Function at 0x140001d30
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov r15d, edx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
xor r12d, r12d
mov ecx, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
mov eax, dword [rcx + rax]
cmp dword [0x140040850], eax
jle 0x140001dea
lea rcx, [0x140040850]
call fcn.1400310f8
cmp dword [0x140040850], 0xffffffff
jne 0x140001dea
mov qword [0x140040858], r12
mov qword [0x140040860], r12
lea ecx, [r12 + 0x48]
call fcn.14003140c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [0x140040858], rax
lea rcx, [0x140032a40]
call fcn.140031670
nop
lea rcx, [0x140040850]
call fcn.14003108c
mov rcx, qword [0x140040858]
mov rax, qword [rcx + 8]
mov rdx, rcx
cmp byte [rax + 0x19], 0
jne 0x140001e18
nop
cmp dword [rax + 0x20], r15d
jge 0x140001e0c
mov rax, qword [rax + 0x10]
jmp 0x140001e12
mov rdx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140001e00
cmp byte [rdx + 0x19], 0
jne 0x140001e3a
cmp r15d, dword [rdx + 0x20]
jl 0x140001e3a
cmp rdx, rcx
je 0x140001e3a
add rdx, 0x28
mov rcx, rdi
call fcn.140004260
jmp 0x140002131
mov eax, r15d
sar eax, 0x10
lea ecx, [rax*8 + 0x10]
mov rdx, qword [0x1400407f8]
add rdx, 0x6739700
add rdx, rcx
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rsp + 0x60]
mov rcx, qword [0x1400407f0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx ecx, r15w
mov rax, qword [rsp + 0x60]
lea rsi, [rax + rcx*2]
mov word [rsp + 0x50], r12w
mov qword [rsp + 0x20], r12
mov r9d, 2
lea r8, [rsp + 0x50]
mov rdx, rsi
mov rcx, qword [0x1400407f0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movsx ebx, word [rsp + 0x50]
sar ebx, 6
test ebx, ebx
jle 0x14000211c
xor edx, edx
mov r8d, 0x404
lea rcx, [rbp - 0x70]
call sub.VCRUNTIME140.dll_memset
movsxd rbx, ebx
lea rdx, [rsi + 2]
mov qword [rsp + 0x20], r12
mov r9, rbx
lea r8, [rbp - 0x70]
mov rcx, qword [0x1400407f0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp rbx, 0x404
jae 0x14000215f
mov byte [rbp + rbx - 0x70], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
lea rax, [rbp - 0x70]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001f20
movabs rsi, 0x7fffffffffffffff
cmp rbx, rsi
ja 0x14000216b
cmp rbx, 0xf
ja 0x140001f69
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], 0xf
mov r8, rbx
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x70], 0
jmp 0x140002000
mov rax, rbx
or rax, 0xf
cmp rax, rsi
jbe 0x140001fa2
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14003140c
test rax, rax
je 0x14000210e
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140001fdf
mov rsi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x140001fcd
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002165
jmp 0x140001f83
test rcx, rcx
je 0x140001fdc
call fcn.14003140c
mov r14, rax
jmp 0x140001fdf
mov r14, r12
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], rsi
mov r8, rbx
lea rdx, [rbp - 0x70]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], 0
mov rsi, qword [0x140040858]
mov rax, qword [rsi + 8]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], r12d
mov rcx, rsi
cmp byte [rax + 0x19], 0
jne 0x14000204a
nop
mov qword [rsp + 0x38], rax
cmp dword [rax + 0x20], r15d
jge 0x140002036
mov dword [rsp + 0x40], r12d
mov rax, qword [rax + 0x10]
jmp 0x140002044
mov dword [rsp + 0x40], 1
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140002020
cmp byte [rcx + 0x19], 0
jne 0x140002056
cmp r15d, dword [rcx + 0x20]
jge 0x1400020cd
movabs rax, 0x38e38e38e38e38e
cmp qword [0x140040860], rax
je 0x140002171
lea r14, [0x140040858]
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r12
mov ecx, 0x48
call fcn.14003140c
mov rbx, rax
mov qword [rsp + 0x68], rax
mov dword [rax + 0x20], r15d
lea rcx, [rax + 0x28]
lea rdx, [rsp + 0x70]
call fcn.140004260
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
mov word [rbx + 0x18], 0
movups xmm0, xmmword [rsp + 0x38]
movaps xmmword [rsp + 0x60], xmm0
mov r8, rbx
lea rdx, [rsp + 0x60]
mov rcx, r14
call fcn.140004c50
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.140004260
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140002131
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002115
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002115
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140031690
jmp 0x140002131
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rax, rdi
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.140031030
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.140031278
int3
call fcn.140001100
int3
call fcn.1400011a0
nop
call fcn.140001600
nop
int3