Function at 0x1400b2780
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r9
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [0x140108820]
mov r14, r8
mov ebp, edx
mov rbx, rcx
xor edx, edx
movzx r8d, word [rax + 0x16]
call sub.msvcrt.dll_memset
mov rcx, r14
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov rdi, rax
test rax, rax
je case.default.0x1400b283f
mov r8, qword gs:[0x30]
xor r12b, r12b
xor r15b, r15b
xor esi, esi
mov r9d, 1
mov rdx, qword [r8 + 0x60]
mov r13, qword [rdx + 0x30]
cmp dword [rax + 0xfc], esi
je 0x1400b280f
mov eax, dword [rax + 0xf8]
test eax, eax
je 0x1400b280f
test byte [rax + r14 + 0x10], r9b
movzx r15d, r9b
cmovne esi, r9d
mov rdx, qword [0x140108820]
movzx eax, byte [rdx + 0x14]
dec eax
cmp eax, 8
ja case.default.0x1400b283f
lea r8, [0x140000000]
cdqe
mov ecx, dword [r8 + rax*4 + 0xb2a74]
add rcx, r8
mov r8d, 0xe0
jmp rcx
mov eax, dword [rdi + 0x58]
mov dword [rbx + 0x120], eax
mov dword [rbx + 0x114], r9d
mov r9d, 6
mov dword [rsp + 0x28], 0xffffffff
mov ecx, r9d
mov dword [rsp + 0x20], 3
xor r8d, r8d
mov edx, 2
call fcn.1400b4130
lea rcx, [rbx + 0x100]
mov r12d, eax
call qword [sym.imp.ntdll.dll_NtQuerySystemTime]
mov rcx, qword [rdi + 0x30]
xor edx, edx
mov qword [rbx + 0xf8], rcx
mov rcx, qword [rsp + 0x78]
call fcn.1400b23e0
mov rdx, r14
mov dword [rbx + 0x108], eax
mov rcx, rbx
mov dword [rbx + 0x10c], 4
call fcn.1400b5210
test eax, eax
js case.default.0x1400b283f
mov edx, 8
mov r8d, 0x50
mov rcx, r13
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rbx + 0x98], rax
test rax, rax
je case.default.0x1400b283f
mov qword [rbx + 0xa8], rax
lea rcx, [rbx + 0xa0]
mov qword [rcx], rax
mov r9d, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x98]
mov qword [rax + 8], rcx
mov rax, qword [rbx + 0x98]
mov dword [rax + 0x38], 9
mov rax, qword [rbx + 0x98]
mov dword [rax + 0x18], r9d
test r12d, r12d
je 0x1400b2933
mov rax, qword [rbx + 0x98]
mov dword [rax + 0x1c], r9d
mov ecx, dword [rbx + 0x68]
lea eax, [rsi*4]
shl ebp, 9
btr ecx, 0x13
not ebp
movzx edx, r15b
and edx, 0xfffffffb
or ecx, 0x40cc
xor ebp, ecx
or edx, eax
and ebp, 0x200
shl edx, 0x16
xor ebp, ecx
movzx r12d, r9b
and ebp, 0xfebfffff
mov r8d, 0xe0
or edx, ebp
mov dword [rbx + 0x68], edx
mov rdx, qword [0x140108820]
cmp word [rdx + 0x16], r8w
jne case.0x1400b283f.2
mov rax, qword [rdi + 0x30]
lea rcx, [rbx + 0xd8]
mov qword [rbx + 0xd0], rax
call qword [sym.imp.ntdll.dll_NtQuerySystemTime]
mov rdx, qword [0x140108820]
mov r8d, 0xe0
movzx eax, word [rdx + 0x16]
mov ecx, 0xc8
cmp ax, cx
je 0x1400b29be
cmp ax, r8w
jne 0x1400b29e8
lea rax, [rbx + 0x98]
mov qword [rax + 8], rax
mov qword [rax], rax
lea rax, [rbx + 0xb8]
mov qword [rax + 8], rax
mov qword [rax], rax
lea rax, [rbx + 0xa8]
mov qword [rax + 8], rax
mov qword [rax], rax
mov r9d, 1
mov qword [rbx + 0x30], r14
mov eax, dword [rdi + 0x50]
mov dword [rbx + 0x40], eax
mov eax, dword [rdi + 8]
mov dword [rbx + 0x80], eax
mov rax, qword [rsp + 0x78]
movups xmm0, xmmword [rax]
mov rax, qword [rsp + 0x80]
movups xmmword [rbx + 0x58], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbx + 0x48], xmm0
mov eax, dword [rdi + 0x28]
add rax, r14
mov word [rbx + 0x6c], r9w
mov qword [rbx + 0x38], rax
test r12b, r12b
jne 0x1400b2a43
mov dword [rbx + 0x68], 0xc004
test r15b, r15b
je 0x1400b2a43
mov dword [rbx + 0x68], 0x40c004
lea rcx, [rbx + 0x70]
mov eax, r9d
mov qword [rcx + 8], rcx
mov qword [rcx], rcx
jmp 0x1400b2a55
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret