mov qword [rsp], rdi
movabs rdi, 0x7eb5507c
mov r12, rdi
pop rdi
sub qword [rsp + 8], r12
pop r12
pop qword [rbx + rbp]
add qword [rbx + rbp], 0x7eb5507c
push qword [rsp + 0x88]
push qword [rsp]
push qword [rsp]
pop rbx
add rsp, 8
add rsp, 8
shl rbx, 3
add rax, 0x7fe63d61
add rax, 0x77fbd113
add rax, 0x39beb909
add rax, 0x4f7bb2e4
add rax, 0x71f5b54e
add rax, rbx
sub rax, 0x71f5b54e
sub rax, 0x4f7bb2e4
sub rax, 0x39beb909
sub rax, 0x77fbd113
sub rax, 0x7fe63d61
jmp qword [rax]
pushfq
sub rsp, 8
mov qword [rsp], rsi
push r12
mov r12, rsi
push r12
pop rsi
pop r12
push rax
movabs rax, Ordinal_200
mov qword [rsp + 8], rax
pop rax
sub rsp, 8
mov qword [rsp], rcx
mov rcx, rcx
sub rsp, 8
mov qword [rsp], rcx
movabs rcx, 0x299591
push rcx
pop qword [rsp + 8]
pop rcx
push 0x579e77d3
sub rsp, 8
push 0x6bef16d4
mov qword [rsp], rax
pop qword [rsp]
pop qword [rsp]
sub rsp, 8
push 0x7ff875f1
push 0x7ae290ae
mov qword [rsp], rbx
pop qword [rsp]
pop qword [rsp]
push qword [rsp + 0x20]
push qword [rsp]
pop rax
push r12
mov r12, rsp
add r12, 8
add r12, 8
push r12
push qword [rsp + 8]
pop r12
pop qword [rsp]
pop rsp
push qword [rsp + 0x10]
push qword [rsp]
pop rbx
push rdi
mov rdi, rsp
add rdi, 8
add rdi, 8
xchg qword [rsp], rdi
mov rsp, qword [rsp]
push r13
mov r13, rsp
add r13, 8
sub r13, 8
xchg qword [rsp], r13
pop rsp
push 0x5d6f0436
mov qword [rsp], rax
pop qword [rsp]
pop qword [rsp + 0x10]
push r12
mov r12, rsp
add r12, 8
sub r12, 8
xor r12, qword [rsp]
xor qword [rsp], r12
xor r12, qword [rsp]
pop rsp
push rbx
pop qword [rsp]
pop qword [rsp + 0x20]
mov rbx, qword [rsp]
push r15
mov r15, rsp
add r15, 8
add r15, 8
xor r15, qword [rsp]
push rax
mov rax, r15
xor qword [rsp + 8], rax
pop rax
xor r15, qword [rsp]
mov rsp, qword [rsp]
push qword [rsp]
pop rax
push rbp
push rsp
pop rbp
add rbp, 8
add rbp, 8
xchg qword [rsp], rbp
sub al, 0x24
pop rsp
push rcx
mov rcx, rcx
push rdx
movabs rdx, 0x377a115a
not rdx
inc rdx
dec rdx
push 0x7bf61623
mov qword [rsp], rbp
mov rbp, 0x377a8504
add rdx, rbp
pop rbp
mov qword [rsp + 8], rdx
pop rdx
jmp 0x14037ad92