Function at 0x100014524
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x100032100]
xor rax, rsp
mov qword [rsp + 0x130], rax
and qword [rsp + 0x40], 0
mov qword [rsp + 0x58], rdx
lea rdx, [rsp + 0x40]
add rcx, 0x14
mov r14, r8
call fcn.100019444
mov rdi, qword [rsp + 0x40]
mov ebx, eax
test eax, eax
jne 0x100014786
cmp dword [rdi], 2
je 0x100014585
lea ebx, [rax + 0x32]
jmp 0x100014786
xor esi, esi
lea rcx, [rsp + 0x60]
xor edx, edx
lea r8d, [rsi + 0x50]
mov qword [rsp + 0x48], rsi
xor r15d, r15d
call sub.msvcrt.dll_memset
and dword [rsp + 0x50], esi
cmp dword [rdi], esi
jbe 0x100014759
lea r12, [rsp + 0x60]
lea r13, [rdi + 0x18]
mov r9d, dword [r13 - 0x10]
lea r8, [0x100001cd0]
lea rcx, [rsp + 0xb0]
mov edx, 0x3e
call fcn.1000149e4
test eax, eax
js 0x10001470f
and qword [rsp + 0x30], 0
xor r9d, r9d
lea rcx, [rsp + 0xb0]
lea r8d, [r9 + 3]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x10001461c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x100014639
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.100019600
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x48]
test ebx, ebx
jne 0x100014719
mov rcx, qword [r13 - 8]
mov rdx, qword [r13]
xor eax, eax
mov ebx, 0x490
cmp dword [rsi + 4], eax
jbe 0x1000146c2
lea rbp, [rsi + 0x38]
cmp dword [rbp + 0x10], 0
je 0x10001466b
cmp qword [rbp], rcx
jne 0x10001466b
cmp qword [rbp + 8], rdx
je 0x10001467b
inc eax
add rbp, 0x90
cmp eax, dword [rsi + 4]
jae 0x1000146c2
jmp 0x100014659
xor edx, edx
mov rcx, r12
lea r8d, [rdx + 0x28]
call sub.msvcrt.dll_memset
mov r11d, dword [rsi]
mov dword [r12], r11d
test r11d, r11d
jne 0x1000146a8
mov eax, dword [rsi + 8]
mov dword [r12 + 8], eax
mov rax, qword [rbp]
mov qword [r12 + 0xc], rax
jmp 0x1000146c0
movdqu xmm0, xmmword [rsi + 8]
movdqu xmmword [r12 + 8], xmm0
movdqu xmm1, xmmword [rbp + 0x28]
movdqu xmmword [r12 + 0x18], xmm1
xor ebx, ebx
test ebx, ebx
jne 0x100014719
mov rax, qword gs:[0x30]
mov r8, qword [rsp + 0x48]
xor edx, edx
mov rcx, qword [rax + 0x60]
inc r15d
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ebp, dword [rsp + 0x50]
mov rdi, qword [rsp + 0x40]
inc ebp
xor esi, esi
add r12, 0x28
add r13, 0x18
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], ebp
cmp ebp, dword [rdi]
jb 0x1000145b4
jmp 0x100014719
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ebx, eax
cmp r15d, 2
jne 0x100014755
mov rdx, qword [rsp + 0x58]
lea ebp, [r15 + 0x26]
lea rcx, [rsp + 0x60]
mov r8, rbp
call qword [sym.imp.KERNEL32.dll_RtlCompareMemory]
mov rcx, r14
mov r8, rbp
lea rdx, [rsp + 0x88]
cmp rax, rbp
je 0x10001474e
lea rdx, [rsp + 0x60]
call sub.msvcrt.dll_memcpy
jmp 0x10001475e
test ebx, ebx
jne 0x10001475e
mov ebx, 0x490
test rsi, rsi
je 0x100014786
mov rax, qword gs:[0x30]
mov r8, qword [rsp + 0x48]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rdi, qword [rsp + 0x40]
test rdi, rdi
je 0x1000147a9
mov rax, qword gs:[0x30]
mov r8, qword [rsp + 0x40]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1000296e0
mov rbx, qword [rsp + 0x198]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret