Function at 0x1400af068
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0x98
mov rax, qword [0x1401a7d98]
xor rax, rsp
mov qword [rbp - 1], rax
mov rax, qword [rbp + 0x77]
mov rdi, rcx
mov rsi, qword [rbp + 0x7f]
xor ecx, ecx
mov qword [rbp - 0x39], r9
mov r10, r8
mov qword [rbp - 0x59], r8
mov r13, rdx
mov qword [rbp - 0x31], rax
mov ebx, ecx
mov qword [rbp - 0x41], rsi
mov dword [rbp - 9], ecx
test r8, r8
jne 0x1400af0bd
int3
test r9, r9
jne 0x1400af0c3
int3
test rax, rax
jne 0x1400af0c9
int3
mov qword [rax], rcx
mov r15, rcx
cmp byte [rsi], cl
je 0x1400af139
mov rcx, rdi
call fcn.1400afa9c
cmp r13, rax
jbe 0x1400af133
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
sub rax, rcx
and rax, 0xfffffffffffffff8
cmp rax, 0x80000
jne 0x1400af106
mov rcx, qword [rcx + 0x7fff8]
call fcn.1400af7cc
xor ecx, ecx
jmp 0x1400af10a
xor ecx, ecx
mov al, cl
test al, al
jne 0x1400af135
mov rcx, rdi
call fcn.1400afa9c
mov rdx, r13
mov r9, rsi
sub rdx, rax
mov rcx, rdi
call fcn.1400af854
xor ecx, ecx
test eax, eax
js 0x1400af282
jmp 0x1400af135
xor ecx, ecx
mov r10, qword [rbp - 0x59]
mov rsi, qword [rdi + 8]
lea r14, [r10 + r13]
mov r12, r13
shr r12, 0x30
test r14, r14
cmovne r14, rcx
sub rsi, qword [rdi]
sar rsi, 3
shr r14, 0x30
lea rax, [rsi - 1]
cmp r14, rax
jbe 0x1400af1fa
lea rdx, [r14 + 1]
mov rcx, rdi
call fcn.1400ae238
xor ecx, ecx
test eax, eax
js 0x1400af282
mov r15, qword [rdi]
mov rax, qword [rdi + 8]
sub rax, r15
sar rax, 3
cmp rsi, rax
jae 0x1400af1f3
mov rax, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rax + 0x30]
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
xor ecx, ecx
test rax, rax
je 0x1400af1c3
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
jmp 0x1400af1c6
mov rax, rcx
cmp qword [r15 + rsi*8], rcx
je 0x1400af1cd
int3
mov qword [r15 + rsi*8], rax
test rax, rax
je 0x1400af2a3
mov r15, qword [rdi]
inc rsi
mov rax, qword [rdi + 8]
sub rax, r15
sar rax, 3
cmp rsi, rax
jb 0x1400af190
mov ebx, dword [rbp - 9]
mov r10, qword [rbp - 0x59]
mov r15, rcx
cmp r12, r14
ja 0x1400af279
mov rsi, qword [rbp - 0x41]
movabs rdx, 0x1000000000000
mov rax, qword [rdi]
mov r8, r10
mov r9, qword [rbp - 0x39]
mov qword [rbp - 0x49], rcx
add r9, r15
cmp r10, rdx
mov qword [rsp + 0x28], rsi
movabs rcx, 0xffffffffffff
cmova r8, rdx
mov rdx, r13
and rdx, rcx
lea rcx, [rbp - 0x49]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax + r12*8]
call fcn.1400aee04
xor ecx, ecx
test eax, eax
js 0x1400af282
mov rax, qword [rbp - 0x49]
inc r12
mov r10, qword [rbp - 0x59]
add r15, rax
sub r10, rax
add r13, rax
mov qword [rbp - 0x59], r10
movabs rdx, 0x1000000000000
cmp r12, r14
jbe 0x1400af20d
mov rax, qword [rbp - 0x31]
mov qword [rax], r15
mov eax, ebx
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.140109af0
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rax, str.onecore_basexml_stream_bufferedstream.cpp
mov dword [rbp - 0x19], 0x2e9
mov qword [rbp - 0x29], rax
lea rcx, [rbp - 0x29]
lea rax, str.CIndex_class_Windows::Auto_class_CIndex_class_Windows::Auto_class_CIndex_class_Windows::Auto_class_CIndex_class_Windows::Auto_struct__LBLOB__12_12____12_24____12_36____16_48_::WriteAt
mov r8d, 0xc0000017
mov qword [rbp - 0x21], rax
lea rax, str._this__Index_.Allocate__
mov qword [rbp - 0x11], rax
call fcn.1400c81b4
mov eax, 0xc0000017
jmp 0x1400af282