Function at 0x140196ba0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
nop
push 0x56e4f07
mov qword [rsp], rbp
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r14
nop
sub rsp, 8
mov qword [rsp], r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
xchg r8, rbx
mov r8, rcx
xchg r8, rbx
xor r14d, r14d
mov qword [rcx + 0x10], r14
xchg rdx, r14
mov qword [rcx + 0x20], rdx
xchg r14, rdx
xchg rdi, r14
mov qword [rcx + 0x30], rdi
xchg r14, rdi
mov qword [rcx + 0x40], r14
xchg r11, r14
mov qword [rcx + 0x50], r11
xchg r14, r11
mov qword [rcx + 0x60], r14
xchg rbx, r14
mov qword [rcx + 0x70], rbx
xchg r14, rbx
xchg r14, r12
mov qword [rcx + 0x80], r12
xchg r12, r14
xchg rdi, r14
mov qword [rcx + 0x90], rdi
xchg rdi, r14
mov qword [rcx + 0xa0], r14
xchg r12, r14
mov qword [rcx + 0xb0], r12
xchg r12, r14
mov qword [rcx + 0xc0], r14
mov qword [rcx + 0xd0], r14
mov qword [rcx + 0xe0], r14
mov qword [rcx + 0xf0], r14
xchg r14, r9
mov qword [rcx + 0x100], r9
xchg r14, r9
mov rax, qword gs:[0x30]
xchg rcx, r15
mov r15, qword [rax + 0x60]
xchg rcx, r15
mov rax, qword [rcx + 0x18]
xchg r14, rcx
mov r14, qword [rax + 0x20]
xchg rcx, r14
mov rax, qword [rcx]
mov rdx, qword [rax + 0x20]
mov qword [rbx], rdx
lea r15, [0x140003e38]
xchg r15, r12
mov qword [rbp - 0x70], r12
xchg r12, r15
lea r12, [0x140198a40]
mov qword [rbp - 0x68], r12
lea rax, [rbp - 0x70]
mov qword [rbp - 0x38], rax
lea r9, [rbp - 0x70]
xor r8d, r8d
xchg r11, rcx
mov r11, rbx
xchg r11, rcx
call fcn.140198780
mov dword [rsp + 0x30], 0x692c3f06
sub dword [rsp + 0x30], 0x17fce1c1
xor dword [rsp + 0x30], 0x641d6651
add dword [rsp + 0x30], 0x8e119a
xor dword [rsp + 0x30], 0x1d9a0e04
add dword [rsp + 0x30], 0x556f8fc7
xor dword [rsp + 0x30], 0x8b3f2487
mov dword [rsp + 0x50], 0x388516dd
xor dword [rsp + 0x50], 0x471f423b
xor dword [rsp + 0x50], 0x779a80b6
xor dword [rsp + 0x50], 0x2ae3cf07
sub dword [rsp + 0x50], 0x52c6e88
xor dword [rsp + 0x50], 0x6e5be6ee
sub dword [rsp + 0x50], 0x12264725
xor dword [rsp + 0x50], 0x47286286
xor dword [rsp + 0x50], 0xd9b29f1c
mov dword [rsp + 0x54], 0x3203d491
add dword [rsp + 0x54], 0x72cd4e
xor dword [rsp + 0x54], 0x16ef37d7
xor dword [rsp + 0x54], 0x35805170
add dword [rsp + 0x54], 0x38343c89
add dword [rsp + 0x54], 0xd9f84df
sub dword [rsp + 0x54], 0x25040da9
add dword [rsp + 0x54], 0xcd94844c
mov dword [rsp + 0x34], 0x2aa7b82e
sub dword [rsp + 0x34], 0xd534e81
sub dword [rsp + 0x34], 0x51fbec7
add dword [rsp + 0x34], 0x577df585
sub dword [rsp + 0x34], 0x30f0365e
add dword [rsp + 0x34], 0x17d227b0
sub dword [rsp + 0x34], 0x27d588e3
sub dword [rsp + 0x34], 0x648e9b9
xor dword [rsp + 0x34], 0xde80e9d7
mov dword [rsp + 0x58], 0x6008712c
add dword [rsp + 0x58], 0x8abdfa0
add dword [rsp + 0x58], 0xa01831e
sub dword [rsp + 0x58], 0x40522f19
xor dword [rsp + 0x58], 0x376afcc2
add dword [rsp + 0x58], 0x36803645
add dword [rsp + 0x58], 0xbf268df
sub dword [rsp + 0x58], 0x414700bf
xor dword [rsp + 0x58], 0xf95b0906
mov dword [rsp + 0x5c], 0x7e0a44e1
sub dword [rsp + 0x5c], 0x15f1c34a
xor dword [rsp + 0x5c], 0x14d01877
xor dword [rsp + 0x5c], 0x47dce41b
xor dword [rsp + 0x5c], 0x2cbd7426
add dword [rsp + 0x5c], 0xa73019c
sub dword [rsp + 0x5c], 0x12304623
add dword [rsp + 0x5c], 0xef713a21
mov dword [rsp + 0x38], 0x3a7908ab
sub dword [rsp + 0x38], 0x2a99fe22
add dword [rsp + 0x38], 0x10de1660
add dword [rsp + 0x38], 0xc9c777f
add dword [rsp + 0x38], 0x2797d799
sub dword [rsp + 0x38], 0x31946cd4
sub dword [rsp + 0x38], 0x22d0147e
xor dword [rsp + 0x38], 0x39393fa
add dword [rsp + 0x38], 0xf3d779a1
mov dword [rsp + 0x60], 0x2f28240e
xor dword [rsp + 0x60], 0x14c6c098
xor dword [rsp + 0x60], 0x3e115e61
add dword [rsp + 0x60], 0x50d1a8fd
sub dword [rsp + 0x60], 0xca4e040
sub dword [rsp + 0x60], 0x2324f492
xor dword [rsp + 0x60], 0x574e17c0
xor dword [rsp + 0x60], 0x3b4417a5
add dword [rsp + 0x60], 0xb46c7032
mov dword [rsp + 0x64], 0x15751874
sub dword [rsp + 0x64], 0x11b3e1ba
add dword [rsp + 0x64], 0x657497ff
xor dword [rsp + 0x64], 0x78275d02
add dword [rsp + 0x64], 0x13966884
add dword [rsp + 0x64], 0xdabe033f
mov dword [rsp + 0x3c], 0x1c226b4a
xor dword [rsp + 0x3c], 0x275a533b
sub dword [rsp + 0x3c], 0x3ebe18c
xor dword [rsp + 0x3c], 0x349931ca
add dword [rsp + 0x3c], 0x4321af70
add dword [rsp + 0x3c], 0xb0bfe057
mov dword [rsp + 0x68], 0x52e630b9
sub dword [rsp + 0x68], 0xfe9aa76
add dword [rsp + 0x68], 0x1143b4a6
xor dword [rsp + 0x68], 0x5d7ef2c9
add dword [rsp + 0x68], 0x2642acdd
xor dword [rsp + 0x68], 0x2c1846bc
add dword [rsp + 0x68], 0x711100f
xor dword [rsp + 0x68], 0xf529bd2d
mov dword [rsp + 0x6c], 0x30537d4c
add dword [rsp + 0x6c], 0x13c88207
sub dword [rsp + 0x6c], 0x3cf20651
xor dword [rsp + 0x6c], 0x675309b4
xor dword [rsp + 0x6c], 0xaf34976
xor dword [rsp + 0x6c], 0xca9840d
sub dword [rsp + 0x6c], 0xe13b295
add dword [rsp + 0x6c], 0xa7727445
mov dword [rsp + 0x40], 0x6bfc110c
xor dword [rsp + 0x40], 0x63125526
add dword [rsp + 0x40], 0x1d530073
xor dword [rsp + 0x40], 0x677c6ab6
add dword [rsp + 0x40], 0x1af61e78
add dword [rsp + 0x40], 0x10f1b83f
add dword [rsp + 0x40], 0x4c8ebf
add dword [rsp + 0x40], 0x89856355
mov dword [rsp + 0x70], 0x4e6544a3
xor dword [rsp + 0x70], 0x277eded2
add dword [rsp + 0x70], 0x137d040d
sub dword [rsp + 0x70], 0x544b15f3
xor dword [rsp + 0x70], 0x6ace41b5
xor dword [rsp + 0x70], 0xbdf43651
mov dword [rsp + 0x74], 0x5a38303e
xor dword [rsp + 0x74], 0x3c611a14
sub dword [rsp + 0x74], 0x238495e4
xor dword [rsp + 0x74], 0x2365ba62
xor dword [rsp + 0x74], 0x636e6eaf
add dword [rsp + 0x74], 0x1eef032a
xor dword [rsp + 0x74], 0x70b075b3
add dword [rsp + 0x74], 0xadbec937
mov dword [rsp + 0x44], 0x1119e6d0
xor dword [rsp + 0x44], 0x151cad5a
add dword [rsp + 0x44], 0x27f72e0d
xor dword [rsp + 0x44], 0x1c976052
sub dword [rsp + 0x44], 0x2a7af08b
xor dword [rsp + 0x44], 0x682e44f2
sub dword [rsp + 0x44], 0x493ae798
xor dword [rsp + 0x44], 0xed5570c6
mov dword [rsp + 0x78], 0x55929ff7
sub dword [rsp + 0x78], 0xd2d2e73
sub dword [rsp + 0x78], 0x47ec4191
xor dword [rsp + 0x78], 0x90297e5
add dword [rsp + 0x78], 0x37ca9df
xor dword [rsp + 0x78], 0xc4861ab
add dword [rsp + 0x78], 0x2dbf7fdf
add dword [rsp + 0x78], 0xd1097f29
mov dword [rsp + 0x7c], 0x2cbef6f4
xor dword [rsp + 0x7c], 0x29c815fe
sub dword [rsp + 0x7c], 0x4b87ba7
add dword [rsp + 0x7c], 0x1c87a6af
add dword [rsp + 0x7c], 0x21a9ec55
xor dword [rsp + 0x7c], 0xc1810519
mov dword [rsp + 0x48], 0x5888f358
sub dword [rsp + 0x48], 0x4524d201
add dword [rsp + 0x48], 0x3c730d31
add dword [rsp + 0x48], 0x166ddb1b
sub dword [rsp + 0x48], 0x4a81171a
add dword [rsp + 0x48], 0x54806471
xor dword [rsp + 0x48], 0x86b2a00c
mov dword [rbp - 0x80], 0xb90173b
sub dword [rbp - 0x80], 0xb84955b
add dword [rbp - 0x80], 0x1a66baa1
add dword [rbp - 0x80], 0x57803f80
sub dword [rbp - 0x80], 0x53bd9a3
sub dword [rbp - 0x80], 0x3ec8ee66
add dword [rbp - 0x80], 0x285fa881
sub dword [rbp - 0x80], 0x25df5612
add dword [rbp - 0x80], 0xcf08f90f
mov dword [rbp - 0x7c], 0x9b27441
xor dword [rbp - 0x7c], 0x6cd7b1f8
sub dword [rbp - 0x7c], 0x16611d84
sub dword [rbp - 0x7c], 0xf7724f4
xor dword [rbp - 0x7c], 0x4669bcd8
sub dword [rbp - 0x7c], 0x64ac0ef8
add dword [rbp - 0x7c], 0xea36ce97
mov word [rsp + 0x4c], 0xf57
add word [rsp + 0x4c], 0x6bbb
sub word [rsp + 0x4c], 0x61cf
xor word [rsp + 0x4c], 0x1f03
xor word [rsp + 0x4c], 0x5871
sub word [rsp + 0x4c], 0x5a9a
add word [rsp + 0x4c], 0x53b3
sub word [rsp + 0x4c], 0x34f2
add word [rsp + 0x4c], 0xd49e
mov dword [rbp - 0x78], 0x3ac71ead
sub dword [rbp - 0x78], 0x204fa8ea
xor dword [rbp - 0x78], 0x434a97af
sub dword [rbp - 0x78], 0x1eb3a328
add dword [rbp - 0x78], 0x40ffeb60
sub dword [rbp - 0x78], 0x41ab0702
xor dword [rbp - 0x78], 0x7c371c2f
xor dword [rbp - 0x78], 0xba9ec0fb
xor eax, eax
mov word [rbp - 0x74], ax
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x50]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x50], dx
mov byte [rsp + rax + 0x30], r14b
inc rax
cmp rax, 0x1e
jb 0x14019726a
xor r8d, r8d
lea rdx, [rsp + 0x50]
xchg rdi, rcx
mov rdi, rbx
xchg rdi, rcx
call fcn.1401994a0
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
xchg r14, rcx
mov r14, rcx
xchg r14, rcx
nop word [rax + rax]
mov byte [rsp + rcx + 0x50], 0x20
sub byte [rsp + rcx + 0x50], 0x15
add byte [rsp + rcx + 0x50], 0x1d
add byte [rsp + rcx + 0x50], 0x3b
sub byte [rsp + rcx + 0x50], 0x29
sub byte [rsp + rcx + 0x50], 0x3a
inc rcx
cmp rcx, 0x3c
jb 0x1401972be
mov qword [rsp + 0x28], r14
mov byte [rsp + 0x20], 0x2d
sub byte [rsp + 0x20], 0x16
xor byte [rsp + 0x20], 0xd
add byte [rsp + 0x20], 0x45
add byte [rsp + 0x20], 0x13
sub byte [rsp + 0x20], 0x72
xor r9d, r9d
xor r8d, r8d
xchg r10, rdi
mov rdx, r10
xchg r10, rdi
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.14019a590
mov qword [rbx + 8], rax
xchg rdi, r13
mov qword [rbp + 0x40], r13
xchg r13, rdi
test rdi, rdi
je 0x140197394
mov dword [rsp + 0x20], 0x1af6129f
xor dword [rsp + 0x20], 0x50862d2e
sub dword [rsp + 0x20], 0x414f1a38
xor dword [rsp + 0x20], 0x7381040f
sub dword [rsp + 0x20], 0x1a71c256
sub dword [rsp + 0x20], 0xf25c4f
xor dword [rsp + 0x20], 0x643301e
sub dword [rsp + 0x20], 0x597eb2cf
xor r9d, r9d
lea r8, [rbp + 0x40]
lea rdx, [r9 - 1]
lea rcx, [rbx + 0x70]
call fcn.140197720
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r12
lea rax, [rbp - 0x30]
mov qword [rbp + 8], rax
lea r9, [rbp - 0x30]
xor r8d, r8d
mov rdx, qword [rbx + 8]
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.140198780
xchg r13, rbx
mov rax, r13
xchg r13, rbx
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x40]
xchg rbp, rsi
mov rbp, qword [r11 + 0x48]
xchg rsi, rbp
mov rsp, r11
nop
add rsp, 8
mov r15, qword [rsp - 8]
push rcx
push rbx
xchg qword [rsp + 0x10], r14
pop rbx
pop rcx
add rsp, 8
nop
xchg qword [rsp], r12
add rsp, 8
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
mov rbp, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]