Function at 0x1400336f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xd8
xor r14d, r14d
mov dword [rsp + 0x20], 0x55527024
mov dword [rsp + 0x24], 0x3c374e59
mov dword [rsp + 0x28], 0x446c6870
mov dword [rsp + 0x2c], 0x4151714f
mov dword [rsp + 0x30], 0x217a6d35
lea r8d, [r14 + 0x6b]
lea r12d, [r14 + 1]
mov word [rsp + 0x34], 0x5163
mov byte [rsp + 0x36], r14b
mov dword [rsp + 0x38], 0x65006b
mov dword [rbp - 0x7d], 0x6e0072
mov dword [rbp - 0x79], 0x6c0065
mov dword [rbp - 0x75], 0x320033
mov dword [rbp - 0x71], 0x64002e
mov dword [rbp - 0x6d], 0x6c006c
mov word [rbp - 0x69], r14w
mov edx, 0x3d0908
mov eax, r14d
lea rcx, [rbp - 0x59]
mov byte [rcx], al
add eax, r12d
add rcx, r12
cmp eax, r8d
jb 0x140033466
sub rdx, r12
jne 0x14003345f
cmp byte [rbp - 0x19], 0x40
jne 0x140033543
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rbx, qword [rcx + 0x10]
mov rdx, rbx
mov rcx, qword [rdx + 0x60]
mov r9d, r14d
mov rax, rcx
cmp word [rcx], r14w
je 0x1400334b3
lea rax, [rax + 2]
add r9d, r12d
cmp word [rax], r14w
jne 0x1400334a6
lea rax, [rsp + 0x38]
mov r8d, r14d
lea rax, [rax + 2]
add r8d, r12d
cmp word [rax], r14w
jne 0x1400334bb
cmp r9d, r8d
jne 0x14003352c
lea r11, [rsp + 0x38]
mov r10d, r14d
sub r11, rcx
movzx r8d, word [rcx]
mov rax, rcx
mov r9d, r14d
test r8w, r8w
je 0x14003353d
lea rax, [rax + 2]
add r9d, r12d
cmp word [rax], r14w
jne 0x1400334e8
cmp r10d, r9d
jae 0x14003353d
movzx r9d, word [r11 + rcx]
lea eax, [r8 - 0x41]
cmp ax, 0x19
ja 0x14003350e
add r8w, 0x20
lea eax, [r9 - 0x41]
cmp ax, 0x19
ja 0x14003351d
add r9w, 0x20
cmp r8w, r9w
jne 0x14003352c
add r10d, r12d
add rcx, 2
jmp 0x1400334d8
mov rdx, qword [rdx]
cmp rdx, rbx
jne 0x140033496
mov rbx, r14
jmp 0x140033547
mov rbx, qword [rdx + 0x30]
jmp 0x140033547
mov rbx, qword [rbp + 0x67]
mov edx, 0xe3142
mov rcx, rbx
call fcn.1400338a2
mov edx, 0xd5786
mov rcx, rbx
mov rdi, rax
call fcn.1400338a2
mov edx, 0x348bfa
mov rcx, rbx
mov qword [rbp + 0x7f], rax
call fcn.1400338a2
mov r13d, 0x3000
mov r9d, 4
mov edx, 0x11a00
xor ecx, ecx
mov r8d, r13d
mov qword [rbp + 0x77], rax
call rdi
movsx ecx, byte [rbp - 0xc]
xor ecx, 0x4d
movabs rbx, resource.366
mov r15, rax
add ecx, r12d
mov r10d, r14d
mov r11, rax
movsxd rsi, ecx
sub rbx, rax
movsxd r8, r10d
movabs rax, 0x642c8590b21642c9
add r10d, r12d
mov rcx, r8
mul r8
sub rcx, rdx
shr rcx, 1
add rcx, rdx
xor edx, edx
shr rcx, 4
imul rcx, rcx, 0x17
sub r8, rcx
mov rax, r8
div rsi
mov cl, byte [rsp + rax + 0x20]
xor cl, byte [rbx + r11]
mov byte [r11], cl
add r11, r12
cmp r10d, 0x11a00
jb 0x1400335b4
movsxd rax, dword [r15 + 0x3c]
mov r9d, 0x40
mov r8d, r13d
mov edx, dword [rax + r15 + 0x50]
xor ecx, ecx
leave
call rdi
mov rdi, rax
test rax, rax
je 0x140033889
movsxd rsi, dword [r15 + 0x3c]
mov r8d, r14d
add rsi, r15
sub rax, qword [rsi + 0x30]
mov r9d, dword [rsi + 0x54]
movzx r10d, word [rsi + 0x14]
mov qword [rbp + 0x6f], rax
mov qword [rsi + 0x30], rdi
test r9, r9
je 0x14003365f
mov rdx, r15
mov rcx, rdi
sub rdx, rdi
mov al, byte [rdx + rcx]
add r8d, r12d
mov byte [rcx], al
movsxd rax, r8d
add rcx, r12
cmp rax, r9
jb 0x14003364c
mov rax, qword [rsi + 0xb0]
mov rcx, qword [rsi + 0x90]
mov r13, r14
mov r12, r14
mov ebx, r14d
mov qword [rbp + 0x67], rax
cmp r14w, word [rsi + 6]
jae 0x140033889
lea r9, [r10 + 0x24]
add r9, rsi
mov r10d, dword [r9]
cmp eax, r10d
jb 0x1400336a4
mov r8d, dword [r9 - 4]
add r8d, r10d
cmp eax, r8d
jae 0x1400336a4
lea r13, [r9 - 0xc]
cmp ecx, r10d
jb 0x1400336b9
mov r8d, dword [r9 - 4]
add r8d, r10d
cmp ecx, r8d
jae 0x1400336b9
lea r12, [r9 - 0xc]
mov r11d, dword [r9 + 8]
mov r14d, dword [r9 + 4]
lea r8, [rdi + r10]
add r11, r15
xor r10d, r10d
test r14, r14
je 0x1400336e8
sub r11, r8
mov dl, byte [r11 + r8]
inc r10d
mov byte [r8], dl
movsxd rdx, r10d
inc r8
cmp rdx, r14
jb 0x1400336d3
movzx edx, word [rsi + 6]
inc ebx
add r9, 0x28
shr dword [rax], 0x3b
invalid
jl 0x14003368c
test r12, r12
je 0x140033889
mov r14d, dword [rbp + 0x6b]
xor edx, edx
test r14, r14
je 0x1400337bd
mov r12, qword [rbp + 0x6f]
mov r9d, dword [r13 + 0x14]
add r9, rdx
add rdx, 8
mov r8d, dword [r9 + r15 + 4]
sub r8, 8
shr r8, 1
je 0x1400337b4
mov eax, dword [r13 + 0x14]
add rax, rdx
add rdx, 2
movzx r10d, word [rax + r15]
mov eax, 0xf000
test ax, r10w
je 0x1400337ab
mov ecx, dword [r9 + r15]
and qword [rbp + 0x67], 0
and r10d, 0xfff
lea rax, [rdi + r10]
xor r11d, r11d
lea r10, [rbp + 0x67]
add rcx, rax
lea rax, [rbp + 0x67]
mov rbx, rcx
sub rbx, rax
mov al, byte [rbx + r10]
inc r11d
mov byte [r10], al
movsxd rax, r11d
inc r10
cmp rax, 8
jb 0x140033772
add qword [rbp + 0x67], r12
lea r11, [rbp + 0x67]
xor r10d, r10d
sub r11, rcx
mov al, byte [r11 + rcx]
inc r10d
mov byte [rcx], al
movsxd rax, r10d
inc rcx
cmp rax, 8
jb 0x140033796
dec r8
jne 0x14003372f
cmp rdx, r14
jb 0x140033712
mov r14d, dword [rsi + 0x90]
add r14, rdi
je 0x140033889
add r14, 0xc
cmp dword [r14], 0
je 0x140033834
mov r13, qword [rbp + 0x77]
mov ecx, dword [r14]
add rcx, rdi
call qword [rbp + 0x7f]
mov r12, rax
test rax, rax
je 0x140033889
mov ebx, dword [r14 + 4]
add rbx, rdi
jmp 0x140033824
mov rax, qword [rbx]
movabs rcx, 0x8000000000000000
test rcx, rax
mov rcx, r12
je 0x140033813
movzx edx, ax
jmp 0x14003381a
lea rdx, [rax + 2]
add rdx, rdi
call r13
mov qword [rbx], rax
add rbx, 8
cmp qword [rbx], 0
jne 0x1400337f9
add r14, 0x14
cmp dword [r14], 0
jne 0x1400337db
movsxd rax, dword [r15 + 0x3c]
cmp dword [rax + r15 + 0xd0], 0
je 0x140033868
mov eax, dword [rsi + 0xd0]
mov rbx, qword [rax + rdi + 0x18]
jmp 0x140033860
xor r8d, r8d
mov rcx, r15
lea edx, [r8 + 1]
call rax
lea rbx, [rbx + 8]
mov rax, qword [rbx]
test rax, rax
jne 0x140033850
mov rax, qword gs:[0x60]
mov qword [rax + 0x10], rdi
mov rax, qword [rax + 0x18]
mov rcx, qword [rax + 0x10]
mov qword [rcx + 0x30], rdi
mov eax, dword [rsi + 0x28]
add rax, rdi
call rax
xor eax, eax
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret