Function at 0x7fff25d9f4b8
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb8]
sub rsp, 0x190
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rax, qword gs:[0x60]
xor r14d, r14d
mov edi, r14d
mov qword [rsp + 0x40], r14
mov r15, qword [rax + 0x20]
mov qword [rsp + 0x48], r15
lea r12, [r15 + 0x400]
mov rcx, qword [r12]
mov qword [rsp + 0x60], r12
test rcx, rcx
jne 0x7fff25d9f563
test byte [rax + 3], 0x10
jne 0x7fff25d9f573
mov rcx, rdi
call fcn.7fff25d7b4f4
mov eax, r14d
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.7fff25dce640
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov edx, dword [rcx + 8]
mov r8, rdi
call fcn.7fff25d9f69c
mov r14d, eax
jmp 0x7fff25d9f527
test byte [rax + 3], 2
jne 0x7fff25d9f5bf
lea rax, [rsp + 0x70]
mov dword [rsp + 0x38], r14d
lea r9, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x38]
mov edx, 0x37
mov rcx, 0xfffffffffffffffc
call fcn.7fff25db3c3c
mov ebx, eax
or ebx, 0x10000000
jl 0x7fff25df36c4
cmp dword [rsp + 0x38], 0x370000
je 0x7fff25d9f527
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
call sym.KERNELBASE.dll_GetCurrentProcess
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.7fff25d7add4
mov esi, eax
test eax, eax
jne 0x7fff25df36e7
mov rax, qword [rsp + 0x58]
mov rdx, qword [rax + 0x20]
movzx ecx, word [rdx]
shr ecx, 1
lea eax, [rcx + 1]
cmp eax, 0x80
ja 0x7fff25df3905
mov rdx, qword [rdx + 8]
lea rbx, [rcx + rcx]
mov r8, rbx
lea rcx, [rbp - 0x80]
call sub.ntdll.dll_memcpy
lea rcx, [rsp + 0x30]
mov word [rbp + rbx - 0x80], r14w
mov byte [rsp + 0x30], r14b
call fcn.7fff25d44c48
mov esi, eax
test eax, eax
js 0x7fff25df36fb
xor ecx, ecx
cmp byte [rsp + 0x30], r14b
jne 0x7fff25df3705
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x80]
call fcn.7fff25d9cf14
mov esi, eax
test eax, eax
js 0x7fff25df38c6
mov rdi, qword [rsp + 0x40]
xor r9d, r9d
lea rdx, [rsp + 0x68]
mov r8, r12
mov rcx, rdi
call fcn.7fff25d7b2fc
mov esi, eax
test eax, eax
js 0x7fff25df38e8
lea rcx, [rsp + 0x50]
call fcn.7fff25d7b0ec
mov rcx, qword [r15 + 0x400]
mov rdx, qword [rsp + 0x68]
jmp 0x7fff25d9f566
mov rcx, qword [rbp + 0xb8]
lea r8, [0x7fff25fa2b70]
mov r9d, ebx
mov edx, 0x52
call fcn.7fff25d81fe8
mov r14d, ebx
jmp 0x7fff25d9f527
jle 0x7fff25df390a
movzx esi, ax
or esi, 0x80070000
jmp 0x7fff25df390a
mov edx, 0x63
jmp 0x7fff25df38ed
call fcn.7fff25d7b4f4
xor r8d, r8d
mov dword [rsp + 0x34], r14d
lea rdx, [rsp + 0x34]
lea rcx, [rbp - 0x80]
call fcn.7fff25d567f0
mov esi, eax
cmp eax, 0x7a
je 0x7fff25df373d
test eax, eax
jle 0x7fff25df38b4
movzx esi, ax
or esi, 0x80070000
jmp 0x7fff25df38b4
mov r15d, dword [rsp + 0x34]
add r15, 0x10
mov rcx, r15
call fcn.7fff25d7b1e0
mov rbx, rax
test rax, rax
jne 0x7fff25df376c
xor ecx, ecx
jmp 0x7fff25df375d
mov rcx, rbx
call fcn.7fff25d7b4f4
mov esi, 0x8007000e
jmp 0x7fff25df38bc
mov r8, rbx
mov dword [rsp + 0x34], r15d
lea rdx, [rsp + 0x34]
lea rcx, [rbp - 0x80]
call fcn.7fff25d567f0
mov esi, eax
test eax, eax
je 0x7fff25df37a0
jle 0x7fff25df3793
movzx esi, ax
or esi, 0x80070000
mov rcx, rbx
call fcn.7fff25d7b4f4
jmp 0x7fff25df38af
mov r12d, dword [rsp + 0x34]
mov r13, r15
dec r12d
mov edx, r12d
sub r13, rdx
lea rcx, [rbx + r12*2]
cmp r15, 0x104
jbe 0x7fff25df3887
cmp edx, 4
jb 0x7fff25df37f5
movabs rax, 0x5c003f005c005c
cmp rax, qword [rbx]
jne 0x7fff25df37f5
cmp r15, 0x8000
jbe 0x7fff25df3887
mov rcx, rbx
call fcn.7fff25d7b4f4
mov esi, 0x800700ce
jmp 0x7fff25df38bc
add r15, 4
cmp r15, 0x8000
ja 0x7fff25df37e3
mov rcx, r15
call fcn.7fff25d7b1e0
mov rsi, rax
test rax, rax
je 0x7fff25df375a
mov r8d, 0x7ffffffe
lea r9, str.__
sub r8, r15
mov rdx, r15
sub r9, rax
mov rcx, rax
lea rax, [rdx + r8]
test rax, rax
je 0x7fff25df384f
movzx eax, word [rcx + r9]
test ax, ax
je 0x7fff25df384f
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x7fff25df382f
test rdx, rdx
lea rax, [rcx - 2]
mov r8, rbx
mov rdx, r15
cmovne rax, rcx
mov rcx, rsi
mov word [rax], r14w
call fcn.7fff25d44ee8
cmp rbx, rsi
je 0x7fff25df387c
mov rcx, rbx
call fcn.7fff25d7b4f4
mov rbx, rsi
mov ecx, r12d
add rcx, 4
lea rcx, [rbx + rcx*2]
lea r9, [0x7fff25fa2078]
mov rdx, r13
lea r8, str._s.pckgdep
call fcn.7fff25dc15b8
xor ecx, ecx
mov rdi, rbx
call fcn.7fff25d7b4f4
mov r12, qword [rsp + 0x60]
mov esi, r14d
mov r15, qword [rsp + 0x48]
test esi, esi
jns 0x7fff25d9f65d
mov r9d, esi
mov edx, 0x69
jmp 0x7fff25df38f0
mov rcx, qword [rbp + 0xb8]
lea r8, [0x7fff25fa2b70]
mov r9d, eax
mov edx, 0x6d
call fcn.7fff25d81fe8
mov rdi, qword [rsp + 0x40]
jmp 0x7fff25df390a
mov edx, 0x70
mov r9d, eax
mov rcx, qword [rbp + 0xb8]
lea r8, [0x7fff25fa2b70]
call fcn.7fff25d81fe8
jmp 0x7fff25df390a
mov esi, 0x8007007a
lea rcx, [rsp + 0x50]
call fcn.7fff25d7b0ec
mov r14d, esi
jmp 0x7fff25d9f527