Function at 0x140094052
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
add rcx, 0x10
cmp rax, rcx
je 0x140094085
mov r14, qword [rax + 0x30]
mov r13, qword [rax + 0x60]
jmp 0x14009408b
xor r13d, r13d
xor r14d, r14d
mov r10d, dword [0x14018cc9c]
mov rcx, qword gs:[0x60]
mov r9, qword [rcx + 0x18]
mov r8, qword [r9 + 0x10]
add r9, 0x10
mov rcx, r8
cmp rcx, r9
je 0x140094111
nop dword [rax]
test r10d, r10d
je 0x140094120
mov rsi, qword [rcx + 0x60]
movzx ebx, word [rsi]
test bx, bx
je 0x140094102
add rsi, 2
xor edi, edi
nop word [rax + rax]
lea eax, [rbx - 0x41]
lea edx, [rbx + 0x20]
cmp ax, 0x1a
cmovae edx, ebx
movzx eax, dx
add edi, eax
movzx ebx, word [rsi]
add rsi, 2
test bx, bx
jne 0x1400940d2
cmp edi, r10d
jne 0x140094109
jmp 0x14009411d
xor edi, edi
cmp edi, r10d
je 0x14009411d
mov rcx, qword [rcx]
cmp rcx, r9
jne 0x1400940b2
mov rcx, qword [0x14018cca8]
jmp 0x1400941b4
mov r8, rcx
mov r12, qword [r8 + 0x30]
mov rcx, qword [0x14018cca8]
test r12, r12
je 0x1400941b4
movsxd rax, dword [r12 + 0x3c]
mov r8d, dword [r12 + rax + 0x88]
mov r9d, dword [r12 + r8 + 0x18]
test r9, r9
je 0x1400941dc
mov r11d, dword [r12 + r8 + 0x20]
add r11, r12
movzx r10d, byte [rcx]
xor edx, edx
mov edi, dword [r11 + rdx*4]
movzx ebx, byte [r12 + rdi]
test bl, bl
je 0x1400941a2
test r10b, r10b
je 0x1400941a2
cmp bl, r10b
jne 0x1400941a2
add rdi, r12
mov esi, 1
nop word [rax + rax]
mov eax, esi
movzx ebx, byte [rdi + rax]
cmp bl, byte [rcx + rax]
jne 0x1400941a7
inc esi
test bl, bl
jne 0x140094182
jmp 0x1400941bc
cmp bl, r10b
je 0x1400941bc
inc rdx
xor r15d, r15d
cmp rdx, r9
jne 0x14009415d
jmp 0x1400941df
mov r15b, 1
xor r12d, r12d
jmp 0x1400941df
mov eax, dword [r12 + r8 + 0x1c]
mov ecx, dword [r12 + r8 + 0x24]
add rax, r12
add rcx, r12
movzx ecx, word [rcx + rdx*2]
mov r8d, dword [rax + rcx*4]
add r8, r12
xor r15d, r15d
jmp 0x1400941e2
xor r15d, r15d
xor r8d, r8d
mov rcx, qword [0x14018cc6c]
mov edx, dword [rcx]
test edx, edx
je 0x14009425c
mov edi, edx
shr edi, 8
xor esi, esi
nop word cs:[rax + rax]
mov eax, esi
inc esi
cmp word [r13 + rax*2], 0
jne 0x140094202
inc dl
cmp dl, sil
je 0x140094222
inc dil
cmp dil, sil
jne 0x140094334
movzx edi, word [r13]
test di, di
je 0x14009424c
add r13, 2
xor edx, edx
movzx eax, di
add edx, eax
movzx edi, word [r13]
add r13, 2
test di, di
jne 0x140094232
cmp edx, dword [rcx + 4]
jne 0x140094253
jmp 0x14009425c
xor edx, edx
cmp edx, dword [rcx + 4]
je 0x14009425c
cmp edx, dword [rcx + 8]
jne 0x140094334
mov r13, r8
mov esi, dword [0x14018cc58]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edi, edi
mov rcx, rax
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp dword [0x14009606a], 0
je 0x1400942b0
nop word cs:[rax + rax]
mov rcx, qword [str.VirtualProtect]
movsxd rdi, edi
mov ecx, dword [rcx + rdi]
mov dword [rax + rdi], ecx
add edi, dword [0x14018cc7c]
cmp edi, dword [0x14018cc60]
jb 0x140094292
test r15b, r15b
jne 0x1400943fa
movsxd rcx, dword [r12 + 0x3c]
mov r8d, dword [r12 + rcx + 0x88]
mov r9d, dword [r12 + r8 + 0x18]
test r9, r9
je 0x1400943fa
mov r10d, dword [r12 + r8 + 0x20]
add r10, r12
movzx r11d, byte [rax]
xor edi, edi
mov edx, dword [r10 + rdi*4]
movzx ebx, byte [r12 + rdx]
test bl, bl
je 0x140094322
test r11b, r11b
je 0x140094322
cmp bl, r11b
jne 0x140094322
add rdx, r12
mov esi, 1
nop
mov ecx, esi
movzx ebx, byte [rdx + rcx]
cmp bl, byte [rax + rcx]
jne 0x140094327
inc esi
test bl, bl
jne 0x140094302
jmp 0x14009434b
cmp bl, r11b
je 0x14009434b
inc rdi
cmp rdi, r9
jne 0x1400942e2
jmp 0x1400943fa
mov ecx, 1
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp r8
mov eax, dword [r12 + r8 + 0x1c]
mov ecx, dword [r12 + r8 + 0x24]
add rax, r12
add rcx, r12
movzx ecx, word [rcx + rdi*2]
mov edi, dword [rax + rcx*4]
add rdi, r12
mov rsi, qword [0x14018cc80]
mov r8d, dword [0x14018cc60]
mov edx, dword [0x14018cc68]
lea r9, [rsp + 0x2c]
mov rcx, rsi
call rdi
mov rax, qword [0x14018cc50]
mov edx, eax
mov eax, dword [r14 + rdx + 4]
mov ecx, dword [0x14018cc90]
cmp ecx, dword [0x14018cc68]
jae 0x1400943bc
add r14, rdx
movsxd rcx, ecx
mov edx, dword [r14 + rcx]
add edx, eax
mov dword [rsi + rcx], edx
add ecx, dword [0x14018cc7c]
cmp ecx, dword [0x14018cc68]
jb 0x1400943a2
mov eax, dword [0x14018cc5c]
mov ecx, dword [0x14018cc64]
mov dword [rsi + rcx*4], eax
mov r8d, dword [rsp + 0x2c]
mov edx, dword [0x14018cc68]
lea r9, [rsp + 0x2c]
mov rcx, rsi
call rdi
mov eax, dword [0x14018ccb0]
add rax, rsi
mov edx, dword [rsi + 0xc]
add rdx, rax
mov ecx, dword [0x14018ccb0]
add rcx, rsi
call rdx
mov ecx, 1
call r13
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret