Function at 0x62d100
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
lea r12, [rsp - 0xf0]
cmp r12, qword [r14 + 0x10]
jbe 0x62e7aa
push rbp
mov rbp, rsp
sub rsp, 0x168
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x198], rbx
mov qword [rsp + 0x1a0], rcx
mov qword [rsp + 0x1b8], r8
mov rdx, qword [rsp + 0x188]
cmp rdx, 0x10
jb 0x62e79f
cmp rdx, 0x20
jb 0x62e795
mov qword [rsp + 0x1c8], r10
mov qword [rsp + 0x1c0], r9
mov qword [rsp + 0x1b8], r8
mov qword [rsp + 0x1b0], rsi
mov qword [rsp + 0x1a8], rdi
mov qword [rsp + 0x1a0], rcx
mov qword [rsp + 0x198], rbx
mov qword [rsp + 0x190], rax
mov rsi, qword [0x00886aa0]
mov r8, qword [0x00886aa8]
mov r9, qword [0x00886ab0]
mov r10, qword [rax + 0x28]
mov ecx, 0x10
mov rdi, rdx
mov rax, rbx
mov rbx, qword [rsp + 0x178]
call r10
mov rdi, qword [rsp + 0x188]
lea rdx, [rdi - 0x10]
mov qword [rsp + 0x48], rdx
mov rbx, qword [rsp + 0x178]
lea r10, [rbx + 0x10]
mov qword [rsp + 0xe0], r10
mov rcx, qword [rsp + 0x1c0]
mov r8, rcx
shr rcx, 7
mov r11, qword [rsp + 0x1b0]
mov r12, qword [rsp + 0x1a0]
mov rax, qword [rsp + 0x198]
mov r13, qword [rsp + 0x190]
mov r15, qword [rsp + 0x1b8]
mov rsi, qword [rsp + 0x1a8]
mov r9, qword [rsp + 0x1c8]
mov qword [rsp + 0xa0], rax
xor eax, eax
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xa0]
jmp 0x62da80
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0xd0], r9
mov qword [rsp + 0x160], r8
mov qword [rsp + 0xc8], r11
mov qword [rsp + 0x120], rsi
mov r10, qword [r13 + 0x28]
mov rbx, qword [rsp + 0xe0]
mov ecx, 0x10
mov rdi, rdx
mov rsi, r8
mov r8, rcx
mov r9, r15
call r10
mov rdx, qword [rsp + 0xd0]
mov r10, qword [rsp + 0x1b8]
lea r11, [r10 + rdx]
lea r11, [r11 + 0x10]
mov qword [rsp + 0x158], r11
mov r12, qword [rsp + 0xd8]
lea r13, [r12 - 0x10]
mov qword [rsp + 0xd8], r13
mov r15, qword [rsp + 0xc8]
mov r11, qword [rsp + 0x1a0]
lea rcx, [r11 + r15]
lea rcx, [rcx + 0x10]
mov qword [rsp + 0x118], rcx
mov r13, qword [rsp + 0x90]
lea rsi, [r13 - 0x10]
mov qword [rsp + 0x88], rsi
lea rdi, [r10 + rdx]
lea rdi, [rdi + 0x20]
mov qword [rsp + 0x150], rdi
lea r8, [r12 - 0x20]
mov qword [rsp + 0xd0], r8
lea r9, [r11 + r15]
lea r9, [r9 + 0x20]
mov qword [rsp + 0x110], r9
lea r9, [r13 - 0x20]
mov qword [rsp + 0x80], r9
lea r9, [r10 + rdx]
lea r9, [r9 + 0x30]
mov qword [rsp + 0x148], r9
lea r9, [r12 - 0x30]
mov qword [rsp + 0xc8], r9
lea r9, [r11 + r15]
lea r9, [r9 + 0x30]
mov qword [rsp + 0x108], r9
lea r9, [r13 - 0x30]
mov qword [rsp + 0x78], r9
lea r9, [r10 + rdx]
lea r9, [r9 + 0x40]
mov qword [rsp + 0x140], r9
lea r9, [r12 - 0x40]
mov qword [rsp + 0xc0], r9
lea r9, [r11 + r15]
lea r9, [r9 + 0x40]
mov qword [rsp + 0x100], r9
lea r9, [r13 - 0x40]
mov qword [rsp + 0x70], r9
lea r9, [r10 + rdx]
lea r9, [r9 + 0x50]
mov qword [rsp + 0x138], r9
lea r9, [r12 - 0x50]
mov qword [rsp + 0xb8], r9
lea r9, [r11 + r15]
lea r9, [r9 + 0x50]
mov qword [rsp + 0xf8], r9
lea r9, [r13 - 0x50]
mov qword [rsp + 0x68], r9
lea r9, [r10 + rdx]
lea r9, [r9 + 0x60]
mov qword [rsp + 0x130], r9
lea r9, [r12 - 0x60]
mov qword [rsp + 0xb0], r9
lea r9, [r11 + r15]
lea r9, [r9 + 0x60]
mov qword [rsp + 0xf0], r9
lea r9, [r13 - 0x60]
mov qword [rsp + 0x60], r9
lea rdx, [r10 + rdx]
lea rdx, [rdx + 0x70]
mov qword [rsp + 0x128], rdx
lea r10, [r12 - 0x70]
mov qword [rsp + 0xa8], r10
lea r15, [r11 + r15]
lea r15, [r15 + 0x70]
mov qword [rsp + 0xe8], r15
lea r11, [r13 - 0x70]
mov qword [rsp + 0x58], r11
mov r11, qword [rsp + 0x50]
dec r11
mov qword [rsp + 0x50], r11
nop
mov r11, qword [rsp + 0x120]
mov qword [rsp], r11
mov qword [rsp + 8], 0x10
mov qword [rsp + 0x10], r13
mov r11, qword [rsp + 0x160]
mov qword [rsp + 0x18], r11
mov qword [rsp + 0x20], 0x10
mov qword [rsp + 0x28], r12
mov r11, qword [rsp + 0x178]
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x38], 0x10
mov r12, qword [rsp + 0x188]
mov qword [rsp + 0x40], r12
call fcn.00538980
xorps xmm15, xmm15
mov r14, qword [0x0091f2b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x190]
mov r10, qword [rdx + 0x28]
mov rax, qword [rsp + 0x198]
mov rbx, qword [rsp + 0x178]
mov ecx, 0x10
mov rdi, qword [rsp + 0x188]
mov rsi, qword [rsp + 0x158]
mov r8, rcx
mov r9, qword [rsp + 0xd8]
call r10
mov rdx, qword [rsp + 0x118]
mov qword [rsp], rdx
mov qword [rsp + 8], 0x10
mov rdx, qword [rsp + 0x88]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x158]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], 0x10
mov rdx, qword [rsp + 0xd8]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0xe0]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], 0x10
mov r10, qword [rsp + 0x48]
mov qword [rsp + 0x40], r10
call fcn.00538980
xorps xmm15, xmm15
mov r14, qword [0x0091f2b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x190]
mov r10, qword [rdx + 0x28]
mov rax, qword [rsp + 0x198]
mov rbx, qword [rsp + 0xe0]
mov ecx, 0x10
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x150]
mov r8, rcx
mov r9, qword [rsp + 0xd0]
call r10
mov rdx, qword [rsp + 0x110]
mov qword [rsp], rdx
mov qword [rsp + 8], 0x10
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x150]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], 0x10
mov rdx, qword [rsp + 0xd0]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x178]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], 0x10
mov r10, qword [rsp + 0x188]
mov qword [rsp + 0x40], r10
call fcn.00538980
xorps xmm15, xmm15
mov r14, qword [0x0091f2b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x190]
mov r10, qword [rdx + 0x28]
mov rax, qword [rsp + 0x198]
mov rbx, qword [rsp + 0x178]
mov ecx, 0x10
mov rdi, qword [rsp + 0x188]
mov rsi, qword [rsp + 0x148]
mov r8, rcx
mov r9, qword [rsp + 0xc8]
call r10
mov rdx, qword [rsp + 0x108]
mov qword [rsp], rdx
mov qword [rsp + 8], 0x10
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x148]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], 0x10
mov rdx, qword [rsp + 0xc8]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0xe0]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], 0x10
mov r10, qword [rsp + 0x48]
mov qword [rsp + 0x40], r10
nop dword [rax]
call fcn.00538980
xorps xmm15, xmm15
mov r14, qword [0x0091f2b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x190]
mov r10, qword [rdx + 0x28]
mov rax, qword [rsp + 0x198]
mov rbx, qword [rsp + 0xe0]
mov ecx, 0x10
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x140]
mov r8, rcx
mov r9, qword [rsp + 0xc0]
call r10
mov rdx, qword [rsp + 0x100]
mov qword [rsp], rdx
mov qword [rsp + 8], 0x10
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x140]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], 0x10
mov rdx, qword [rsp + 0xc0]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x178]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], 0x10
mov r10, qword [rsp + 0x188]
mov qword [rsp + 0x40], r10
call fcn.00538980
xorps xmm15, xmm15
mov r14, qword [0x0091f2b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x190]
mov r10, qword [rdx + 0x28]
mov rax, qword [rsp + 0x198]
mov rbx, qword [rsp + 0x178]
mov ecx, 0x10
mov rdi, qword [rsp + 0x188]
mov rsi, qword [rsp + 0x138]
mov r8, rcx
mov r9, qword [rsp + 0xb8]
call r10
mov rdx, qword [rsp + 0xf8]
mov qword [rsp], rdx
mov qword [rsp + 8], 0x10
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x138]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], 0x10
mov rdx, qword [rsp + 0xb8]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0xe0]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], 0x10
mov r10, qword [rsp + 0x48]
mov qword [rsp + 0x40], r10
call fcn.00538980
xorps xmm15, xmm15
mov r14, qword [0x0091f2b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x190]
mov r10, qword [rdx + 0x28]
mov rax, qword [rsp + 0x198]
mov rbx, qword [rsp + 0xe0]
mov ecx, 0x10
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x130]
mov r8, rcx
mov r9, qword [rsp + 0xb0]
call r10
mov rdx, qword [rsp + 0xf0]
mov qword [rsp], rdx
mov qword [rsp + 8], 0x10
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x130]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], 0x10
mov rdx, qword [rsp + 0xb0]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x178]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], 0x10
mov r10, qword [rsp + 0x188]
mov qword [rsp + 0x40], r10
call fcn.00538980
xorps xmm15, xmm15
mov r14, qword [0x0091f2b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x190]
mov r10, qword [rdx + 0x28]
mov rax, qword [rsp + 0x198]
mov rbx, qword [rsp + 0x178]
mov ecx, 0x10
mov rdi, qword [rsp + 0x188]
mov rsi, qword [rsp + 0x128]
mov r8, rcx
mov r9, qword [rsp + 0xa8]
call r10
mov rdx, qword [rsp + 0xe8]
mov qword [rsp], rdx
mov qword [rsp + 8], 0x10
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x128]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], 0x10
mov rdx, qword [rsp + 0xa8]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0xe0]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], 0x10
mov r10, qword [rsp + 0x48]
mov qword [rsp + 0x40], r10
call fcn.00538980
xorps xmm15, xmm15
mov r14, qword [0x0091f2b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x98]
sub rdx, 0xffffffffffffff80
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0xe0]
mov r10, qword [rsp + 0x1b0]
mov r11, qword [rsp + 0x1a0]
mov r12, qword [rsp + 0x1c0]
mov rax, qword [rsp + 0x198]
mov r13, qword [rsp + 0x190]
mov r15, qword [rsp + 0x1b8]
mov rcx, qword [rsp + 0x1a8]
mov rsi, qword [rsp + 0x1c8]
mov r8, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x178]
mov rsi, rcx
mov rdi, qword [rsp + 0x188]
mov r8, r12
mov r9, qword [rsp + 0x1c8]
mov r10, qword [rsp + 0xe0]
mov r11, qword [rsp + 0x1b0]
mov r12, qword [rsp + 0x1a0]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x98], rdx
mov rdx, qword [rsp + 0x48]
nop dword [rax]
test rcx, rcx
jle 0x62db12
mov r10, qword [rsp + 0x98]
cmp r8, r10
jb 0x62e78a
sub r9, r10
mov qword [rsp + 0xd8], r9
neg r9
sar r9, 0x3f
and r9, r10
lea r8, [r15 + r9]
mov r15, qword [rsp + 0xd8]
nop dword [rax + rax]
cmp r15, 0x80
jb 0x62e77d
cmp rsi, r10
jb 0x62e772
sub r11, r10
mov qword [rsp + 0x90], r11
neg r11
sar r11, 0x3f
and r11, r10
lea rsi, [r12 + r11]
mov r10, qword [rsp + 0x90]
nop word [rax + rax]
cmp r10, 0x80
jae 0x62d253
jmp 0x62e765
mov rcx, r8
shr r8, 4
and r8d, 7
lea r12, [0x0070b520]
jmp qword [r12 + r8*8]
mov ecx, pe_nt_image_headers64
mov rdx, r10
call fcn.0046bee0
mov rax, r10
mov rcx, rsi
call fcn.0046bf20
mov ecx, pe_nt_image_headers64
mov rdx, r15
call fcn.0046bee0
mov rax, r10
mov rcx, r8
call fcn.0046bf20
mov ecx, 0x20
call fcn.0046bee0
mov ecx, 0x10
call fcn.0046bee0
nop
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x58], r10
call fcn.00469b80
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov r9, qword [rsp + 0x50]
mov r10, qword [rsp + 0x58]
nop
jmp fcn.0062d100