Function at 0x1400014a0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword gs:[0x60]
lea rbp, str.licenseCompliance
xor r8d, r8d
mov rsi, rcx
mov rcx, rbp
mov r14, qword [rax + 0x18]
add r14, 0x20
lea edx, [r8 + 8]
mov rbx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
xor r15d, r15d
test eax, eax
je 0x14000154a
mov edi, r15d
nop dword [rax]
movsx rcx, byte [rdi + rbp]
call qword [sym.imp.USER32.dll_CharUpperW]
inc rdi
cmp rdi, 8
jl 0x1400014f0
xor r8d, r8d
lea rdi, str.gplTaxonomy
mov rcx, rdi
lea edx, [r8 + 8]
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x14000154a
nop
movsx rcx, byte [r15 + rdi]
call qword [sym.imp.USER32.dll_CharUpperW]
inc r15
cmp r15, 8
jl 0x140001520
lea rcx, str.Error_retrieving_base_addr_of_module_n
call fcn.140001a20
mov eax, 0xffffffff
jmp 0x140001615
cmp rbx, r14
je 0x140001534
nop
test rsi, rsi
je 0x140001566
mov rcx, qword [rbx + 0x50]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140001570
mov rbx, qword [rbx]
cmp rbx, r14
jne 0x140001550
jmp 0x140001534
mov rbp, qword [rbx + 0x20]
test rbp, rbp
je 0x140001534
movsxd rdi, dword [rbp + 0x3c]
lea rsi, str.axaTriggerW
xor r8d, r8d
mov qword [rsp + 0x80], r12
mov rcx, rsi
mov qword [rsp + 0x90], r13
lea edx, [r8 + 8]
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x140001629
mov rbx, r15
nop
movsx rcx, byte [rbx + rsi]
call qword [sym.imp.USER32.dll_CharUpperW]
inc rbx
cmp rbx, 8
jl 0x1400015b0
xor r8d, r8d
lea rbx, str.axaTriggerA
mov rcx, rbx
lea edx, [r8 + 8]
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x140001629
nop
movsx rcx, byte [r15 + rbx]
call qword [sym.imp.USER32.dll_CharUpperW]
inc r15
cmp r15, 8
jl 0x1400015e0
lea rcx, str.Error_retrieving_address_of_func
call fcn.140001a20
mov eax, 0xffffffff
mov r12, qword [rsp + 0x80]
mov r13, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov r14d, dword [rdi + rbp + 0x88]
mov ebx, r15d
add r14, rbp
mov r13d, dword [r14 + 0x1c]
mov edi, dword [r14 + 0x20]
add r13, rbp
mov esi, dword [r14 + 0x24]
add rdi, rbp
add rsi, rbp
cmp dword [r14 + 0x18], ebx
jbe 0x1400015f4
mov ecx, dword [rdi]
mov rdx, qword [rsp + 0x88]
add rcx, rbp
movzx r12d, word [rsi]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140001682
inc ebx
add rdi, 4
add rsi, 2
cmp ebx, dword [r14 + 0x18]
jb 0x140001652
jmp 0x1400015f4
mov edx, dword [r13 + r12*4]
add rdx, rbp
je 0x1400015f4
cmp byte [rdx], 0x4c
jne 0x140001864
cmp byte [rdx + 1], 0x8b
jne 0x140001864
cmp byte [rdx + 2], 0xd1
jne 0x140001864
movzx ecx, byte [rdx + 3]
lea eax, [rcx + 0x17]
cmp al, 2
jbe 0x1400016c1
cmp cl, 0xff
jne 0x140001600
cmp cl, 0xe9
jne 0x1400016d2
mov edi, dword [rdx + 4]
lea rsi, [rdx + 8]
add rdi, rsi
jmp 0x1400016e3
cmp cl, 0xff
jne 0x140001858
mov rdi, qword [rdx + 9]
lea rsi, [rdx + 9]
test rdi, rdi
je 0x140001858
mov rbp, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x30
lea r8, [rsp + 0x20]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp rax, 0x30
jne 0x1400017c1
nop word [rax + rax]
cmp dword [rsp + 0x40], 0x1000
mov r11, qword [rsp + 0x38]
jne 0x140001797
cmp dword [rsp + 0x48], 0x20000
jne 0x140001797
cmp dword [rsp + 0x44], 0x20
jne 0x140001797
lea r10, [r11 - 8]
mov r8, r15
test r10, r10
je 0x140001797
mov r9, qword [rsp + 0x20]
cmp qword [r9 + r8], rsi
lea rbx, [r9 + r8]
jne 0x14000178f
mov edx, 1
lea rax, [r9 + 1]
mov ecx, edx
add rax, r8
nop dword [rax]
cmp byte [rax - 2], 0x4c
jne 0x140001781
cmp byte [rax - 1], 0x8b
jne 0x140001781
cmp byte [rax], 0xd1
je 0x1400017cd
inc edx
inc rcx
dec rax
cmp rcx, 0x64
jl 0x140001770
inc r8
cmp r8, r10
jb 0x140001751
add rbp, r11
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x30
lea r8, [rsp + 0x20]
mov rcx, rax
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp rax, 0x30
je 0x140001720
lea rcx, str.____Unable_to_find_related_stub_n
jmp 0x1400015fb
movsxd rax, edx
sub rbx, rax
je 0x1400017c1
movzx edx, word [rbx + 4]
lea rcx, str.____Syscall_ID:__x_n
call fcn.140001a20
mov rdx, rbx
lea rcx, str.____Final_address_to_use_for_fix:__p_n
call fcn.140001a20
movzx eax, byte [rdi]
cmp al, 0x51
jne 0x14000180e
nop dword [rax + rax]
movzx eax, byte [rdi + 1]
inc rdi
inc r15d
cmp al, 0x51
je 0x140001800
cmp al, 0xe9
jne 0x14000181e
mov eax, dword [rdi + 1]
lea rdx, [rdi + 5]
add rdx, rax
jmp 0x14000182a
cmp al, 0xff
jne 0x140001605
mov rdx, qword [rdi + 6]
test rdx, rdx
je 0x140001605
mov eax, dword [rdx + 3]
lea rcx, [rdx + 7]
mov rdx, qword [rax + rdx + 7]
mov eax, dword [rcx + 9]
xor rdx, qword [rax + rcx + 0xd]
imul eax, r15d, 0x45
movsxd rcx, eax
mov qword [rdx + rcx + 0x28], rbx
jmp 0x140001605
lea rcx, str.____Error_resolving_jmp_n
jmp 0x1400015fb
lea rcx, str.____Unexpected_bytes_found_at_function_starting_at:__p_n
call fcn.140001a20
jmp 0x140001600