Function at 0x140020e50
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x60
mov r14, rcx
mov r15, rdx
mov rcx, qword gs:[0x60]
mov ebp, 0x4830
mov r8d, ebp
xor edx, edx
xor esi, esi
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140020eaa
mov ebx, 0xc000009a
jmp 0x140021151
mov dword [rsp + 0x48], ebp
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
and dword [rsp + 0x38], esi
lea rax, [rsp + 0x50]
and qword [rsp + 0x30], rsi
xor edx, edx
mov dword [rsp + 0x28], 0x70050
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_ZwDeviceIoControlFile]
nop dword [rax + rax]
mov r13d, 0xc0000023
jmp 0x140020f79
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
add ebp, 0x2400
mov r8d, ebp
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x140021089
mov dword [rsp + 0x48], ebp
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
and dword [rsp + 0x38], esi
lea rax, [rsp + 0x50]
and qword [rsp + 0x30], rsi
xor edx, edx
mov dword [rsp + 0x28], 0x70050
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_ZwDeviceIoControlFile]
nop dword [rax + rax]
mov ebx, eax
cmp eax, r13d
je 0x140020ef0
test eax, eax
jns 0x140021104
mov ebp, 0x808
mov r8d, ebp
jmp 0x140020fc7
mov ebx, 0xc000009a
jmp 0x14002112e
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
add ebp, 0x800
mov r8d, ebp
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x140020f96
mov dword [rsp + 0x48], ebp
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
and dword [rsp + 0x38], 0
lea rax, [rsp + 0x50]
and qword [rsp + 0x30], 0
xor edx, edx
mov dword [rsp + 0x28], 0x7400c
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_ZwDeviceIoControlFile]
nop dword [rax + rax]
mov ebx, eax
cmp eax, r13d
je 0x140020fa0
test eax, eax
js 0x140021107
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov eax, dword [rsi]
xor edx, edx
mov rcx, qword gs:[0x60]
lea ebp, [rax + rax*8]
mov rcx, qword [rcx + 0x30]
shl ebp, 4
add ebp, 0x30
mov r8d, ebp
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140021090
mov ebx, 0xc000009a
jmp 0x140021107
mov r8, rbp
xor edx, edx
mov rcx, rdi
call sub.msvcrt.dll_memset
and dword [rdi], 0
lea rdx, [rsi + 8]
mov eax, dword [rsi]
lea rcx, [rdi + 0x30]
mov dword [rdi + 4], eax
xor r8d, r8d
mov eax, dword [rsi + 4]
mov dword [rdi + 8], eax
cmp dword [rsi], r8d
jbe 0x140021104
and dword [rcx], 0
inc r8d
mov rax, qword [rdx]
lea rdx, [rdx + 0x20]
mov qword [rcx + 8], rax
lea rcx, [rcx + 0x90]
mov rax, qword [rdx - 0x18]
mov qword [rcx - 0x80], rax
mov eax, dword [rdx - 0xc]
mov dword [rcx - 0x78], eax
mov al, byte [rdx - 5]
mov byte [rcx - 0x74], al
mov al, byte [rdx - 8]
mov byte [rcx - 0x70], al
mov al, byte [rdx - 7]
mov byte [rcx - 0x6f], al
mov al, byte [rdx - 6]
mov byte [rcx - 0x6e], al
mov eax, dword [rdx - 0x10]
mov dword [rcx - 0x6c], eax
cmp r8d, dword [rsi]
jb 0x1400210bb
mov qword [r15], rdi
test rsi, rsi
je 0x14002112a
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
test ebx, ebx
jns 0x140021151
test rdi, rdi
je 0x140021151
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret