Function at 0x551440
Capabilities:
Access peb ldr_data
Check os version

Disassembly:
lea r12, [rsp - 0xf0]
cmp r12, qword [r14 + 0x10]
jbe 0x551d4e
push rbp
mov rbp, rsp
sub rsp, 0x168
mov qword [rsp + 0x178], rax
mov qword [rsp + 0x188], rcx
mov qword [rsp + 0x180], rbx
lea rax, [0x0059df20]
nop dword [rax]
call fcn.0040e7c0
mov qword [rsp + 0x98], rax
nop
movups xmmword [rsp + 0xa0], xmm15
movups xmmword [rsp + 0xa8], xmm15
movups xmmword [rsp + 0xb8], xmm15
mov rcx, qword [rsp + 0x178]
mov qword [rsp + 0xa0], rcx
mov ecx, 1
nop
jmp 0x5514c4
mov ecx, eax
mov byte [rsp + 0x51], cl
lea rax, [rsp + 0xa0]
call fcn.004d6ae0
test rdi, rdi
jne 0x55187d
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x90], rax
nop
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov byte [rsp + 0x18], 0x3a
call fcn.00403940
xorps xmm15, xmm15
mov r14, qword [0x008e9cd8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x60], rax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
lea rdi, [0x005b5d3c]
mov esi, 4
mov rax, qword [rsp + 0x90]
call fcn.004bcd80
test rax, rax
je 0x551809
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x55176d
nop
jle 0x551690
lea rbx, [rcx + 1]
mov rdx, qword [rsp + 0x70]
cmp rdx, rbx
jb 0x551d45
mov word [rsp + 0x52], 0
mov word [rsp + 0x52], 0x3a20
mov rax, qword [rsp + 0x90]
mov rcx, rdx
lea rdi, [rsp + 0x52]
mov esi, 2
mov r8, rsi
nop
call fcn.004bde20
cmp rax, 0xffffffffffffffff
jne 0x5515c7
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x68]
jmp 0x55166e
mov word [rsp + 0x55], 0
mov word [rsp + 0x55], 0x3a20
mov byte [rsp + 0x54], 0
mov byte [rsp + 0x54], 0x3a
mov qword [rsp], 1
mov rax, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
lea rdi, [rsp + 0x55]
mov esi, 2
mov r8, rsi
lea r9, [rsp + 0x54]
mov r10d, 1
mov r11, r10
call fcn.004bd880
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
nop
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov byte [rsp + 0x18], 0x3a
nop
call fcn.00403940
xorps xmm15, xmm15
mov r14, qword [0x008e9cd8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x68]
cmp rax, rcx
ja 0x551d36
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x68], rbx
xor esi, esi
jmp 0x551b43
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x551853
mov rax, qword [rsp + 0x98]
mov ebx, 0x20
call fcn.004bc6e0
mov rax, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
call fcn.004bc040
lea rax, [0x005897c0]
call fcn.0040e7c0
mov qword [rsp + 0xe0], rax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x90]
call fcn.0040b940
lea rcx, [0x005864c0]
mov r8, qword [rsp + 0xe0]
mov qword [r8], rcx
cmp dword [0x008e9d40], 0
je 0x551725
call fcn.00468b20
mov qword [r11], rax
mov rdx, qword [r8 + 8]
mov qword [r11 + 8], rdx
mov qword [r8 + 8], rax
mov rdx, qword [rsp + 0x180]
mov r11, qword [rdx + 0x20]
mov rax, qword [rsp + 0x188]
lea rbx, [0x005bd105]
mov ecx, 0x10
lea rdi, [0x005c46c1]
mov esi, 0x22
mov r9d, 1
mov r10, r9
nop
call r11
movzx eax, byte [rsp + 0x51]
jmp 0x5514c2
lea rax, [0x005897c0]
call fcn.0040e7c0
mov qword [rsp + 0xd8], rax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x90]
call fcn.0040b940
lea rcx, [0x005864c0]
mov r8, qword [rsp + 0xd8]
mov qword [r8], rcx
cmp dword [0x008e9d40], 0
je 0x5517c3
call fcn.00468b20
mov qword [r11], rax
mov rdx, qword [r8 + 8]
mov qword [r11 + 8], rdx
mov qword [r8 + 8], rax
mov rdx, qword [rsp + 0x180]
mov r11, qword [rdx + 0x18]
mov rax, qword [rsp + 0x188]
lea rbx, [0x005bd105]
mov ecx, 0x10
lea rdi, [0x005c4b67]
mov esi, 0x23
mov r9d, 1
mov r10, r9
call r11
movzx eax, byte [rsp + 0x51]
jmp 0x5514c2
mov rax, qword [rsp + 0x98]
mov ebx, 0x20
call fcn.004bc6e0
nop
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x68]
jmp 0x551ae0
mov rax, qword [rsp + 0x98]
mov rbx, rdx
mov rdi, rcx
mov rcx, rsi
call fcn.004bc040
movzx eax, byte [rsp + 0x51]
jmp 0x5514c2
mov word [rsp + 0x55], 0
mov word [rsp + 0x55], 0xa0d
mov rax, qword [rsp + 0x98]
lea rbx, [rsp + 0x55]
mov ecx, 2
mov rdi, rcx
call fcn.004bc040
jmp 0x5518a5
mov word [rsp + 0x55], 0
mov word [rsp + 0x55], 0xa0d
mov rax, qword [rsp + 0x98]
lea rbx, [rsp + 0x55]
mov ecx, 2
mov rdi, rcx
call fcn.004bc040
mov word [rsp + 0x55], 0
mov word [rsp + 0x55], 0xa0d
mov rax, qword [rsp + 0x98]
lea rbx, [rsp + 0x55]
mov ecx, 2
mov rdi, rcx
call fcn.004bc040
nop
nop
lea rax, [0x005a8cc0]
call fcn.0040e7c0
mov qword [rsp + 0x80], rax
mov ebx, 0x1000
mov rcx, rbx
lea rax, [0x005879c0]
call fcn.0044cf20
nop
movups xmmword [rsp + 0x110], xmm15
lea rdi, [rsp + 0x118]
lea rdi, [rdi - 0x30]
nop word [rax + rax]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00469170
mov rbp, qword [rbp]
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], 0x1000
mov qword [rsp + 0x120], 0x1000
lea rdx, [0x0060d760]
mov qword [rsp + 0x128], rdx
mov rdx, qword [rsp + 0x98]
mov qword [rsp + 0x130], rdx
mov qword [rsp + 0x158], 0xffffffffffffffff
mov qword [rsp + 0x160], 0xffffffffffffffff
cmp dword [0x008e9d40], 0
je 0x5519af
lea rax, [0x005a8cc0]
mov rbx, qword [rsp + 0x80]
lea rcx, [rsp + 0x110]
call fcn.00414680
mov rcx, qword [rsp + 0x110]
mov rdi, qword [rsp + 0x80]
mov qword [rdi], rcx
lea rcx, [rdi + 8]
lea rsi, [rsp + 0x118]
mov rax, rdi
mov rdi, rcx
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004694da
mov rbp, qword [rbp]
nop
movups xmmword [rsp + 0xe8], xmm15
movups xmmword [rsp + 0xf0], xmm15
movups xmmword [rsp + 0x100], xmm15
mov qword [rsp + 0xe8], rax
nop
lea rax, [rsp + 0xe8]
movabs rbx, 0x7fffffffffffffff
call fcn.004d7b60
test rbx, rbx
jne 0x551a3a
xor ecx, ecx
xor edx, edx
jmp 0x551ab8
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x88], rax
call fcn.004c5360
mov qword [rsp + 0xd0], rax
lea rax, [0x005a0e60]
call fcn.0040e7c0
mov rcx, qword [rsp + 0x58]
mov qword [rax], rcx
cmp dword [0x008e9d40], 0
jne 0x551a85
mov rdx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0xd0]
jmp 0x551a9e
call fcn.00468b20
mov rdx, qword [rsp + 0x78]
mov qword [r11], rdx
mov rsi, qword [rsp + 0xd0]
mov qword [r11 + 8], rsi
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rsi
lea rcx, [0x0060d800]
mov rdx, rax
mov rax, qword [rsp + 0x88]
mov rbx, rcx
mov rcx, rdx
add rsp, 0x168
pop rbp
ret
dec rcx
mov r8, rcx
neg r8
sar r8, 0x3f
and r8d, 1
add rdx, r8
dec rsi
nop
test rsi, rsi
je 0x551b0b
movzx r8d, byte [rdx]
cmp r8b, 0x20
je 0x551ac7
cmp r8b, 9
je 0x551ac7
cmp r8b, 0xa
je 0x551ac7
nop dword [rax + rax]
cmp r8b, 0xd
je 0x551ac7
jmp 0x551b0b
dec rsi
test rsi, rsi
je 0x551833
movzx r8d, byte [rsi + rdx - 1]
nop word [rax + rax]
cmp r8b, 0x20
je 0x551b08
cmp r8b, 9
je 0x551b08
cmp r8b, 0xa
je 0x551b08
cmp r8b, 0xd
je 0x551b08
jmp 0x551833
inc rsi
mov rcx, rdi
cmp rsi, rax
jge 0x551c70
movzx r8d, byte [rdx + rsi]
cmp r8b, 0x20
je 0x551b9a
mov rdi, rcx
mov ecx, r8d
mov r9d, 1
shl r9, cl
lea r10d, [rcx - 0x40]
nop
cmp cl, 0x40
sbb r11, r11
and r11, r9
movabs r12, 0xfbfffffe00000000
and r11, r12
cmp r10b, 0x40
sbb r10, r10
and r10, r9
btr r10, 0x3f
or r11, r10
test r11, r11
jne 0x551b3d
jmp 0x551ba9
mov rdi, rcx
movabs r12, 0xfbfffffe00000000
jmp 0x551b3d
mov byte [rsp + 0x57], cl
lea rax, [0x00589880]
call fcn.0040e7c0
mov qword [rsp + 0xc8], rax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x90]
call fcn.0040b940
lea rcx, [0x005864c0]
mov r8, qword [rsp + 0xc8]
mov qword [r8], rcx
movzx edx, byte [rsp + 0x57]
lea rbx, [0x00766600]
lea rdx, [rbx + rdx*8]
cmp dword [0x008e9d40], 0
je 0x551c1b
call fcn.00468b40
mov qword [r11], rax
mov r12, qword [r8 + 8]
mov qword [r11 + 8], r12
mov r12, qword [r8 + 0x18]
mov qword [r11 + 0x10], r12
mov qword [r8 + 8], rax
lea r11, [0x005879c0]
mov qword [r8 + 0x10], r11
mov qword [r8 + 0x18], rdx
mov rdx, qword [rsp + 0x180]
mov r12, qword [rdx + 0x18]
mov rax, qword [rsp + 0x188]
lea rbx, [0x005bd105]
mov ecx, 0x10
lea rdi, [0x005c6fe1]
mov esi, 0x2c
mov r9d, 2
mov r10, r9
call r12
movzx eax, byte [rsp + 0x51]
jmp 0x5514c2
movzx esi, byte [rsp + 0x51]
test sil, sil
jne 0x551cb7
mov word [rsp + 0x55], 0
mov word [rsp + 0x55], 0xa0d
mov rax, qword [rsp + 0x98]
lea rbx, [rsp + 0x55]
mov ecx, 2
mov rdi, rcx
nop dword [rax]
call fcn.004bc040
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x68]
nop
jmp 0x551cd0
dec rcx
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and esi, 1
add rdx, rsi
dec rbx
test rbx, rbx
je 0x551cf7
movzx esi, byte [rdx]
cmp sil, 0x20
je 0x551cba
nop
cmp sil, 9
je 0x551cba
cmp sil, 0xa
je 0x551cba
cmp sil, 0xd
je 0x551cba
jmp 0x551cf7
dec rbx
test rbx, rbx
je 0x551d19
movzx esi, byte [rbx + rdx - 1]
cmp sil, 0x20
je 0x551cf4
cmp sil, 9
je 0x551cf4
cmp sil, 0xa
je 0x551cf4
cmp sil, 0xd
je 0x551cf4
mov rax, qword [rsp + 0x98]
mov rdi, rcx
mov rcx, rbx
mov rbx, rdx
call fcn.004bc040
xor eax, eax
jmp 0x5514c2
mov rdx, rcx
mov rcx, rax
nop dword [rax]
call fcn.00468f40
mov rcx, rbx
call fcn.00468f40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax]
call fcn.00466be0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00551440