Function at 0x1400039f0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword gs:[0x60]
xor r12d, r12d
mov dword [rbp + 7], 0x65006b
mov dword [rbp + 0xb], 0x6e0072
mov dword [rbp + 0xf], 0x6c0065
mov dword [rbp + 0x13], 0x320033
mov dword [rbp + 0x17], 0x64002e
mov dword [rbp + 0x1b], 0x6c006c
mov word [rbp + 0x1f], r12w
test rax, rax
je 0x140003acf
mov rax, qword [rax + 0x18]
test rax, rax
je 0x140003acf
mov r10, qword [rax + 0x10]
lea r11, [rax + 0x10]
cmp r10, r11
je 0x140003acf
nop word [rax + rax]
mov r8, qword [r10 + 0x60]
lea r9, [rbp + 7]
nop dword [rax + rax]
movzx eax, word [r8]
lea r8, [r8 + 2]
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x140003a95
add ax, 0x20
movzx edx, word [r9]
add r9, 2
lea ecx, [rdx - 0x42]
cmp cx, 0x17
ja 0x140003aaa
add dx, 0x20
test ax, ax
je 0x140003abe
cmp ax, dx
je 0x140003a80
movzx ecx, dx
movzx edx, ax
sub edx, ecx
jmp 0x140003ac3
movzx edx, dx
neg edx
test edx, edx
je 0x140003aee
mov r10, qword [r10]
cmp r10, r11
jne 0x140003a70
xor eax, eax
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r12
pop rbp
ret
mov rdi, qword [r10 + 0x30]
test rdi, rdi
je 0x140003acf
mov qword [rsp + 0xf0], r13
lea r11, [rdi + 0x3c]
mov r13d, 0x5a4d
mov dword [rbp - 0x19], 0x50746547
mov dword [rbp - 0x15], 0x41636f72
mov dword [rbp - 0x11], 0x65726464
mov word [rbp - 0xd], 0x7373
mov byte [rbp - 0xb], r12b
cmp word [rdi], r13w
jne 0x140003bbc
movsxd rax, dword [r11]
cmp dword [rax + rdi], 0x4550
jne 0x140003bbc
mov ecx, dword [rax + rdi + 0x88]
test ecx, ecx
je 0x140003bbc
mov r9d, dword [rdi + rcx + 0x20]
lea rsi, [rdi + rcx]
mov ebx, dword [rsi + 0x18]
add r9, rdi
mov r10d, r12d
test ebx, ebx
je 0x140003bbc
mov ecx, dword [r9]
lea r8, [rbp - 0x19]
add rcx, rdi
sub r8, rcx
movzx edx, byte [r8 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
je 0x140003b8a
cmp dl, al
je 0x140003b70
mov ecx, edx
sub ecx, eax
jmp 0x140003b8e
mov ecx, eax
neg ecx
test ecx, ecx
je 0x140003ba0
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x140003b63
jmp 0x140003bbc
mov eax, dword [rsi + 0x24]
add rax, rdi
mov ecx, r10d
movzx edx, word [rax + rcx*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rdi
mov r15d, dword [rcx + rdx*4]
add r15, rdi
jne 0x140003bc3
lea r15, [0x140003910]
cmp word [rdi], r13w
mov r13, qword [rsp + 0xf0]
mov dword [rbp - 0x59], 0x626f6c47
mov dword [rbp - 0x55], 0x6c416c61
mov dword [rbp - 0x51], 0x636f6c
mov dword [rbp - 0x69], 0x626f6c47
mov dword [rbp - 0x65], 0x72466c61
mov word [rbp - 0x61], 0x6565
mov byte [rbp - 0x5f], r12b
je 0x140003c06
mov rsi, r12
jmp 0x140003d25
movsxd rax, dword [r11]
cmp dword [rax + rdi], 0x4550
je 0x140003c1a
mov rsi, r12
jmp 0x140003d25
mov ecx, dword [rax + rdi + 0x88]
test ecx, ecx
je 0x140003c7e
mov r9d, dword [rdi + rcx + 0x20]
lea rsi, [rdi + rcx]
mov ebx, dword [rsi + 0x18]
add r9, rdi
mov r10d, r12d
test ebx, ebx
je 0x140003c7e
nop dword [rax + rax]
mov ecx, dword [r9]
lea r8, [rbp - 0x59]
add rcx, rdi
sub r8, rcx
nop dword [rax]
movzx edx, byte [r8 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
je 0x140003c6a
cmp dl, al
je 0x140003c50
mov ecx, edx
sub ecx, eax
jmp 0x140003c6e
mov ecx, eax
neg ecx
test ecx, ecx
je 0x140003cda
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x140003c40
mov rsi, r12
movsxd rax, dword [r11]
add rax, rdi
mov ecx, dword [rax + 0x88]
test ecx, ecx
je 0x140003d25
mov r9d, dword [rdi + rcx + 0x20]
lea rbx, [rdi + rcx]
mov r11d, dword [rbx + 0x18]
add r9, rdi
mov r10d, r12d
test r11d, r11d
je 0x140003d25
nop dword [rax]
mov ecx, dword [r9]
lea r8, [rbp - 0x69]
add rcx, rdi
sub r8, rcx
nop dword [rax]
movzx edx, byte [r8 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
je 0x140003cf5
cmp dl, al
je 0x140003cc0
mov ecx, edx
sub ecx, eax
jmp 0x140003cf9
mov eax, dword [rsi + 0x24]
add rax, rdi
mov ecx, r10d
movzx edx, word [rax + rcx*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rdi
mov esi, dword [rcx + rdx*4]
add rsi, rdi
jmp 0x140003c81
mov ecx, eax
neg ecx
test ecx, ecx
je 0x140003d0b
inc r10d
add r9, 4
cmp r10d, r11d
jb 0x140003cb0
jmp 0x140003d25
mov eax, dword [rbx + 0x24]
add rax, rdi
mov ecx, r10d
movzx edx, word [rax + rcx*2]
mov ecx, dword [rbx + 0x1c]
add rcx, rdi
mov r12d, dword [rcx + rdx*4]
add r12, rdi
test rsi, rsi
je 0x140003acf
test r12, r12
je 0x140003acf
mov edx, pe_nt_image_headers64
mov ecx, edx
call rsi
mov rbx, rax
test rax, rax
je 0x140003acf
movdqa xmm0, xmmword [0x140002480]
lea rdx, [rbp + 0x27]
mov rcx, rdi
mov qword [rax], r15
movdqu xmmword [rbp + 0x27], xmm0
mov qword [rax + 0x30], rsi
mov qword [rax + 0x38], r12
mov byte [rbp + 0x37], 0
call r15
mov qword [rbx + 8], rax
test rax, rax
je 0x140003acf
lea rdx, [rbp - 0x39]
mov dword [rbp - 0x39], 0x64616f4c
mov rcx, rdi
mov dword [rbp - 0x35], 0x7262694c
mov dword [rbp - 0x31], 0x41797261
mov byte [rbp - 0x2d], 0
call r15
cmp qword [rbx + 8], 0
mov qword [rbx + 0x10], rax
je 0x140003acf
lea rdx, [rbp - 0x29]
mov dword [rbp - 0x29], 0x74726956
mov rcx, rdi
mov dword [rbp - 0x25], 0x416c6175
mov dword [rbp - 0x21], 0x636f6c6c
mov byte [rbp - 0x1d], 0
call r15
cmp qword [rbx + 8], 0
mov qword [rbx + 0x18], rax
je 0x140003acf
lea rdx, [rbp - 0x49]
mov dword [rbp - 0x49], 0x74726956
mov rcx, rdi
mov dword [rbp - 0x45], 0x466c6175
mov dword [rbp - 0x41], 0x656572
call r15
cmp qword [rbx + 8], 0
mov qword [rbx + 0x20], rax
je 0x140003acf
lea rdx, [rbp - 9]
mov dword [rbp - 9], 0x74726956
mov rcx, rdi
mov dword [rbp - 5], 0x506c6175
mov dword [rbp - 1], 0x65746f72
mov word [rbp + 3], 0x7463
mov byte [rbp + 5], 0
call r15
cmp qword [rbx + 8], 0
mov qword [rbx + 0x28], rax
je 0x140003acf
mov rax, rbx
jmp 0x140003ad1