Function at 0x2a3ec18e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
movzx ebx, word [section..rdata]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rdi, rcx
mov ebp, edx
mov qword [rsp + 0x58], 0
mov rax, qword [rax + 0x20]
mov r11, qword [rax]
mov r10, qword [r11 - 0x10]
lea r9, [r11 - 0x10]
cmp r11, r10
je 0x2a3ec1970
nop dword [rax]
mov rax, qword [r9 + 0x60]
lea rcx, [rax + 2]
movzx eax, word [rax]
test ax, ax
je 0x2a3ec1965
mov edx, 0x2108
nop dword [rax]
mov r8d, edx
add rcx, 2
shl r8d, 6
add edx, r8d
add edx, eax
movzx eax, word [rcx - 2]
test ax, ax
jne 0x2a3ec1940
cmp edx, 0xfcdfbd0e
je 0x2a3ec1b71
mov r9, r10
mov r10, qword [r9]
cmp r11, r10
jne 0x2a3ec1928
xor eax, eax
mov qword [rsp + 0x60], rax
lea rsi, [rsp + 0x60]
xor r8d, r8d
xor r9d, r9d
mov rax, qword [0x2a3f887f0]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
lea rdx, [0x2a3f82002]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x68], rax
call fcn.2a3ec2560
mov r8d, ebp
mov r11, qword [rsp + 0x58]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov r12, qword [rax]
mov rbp, qword [r12 - 0x10]
lea r10, [r12 - 0x10]
cmp r12, rbp
je 0x2a3ec1a48
mov rax, qword [r10 + 0x60]
lea rcx, [rax + 2]
movzx eax, word [rax]
test ax, ax
je 0x2a3ec1a3d
mov edx, 0x2108
nop dword [rax]
mov r9d, edx
add rcx, 2
shl r9d, 6
add edx, r9d
add edx, eax
movzx eax, word [rcx - 2]
test ax, ax
jne 0x2a3ec1a18
cmp edx, 0xfcdfbd0e
je 0x2a3ec1bd7
mov r10, rbp
mov rbp, qword [r10]
cmp r12, rbp
jne 0x2a3ec1a00
xor eax, eax
mov qword [rsp + 0x60], rax
xor r9d, r9d
mov rdx, rdi
mov rcx, r11
mov rax, qword [0x2a3f887e0]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x68], rax
call fcn.2a3ec2560
mov r10, qword [rsp + 0x58]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov rdi, qword [rax]
mov r11, qword [rdi - 0x10]
lea r9, [rdi - 0x10]
cmp rdi, r11
je 0x2a3ec1b10
nop dword [rax]
mov rax, qword [r9 + 0x60]
lea rcx, [rax + 2]
movzx eax, word [rax]
test ax, ax
je 0x2a3ec1b05
mov edx, 0x2108
nop dword [rax]
mov r8d, edx
add rcx, 2
shl r8d, 6
add edx, r8d
add edx, eax
movzx eax, word [rcx - 2]
test ax, ax
jne 0x2a3ec1ae0
cmp edx, 0xfcdfbd0e
je 0x2a3ec1ba7
mov r9, r11
mov r11, qword [r9]
cmp rdi, r11
jne 0x2a3ec1ac8
xor eax, eax
mov qword [rsp + 0x60], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rax, qword [0x2a3f887d0]
mov qword [rsp + 0x20], rsi
mov rcx, r10
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x68], rax
call fcn.2a3ec2560
nop
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov edx, dword [r9 + 0x40]
mov rax, qword [r9 + 0x30]
cmp edx, 2
je 0x2a3ec1970
sub edx, 3
lea rdx, [rax + rdx + 1]
nop word [rax + rax]
cmp word [rax], bx
je 0x2a3ec1972
add rax, 1
cmp rdx, rax
jne 0x2a3ec1b90
jmp 0x2a3ec1970
mov edx, dword [r9 + 0x40]
mov rax, qword [r9 + 0x30]
cmp edx, 2
je 0x2a3ec1b10
sub edx, 3
lea rdx, [rax + rdx + 1]
cmp word [rax], bx
je 0x2a3ec1b12
add rax, 1
cmp rdx, rax
jne 0x2a3ec1bc0
jmp 0x2a3ec1b10
mov edx, dword [r10 + 0x40]
mov rax, qword [r10 + 0x30]
cmp edx, 2
je 0x2a3ec1a48
sub edx, 3
lea rdx, [rax + rdx + 1]
cmp word [rax], bx
je 0x2a3ec1a4a
add rax, 1
cmp rdx, rax
jne 0x2a3ec1bf0
jmp 0x2a3ec1a48