Function at 0x1400e2564
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process filename

Disassembly:
mov r11, rsp
push rdi
push r14
push r15
sub rsp, 0xa00
mov qword [r11 - 0x830], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1401a7d98]
xor rax, rsp
mov qword [rsp + 0x9f0], rax
mov r15, rcx
and dword [rsp + 0x20], 0
and dword [rsp + 0x518], 0
lea rax, [rcx + 0xd8]
mov qword [r11 - 0x980], rax
mov rdx, qword [rax]
test rdx, rdx
je 0x1400e25c1
mov rdx, qword [rdx]
lea rcx, [rsp + 0x310]
call fcn.1400e3dc8
nop
mov rdx, rax
lea rcx, [rsp + 0x540]
call fcn.1400d4cd0
nop
lea rcx, [rsp + 0x310]
call fcn.1400e3d44
mov al, byte [rsp + 0x558]
mov byte [rsp + 0x24], al
test al, al
jne 0x1400e26a7
mov ecx, 0x80004005
mov dword [rsp + 0x2c], ecx
mov byte [rsp + 0x25], al
lea rax, str.onecore_basewcp_toolsmt_rgstlbmangenlib.cpp
mov qword [rsp + 0x78], rax
lea rax, str.CManGenLib::ProcessWinmd
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x88], 0x72e
lea rax, str.__HRESULT_0x80004005L_
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x518]
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x518], ecx
mov r8d, 0x80004005
lea rcx, [rsp + 0x78]
call fcn.1400c81b4
mov ebx, dword [rsp + 0x518]
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
cmp byte [rsp + 0x558], 0
je 0x1400e26a0
lea rax, [rsp + 0x540]
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x540]
call fcn.1400d4d54
nop
mov eax, ebx
jmp 0x1400e2d8e
lea rcx, [rsp + 0x3e8]
mov qword [rsp + 0xb0], rcx
mov byte [rsp + 0x26], al
lea rax, [rsp + 0x540]
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0x540]
mov qword [rsp + 0xc0], rax
lea rdx, [rsp + 0x540]
lea rcx, [rsp + 0x3e8]
call fcn.1400dc4b0
nop
mov rdx, rax
lea rcx, [rsp + 0x710]
call fcn.1400dc600
nop
lea rax, [rsp + 0x710]
mov qword [rsp + 0xc8], rax
lea rax, [rsp + 0x250]
mov qword [rsp + 0xd0], rax
lea rax, [rsp + 0x840]
mov qword [rsp + 0xd8], rax
and qword [rsp + 0x288], 0
mov rcx, qword [rsp + 0x878]
mov qword [rsp + 0xe0], rcx
test rcx, rcx
sete byte [rsp + 0x27]
test rcx, rcx
je 0x1400e277c
mov rax, qword [rcx]
lea rdx, [rsp + 0x250]
mov rax, qword [rax]
call qword [case.0x14010a1e6.0]
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0x288], rax
lea rax, [rsp + 0x480]
mov qword [rsp + 0xf0], rax
lea rdx, [rsp + 0x710]
lea rcx, [rsp + 0x480]
call fcn.1400dc558
nop
lea r8, [rsp + 0x250]
mov rdx, rax
lea rcx, [rsp + 0x5a0]
call fcn.1400e358c
mov dword [rsp + 0x20], 1
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0xf8], rax
lea rax, [rsp + 0x840]
mov qword [rsp + 0x100], rax
and qword [rsp + 0x308], 0
mov rcx, qword [rsp + 0x878]
mov qword [rsp + 0x108], rcx
test rcx, rcx
sete byte [rsp + 0x28]
test rcx, rcx
je 0x1400e282c
mov rax, qword [rcx]
lea rdx, [rsp + 0x2d0]
mov rax, qword [rax]
call qword [case.0x14010a1e6.0]
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x308], rax
lea rax, [rsp + 0x350]
mov qword [rsp + 0x118], rax
lea rax, [rsp + 0x710]
mov qword [rsp + 0x120], rax
mov ebx, dword [rsp + 0x720]
lea rax, [rsp + 0x290]
mov qword [rsp + 0x128], rax
lea rax, [rsp + 0x768]
mov qword [rsp + 0x130], rax
and qword [rsp + 0x2c8], 0
mov rcx, qword [rsp + 0x7a0]
mov qword [rsp + 0x138], rcx
test rcx, rcx
sete byte [rsp + 0x29]
test rcx, rcx
je 0x1400e28ba
mov rax, qword [rcx]
lea rdx, [rsp + 0x290]
mov rax, qword [rax]
call qword [case.0x14010a1e6.0]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x2c8], rax
mov r9d, ebx
lea r8, [rsp + 0x290]
lea rdx, [rsp + 0x728]
lea rcx, [rsp + 0x350]
call fcn.1400e34cc
mov dword [rsp + 0x20], 5
mov byte [rsp + 0x358], 0
lea r8, [rsp + 0x2d0]
lea rdx, [rsp + 0x350]
lea rcx, [rsp + 0x880]
call fcn.1400e358c
mov ebx, 7
mov dword [rsp + 0x20], ebx
mov r14, qword [rsp + 0x58]
lea rax, [rsp + 0x5a0]
mov qword [rsp + 0x140], rax
mov al, byte [rsp + 0x888]
cmp byte [rsp + 0x5a8], al
je 0x1400e2d28
lea rax, [rsp + 0x5a0]
mov qword [rsp + 0x148], rax
lea rax, [rsp + 0x5d0]
mov qword [rsp + 0x150], rax
mov al, byte [rsp + 0x5f0]
mov byte [rsp + 0x2a], al
test al, al
je 0x1400e2db8
lea rax, [rsp + 0x5d0]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x5d0]
mov qword [rsp + 0x160], rax
lea rdx, [rsp + 0x5d0]
lea rcx, [rsp + 0x560]
call fcn.1400d7078
mov eax, dword [rsp + 0x5e8]
mov dword [rsp + 0x578], eax
bts ebx, 8
mov dword [rsp + 0x20], ebx
lea rax, [rsp + 0x560]
mov qword [rsp + 0x168], rax
bts ebx, 7
mov dword [rsp + 0x20], ebx
lea rax, [rsp + 0x560]
mov qword [rsp + 0x170], rax
or ebx, 0x40
mov dword [rsp + 0x20], ebx
lea rax, [rsp + 0x560]
mov qword [rsp + 0x178], rax
lea rcx, [rsp + 0x560]
call fcn.1400d2d80
mov r8d, eax
lea rcx, [rsp + 0x560]
call fcn.140003420
mov rdx, rax
lea rcx, [rsp + 0x520]
call fcn.1400d4d18
or ebx, 0x20
mov dword [rsp + 0x20], ebx
lea rcx, [rsp + 0x560]
call fcn.1400d4d54
lea rax, [rsp + 0x520]
mov qword [rsp + 0x180], rax
or ebx, 0x10
mov dword [rsp + 0x20], ebx
lea rax, [rsp + 0x520]
mov qword [rsp + 0x188], rax
or ebx, 8
mov dword [rsp + 0x20], ebx
lea rax, [rsp + 0x520]
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x520]
mov qword [rsp + 0x198], rax
lea rdx, str.Windows.Foundation.Metadata.ActivatableAttribute
lea rcx, [rsp + 0x230]
call fcn.1400e3dc8
nop
bts ebx, 9
mov dword [rsp + 0x20], ebx
mov esi, ebx
lea rdx, [rsp + 0x520]
lea rcx, [rsp + 0x230]
call fcn.1400e8078
test al, al
jne 0x1400e2b32
lea rdx, str.Windows.Foundation.Metadata.StaticAttribute
lea rcx, [rsp + 0x210]
call fcn.1400e3dc8
nop
bts ebx, 0xa
mov dword [rsp + 0x20], ebx
mov esi, ebx
lea rdx, [rsp + 0x520]
lea rcx, [rsp + 0x210]
call fcn.1400e8078
test al, al
jne 0x1400e2b32
lea rdx, str.Windows.Foundation.Metadata.ComposableAttribute
lea rcx, [rsp + 0x1f0]
call fcn.1400e3dc8
nop
bts ebx, 0xb
mov dword [rsp + 0x20], ebx
mov esi, ebx
lea rdx, [rsp + 0x520]
lea rcx, [rsp + 0x1f0]
call fcn.1400e8078
test al, al
jne 0x1400e2b32
xor dil, dil
jmp 0x1400e2b35
mov dil, 1
mov byte [rsp + 0x2b], dil
bt esi, 0xb
jae 0x1400e2b56
btr ebx, 0xb
mov dword [rsp + 0x20], ebx
lea rcx, [rsp + 0x1f0]
call fcn.1400e3d44
nop
bt ebx, 0xa
jae 0x1400e2b72
btr ebx, 0xa
mov dword [rsp + 0x20], ebx
lea rcx, [rsp + 0x210]
call fcn.1400e3d44
nop
bt ebx, 9
jae 0x1400e2b8d
btr ebx, 9
mov dword [rsp + 0x20], ebx
lea rcx, [rsp + 0x230]
call fcn.1400e3d44
test dil, dil
je 0x1400e2ceb
lea rcx, [rsp + 0x520]
call fcn.1400d2d80
mov r8d, eax
lea rcx, [rsp + 0x520]
call fcn.140003420
mov rdx, rax
lea rcx, [rsp + 0x330]
call fcn.1400d4d18
nop
mov rdx, rax
lea rcx, [rsp + 0x580]
call fcn.1400daa84
bts ebx, 0xc
mov dword [rsp + 0x20], ebx
lea rcx, [rsp + 0x330]
call fcn.1400d4d54
nop
lea rcx, [rsp + 0x520]
call fcn.1400e2448
mov qword [rsp + 0x50], rax
lea rdi, [r15 + 0x90]
mov qword [rsp + 0x1a0], rdi
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x1a8], rcx
xor edx, edx
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
mov qword [rsp + 0x1b0], rax
test rax, rax
je 0x1400e2cb9
mov qword [rsp + 0x48], r14
lea rax, [rsp + 0x580]
mov qword [rsp + 0x1b8], rax
lea rax, [rsp + 0x580]
mov qword [rsp + 0x1c0], rax
lea rdx, [rsp + 0x580]
mov qword [rsp + 0x40], rdx
cmp qword [rsp + 0x598], 8
cmovae rdx, qword [rsp + 0x580]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rdx
lea rax, method.std::_Facet_base.virtual_8
mov qword [rbx], rax
lea rax, fcn.1400e2df0
mov qword [rbx], rax
lea rcx, [rbx + 8]
call fcn.1400d44d8
nop
mov rax, qword [rsp + 0x50]
mov qword [rbx + 0x10], rax
jmp 0x1400e2cbb
xor ebx, ebx
mov qword [rsp + 0x1c8], rbx
mov rdx, qword [rdi + 0x10]
mov qword [rsp + 0x1d0], rdx
mov rcx, rdi
call fcn.1400e3230
mov qword [rax], rbx
lea rcx, [rsp + 0x580]
call fcn.1400e3d44
mov ebx, dword [rsp + 0x20]
lea rcx, [rsp + 0x520]
call fcn.1400d4d54
nop
lea rax, [rsp + 0x5a0]
mov qword [rsp + 0x1d8], rax
lea rcx, [rsp + 0x5a0]
call fcn.1400e56c0
lea rcx, [rsp + 0x5a0]
call fcn.1400e57e0
jmp 0x1400e2915
lea rcx, [rsp + 0x880]
call fcn.1400dc700
nop
lea rcx, [rsp + 0x5a0]
call fcn.1400dc700
nop
lea rcx, [rsp + 0x710]
call fcn.1400dc700
nop
cmp byte [rsp + 0x558], 0
je 0x1400e2d7a
lea rax, [rsp + 0x540]
mov qword [rsp + 0x1e0], rax
lea rcx, [rsp + 0x540]
call fcn.1400d4d54
nop
mov eax, dword [rsp + 0x518]
mov dword [rsp + 0x38], eax
jmp 0x1400e2d8e
mov rcx, qword [rsp + 0x9f0]
xor rcx, rsp
call fcn.140109af0
lea r11, [rsp + 0xa00]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x60]
call fcn.1400e5134
lea rdx, [0x1401a17e8]
lea rcx, [rsp + 0x60]
call fcn.14010d940
int3