Function at 0x140001ea4
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x1400047cb
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], r14
je 0x140001f39
jmp 0x140004821
je 0x140001f0a
cmp rcx, 0x3f
jae 0x140001f0a
jmp 0x14000483f
jne 0x140001ef3
mov byte [rsp + rcx + 0x30], r14b
jmp 0x14000486e
je 0x140001f28
inc rax
jmp 0x140004888
jne 0x140001f1e
lea rcx, [rsp + 0x30]
jmp 0x1400048b1
je 0x140001f3e
cmp rdi, rbx
jne 0x140001edd
mov rcx, qword [rbx + 0x30]
jmp 0x1400048ce
je 0x140001f74
jmp 0x140004910
call qword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x140004937
jb 0x14000208a
jmp 0x14000496c
jb 0x14000208a
jmp 0x1400049a0
jb 0x14000208a
mov esi, r14d
rdtsc
jmp 0x140004a0d
jae 0x140002036
jmp 0x140004a5a
jb 0x140001ff1
jmp 0x14000208a
xor edx, edx
jmp 0x140004a79
jne 0x1400020a9
jmp 0x140004af7
lea r11, [rsp + 0x250]
jmp 0x140004b0c
call fcn.140001794
int3
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rax
push rcx
push rdx
push rbx
pop rbx
pop rdx
pop rcx
pop rax
push rbp
push rcx
pop rcx
push rbx
pop rbx
push rdx
pop rdx
push rax
pop rax
lea rbp, [rax - 0x158]
sub rsp, 0x250
mov rax, qword gs:[0x60]
xor r14d, r14d
mov rcx, qword [rax + 0x18]
mov rdi, qword [rcx + 0x18]
mov rbx, rdi
jmp 0x140001edd
mov rdx, qword [rbx + 0x60]
mov rcx, r14
cmp word [rdx], r14w
push rbx
push rcx
push rax
push rdx
pop rdx
pop rax
pop rcx
pop rbx
jmp 0x140001ef1
mov al, byte [rdx + rcx*2]
mov byte [rsp + rcx + 0x30], al
inc rcx
cmp word [rdx + rcx*2], r14w
jmp 0x140001f08
lea rax, [rsp + 0x30]
mov edx, r14d
cmp byte [rsp + 0x30], r14b
jmp 0x140001f1c
jmp 0x140004889
inc edx
push rbx
push rcx
push rax
push rdx
pop rdx
pop rax
pop rcx
pop rbx
cmp byte [rax], r14b
jmp 0x140001f26
call fcn.14000abe0
nop
cmp eax, 0x240dfbc0
jmp 0x140001f37
lea r8, [rsp + 0x20]
push rcx
pop rcx
push rbx
pop rbx
push rdx
pop rdx
push rax
pop rax
mov edx, 0xbe3d21a8
call fcn.140001564
mov rax, qword [rsp + 0x20]
add rax, 0xfffffffffffffffe
mov qword [0x1400289b8], rax
jmp 0x140001f61
mov ecx, 0x800
push rax
push rcx
push rdx
push rbx
pop rbx
pop rdx
pop rcx
pop rax
call fcn.14000968c
mov qword [0x1400289c0], rax
jmp 0x140001f74
mov edi, 0x2710
mov ebx, eax
push rcx
pop rcx
push rbx
pop rbx
push rdx
pop rdx
push rax
pop rax
mov ecx, edi
jmp 0x140004949
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004950
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, edi
jmp 0x140001f93
mov rax, qword gs:[0x60]
push rax
pop rax
push rcx
pop rcx
push rdx
pop rdx
push rbx
pop rbx
cmp dword [rax + 0xb8], 2
jmp 0x140001fa9
mov ebx, 0x40
lea rcx, [rsp + 0x70]
push rax
push rcx
push rdx
push rbx
pop rbx
pop rdx
pop rcx
pop rax
mov r8d, ebx
push rax
push rcx
push rdx
push rbx
pop rbx
pop rdx
pop rcx
pop rax
xor edx, edx
call fcn.14000e600
xor edx, edx
nop
mov dword [rsp + 0x70], ebx
lea r9d, [rbx - 0x23]
mov r8d, 0xe576b34a
call fcn.140004cac
lea rcx, [rsp + 0x70]
jmp 0x1400049e0
call rax
cmp qword [rsp + 0x78], 0x40000000
jmp 0x140001fe8
shl rdx, 0x20
or rax, rdx
mov rdi, rax
jmp 0x140004a18
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
rdtsc
shl rdx, 0x20
xor ecx, ecx
or rax, rdx
mov rbx, rax
jmp 0x140004a2d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
rdtsc
shl rdx, 0x20
or rax, rdx
xor edx, edx
sub eax, ebx
sub ebx, edi
div ebx
cmp eax, 0xa
jmp 0x14000202b
jmp 0x140004a5b
inc esi
cmp esi, 0xa
jmp 0x140002032
mov dword [rbp - 0x50], r14d
mov r8d, 0x194
lea rcx, [rbp - 0x4c]
call fcn.14000e600
push rax
push rcx
push rdx
push rbx
pop rbx
pop rdx
pop rcx
pop rax
mov edx, 1
mov r8d, 0xaf724aac
mov ebx, 0x202
lea r9d, [rdx + 0x2e]
call fcn.140004cac
push rax
push rcx
push rdx
push rbx
pop rbx
pop rdx
pop rcx
pop rax
lea rdx, [rbp - 0x50]
movzx ecx, bx
jmp 0x140004abd
call rax
xor ecx, ecx
push rax
pop rax
push rcx
pop rcx
push rdx
pop rdx
push rbx
pop rbx
call fcn.140010864
mov rcx, rax
call fcn.1400107b4
call fcn.140009b80
test eax, eax
jmp 0x140002083
call fcn.140003218
jmp 0x14000208a
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret