Function at 0x140004230
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xa0
cmp ecx, 5
mov edi, edx
lea rdx, [0x140022428]
mov rbp, r9
sbb eax, eax
mov r14d, r8d
and eax, ecx
lea rcx, [0x140021580]
imul rsi, rax, 0x70
lea rax, [0x140025c70]
add rsi, rax
call fcn.140001008
mov r8, qword [rsi + 0x18]
lea rcx, [0x140022440]
mov rdx, qword [rsi + 0x10]
call fcn.140001008
xor r15d, r15d
mov ebx, 1
test edi, edi
je 0x1400042aa
test byte [rsi + 8], bl
jne 0x1400042aa
lea rcx, [0x140022470]
jmp 0x140004545
cmp dword [rsi], 0xffffffff
je 0x1400042c0
cmp r14d, dword [rsi]
jbe 0x1400042c0
lea rcx, [0x1400224b0]
jmp 0x140004545
lea r12, [0x140004218]
cmp qword [rsi + 0x28], r12
je 0x14000453e
cmp qword [rsi + 0x30], r12
je 0x14000453e
mov edx, ebx
mov ecx, 0x14
call fcn.140004c7c
test eax, eax
jns 0x1400042fe
lea rcx, [0x140022590]
mov edx, eax
call fcn.140001008
jmp 0x14000454a
mov edx, ebx
mov ecx, 0xa
call fcn.140004c7c
test eax, eax
jns 0x140004317
lea rcx, [0x1400225d0]
jmp 0x1400042f2
mov rax, qword gs:[0x30]
mov edx, 8
mov rcx, qword [rax + 0x60]
lea r8d, [rdx + 0x30]
mov rcx, qword [rcx + 0x30]
call qword [0x140019348]
mov rbx, rax
test rax, rax
je 0x14000454a
mov ecx, 0xb
mov qword [rax + 0x30], rsi
mov qword [rax + 8], rbp
mov rdi, r15
call fcn.14000517c
test rax, rax
je 0x14000437d
mov rcx, qword gs:[0x30]
mov r8, rax
mov rdi, qword [rax + 0x18]
xor edx, edx
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [0x1400192f0]
mov qword [rbx + 0x10], rdi
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rbx + 0x30]
mov rsi, qword [rcx + 0x20]
mov rcx, qword [rax + 0x18]
mov rax, rcx
test rcx, rcx
jne 0x1400043ab
mov rcx, r15
jmp 0x1400043b7
add rcx, 2
cmp word [rcx], r15w
jne 0x1400043a7
sub rcx, rax
sar rcx, 1
movzx eax, word [rsi + 0x38]
lea rcx, [rcx + 0x20]
mov dword [rbx + 4], r14d
mov edx, 8
lea r8, [rax + rcx*2]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [0x140019348]
lea rdi, [rsp + 0x60]
mov dword [rsp + 0xd0], r15d
mov qword [rbx + 0x20], rax
lea r9, [rsp + 0xd0]
xor eax, eax
lea edx, [rax + 0x40]
mov ecx, edx
mov r8d, edx
rep stosb byte [rdi], al
xor ecx, ecx
lea rdx, [rsp + 0x60]
call qword [0x140019340]
test eax, eax
js 0x140004423
mov rax, qword [rsp + 0x88]
jmp 0x14000443f
xor eax, eax
lea rdi, [rsp + 0x30]
lea ecx, [rax + 0x30]
rep stosb byte [rdi], al
lea rcx, [rsp + 0x30]
call qword [0x140019058]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rbx + 0x20]
mov qword [rbx + 0x28], rax
test rcx, rcx
je 0x140004507
movzx edx, word [rsi + 0x38]
mov r8, qword [rsi + 0x40]
shr rdx, 1
mov r9, rdx
call fcn.140003f1c
mov rcx, qword [rbx + 0x20]
lea rdx, [0x140022618]
call fcn.140003ee0
mov rdx, qword [rbx + 0x30]
mov rcx, qword [rbx + 0x20]
mov rdx, qword [rdx + 0x18]
call fcn.140003ee0
mov rcx, qword [rbx + 0x20]
lea rdx, [0x140022620]
call fcn.140003ee0
mov rcx, qword [rbx + 0x30]
mov rax, qword [rbx + 0x20]
mov rdx, qword [rbx + 8]
mov qword [rsp + 0x20], rax
mov r9, qword [rcx + 0x20]
mov r8, qword [rcx + 0x18]
mov ecx, dword [rcx + 4]
call fcn.14000403c
test rax, rax
je 0x1400044ea
mov rcx, qword [rbx + 0x30]
mov qword [rbx + 0x18], rax
mov rdx, qword [rcx + 0x60]
cmp rdx, r12
je 0x140004526
mov rcx, rax
call rdx
test eax, eax
jne 0x140004526
call qword [0x1400190b8]
mov edx, eax
lea rcx, [0x140022630]
call fcn.140001008
jmp 0x140004526
mov rax, qword gs:[0x30]
xor edx, edx
mov r8, qword [rbx + 0x20]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [0x1400192f0]
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [0x1400192f0]
mov rbx, r15
lea rdx, [0x140022428]
lea rcx, [0x140021598]
call fcn.140001008
mov rax, rbx
jmp 0x14000454c
lea rcx, [0x140022500]
call fcn.140001008
xor eax, eax
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret