Function at 0x14002644f
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
movdqa xmmword [rsp + 0xc0], xmm6
mov rsi, rcx
lea r14, [rdx + 0xb0]
cmp byte [rdx + 0xd0], 2
jne 0x1400264d9
mov rdi, rdx
mov rax, qword [rdx + 0xd8]
lea r8, [rsp + 0x40]
mov qword [r8], 0
lea rcx, [0x140064d98]
lea rdx, [0x140064da8]
call rax
mov dword [rsp + 0x38], eax
test eax, eax
js 0x1400264ef
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x1400269c1
mov qword [rsp + 0x90], rbx
movabs rax, 0x8000000000000000
mov qword [rsp + 0x88], rax
jmp 0x14002655c
mov qword [rsi + 8], r14
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x140026ccf
lea rax, [rsp + 0x38]
lea rcx, [rsp + 0xa0]
mov qword [rcx], rax
lea rax, [0x14004bbc2]
mov qword [rcx + 8], rax
lea rax, [0x14006d5e8]
lea rdx, [rsp + 0x50]
mov qword [rdx], rax
mov eax, 1
mov qword [rdx + 8], rax
mov qword [rdx + 0x20], 0
mov qword [rdx + 0x10], rcx
mov qword [rdx + 0x18], rax
lea rbx, [rsp + 0x88]
mov rcx, rbx
call fcn.140016901
mov rcx, qword [rbx]
mov rbx, qword [rbx + 8]
movabs rax, 0x8000000000000000
cmp rcx, rax
jne 0x1400269cc
mov bpl, byte [rdi + 0xe0]
lea rdx, [rsp + 0x38]
mov qword [rdx], 0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
test eax, eax
js 0x140026cbe
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140026cbe
mov eax, dword [0x14007dbbc]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
cmp qword [rax + 0x78], 0
je 0x140026c36
mov byte [rsp + 0x2b], bpl
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], r14
mov qword [rsp + 0x30], rsi
mov eax, dword [0x14007dbbc]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
mov rdx, qword [rax + 0x80]
mov r8, qword [rax + 0x88]
lea r9, [rdx + 1]
mov qword [rax + 0x80], r9
movups xmm0, xmmword [0x14006d420]
movaps xmmword [rsp + 0x50], xmm0
movdqu xmm0, xmmword [0x14006d430]
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], r8
lea r8, [rsp + 0x40]
mov qword [r8], 0
lea r9, [rsp + 0x4c]
mov dword [r9], 0
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0x18]
lea r14, [0x14006d410]
test eax, eax
js 0x1400269e0
lea rsi, [rsp + 0x2c]
pcmpeqd xmm6, xmm6
xor r15d, r15d
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400269e3
mov qword [rsp + 0xa0], 0
mov rax, qword [rcx]
lea rdx, [0x140064db8]
lea r8, [rsp + 0xa0]
call qword [rax]
test eax, eax
js 0x1400269e3
mov r12, qword [rsp + 0xa0]
test r12, r12
je 0x1400269e3
mov dword [rsp + 0x2c], 0
mov r15, qword [r12]
mov rcx, r12
xor edx, edx
mov r8, rsi
call qword [r15 + 0x18]
mov ebx, dword [rsp + 0x2c]
test rbx, rbx
je 0x1400266de
lea rdx, [rbx + rbx]
mov al, byte [0x14007dbb8]
xor ecx, ecx
call fcn.14003494a
test rax, rax
je 0x140026cfe
mov r14, rax
jmp 0x1400266e6
mov r14d, 2
xor ebx, ebx
mov rcx, r12
mov rdx, r14
mov r8, rsi
call qword [r15 + 0x18]
test eax, eax
js 0x140026be8
mov rcx, r14
call fcn.140052cd0
lea rcx, [rsp + 0x88]
mov rdx, r14
mov r8, rax
call fcn.1400169ae
mov rax, qword [rsp + 0x88]
movabs rcx, 0x8000000000000000
cmp rax, rcx
mov r8, qword [rsp + 0x90]
mov ecx, 1
cmove r8, rcx
mov rcx, qword [rsp + 0x98]
mov edx, 0
cmove rcx, rdx
cmp rcx, 4
je 0x1400267d1
cmp rcx, 0xa
jne 0x1400267de
mov rcx, qword [r8]
movabs rdx, 0x3730352e302e3276
xor rcx, rdx
movzx edx, word [r8 + 8]
xor rdx, 0x3732
or rdx, rcx
je 0x14002694a
mov rcx, qword [r8]
bswap rcx
movabs r9, 0x76342e302e333033
mov rdx, r9
cmp rcx, r9
jne 0x1400267b5
movzx ecx, word [r8 + 8]
rol cx, 8
movzx ecx, cx
xor edx, edx
cmp ecx, 0x3139
je 0x1400267c2
mov edx, 0x3139
cmp rcx, rdx
mov edx, 0
sbb edx, edx
or edx, 1
cmp edx, 1
mov r15d, 3
sbb r15, 0
jmp 0x1400267e4
cmp dword [r8], 0x302e3376
je 0x140026952
mov r15d, 3
shl rax, 1
test rax, rax
je 0x1400267fb
mov rcx, qword [0x14007db30]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
test rbx, rbx
je 0x140026812
mov rcx, qword [0x14007db30]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
and r13, 0xffffffffffffff00
or r13, r15
mov rbx, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x78]
mov rcx, r14
mov rdx, r15
mov r8d, r13d
call fcn.1400271b3
mov r12, rax
cmp qword [rsp + 0x60], 0
je 0x14002695d
mov r14, qword [rsp + 0x50]
mov r15, qword [rsp + 0x58]
mov rcx, r15
and rcx, r12
shr r12, 0x39
movd xmm0, r12d
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
lea rsi, [r14 - 0x10]
xor r8d, r8d
xor r9d, r9d
movdqu xmm1, xmmword [r14 + rcx]
movdqa xmm2, xmm1
pcmpeqb xmm2, xmm0
pmovmskb r11d, xmm2
test r11w, r11w
je 0x1400268bd
bsf r10d, r11d
lea ebp, [r11 - 1]
and ebp, r11d
add r10, rcx
and r10, r15
mov r11, r10
shl r11, 4
mov rdx, rsi
sub rdx, r11
mov r11d, ebp
cmp byte [rdx], r13b
jne 0x14002688f
jmp 0x140026901
test r9, r9
mov r9d, 1
jne 0x1400268de
pmovmskb eax, xmm1
xor r9d, r9d
test eax, eax
setne r9b
bsf eax, eax
add rax, rcx
and rax, r15
pcmpeqb xmm1, xmm6
pmovmskb edx, xmm1
test edx, edx
jne 0x140026972
add rcx, r8
add rcx, 0x10
add r8, 0x10
and rcx, r15
jmp 0x14002687c
neg r10
lea rsi, [rsp + 0x2c]
shl r10, 4
mov qword [r14 + r10 - 8], rbx
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x4c], 0
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
mov edx, 1
lea r8, [rsp + 0x40]
lea r9, [rsp + 0x4c]
call qword [rax + 0x18]
test eax, eax
jns 0x140026657
jmp 0x1400269e3
xor r15d, r15d
jmp 0x1400267e4
mov r15d, 1
jmp 0x1400267e4
lea rcx, [rsp + 0x50]
mov rdx, r14
mov r8, r15
call fcn.140060992
jmp 0x14002684b
mov cl, byte [r14 + rax]
test cl, cl
js 0x14002698a
movdqa xmm0, xmmword [r14]
pmovmskb eax, xmm0
bsf eax, eax
mov cl, byte [r14 + rax]
and cl, 1
movzx ecx, cl
sub qword [rsp + 0x60], rcx
lea rcx, [rax - 0x10]
and rcx, r15
mov byte [r14 + rax], r12b
mov byte [rcx + r14 + 0x10], r12b
inc qword [rsp + 0x68]
mov r10, rax
neg r10
shl rax, 4
neg rax
mov byte [r14 + rax - 0x10], r13b
jmp 0x140026904
mov ebx, 1
xor eax, eax
xor ecx, ecx
jmp 0x1400269d4
mov rax, qword [rsp + 0x98]
mov qword [rsi], rcx
mov qword [rsi + 8], rbx
jmp 0x140026ccb
xor r15d, r15d
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x140026cae
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov sil, byte [rsp + 0x2b]
mov r8d, esi
call fcn.1400271b3
mov rcx, r15
and rcx, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
lea rax, [r14 - 0x10]
xor edx, edx
pcmpeqd xmm1, xmm1
movdqu xmm2, xmmword [r14 + rcx]
movdqa xmm3, xmm2
pcmpeqb xmm3, xmm0
pmovmskb r9d, xmm3
test r9w, r9w
je 0x140026a6f
bsf r8d, r9d
lea r10d, [r9 - 1]
and r10d, r9d
add r8, rcx
and r8, r15
mov r9, r8
shl r9, 4
mov r11, rax
sub r11, r9
mov r9d, r10d
cmp byte [r11], sil
jne 0x140026a41
jmp 0x140026a91
pcmpeqb xmm2, xmm1
pmovmskb r8d, xmm2
test r8d, r8d
jne 0x140026c5e
add rcx, rdx
add rcx, 0x10
add rdx, 0x10
and rcx, r15
jmp 0x140026a2e
neg r8
shl r8, 4
lea rax, [r14 + r8]
add rax, 0xfffffffffffffff8
mov r12, qword [rax]
mov rcx, r14
mov rdx, r15
call fcn.1400272f2
lea r9, [rsp + 0x50]
mov qword [r9], 0
mov rax, qword [r12]
lea rdx, [0x140064dc8]
lea r8, [0x140064dd8]
mov rcx, r12
call qword [rax + 0x48]
test eax, eax
js 0x140026bcd
mov r14, qword [rsp + 0x50]
test r14, r14
je 0x140026bcd
lea rdx, [rsp + 0x50]
mov dword [rdx], 0
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x50]
test eax, eax
js 0x140026c0e
cmp dword [rsp + 0x50], 0
jle 0x140026b5f
xor eax, eax
lea r8, [rsp + 0x88]
mov dword [r8], eax
lea rdx, [rsp + 0x50]
mov dword [rdx], eax
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x70]
test eax, eax
js 0x140026c0e
cmp dword [rsp + 0x50], 0
jg 0x140026b5f
lea r15, [rsp + 0x50]
mov rcx, r15
mov rdx, r14
call fcn.140027510
mov rax, qword [r15]
movabs rcx, 0x8000000000000000
cmp rax, rcx
jne 0x140026ceb
movabs rbx, 0x8000000000000000
lea r15, [rsp + 0x50]
mov rcx, r15
mov rdx, r14
call fcn.140027564
mov rcx, qword [r15]
mov rax, qword [r15 + 8]
cmp rcx, rbx
jne 0x140026c47
mov rcx, qword [rsp + 0xb0]
mov qword [rdi + 0xb0], rcx
mov qword [rdi + 0xb8], r12
mov qword [rdi + 0xc0], r14
mov qword [rdi + 0xc8], rax
mov byte [rdi + 0xd0], 1
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0xb8]
mov qword [rax + 8], rcx
mov qword [rax], rbx
jmp 0x140026ccf
xor eax, eax
mov rcx, qword [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], rax
jmp 0x140026ccf
test rbx, rbx
je 0x140026bff
mov rcx, qword [0x14007db30]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
jmp 0x140026cb4
mov rcx, qword [rsp + 0x30]
mov byte [rcx + 0xf], 0
mov word [rcx + 0xd], 0
mov dword [rcx + 9], 0
xor eax, eax
mov qword [rcx + 0x10], rax
mov qword [rcx], rax
mov byte [rcx + 8], 1
jmp 0x140026ccf
xor ecx, ecx
call fcn.1400622be
mov rcx, qword [rsp + 0x38]
jmp 0x1400265af
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x30]
mov qword [r8], rcx
mov qword [r8 + 8], rax
mov qword [r8 + 0x10], rdx
jmp 0x140026ccf
test rbx, rbx
je 0x140026cae
movdqa xmm0, xmmword [r14]
pmovmskb ecx, xmm0
mov rax, r14
cmp ecx, 0xffff
jne 0x140026c98
lea rdx, [r14 + 0x10]
mov rax, r14
movdqa xmm0, xmmword [rdx]
pmovmskb ecx, xmm0
add rax, 0xffffffffffffff00
add rdx, 0x10
cmp ecx, 0xffff
je 0x140026c7e
not ecx
bsf ecx, ecx
shl rcx, 4
sub rax, rcx
add rax, 0xfffffffffffffff8
jne 0x140026aa0
mov rcx, r14
mov rdx, r15
call fcn.1400272f2
mov rsi, qword [rsp + 0x30]
xor eax, eax
mov qword [rsi], rax
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], rax
movaps xmm6, xmmword [rsp + 0xc0]
add rsp, 0xd8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movups xmm0, xmmword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
movups xmmword [rcx + 8], xmm0
mov qword [rcx], rax
jmp 0x140026ccf
ud2