Function at 0x14019ff87
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov byte [rsp + 1], r10b
mov byte [rsp + 1], spl
push word [rsp + 2]
lea rsp, [rsp + 5]
jmp 0x140197f0f
push rsp
pop word [rsp + 3]
add rsp, 1
add rsp, 0
clc
add rsp, 2
jmp 0x140197ee0
cld
stc
clc
push r15
mov qword [rsp], r13
mov qword [rsp], rbp
jmp 0x140197fb1
inc dword [0x14005600c]
pushfq
jmp 0x140197efa
not r8w
xchg r8b, bpl
mov qword [rsp + 5], r9
neg bp
jmp 0x140197f61
mov r8d, dword [rsp]
rol bpl, cl
bt ebp, r15d
mov bp, 0xab88
mov rbp, 0xffffffff8f7eb721
mov rbp, qword [rsp]
jmp 0x140197f2f
mov rbp, 0x33a272d1
mov rbp, qword [rsp]
mov rbp, 0xffffffffea4f3ed8
mov r8b, r10b
jmp 0x140197f97
mov bp, 0x396a
mov ebp, esi
bswap rbp
lea rsp, [rsp + 2]
mov qword [rsp + 0xf], r8
lea r8, [r14 + rbp]
jmp 0x140197f45
mov ebp, 0x8997b8fa
inc rbp
xchg bp, r8w
clc
mov r8, qword [rsp]
jmp 0x140197fdd
sets bpl
mov ebp, esp
add ebp, 0xc310042e
mov bpl, sil
sub rsp, 0x1a
clc
jmp 0x140197f7e
bsf r8d, r15d
dec ebp
mov r9, qword [rsp]
mov r8b, byte [rsp]
stc
jmp 0x140198204
mov r9d, dword [rsp]
sub rsp, 2
not r8d
mov r8d, 0x5fda8762
bswap ebp
lea rsp, [rsp]
jmp 0x140197fc7
cmp dword [0x14005600c], 0
jmp 0x14019994b
lea r9, [r14*8]
btc r8d, r9d
lea r9, [r8 + rbp]
mov r9w, word [rsp]
add rsp, 1
sub rsp, 0x12
jmp 0x14019806e
bsf r9, rsp
mov word [rsp], r13w
mov r8, rcx
mov r9d, dword [rsp]
dec r9w
bswap r9
jmp 0x140198015
mov bp, r12w
neg r9
pop word [rsp + 6]
std
jmp 0x14019809f
mov r9b, byte [rsp + 7]
xchg qword [rsp + 8], r8
xchg ebp, r9d
add rsp, 6
sub rsp, 8
rcl r8w, cl
jmp 0x140198058
mov r8b, byte [rsp]
mov bpl, r12b
cld
mov r9w, r14w
mov r9w, r11w
jmp 0x1401980fb
xchg word [rsp + 9], r9w
mov rbp, rsi
push word [rsp + 5]
mov r9b, r15b
pop qword [rsp]
pop rbp
jmp 0x140198089
iretd
shl bp, 0xf
mov r8w, dx
adc ebp, 0xcf5bc659
bswap ebp
lea r9, [r10 + riz]
mov r8b, 0xf9
jmp 0x14019803f
mov bp, 0xe91e
cld
mov r9w, bp
neg r9
dec r8
bswap r8
jmp 0x140198169
xchg r8d, ebp
shl r8b, 6
shl al, 6
add rsp, 0
mov word [rsp + 1], cx
mov ebp, eax
pop r9w
jmp 0x1401980db
cmp bpl, 0xd4
bswap r8
mov r9d, dword [rsp + 0x1c]
call int.14019814d
loop 0x140198198
loopne 0x1401980af
jb 0x1401980ff
invalid
mov r9w, word [rsp + 1]
std
mov r8w, cx
lea r8, [0xffffffffec789c03]
mov r9w, word [rsp + 2]
sub rsp, 0x1a
jmp 0x140198113
mov r8w, r15w
lea rbp, [r9 + riz - 0x5352dafc]
mov r8b, r12b
xchg r8, rbp
mov r9d, dword [rsp]
xchg byte [rsp + 1], r8b
jmp 0x14019812e
cld
iretd
lea r9, [r11 + r14]
cmc
mov r9w, bp
mov r8w, ax
cld
sbb r9d, r13d
jmp 0x1401980bf
lea rsp, [rsp + 0x10]
jmp 0x140199975
je 0x140197f26
jne 0x140199935
cmpsd dword [rsi], dword [rdi]
and eax, 0xcc2fdcb5
xlatb
push rsi
invalid
add rsp, 8
call 0x14019997f
lea esp, [rsi - 0x71]
and al, 3
push word [rsp + 2]
push qword [rsp]
mov byte [rsp + 5], spl
jmp 0x1401999c9
push r15w
push r8
mov qword [rsp + 4], rcx
jmp 0x140199ae1
push rax
mov dword [rsp + 2], r11d
pop qword [rsp + 5]
pop word [rsp + 0xb]
push word [rsp + 9]
push word [rsp + 4]
jmp 0x1401999b3
mov qword [rsp + 6], r14
call fcn.140199a0a
lea rsp, [rsp + 0x27]
push word [rsp]
mov byte [rsp + 9], spl
jmp 0x140199a6e
push word [rsp + 0x18]
mov dword [rsp + 4], r13d
push rdi
pushfq
lea rsp, [rsp + 3]
pop word [rsp + 0x1e]
jmp 0x140199a40
push qword [rsp + 9]
call fcn.140199abf
fstp qword [rdi - 0x31]
stosb byte [rdi], al
pop rcx
mov dword [reloc.KERNEL32.dll_CreateThread], esi
pop rcx
sub eax, 0x66960f3c
mov dword [rsp + 0xd], r9d
mov word [rsp + 2], si
mov byte [rsp + 0xe], r8b
mov qword [rsp + 0xa], rbx
mov byte [rsp + 5], r10b
push qword [rsp + 4]
jmp 0x140199a56
mov word [rsp + 0x12], r15w
mov qword [rsp + 2], rdi
mov dword [rsp + 0xf], ecx
pop qword [rsp + 8]
mov byte [rsp + 3], r12b
mov word [rsp + 5], r13w
jmp 0x140199a36
lea rsp, [rsp + 0x10]
call 0x14019ff87
sub ch, bl
mov qword [r12 + r12 + 0x14], r8
mov dword [rsp + 1], edi
mov word [rsp + 0x25], sp
pushfq
lea rsp, [rsp + 1]
jmp 0x14019ffc2
lea rsp, [rsp + 0x30]
jmp 0x1401a1a2b
pop rax
sub rax, 0x1a0c48
push rax
jmp 0x140197fff
call 0x1401a0c48
jmp 0x1401a0933
mov rax, qword [rax + riz]
mov rax, qword [rax + riz + 0x10]
push rax
jmp 0x1401a0c43
mov rax, qword gs:[0x60]
mov rax, qword [rax + riz + 0x18]
mov rax, qword [rax + riz + 0x30]
jmp 0x1401a163d