Function at 0x1400130c0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
sub rsp, 0x698
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x10a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [0x1400400a5]
call fcn.140011dc0
cmp qword [0x140029210], 0
jbe 0x140013100
mov eax, 1
jmp 0x140013af1
call fcn.140011a9b
test eax, eax
jne 0x140013110
xor eax, eax
jmp 0x140013af1
call fcn.140011762
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0x108], 0
mov qword [rbp + 0x128], 0
mov qword [rbp + 0x148], 0
mov qword [rbp + 0x168], 0
mov qword [rbp + 0x188], 0
mov rax, qword [rbp + 0xe8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0xe8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x128]
cmp dword [rax], 0x4550
jne 0x140013206
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x128]
cmp dword [rcx + rax + 0x8c], 0
jbe 0x140013206
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x128]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rbp + 0xe8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rbp + 0xe8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x148], rax
mov rax, qword [rbp + 0x108]
mov eax, dword [rax + 0x24]
mov rcx, qword [rbp + 0xe8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x188], rax
lea rcx, [0x140029218]
call fcn.1400114bf
mov rax, qword [0x140029208]
mov qword [rbp + 0xc8], rax
mov r9, qword [rbp + 0xe8]
mov r8, qword [rbp + 0xc8]
lea rdx, [0x140029210]
lea rcx, str.0x_p__SyscallList_n0x_p__Ntdll_base_n0x_p__Ntdll_real_base_n
call fcn.140011636
mov rax, qword [rbp + 0xc8]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140013261
xor eax, eax
jmp 0x140013af1
mov rax, qword [rbp + 0x68]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0xc8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
cmp dword [rax], 0x4550
je 0x140013293
xor eax, eax
jmp 0x140013af1
mov qword [0x140035230], 1
mov eax, 0x10
imul rax, rax, 0
lea rcx, [0x140035238]
mov rdx, qword [rbp + 0xc8]
mov qword [rcx + rax], rdx
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x88]
mov eax, dword [rcx + rax + 0x8c]
mov rcx, qword gs:[0x30]
mov rcx, qword [rcx + 0x60]
mov r8d, eax
mov edx, 8
mov rcx, qword [rcx + 0x30]
call fcn.1400117f8
mov qword [rbp + 0x1a8], rax
cmp qword [rbp + 0x1a8], 0
jne 0x140013306
xor eax, eax
jmp 0x140013af1
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x88]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rbp + 0xc8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xa8], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x88]
mov eax, dword [rcx + rax + 0x8c]
mov r8d, eax
mov rdx, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0x1a8]
call fcn.140011668
mov rax, qword [rbp + 0x1a8]
mov qword [rbp + 0x48], rax
mov rdx, qword [rbp + 0x48]
lea rcx, str.0x_p__pImageExportDirectory_n
call fcn.140011636
mov rdx, qword [rbp + 0x1a8]
lea rcx, str.0x_p__lpLocalAddress_n
call fcn.140011636
mov qword [rbp + 0x228], 0
mov qword [rbp + 0x248], 0
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rbp + 0xc8]
add rcx, rax
mov rax, rcx
sub rax, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0x1a8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x1c8], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x20]
mov rcx, qword [rbp + 0xc8]
add rcx, rax
mov rax, rcx
sub rax, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0x1a8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x1e8], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x24]
mov rcx, qword [rbp + 0xc8]
add rcx, rax
mov rax, rcx
sub rax, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0x1a8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x208], rax
lea rax, [0x140029218]
mov qword [rbp + 0x268], rax
mov dword [rbp + 0x284], 0
mov byte [rbp + 0x2a4], 0
mov byte [rbp + 0x2c4], 0
lea rcx, str.____Hooked_Ntdll_Syscall_List:_n
call fcn.140011636
mov eax, 0x744e
mov word [rbp + 0x2e4], ax
mov eax, 0x775a
mov word [rbp + 0x2e6], ax
xor eax, eax
mov word [rbp + 0x304], ax
jmp 0x140013495
movzx eax, word [rbp + 0x304]
inc ax
mov word [rbp + 0x304], ax
movzx eax, word [rbp + 0x304]
cmp rax, 4
jae 0x140013a53
xor eax, eax
mov word [rbp + 0x324], ax
jmp 0x1400134c2
movzx eax, word [rbp + 0x324]
inc ax
mov word [rbp + 0x324], ax
movzx eax, word [rbp + 0x324]
mov rcx, qword [rbp + 0x48]
cmp eax, dword [rcx + 0x18]
jae 0x140013a33
mov byte [rbp + 0x2a4], 0
movzx eax, word [rbp + 0x324]
mov rcx, qword [rbp + 0x1e8]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 0xc8]
add rcx, rax
mov rax, rcx
sub rax, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0x1a8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x228], rax
movzx eax, word [rbp + 0x324]
mov rcx, qword [rbp + 0x208]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rbp + 0x1c8]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 0xc8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x248], rax
cmp qword [rbp + 0x108], 0
je 0x1400135da
mov rax, qword [rbp + 0xe8]
cmp qword [rbp + 0xc8], rax
je 0x1400135da
mov rax, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x108]
mov ecx, dword [rcx + 0x18]
cmp dword [rax + 0x18], ecx
jne 0x1400135da
movzx eax, word [rbp + 0x324]
mov rcx, qword [rbp + 0x188]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rbp + 0x148]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 0xe8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x348], rax
mov rax, qword [rbp + 0x348]
cmp qword [rbp + 0x248], rax
je 0x1400135c3
mov dword [rbp + 0x654], 1
jmp 0x1400135cd
mov dword [rbp + 0x654], 0
movzx eax, byte [rbp + 0x654]
mov byte [rbp + 0x2c4], al
lea rdx, str.RtlAllocateHeap
mov rcx, qword [rbp + 0x228]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x140013600
mov rax, qword [rbp + 0x248]
mov qword [0x140029200], rax
mov rax, qword [rbp + 0x228]
movzx eax, word [rax]
movzx ecx, word [rbp + 0x304]
movzx ecx, word [rbp + rcx*2 + 0x2e4]
cmp eax, ecx
je 0x140013622
jmp 0x1400134b1
mov rax, qword [rbp + 0x228]
add rax, 2
mov rcx, rax
call fcn.140011771
mov qword [rbp + 0x368], rax
movabs rax, 0x66c71bd1b0714d3e
cmp qword [rbp + 0x368], rax
jne 0x140013654
jmp 0x1400134b1
movabs rax, 0x8ad1c604a65844a5
cmp qword [rbp + 0x368], rax
je 0x1400136d9
movabs rax, 0x7af7191d67000db5
cmp qword [rbp + 0x368], rax
je 0x1400136d9
movabs rax, 0x852e6b87b62c2cf0
cmp qword [rbp + 0x368], rax
je 0x1400136d9
movabs rax, 0xf4ce15c0758b33f
cmp qword [rbp + 0x368], rax
je 0x1400136d9
movabs rax, 0x989246e5a13fcbd9
cmp qword [rbp + 0x368], rax
je 0x1400136d9
movabs rax, 0x8599a0e7f8a94577
cmp qword [rbp + 0x368], rax
je 0x1400136d9
movabs rax, 0xeda779755029a0a
cmp qword [rbp + 0x368], rax
jne 0x1400136e0
mov byte [rbp + 0x2a4], 1
movzx eax, byte [rbp + 0x2a4]
test eax, eax
jne 0x14001373e
movabs rax, 0xdcaa9bf058531500
cmp qword [rbp + 0x368], rax
je 0x140013737
movabs rax, 0xb1c15967b96c5e5d
cmp qword [rbp + 0x368], rax
je 0x140013737
movabs rax, 0xe6ebb45b4d604b1d
cmp qword [rbp + 0x368], rax
je 0x140013737
movabs rax, 0x172ecad8537a0f66
cmp qword [rbp + 0x368], rax
jne 0x14001373e
mov byte [rbp + 0x2a4], 1
mov rcx, qword [rbp + 0x248]
call fcn.1400145a0
mov qword [rbp + 0x388], rax
cmp qword [rbp + 0x388], 0xffffffffffffffff
jne 0x140013760
jmp 0x1400134b1
mov rcx, qword [rbp + 0x248]
call fcn.1400144e0
mov qword [rbp + 0x3a8], rax
cmp qword [rbp + 0x3a8], 0
jne 0x140013782
jmp 0x1400134b1
mov byte [rbp + 0x3c4], 0
mov dword [rbp + 0x3e4], 0
jmp 0x1400137a3
mov eax, dword [rbp + 0x3e4]
inc eax
mov dword [rbp + 0x3e4], eax
mov eax, dword [rbp + 0x3e4]
cmp rax, qword [0x140029210]
jae 0x1400137da
mov eax, dword [rbp + 0x3e4]
imul rax, rax, 0x30
mov rcx, qword [rbp + 0x268]
mov rdx, qword [rbp + 0x248]
cmp qword [rcx + rax + 8], rdx
jne 0x1400137d8
mov byte [rbp + 0x3c4], 1
jmp 0x140013795
movzx eax, byte [rbp + 0x3c4]
test eax, eax
je 0x1400137ea
jmp 0x1400134b1
mov eax, dword [rbp + 0x284]
imul rax, rax, 0x30
mov rcx, qword [rbp + 0x268]
mov rdx, qword [rbp + 0x248]
mov qword [rcx + rax + 8], rdx
mov eax, dword [rbp + 0x284]
imul rax, rax, 0x30
mov rcx, qword [rbp + 0x268]
mov rdx, qword [rbp + 0x388]
mov qword [rcx + rax], rdx
mov eax, dword [rbp + 0x284]
imul rax, rax, 0x30
mov rcx, qword [rbp + 0x268]
mov rdx, qword [rbp + 0x3a8]
mov qword [rcx + rax + 0x10], rdx
mov eax, dword [rbp + 0x284]
imul rax, rax, 0x30
mov rcx, qword [rbp + 0x268]
mov rdx, qword [rbp + 0x368]
mov qword [rcx + rax + 0x20], rdx
movzx eax, byte [rbp + 0x2a4]
test eax, eax
jne 0x14001389f
movzx eax, byte [rbp + 0x2c4]
test eax, eax
jne 0x14001389f
mov rax, qword [rbp + 0x248]
movzx eax, byte [rax]
cmp eax, 0xe9
je 0x14001389f
mov rax, qword [rbp + 0x248]
movzx eax, byte [rax + 3]
cmp eax, 0xe9
je 0x14001389f
mov byte [rbp + 0x654], 0
jmp 0x1400138a6
mov byte [rbp + 0x654], 1
mov eax, dword [rbp + 0x284]
imul rax, rax, 0x30
movzx ecx, byte [rbp + 0x654]
mov rdx, qword [rbp + 0x268]
mov dword [rdx + rax + 0x28], ecx
mov eax, dword [rbp + 0x284]
imul rax, rax, 0x30
mov rcx, qword [rbp + 0x268]
cmp dword [rcx + rax + 0x28], 0
je 0x140013906
mov rax, qword [rbp + 0x228]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x248]
mov r8, qword [rbp + 0x388]
mov edx, dword [rbp + 0x284]
lea rcx, str.______Entries__03lu__SSN__0x_04X__Address__0x_p:__s_n
call fcn.140011636
movabs rax, 0x8ad1c604a65844a5
cmp qword [rbp + 0x368], rax
jne 0x14001392b
mov edx, dword [rbp + 0x284]
xor ecx, ecx
call fcn.140011d5c
jmp 0x140013a0d
movabs rax, 0x7af7191d67000db5
cmp qword [rbp + 0x368], rax
jne 0x140013953
mov edx, dword [rbp + 0x284]
mov ecx, 1
call fcn.140011d5c
jmp 0x140013a0d
movabs rax, 0x852e6b87b62c2cf0
cmp qword [rbp + 0x368], rax
jne 0x14001397b
mov edx, dword [rbp + 0x284]
mov ecx, 2
call fcn.140011d5c
jmp 0x140013a0d
movabs rax, 0xf4ce15c0758b33f
cmp qword [rbp + 0x368], rax
jne 0x1400139a0
mov edx, dword [rbp + 0x284]
mov ecx, 3
call fcn.140011d5c
jmp 0x140013a0d
movabs rax, 0x989246e5a13fcbd9
cmp qword [rbp + 0x368], rax
jne 0x1400139c5
mov edx, dword [rbp + 0x284]
mov ecx, 4
call fcn.140011d5c
jmp 0x140013a0d
movabs rax, 0x8599a0e7f8a94577
cmp qword [rbp + 0x368], rax
jne 0x1400139ea
mov edx, dword [rbp + 0x284]
mov ecx, 5
call fcn.140011d5c
jmp 0x140013a0d
movabs rax, 0xeda779755029a0a
cmp qword [rbp + 0x368], rax
jne 0x140013a0d
mov edx, dword [rbp + 0x284]
mov ecx, 6
call fcn.140011d5c
mov eax, dword [rbp + 0x284]
inc eax
mov dword [rbp + 0x284], eax
cmp dword [rbp + 0x284], 0x200
jne 0x140013a29
jmp 0x140013a33
jmp 0x1400134b1
mov eax, dword [rbp + 0x284]
mov qword [0x140029210], rax
cmp dword [rbp + 0x284], 0x200
jne 0x140013a4e
jmp 0x140013a53
jmp 0x140013484
cmp qword [0x140029210], 7
jae 0x140013aa2
lea rcx, str.______Getting_other_Ntdll_version_n
call fcn.140011636
call fcn.140011316
mov qword [rbp + 0x408], rax
cmp qword [rbp + 0x408], 0
je 0x140013aa2
mov rax, qword [rbp + 0xc8]
cmp qword [rbp + 0x408], rax
je 0x140013aa2
mov rax, qword [rbp + 0x408]
mov qword [rbp + 0xc8], rax
jmp 0x140013241
mov rdx, qword [0x140029210]
lea rcx, str.______Mapped__lld_functions_n
call fcn.140011636
cmp qword [0x140029210], 0
jbe 0x140013acb
lea rcx, [0x1400114b5]
call fcn.1400118cf
cmp qword [0x140029210], 0
jbe 0x140013ae1
mov dword [rbp + 0x654], 1
jmp 0x140013aeb
mov dword [rbp + 0x654], 0
mov eax, dword [rbp + 0x654]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1400252a0]
call fcn.140011b31
mov rax, rdi
lea rsp, [rbp + 0x668]
pop rdi
pop rbp
ret