Function at 0x140003e50
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r9
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [0x14008ac28]
mov rsi, r8
mov r12d, edx
mov rbx, rcx
xor edx, edx
movzx r8d, word [rax + 0x16]
call fcn.140065540
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov rbp, rax
test rax, rax
je case.default.0x140003f16
mov r8, qword gs:[0x30]
xor edi, edi
xor r14b, r14b
xor r13b, r13b
mov r15d, edi
lea r9d, [rdi + 1]
mov rdx, qword [r8 + 0x60]
mov rax, qword [rdx + 0x30]
mov qword [rsp + 0x20], rax
cmp dword [rbp + 0xfc], edi
je 0x140003ee6
mov eax, dword [rbp + 0xf8]
test eax, eax
je 0x140003ee6
test byte [rax + rsi + 0x10], r9b
movzx r13d, r9b
cmovne r15d, r9d
mov rdx, qword [0x14008ac28]
movzx eax, byte [rdx + 0x14]
dec eax
cmp eax, 8
ja case.default.0x140003f16
lea r8, [0x140000000]
cdqe
mov ecx, dword [r8 + rax*4 + 0x4234]
add rcx, r8
mov r8d, 0xe0
jmp rcx
mov eax, dword [rbp + 0x58]
mov dword [rbx + 0x120], eax
mov dword [rbx + 0x114], r9d
mov rdx, qword [0x14008ac28]
mov ecx, dword [rdx + 8]
cmp ecx, 6
jne 0x140003fd4
mov r8d, dword [rdx + 0xc]
cmp r8d, 2
jne 0x140003fd4
mov ecx, r8d
cmp ecx, 3
mov eax, edi
seta al
mov r14d, r9d
test eax, eax
je 0x140003f5e
mov r14d, edi
lea rcx, [rbx + 0x100]
call qword [sym.imp.ntdll.dll_NtQuerySystemTime]
mov rax, qword [rbp + 0x30]
xor edx, edx
mov rcx, qword [rsp + 0x78]
mov qword [rbx + 0xf8], rax
call fcn.140004260
mov dword [rbx + 0x108], eax
mov dword [rbx + 0x10c], 4
mov rax, qword [0x14008ac28]
mov rcx, qword [rax + 0x48]
mov r11, qword [rcx]
test r11, r11
je case.default.0x140003f16
mov rcx, qword [r11]
sub rcx, 0xc8
xor r8b, r8b
cmp rsi, qword [rcx + 0x30]
jae 0x140004004
lea rdx, [rcx + 0xc8]
mov rax, qword [rdx]
test rax, rax
je 0x140004025
lea rcx, [rax - 0xc8]
jmp 0x140003fb6
mov eax, edi
seta al
test eax, eax
je 0x140003f5b
cmp ecx, 6
jne 0x140003f4f
mov ecx, dword [rdx + 0xc]
cmp ecx, 3
jne 0x140003f4f
cmp dword [rdx + 0x10], 0xffffffff
mov eax, edi
setae al
jmp 0x140003f54
jbe 0x140004054
mov rax, qword [rcx + 0xd0]
test rax, rax
je 0x14000401b
lea rcx, [rax - 0xc8]
jmp 0x140003fb6
mov r8b, 1
lea rdx, [rcx + 0xc8]
xor eax, eax
lea r9, [rbx + 0xc8]
xorps xmm0, xmm0
movups xmmword [r9], xmm0
mov qword [r9 + 0x10], rax
mov rax, qword [0x14008ac28]
mov r10, qword [rax + 0x48]
mov rax, qword [r10 + 0x10]
test rax, rax
je 0x140004079
mov rcx, r11
call rax
jmp 0x140004079
mov rax, qword [rcx + 0x98]
inc dword [rax + 0x18]
mov rax, qword [0x14008ac28]
cmp dword [rax + 8], 0xa
je 0x140004073
seta dil
test edi, edi
je 0x140004079
inc dword [rcx + 0x114]
mov rcx, qword [rsp + 0x20]
mov edx, 8
lea r8d, [rdx + 0x48]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rbx + 0x98], rax
test rax, rax
je case.default.0x140003f16
mov qword [rbx + 0xa8], rax
lea rcx, [rbx + 0xa0]
mov qword [rcx], rax
mov r9d, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x98]
mov qword [rax + 8], rcx
mov rax, qword [rbx + 0x98]
mov dword [rax + 0x38], 9
mov rax, qword [rbx + 0x98]
mov dword [rax + 0x18], r9d
test r14d, r14d
je 0x1400040eb
mov rax, qword [rbx + 0x98]
mov dword [rax + 0x1c], r9d
mov ecx, dword [rbx + 0x68]
lea eax, [r15*4]
shl r12d, 9
btr ecx, 0x13
not r12d
movzx edx, r13b
and edx, 0xfffffffb
or ecx, 0x40cc
xor r12d, ecx
or edx, eax
and r12d, 0x200
shl edx, 0x16
xor r12d, ecx
movzx r14d, r9b
and r12d, 0xfebfffff
mov r8d, 0xe0
or edx, r12d
mov dword [rbx + 0x68], edx
mov rdx, qword [0x14008ac28]
cmp word [rdx + 0x16], r8w
jne case.0x140003f16.2
mov rax, qword [rbp + 0x30]
lea rcx, [rbx + 0xd8]
mov qword [rbx + 0xd0], rax
call qword [sym.imp.ntdll.dll_NtQuerySystemTime]
mov rdx, qword [0x14008ac28]
mov r8d, 0xe0
movzx eax, word [rdx + 0x16]
mov ecx, 0xc8
cmp ax, cx
je 0x14000417e
cmp ax, r8w
jne 0x1400041a8
lea rax, [rbx + 0x98]
mov qword [rax + 8], rax
mov qword [rax], rax
lea rax, [rbx + 0xb8]
mov qword [rax + 8], rax
mov qword [rax], rax
lea rax, [rbx + 0xa8]
mov qword [rax + 8], rax
mov qword [rax], rax
mov r9d, 1
mov qword [rbx + 0x30], rsi
mov eax, dword [rbp + 0x50]
mov dword [rbx + 0x40], eax
mov eax, dword [rbp + 8]
mov dword [rbx + 0x80], eax
mov rax, qword [rsp + 0x78]
movups xmm0, xmmword [rax]
mov rax, qword [rsp + 0x80]
movups xmmword [rbx + 0x58], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbx + 0x48], xmm0
mov eax, dword [rbp + 0x28]
add rax, rsi
mov word [rbx + 0x6c], r9w
mov qword [rbx + 0x38], rax
test r14b, r14b
jne 0x140004203
mov dword [rbx + 0x68], 0xc004
test r13b, r13b
je 0x140004203
mov dword [rbx + 0x68], 0x40c004
lea rcx, [rbx + 0x70]
mov eax, r9d
mov qword [rcx + 8], rcx
mov qword [rcx], rcx
jmp 0x140004215
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret