Function at 0x140002df0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x14002b018]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rax, qword gs:[0x60]
lea r13, str.ntdll.dll
xor ebx, ebx
mov rcx, r13
mov r12d, ebx
mov rsi, qword [rax + 0x18]
add rsi, 0x20
lea edx, [rbx + 0x5c]
mov rdi, qword [rsi]
call fcn.1400061c4
test rax, rax
mov r14d, ebx
setne r14b
mov rcx, r13
test r14d, r14d
je 0x140002e65
mov rdx, qword [rdi + 0x40]
jmp 0x140002e69
mov rdx, qword [rdi + 0x50]
call fcn.140009cf4
test eax, eax
je 0x140002edf
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140002e57
xor edx, edx
mov rcx, r13
call fcn.140001880
mov rcx, rax
mov edx, 0x7f6f58fc
call fcn.140001b50
mov rdi, rax
test rax, rax
jne 0x140002e9e
mov rcx, rbx
jmp 0x140002ee3
mov edx, 0x104
mov dword [rbp - 0x1d], ebx
mov rcx, r13
mov qword [rbp - 0x19], r13
call fcn.140009638
add ax, ax
mov qword [rbp - 0x31], rbx
mov word [rbp - 0x21], ax
lea r9, [rbp - 0x31]
add ax, 2
lea r8, [rbp - 0x21]
xor edx, edx
mov word [rbp - 0x1f], ax
xor ecx, ecx
call rdi
mov rcx, qword [rbp - 0x31]
test eax, eax
cmovs rcx, rbx
jmp 0x140002ee3
mov rcx, qword [rdi + 0x20]
mov edx, 0x188e251d
call fcn.140001b50
mov r14, rax
lea rcx, str.Kernel32.dll
mov rax, qword gs:[0x60]
mov edx, 0x5c
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
call fcn.1400061c4
test rax, rax
mov r15d, ebx
setne r15b
nop
lea rcx, str.Kernel32.dll
test r15d, r15d
je 0x140002f32
mov rdx, qword [rdi + 0x40]
jmp 0x140002f36
mov rdx, qword [rdi + 0x50]
call fcn.140009cf4
test eax, eax
je 0x140002fb3
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140002f20
xor edx, edx
mov rcx, r13
call fcn.140001880
mov rcx, rax
mov edx, 0x7f6f58fc
call fcn.140001b50
mov rdi, rax
test rax, rax
jne 0x140002f6b
mov rcx, rbx
jmp 0x140002fb7
lea rax, str.Kernel32.dll
mov dword [rbp - 0xd], ebx
mov rcx, rax
mov qword [rbp - 9], rax
mov edx, 0x104
call fcn.140009638
add ax, ax
mov qword [rbp - 0x29], rbx
mov word [rbp - 0x11], ax
lea r9, [rbp - 0x29]
add ax, 2
lea r8, [rbp - 0x11]
xor edx, edx
mov word [rbp - 0xf], ax
xor ecx, ecx
call rdi
mov rcx, qword [rbp - 0x29]
test eax, eax
cmovs rcx, rbx
jmp 0x140002fb7
mov rcx, qword [rdi + 0x20]
mov edx, 0x9605a86c
call fcn.140001b50
mov rsi, rax
test r14, r14
je 0x1400030ae
test rax, rax
je 0x1400030ae
xor edx, edx
lea r9, [rbp - 0x39]
xor r8d, r8d
lea ecx, [rdx + 5]
call r14
movups xmm0, xmmword [0x1400281a8]
mov edi, eax
mov dword [rbp - 1], 0x42ad28de
movzx eax, word [0x1400281b8]
lea rdx, [rbp + 0x17]
mov word [rbp + 0x27], ax
lea rcx, [rbp - 1]
movzx eax, byte [0x1400281ba]
mov r8d, 0x13
mov byte [rbp + 0x29], al
mov dword [rbp + 3], 0x63ef6bbe
mov dword [rbp + 7], 0x7a585af
mov dword [rbp + 0xb], 0x7882c5fb
mov byte [rbp + 0xf], bl
movups xmmword [rbp + 0x17], xmm0
call fcn.140001cb0
cmp edi, 0xc0000004
jne 0x140003070
mov ecx, dword [rbp - 0x39]
call fcn.140010fa4
mov rbx, rax
test rax, rax
je 0x1400030a0
mov r8d, dword [rbp - 0x39]
lea r9, [rbp - 0x39]
mov rdx, rax
mov ecx, 5
call r14
mov edi, eax
cmp eax, 0xc0000004
je 0x140003041
nop dword [rax]
test rbx, rbx
je 0x140003092
test qword [rbx + 0x50], 0xfffffffffffffffb
je 0x140003092
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x140003092
lea rdx, [rbp + 0x17]
call rsi
test eax, eax
je 0x1400030a5
mov eax, dword [rbx]
add rbx, rax
test eax, eax
jne 0x140003070
mov rax, r12
jmp 0x1400030b0
movsxd rax, edi
jmp 0x1400030b0
mov r12, qword [rbx + 0x50]
mov rax, r12
jmp 0x1400030b0
xor eax, eax
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400049b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret