Function at 0x1401cdf80
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor eax, eax
mov qword [rbp - 0x20], 0x46
mov esi, 0x80004005
mov qword [rbp - 0x50], rax
lea rbx, str.Windows.System.Profile.SystemId.dll
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x30], rax
mov r13d, esi
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x18], rbx
mov r12, r8
mov r15, rcx
xor r14b, r14b
call fcn.14017f8a0
mov r9, rax
test rax, rax
jne 0x1401ce047
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r9, rax
test rax, rax
jne 0x1401ce047
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r9, rax
test rax, rax
jne 0x1401ce047
cmp dword [0x1402bbf68], 0x3e
nop
jae 0x1401ce038
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r9, rax
test rax, rax
jne 0x1401ce047
mov ebx, 0x8007007e
lfence
mov eax, ebx
jmp 0x1401ce5de
lea r8, str.Windows.System.Profile.SystemIdentification
mov dword [rbp - 0x20], 1
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
xorps xmm1, xmm1
and ecx, 0xf
je 0x1401ce087
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rbp + 0x58], ecx
je 0x1401ce083
mov edx, ecx
shr rdx, 1
jmp 0x1401ce0c6
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x58], ecx
jne 0x1401ce0b8
nop word [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x58], ecx
je 0x1401ce0a0
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
mov dword [rbp - 0x1c], edx
mov rcx, r9
mov qword [rbp - 0x10], r8
lea rdx, str.DllGetActivationFactory
xor r8d, r8d
call fcn.14017fae0
nop
test rax, rax
jne 0x1401ce0ec
mov ebx, 0x8007007f
jmp 0x1401ce132
lea rdx, [rbp + 0x58]
lea rcx, [rbp - 0x20]
call qword [case.0x14013f76a.0]
mov ebx, eax
test eax, eax
js 0x1401ce132
mov rcx, qword [rbp + 0x58]
lea r8, [rbp - 0x50]
lea rdx, [0x140292528]
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [case.0x14013f76a.0]
mov rcx, qword [rbp + 0x58]
mov ebx, eax
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013f76a.0]
test ebx, ebx
jns 0x1401ce145
lfence
mov eax, ebx
jmp 0x1401ce5de
mov rbx, qword [r15 + 0x10]
lea r8, [rbp - 0x48]
mov rcx, rbx
mov qword [rsp + 0xc0], rdi
mov edi, dword [0x1402c8fac]
mov edx, 0xe
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
cmp eax, 0xc0000022
jne 0x1401ce186
cmp edi, 5
jne 0x1401ce1a5
lea r8, [rbp - 0x48]
mov edx, 0xe
mov rcx, rbx
call fcn.140178f00
test eax, eax
js 0x1401ce1a5
mov rdx, qword [rbp - 0x48]
mov rcx, 0xfffffffffffffffe
call sym.SystemInformer.exe_Ordinal_1551
mov r14d, eax
shr r14d, 0x1f
xor r14b, 1
mov rax, qword [rbp - 0x50]
mov rbx, qword [rax]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r8, qword [rcx + 0x18]
mov rcx, qword [r8 + 0x10]
add r8, 0x10
cmp rcx, r8
je 0x1401ce205
mov rdx, qword [rcx + 0x30]
cmp rbx, rdx
jb 0x1401ce1fd
mov eax, dword [rcx + 0x40]
add rax, rdx
cmp rbx, rax
jb 0x1401ce2c5
mov rcx, qword [rcx]
cmp rcx, r8
jne 0x1401ce1e5
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov edi, esi
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x1401ce23f
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013f76a.0]
mov qword [rbp - 0x50], 0
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1401ce283
test r14b, r14b
je 0x1401ce275
mov r9d, 8
mov qword [rbp + 0x58], 0
lea r8, [rbp + 0x58]
mov edx, 5
mov rcx, 0xfffffffffffffffe
call qword [sym.imp.ntdll.dll_NtSetInformationThread]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [rbp - 0x48], 0
test byte [0x1402c2620], 1
jne 0x1401ce476
lock bts qword [0x1402c2620], 0x1f
setb al
test al, al
jne 0x1401ce45f
call fcn.14014b720
lea rcx, [0x1402c2620]
mov dword [0x1402c9414], eax
call sym.SystemInformer.exe_Ordinal_1386
nop
jmp 0x1401ce476
test rcx, rcx
je 0x1401ce205
mov rax, qword gs:[0x30]
mov rbx, rdx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
test rbx, rbx
je 0x1401ce21f
lea r9, [0x1401cde80]
mov rcx, rbx
lea r8, [0x1402921d0]
lea rdx, str.api_ms_win_core_processthreads_l1_1_0.dll
call fcn.1401807a0
test eax, eax
js 0x1401ce21f
lfence
lea r9, [0x1401cdf00]
mov rcx, rbx
lea r8, str.GetCurrentProcessId
lea rdx, str.api_ms_win_core_processthreads_l1_1_0.dll
call fcn.1401807a0
nop dword [rax]
test eax, eax
js 0x1401ce21f
lfence
lea r9, [0x1401cdec0]
mov rcx, rbx
lea r8, str.GetCurrentThread
lea rdx, str.api_ms_win_core_processthreads_l1_1_0.dll
call fcn.1401807a0
test eax, eax
js 0x1401ce21f
lfence
lea r9, [0x1401cdf40]
mov rcx, rbx
lea r8, str.GetCurrentThreadId
lea rdx, str.api_ms_win_core_processthreads_l1_1_0.dll
call fcn.1401807a0
test eax, eax
js 0x1401ce21f
lfence
lea r9, [0x1401921f0]
mov rcx, rbx
lea r8, str.CloseHandle
lea rdx, str.api_ms_win_core_handle_l1_1_0.dll
call fcn.1401807a0
nop dword [rax + rax]
test eax, eax
js 0x1401ce21f
mov dl, 1
mov rcx, r15
call fcn.1401cdda0
test rax, rax
je 0x1401ce21f
mov rcx, qword [rbp - 0x50]
lea rdx, [rbp - 0x40]
xor edi, edi
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
call qword [case.0x14013f76a.0]
mov r13d, eax
test eax, eax
jne 0x1401ce41a
mov rcx, qword ds:[rbp - 0x40]
call fcn.1401cdc80
mov rcx, qword [rbp - 0x40]
mov qword [rbp - 0x30], rax
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013f76a.0]
mov rcx, qword [rbp - 0x50]
lea r8, [rbp - 0x38]
xor edx, edx
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [case.0x14013f76a.0]
mov esi, eax
test eax, eax
jne 0x1401ce221
mov rcx, qword ds:[rbp - 0x38]
call fcn.1401cdc80
mov rcx, qword [rbp - 0x38]
mov qword [rbp - 0x28], rax
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x10]
call qword [case.0x14013f76a.0]
jmp 0x1401ce221
test byte [0x1402c2620], 1
jne 0x1401ce476
xor edx, edx
lea rcx, [0x1402c2620]
call sym.SystemInformer.exe_Ordinal_1388
mov ecx, dword [0x1402c9414]
nop dword [rax]
cmp ecx, 0xffffffff
je 0x1401ce48c
xor edx, edx
call fcn.14014b8e0
mov r15, qword [rbp + 0x48]
mov eax, esi
shr eax, 0x1c
and eax, 1
mov qword [r12], 0
mov qword [r15], 0
test r13d, r13d
jne 0x1401ce4b8
mov rcx, qword [rbp - 0x30]
mov qword [r15], rcx
jmp 0x1401ce542
mov r14d, eax
test eax, eax
je 0x1401ce528
mov ecx, r13d
call fcn.1401780a0
mov ebx, eax
cmp eax, 0xc0000022
je 0x1401ce4f7
cmp eax, 0xc0000005
je 0x1401ce4f7
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x1401ce4ec
movzx eax, bx
jmp 0x1401ce4ff
cmp eax, 0xb0000
jne 0x1401ce504
mov eax, ebx
jmp 0x1401ce4ff
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
nop
test eax, eax
jne 0x1401ce50d
mov ecx, ebx
call sym.SystemInformer.exe_Ordinal_1660
jmp 0x1401ce514
mov ecx, eax
call sym.SystemInformer.exe_Ordinal_1670
mov qword [r15], rax
mov rcx, rax
test rax, rax
je 0x1401ce528
cmp qword [rcx], 0
mov eax, r14d
jne 0x1401ce542
movzx ecx, r13w
test ecx, ecx
jne 0x1401ce537
call sym.SystemInformer.exe_Ordinal_1660
jmp 0x1401ce53c
call sym.SystemInformer.exe_Ordinal_1670
mov qword [r15], rax
mov eax, r14d
test esi, esi
jne 0x1401ce54f
mov rax, qword [rbp - 0x28]
jmp 0x1401ce5d0
test eax, eax
je 0x1401ce5ad
mov ecx, esi
call fcn.1401780a0
mov ebx, eax
cmp eax, 0xc0000022
je 0x1401ce58b
cmp eax, 0xc0000005
je 0x1401ce58b
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x1401ce57f
movzx eax, bx
jmp 0x1401ce593
nop
cmp eax, 0xb0000
jne 0x1401ce597
mov eax, ebx
jmp 0x1401ce593
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x1401ce5a2
mov ecx, ebx
call sym.SystemInformer.exe_Ordinal_1660
nop
jmp 0x1401ce5a9
mov ecx, eax
call sym.SystemInformer.exe_Ordinal_1670
mov qword [r12], rax
mov rax, qword [r12]
test rax, rax
je 0x1401ce5bc
cmp qword [rax], 0
jne 0x1401ce5d4
movzx ecx, si
test ecx, ecx
jne 0x1401ce5cb
call sym.SystemInformer.exe_Ordinal_1660
jmp 0x1401ce5d0
call sym.SystemInformer.exe_Ordinal_1670
mov qword [r12], rax
mov eax, edi
mov rdi, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbx
pop rbp
ret