Function at 0x1400e15d0
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
push r15
push r13
push r12
push r14
push rsi
push rbx
push rdi
sub rsp, 0x1b8
mov word [rsp + 0x1b2], 0xc36c
mov rax, qword [rsp + 0x1a0]
mov byte [rsp + 0x19f], 0x96
mov cl, byte [rsp + 0x1af]
mov dword [rsp + 0x198], 0x6ad33866
mov edx, dword [rsp + 0x1b4]
imul r8d, edx, 0x7472f5f1
mov dword [rsp + 0x1b4], r8d
mov qword [rsp + 0x190], 0x5acff7b9
mov r9w, word [rsp + 0x1b2]
mov r10w, 0x2de1
sub r10w, r9w
movzx r8d, word [rsp + 0x1b0]
mov r9w, r8w
mov word [rsp + 0xfc], r10w
mov r11b, cl
add r11b, 0xa
mov byte [rsp + 0x1af], r11b
mov esi, dword [rsp + 0x198]
mov edi, 0xcfffb61b
sub edi, esi
mov dword [rsp + 0x174], edi
mov rbx, qword [rsp + 0x190]
mov r14, rbx
xor r14, 0x51a59af
mov qword [rsp + 0x108], r14
mov esi, 0xbf009df2
mov r14d, esi
sub r14, rbx
mov qword [rsp + 0x178], r14
lea rbx, [rsp + 0x130]
mov byte [rsp + 0x1af], 0x81
lea r14, [rsp + 0x90]
mov r11b, byte [rsp + 0x19f]
xor r11b, 0xfd
mov byte [rsp + 0x130], r11b
mov r11b, byte [rsp + 0x19f]
mov bpl, 0xfb
sub bpl, r11b
mov byte [rsp + 0x131], bpl
mov esi, edx
not esi
mov r11b, byte [rsp + 0x19f]
mov dword [rsp + 0x1b4], esi
add r11b, 0xdc
mov byte [rsp + 0x132], r11b
mov r15, qword [rsp + 0x108]
mov r11b, byte [rsp + 0x19f]
xor r11b, 0xf8
mov byte [rsp + 0x133], r11b
mov r11b, byte [rsp + 0x19f]
add r11b, 0xcf
mov esi, edx
add esi, 0x9750da58
mov dword [rsp + 0x1b4], esi
mov byte [rsp + 0x134], r11b
mov word [rsp + 0x1b0], 0xbeef
mov qword [rsp + 0x1a0], 0x573abeae
mov r11b, byte [rsp + 0x19f]
xor r11b, 0xfa
mov byte [rsp + 0x135], r11b
mov r11b, byte [rsp + 0x19f]
xor r11b, 0xa5
mov byte [rsp + 0x136], r11b
mov esi, edx
or esi, 0xe25ffb9
mov dword [rsp + 0x1b4], esi
mov r11b, byte [rsp + 0x19f]
imul r12, rax, 0x3135def
mov qword [rsp + 0x1a0], r12
mov bpl, 0xc8
sub bpl, r11b
mov byte [rsp + 0x137], bpl
mov word [rsp + 0x1b0], 0
mov r11b, byte [rsp + 0x19f]
mov bpl, cl
xor bpl, 0x54
mov byte [rsp + 0x1af], bpl
mov bpl, 0xc4
sub bpl, r11b
mov byte [rsp + 0x138], bpl
mov r11b, byte [rsp + 0x19f]
add r11b, 0xce
and r8d, 0x32b7
mov r10w, r8w
mov word [rsp + 0x1b0], r10w
mov byte [rsp + 0x139], r11b
mov r8d, edx
add r8d, 0x2b02e48a
mov dword [rsp + 0x1b4], r8d
mov r11b, byte [rsp + 0x19f]
mov byte [rsp + 0x1af], 0x68
add r11b, 0xd6
mov bpl, cl
and bpl, 0x76
mov byte [rsp + 0x1af], bpl
mov byte [rsp + 0x13a], r11b
mov dword [rsp + 0x1b4], edx
mov r11b, byte [rsp + 0x19f]
mov bpl, 2
sub bpl, r11b
mov byte [rsp + 0x13b], bpl
mov r11b, cl
or r11b, 0xb7
mov byte [rsp + 0x1af], r11b
mov r11b, byte [rsp + 0x19f]
mov qword [rsp + 0x1a0], 0x16cadaf1
xor r11b, 0x96
mov byte [rsp + 0x13c], r11b
mov r11b, cl
and r11b, 0x7e
mov bpl, byte [rsp + 0x19f]
mov byte [rsp + 0x1af], r11b
xor bpl, 0xa6
mov r8d, 0x864bdacc
mov r12d, r8d
mov qword [rsp + 0x1a0], r12
mov byte [rsp + 0x13d], bpl
mov r12, rax
xor r12, 0xaf70be2
mov qword [rsp + 0x1a0], r12
movaps xmm0, xmmword [str.kernel32ntdll.dl]
movaps xmmword [rsp + 0x90], xmm0
mov r10w, word [rsp + 0x1b2]
mov r13w, 0xc39a
sub r13w, r10w
mov word [rsp + 0xa0], r13w
mov r11b, cl
not r11b
mov r10w, word [rsp + 0x1b2]
mov r13w, 0xc3d0
sub r13w, r10w
mov byte [rsp + 0x1af], r11b
mov word [rsp + 0xa2], r13w
mov r11b, cl
or r11b, 4
mov byte [rsp + 0x1af], r11b
mov r10w, word [rsp + 0x1b2]
xor r10w, 0xc300
mov word [rsp + 0xa4], r10w
mov r11b, cl
and r11b, 0xfe
mov byte [rsp + 0x1af], r11b
mov r10w, word [rsp + 0x1b2]
mov byte [rsp + 0x1af], 0xd7
mov r13w, 0xc3d8
sub r13w, r10w
mov qword [rsp + 0x1a0], 0
mov word [rsp + 0xa6], r13w
mov qword [rsp + 0x1a0], 0xc04d855
mov dword [rsp + 0x1b4], 0xb6038040
mov r10w, word [rsp + 0x1b2]
xor r10w, 0xc36c
mov word [rsp + 0xa8], r10w
imul r8d, edx, 0x33eec66d
mov dword [rsp + 0x1b4], r8d
mov r10w, word [rsp + 0x1b2]
mov r13w, 0xc39c
sub r13w, r10w
mov word [rsp + 0xaa], r13w
mov r12, rax
not r12
mov qword [rsp + 0x1a0], r12
mov word [rsp + 0xc4], 0
mov qword [rsp + 0xbc], 0
mov qword [rsp + 0xb4], 0
mov qword [rsp + 0xac], 0
mov r11b, 0xea
mov qword [rsp + 0x58], rax
mov al, cl
mul r11b
movsx r8d, byte [rsp + 0x14b]
mov r10w, r8w
mov byte [rsp + 0x1af], al
mov word [rsp + 0xc6], r10w
mov qword [rsp + 0x1a0], r12
mov al, byte [rsp + 0x14c]
mov r12, qword [rsp + 0x58]
mov qword [rsp + 0x1a0], r12
mov r8, qword [rsp + 0x190]
movsx esi, al
mov r10w, si
mov dword [rsp + 0x1b4], edx
xor r8, 0x292e69cf
cmp r15, r8
mov qword [rsp + 0x50], r14
mov byte [rsp + 0x4f], cl
mov dword [rsp + 0x48], edx
mov word [rsp + 0x46], r9w
mov qword [rsp + 0x38], rbx
mov word [rsp + 0x36], r10w
jne 0x1400e1d1e
jmp 0x1400e1c00
mov ax, word [rsp + 0x66]
mov rcx, qword [rsp + 0x178]
movzx edx, ax
mov qword [rsp + 0x28], rcx
mov ecx, edx
call fcn.1400e2200
mov ecx, 0xb779cbf7
mov r8d, ecx
mov qword [rsp + 0x1a0], r8
mov r8, qword [rsp + 0x190]
xor r8, 0x1f9ba638
mov word [rsp + 0xde], ax
mov r9, qword [rsp + 0x28]
cmp r8, r9
jb 0x1400e1b6d
jmp 0x1400e21a6
mov rax, qword [rsp + 0x158]
mov rax, qword [rax]
mov qword [rsp + 0x1a0], 0x2b4778ca
mov rcx, qword [rsp + 0x58]
xor rcx, 0x30f05477
mov rdx, qword [rsp + 0x118]
mov qword [rsp + 0x1a0], rcx
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x110], 0
mov byte [rsp + 0x1af], 9
cmp rax, rdx
je 0x1400e2061
jmp 0x1400e20d9
mov rax, qword [rsp + 0x190]
mov cx, word [rsp + 0xde]
mov edx, dword [rsp + 0x48]
imul r8d, edx, 0x45078cfc
mov r9, qword [rsp + 0x100]
mov r10w, word [rsp + r9*2 + 0x90]
mov dword [rsp + 0x1b4], r8d
add rax, 0xffffffffa5300848
add rax, qword [rsp + 0x100]
mov qword [rsp + 0x128], rax
cmp r10w, cx
je 0x1400e21a6
jmp 0x1400e1b10
mov rax, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x68]
mov dx, word [rsp + 0x1b2]
xor dx, 0xc36c
mov r8w, word [rsp + rax*2 + 0x90]
mov qword [rsp + 0x110], rcx
cmp r8w, dx
je 0x1400e2061
jmp 0x1400e1b10
mov rax, qword [rsp + 0x168]
mov qword [rsp + 0x160], rax
jmp 0x1400e20d9
mov eax, dword [rsp + 0x48]
imul ecx, eax, 0x55854e07
mov dword [rsp + 0x1b4], ecx
mov rdx, qword [rsp + 0xe8]
mov r8b, byte [rsp + 0x4f]
mov byte [rsp + 0x1af], r8b
mov rax, rdx
add rsp, 0x1b8
pop rdi
pop rbx
pop rsi
pop r14
pop r12
pop r13
pop r15
pop rbp
ret
mov ax, word [rsp + 0x46]
and ax, 0x2e08
mov word [rsp + 0x1b0], ax
mov rcx, qword [rsp + 0x120]
mov word [rsp + 0x1b0], 0xdff7
mov rdx, qword [rsp + 0x190]
mov r8, qword [rsp + 0x190]
add rdx, 0x20c9899e
xor r8, 0x8d5cdb7
mov qword [rsp + 0x100], rcx
mov qword [rsp + 0x88], r8
mov r9b, byte [rsp + 0x4f]
or r9b, 0xf7
mov rcx, qword [rsp + 0x88]
mov byte [rsp + 0x1af], r9b
mov r8, qword [rsp + 0x180]
mov r9b, byte [rsp + 0x4f]
add r9b, r9b
mov byte [rsp + 0x1af], r9b
mov r10, qword [rsp + 0x100]
shl r10, 1
add r8, r10
mov r10, qword [rsp + 0x58]
add r10, 0x52f8c966
mov qword [rsp + 0x1a0], r10
mov qword [rsp + 0x80], r8
mov r9b, byte [rsp + 0x4f]
xor r9b, 0x81
mov byte [rsp + 0x1af], r9b
cmp rcx, rdx
jae 0x1400e1bc6
jmp 0x1400e1e88
movabs rax, 0x13c1c6cf3d8aa1fd
mov cx, word [rsp + 0x36]
mov word [rsp + 0xc8], cx
movsx edx, byte [rsp + 0x14d]
mov r8w, dx
mov word [rsp + 0xca], r8w
mov r9, qword [rsp + 0x58]
mov edx, r9d
and edx, 0x594632c8
mov r10d, edx
mov qword [rsp + 0x1a0], r10
movsx edx, byte [rsp + 0x14e]
mov r8w, dx
mov byte [rsp + 0x1af], 0x84
mov word [rsp + 0x1b0], 0x2058
mov edx, dword [rsp + 0x198]
xor edx, 0x6ad33856
mov word [rsp + 0xcc], r8w
mov r11b, byte [rsp + 0x14f]
movsx esi, r11b
mov r8w, si
mov word [rsp + 0x1b0], 0xaf6c
mov word [rsp + 0xce], r8w
mov qword [rsp + 0x20], rax
mov r10, qword gs:[edx]
mov r11b, byte [rsp + 0x4f]
mov byte [rsp + 0x1af], r11b
mov rax, qword [r10 + 0x60]
mov dword [rsp + 0x1b4], 0x3fc49fb2
mov edx, dword [rsp + 0x48]
or edx, edx
mov dword [rsp + 0x1b4], edx
mov rax, qword [rax + 0x18]
add rax, 0x20
mov qword [rsp + 0x1a0], 0x7eb7b3fb
mov qword [rsp + 0x118], rax
mov dword [rsp + 0x1b4], 0xbc1af8c9
mov rax, qword [rsp + 0x118]
mov byte [rsp + 0x1af], 0xa9
mov rax, qword [rax]
mov qword [rsp + 0x168], rax
mov qword [rsp + 0x1a0], 0xffffffff95a546ba
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x1a0], r9
mov r10, qword [rsp + 0x168]
mov rdi, qword [rsp + 0x20]
mov qword [rsp + 0x1a0], rdi
mov edx, dword [rsp + 0x48]
xor edx, 0xffffffff
mov dword [rsp + 0x1b4], edx
mov qword [rsp + 0x110], 0
cmp r10, rax
je 0x1400e2061
jmp 0x1400e1c00
mov al, byte [rsp + 0x4f]
or al, 0x1d
mov byte [rsp + 0x1af], al
mov rcx, qword [rsp + 0x80]
mov dx, word [rcx]
mov rcx, qword [rsp + 0x58]
xor rcx, 0x2b31039c
mov qword [rsp + 0x1a0], rcx
mov word [rsp + 0x66], dx
mov dx, word [rsp + 0x1b2]
xor dx, 0xc36c
cmp word [rsp + 0x66], dx
je 0x1400e1bc6
jmp 0x1400e1abe
mov ax, 0xc36c
mov ecx, 0x13c47809
mov edx, ecx
mov r8b, 0xc5
mov ecx, 0x6ab9b15d
mov r9d, ecx
mov r10, qword [rsp + 0x58]
sub r9, r10
mov qword [rsp + 0x1a0], r9
mov ecx, dword [rsp + 0x48]
imul ecx, ecx
mov r11w, word [rsp + 0x1b2]
mov dword [rsp + 0x1b4], ecx
mov r9, qword [rsp + 0xe0]
mov r9, qword [r9]
add r11w, 0x3c95
mov qword [rsp + 0x180], r9
mov bl, byte [rsp + 0x4f]
xor bl, 0xff
mov byte [rsp + 0x1af], bl
mov si, word [rsp + 0xfe]
mov ecx, dword [rsp + 0x48]
mov dword [rsp + 0x1b4], ecx
mov cx, r11w
shr si, cl
mov word [rsp + 0x76], si
mov cl, byte [rsp + 0x4f]
sub r8b, cl
mov r11w, word [rsp + 0x1b2]
mov byte [rsp + 0x1af], r8b
sub rdx, r10
mov si, word [rsp + 0x76]
sub ax, r11w
mov qword [rsp + 0x1a0], rdx
cmp si, ax
je 0x1400e1b10
movzx eax, word [rsp + 0x76]
mov ecx, eax
mov dl, byte [rsp + 0x4f]
add dl, 0x55
mov byte [rsp + 0x1af], dl
mov r8, qword [rsp + 0x190]
mov dl, byte [rsp + 0x4f]
or dl, dl
mov byte [rsp + 0x1af], dl
xor r8, 0x5acff7b9
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0x120], r8
jmp 0x1400e1c52
mov eax, 0xa7270309
mov cl, byte [rsp + 0x4f]
sub cl, 2
mov rdx, qword [rsp + 0x78]
mov rdx, qword [rdx]
mov byte [rsp + 0x1af], cl
mov qword [rsp + 0x68], rdx
mov rdx, qword [rsp + 0x158]
mov byte [rsp + 0x1af], 0xec
mov r8w, word [rdx + 0x48]
mov r9d, dword [rsp + 0x174]
mov r10d, dword [rsp + 0x48]
xor r10d, 0x17ea84a8
sub eax, dword [rsp + 0x198]
mov dword [rsp + 0x1b4], r10d
mov word [rsp + 0xfe], r8w
mov rdx, qword [rsp + 0x158]
mov word [rsp + 0x1b0], 0x6596
add rdx, 0x50
mov qword [rsp + 0xe0], rdx
cmp eax, r9d
jbe 0x1400e1ed6
jmp 0x1400e1f8e
mov eax, 0xcec0a7da
mov ecx, 0x80c0a3d6
mov edx, dword [rsp + 0x198]
mov r8d, dword [rsp + 0x48]
mov dword [rsp + 0x1b4], r8d
mov r9, qword [rsp + 0x110]
mov r10d, dword [rsp + 0x198]
sub ecx, edx
sub eax, r10d
mov qword [rsp + 0xe8], r9
mov r11w, word [rsp + 0x46]
or r11w, 0xe39b
mov word [rsp + 0x1b0], r11w
mov dword [rsp + 0x18c], ecx
mov ecx, dword [rsp + 0x18c]
mov r9, qword [rsp + 0x58]
mov qword [rsp + 0x1a0], r9
cmp ecx, eax
je 0x1400e1bc6
jmp 0x1400e1c15
mov ax, word [rsp + 0x46]
sub ax, ax
mov rcx, qword [rsp + 0x160]
mov word [rsp + 0x1b0], ax
mov qword [rsp + 0x158], rcx
mov dl, byte [rsp + 0x4f]
mov byte [rsp + 0x1af], dl
mov rcx, qword [rsp + 0x158]
mov r8, qword [rsp + 0x58]
xor r8, 0x46a13339
mov qword [rsp + 0x1a0], r8
mov r9d, dword [rsp + 0x48]
xor r9d, 0xffffffff
add rcx, 0x20
mov ax, word [rsp + 0x1b2]
mov dword [rsp + 0x1b4], r9d
mov r10w, word [rsp + 0xfc]
mov r8, qword [rsp + 0x58]
xor r8, 0x391ee789
mov r11, qword [rsp + 0x190]
xor r11, 0x3efd24a
add ax, 0x2824
mov qword [rsp + 0x1a0], r8
mov qword [rsp + 0x78], rcx
mov rcx, qword [rsp + 0x58]
imul r8, rcx, 0x1343e3f4
mov qword [rsp + 0x1a0], r8
mov qword [rsp + 0x120], r11
add dl, dl
mov byte [rsp + 0x1af], dl
cmp r10w, ax
jne 0x1400e1fd4
jmp 0x1400e1c52
mov rax, qword [rsp + 0x128]
mov rcx, qword [rsp + 0xf0]
mov rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x128]
mov byte [rsp + 0x1af], 0x9e
mov qword [rsp + 0x120], r8
mov qword [rsp + 0x110], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x1a0], rdx
cmp rax, rcx
jb 0x1400e1c52
jmp 0x1400e2061