Function at 0x18014d994
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
mov r13, qword [r8 + 0x20]
mov qword [rsp + 0x30], r13
mov rbx, r13
mov qword [rsp + 0xc0], rbx
xor r14d, r14d
lea r12d, [r14 + 1]
mov ebp, r14d
mov rdx, qword [rbx + 0x50]
test rdx, rdx
je 0x18014dc30
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], r14w
jne 0x18014da0b
lea rcx, [rsp + 0x40]
call fcn.18007b5dc
nop
mov r15, r14
mov r8, qword [rdi]
mov r10, qword [rdi + 8]
sub r10, r8
sar r10, 5
test r10, r10
je 0x18014dab4
mov rdi, qword [r8 + 0x10]
mov r11, r8
cmp qword [r8 + 0x18], 0x10
jb 0x18014da47
mov r11, qword [r8]
lea rcx, [rdi + rdi]
movzx eax, word [rbx + 0x48]
cmp rcx, rax
jne 0x18014dc47
mov esi, r14d
test rdi, rdi
je 0x18014daa9
mov r14, qword [rbx + 0x50]
movzx edx, byte [r11]
mov r9b, byte [r14]
lea ecx, [rdx - 0x41]
lea eax, [rdx + 0x20]
movzx r12d, al
cmp cl, 0x19
cmova r12d, edx
lea eax, [r9 - 0x41]
cmp al, 0x19
ja 0x18014da88
add r9b, 0x20
cmp r12b, r9b
mov r12d, 1
jne 0x18014dc44
add esi, r12d
add r11, r12
add r14, 2
movsxd rax, esi
cmp rax, rdi
jb 0x18014da64
mov ebp, r12d
mov rsi, qword [rsp + 0xb0]
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], 4
lea r9, str..exe
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
call fcn.18007b50c
cmp rax, 0xffffffffffffffff
cmovne ebp, r12d
mov eax, 2
cmp word [rbx + 0x38], ax
jbe 0x18014dbfc
test ebp, ebp
jne 0x18014dbfc
mov rax, qword [rbx + 0x50]
mov qword [rsp + 0xc8], rax
mov r15, qword [rbx + 0x20]
mov r9, r15
mov r8, rax
mov rdx, qword [rbx + 0x40]
mov rcx, rsi
call fcn.18014dc60
mov rdi, rax
test rax, rax
je 0x18014dbfc
movsxd r14, dword [rax + 0x3c]
mov eax, dword [r14 + rax + 0x54]
mov qword [rsp + 0x20], rax
mov r9, r15
mov r8, rdi
call fcn.18014e2ec
movsxd r12, dword [rdi + 0x3c]
add r12, rdi
xor ecx, ecx
mov esi, ecx
cmp cx, word [r14 + rdi + 6]
jae 0x18014dbe5
mov rbx, qword [rsp + 0xc8]
mov eax, esi
lea rbp, [rax + rax*4]
lea r13, [r12 + rbp*8]
cmp dword [r13 + 0x12c], ecx
jl 0x18014dbcc
lea rdx, str.clr.dll
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
jne 0x18014dba8
lea rdx, str..text
lea rcx, [r13 + 0x108]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcmp]
xor ecx, ecx
test eax, eax
je 0x18014dbcc
mov eax, dword [r12 + rbp*8 + 0x114]
mov ecx, dword [r12 + rbp*8 + 0x110]
lea r9, [rax + r15]
lea r8, [rax + rdi]
mov qword [rsp + 0x20], rcx
call fcn.18014e2ec
xor ecx, ecx
inc esi
movzx eax, word [r14 + rdi + 6]
cmp esi, eax
jb 0x18014db67
mov rbx, qword [rsp + 0xc0]
mov r13, qword [rsp + 0x30]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r12d, 1
mov rbx, qword [rbx]
mov qword [rsp + 0xc0], rbx
lea rcx, [rsp + 0x40]
call fcn.18007a444
cmp rbx, r13
mov rdi, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xb0]
mov r14d, 0
jne 0x18014d9e5
mov al, r12b
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
xor r14d, r14d
add r15, r12
add r8, 0x20
cmp r15, r10
jae 0x18014daac
jmp 0x18014da36