Function at 0x14005b480
Capabilities:
Access pe header
Access peb ldr_data
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r13d, r8d
mov dword [rsp + 0x30], r8d
mov r15, rdx
mov rsi, rcx
xor r12d, r12d
mov ebx, r12d
mov qword [rax - 0x50], r12
cmp qword [rax + 0x28], rbx
je 0x14005b4ca
mov eax, 0xc00000f3
jmp 0x14005b887
mov qword [rcx], r12
test rdx, rdx
je 0x14005b4d5
mov qword [rdx], r12
bt r8d, 0x1e
jb 0x14005b4fc
lea rdx, [rsp + 0xc0]
mov rcx, r9
call fcn.14005bbd0
mov edi, 0xc000007b
test al, al
cmove ebx, edi
mov dword [rsp + 0x34], ebx
jmp 0x14005b501
mov edi, 0xc000007b
jmp 0x14005b52e
test ebx, ebx
jns 0x14005b539
mov eax, ebx
jmp 0x14005b887
mov eax, r13d
and eax, 0x10000000
je 0x14005b552
mov r13d, eax
mov dword [rsp + 0x30], eax
mov rax, r12
mov r14, r12
jmp 0x14005b562
mov rax, qword [rsp + 0xd0]
mov r14, qword [rsp + 0xc8]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], rax
test r13b, 4
je 0x14005b586
test r14, r14
je 0x14005b57c
test rax, rax
jne 0x14005b586
mov eax, 0xc00000f1
jmp 0x14005b887
test r14, r14
je 0x14005b6e2
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r13, rax
test rax, rax
je 0x14005b795
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rbx, qword [rcx + 0x18]
add rbx, 0x10
mov qword [rsp + 0x38], rbx
mov rdi, qword [rbx]
cmp rdi, rbx
je 0x14005b6dd
mov rax, rbx
mov rbx, rdi
mov rdi, qword [rdi]
cmp qword [rbx + 0x10], 0
je 0x14005b651
movzx r8d, word [rbx + 0x58]
shr r8, 1
sub r8, 4
mov rdx, qword [rbx + 0x60]
mov rcx, r14
call fcn.14016ef5c
test eax, eax
je 0x14005b613
movzx r8d, word [rbx + 0x58]
shr r8, 1
mov rdx, qword [rbx + 0x60]
mov rcx, r14
call fcn.14016ef5c
test eax, eax
jne 0x14005b64c
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r14, rax
test rax, rax
je 0x14005b647
mov rcx, qword [rbx + 0x30]
call fcn.140059fc0
test rax, rax
je 0x14005b647
mov ecx, dword [r14 + 0x1c]
cmp dword [r13 + 0x1c], ecx
jne 0x14005b647
mov ecx, dword [r14 + 0x54]
cmp dword [r13 + 0x54], ecx
je 0x14005b65f
mov r14, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
cmp rdi, rax
je 0x14005b6dd
jmp 0x14005b5d2
test byte [rax + 0xe], 8
je 0x14005b57c
test byte [rsp + 0x30], 2
jne 0x14005b57c
call fcn.14005e010
test eax, eax
jle 0x14005b6c7
cmp eax, 3
jle 0x14005b6b2
cmp eax, 8
jg 0x14005b6c7
movzx eax, word [rbx + 0x6c]
mov ecx, 0xffff
cmp ax, cx
je 0x14005b69c
inc ax
mov word [rbx + 0x6c], ax
mov rcx, qword [rbx + 0x98]
mov eax, dword [rcx + 0x18]
cmp eax, 0xffffffff
je 0x14005b6c7
inc eax
mov dword [rcx + 0x18], eax
jmp 0x14005b6c7
movzx eax, word [rbx + 0x6c]
mov ecx, 0xffff
cmp ax, cx
je 0x14005b6c7
inc ax
mov word [rbx + 0x6c], ax
mov rax, qword [rbx + 0x30]
mov qword [rsi], rax
test r15, r15
je 0x14005b6d6
mov qword [r15], rbx
xor eax, eax
jmp 0x14005b887
mov r13d, dword [rsp + 0x30]
mov r8d, dword [rsp + 0xc0]
mov rdx, qword [rsp + 0xb8]
mov rcx, rsi
call fcn.140059860
mov edi, eax
test eax, eax
js 0x14005b887
cmp eax, 0x4000000e
je 0x14005b887
mov rcx, qword [rsi]
call fcn.140059fc0
mov rbx, rax
test rax, rax
jne 0x14005b738
mov ecx, 7
int 0x29
call qword [sym.imp.KERNEL32.dll_DebugBreak]
mov ecx, 0xc0000141
call qword [sym.imp.KERNEL32.dll_ExitProcess]
or byte [rax + 0xc], 2
mov rcx, qword [rsi]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov qword [rsp + 0xc0], rax
movzx ecx, word [rax + 0x5e]
mov eax, 0x400
mov r14d, r13d
or r14d, 1
and cx, ax
cmove r14d, r13d
bt r14d, 0x1c
jae 0x14005b79c
mov rcx, rbx
call fcn.14005be10
test eax, eax
je 0x14005b788
mov edx, 1
mov rcx, rbx
call fcn.14005be80
test eax, eax
jne 0x14005b795
mov edi, 0xc0000142
mov rcx, qword [rsi]
call fcn.140059ef0
mov eax, edi
jmp 0x14005b887
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x40]
mov edx, r14d
mov rcx, qword [rsi]
call fcn.14005bf20
mov edi, eax
test eax, eax
jns 0x14005b7d5
xor edx, edx
mov rcx, qword [rsi]
call fcn.14005b9d0
mov qword [rsi], r12
mov eax, edi
jmp 0x14005b887
or word [rbx + 0xe], 1
mov r13, qword [rsp + 0x48]
test r15, r15
je 0x14005b7e7
mov qword [r15], r13
test r14b, 2
jne 0x14005b7f2
or word [rbx + 0xe], 8
test r14b, 1
jne 0x14005b830
mov rax, qword [rsp + 0xc0]
mov edx, dword [rax + 0x50]
mov rcx, qword [rbx + 0x10]
call fcn.14005ceb0
mov edi, eax
test eax, eax
jns 0x14005b82b
xor edx, edx
mov rcx, qword [rsi]
call fcn.14005b9d0
mov qword [rsi], r12
test r15, r15
je 0x14005b827
mov qword [r15], r12
mov eax, edi
jmp 0x14005b887
or word [rbx + 0xe], 2
test r14b, 8
jne 0x14005b857
mov rcx, r13
call fcn.14005dea0
mov edi, eax
test eax, eax
jns 0x14005b852
bt r14d, 0x1d
jae 0x14005b812
mov edi, 0x7fffffff
jmp 0x14005b857
or word [rbx + 0xe], 4
mov rcx, rbx
call fcn.14005be10
test eax, eax
je 0x14005b878
mov edx, 1
mov rcx, rbx
call fcn.14005be80
test eax, eax
jne 0x14005b795
xor edx, edx
mov rcx, qword [rsi]
call fcn.14005b9d0
mov eax, 0xc0000142
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret