Function at 0x1400aee04
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0x98
mov rax, qword [0x1401a7d98]
xor rax, rsp
mov qword [rbp - 1], rax
mov rax, qword [rbp + 0x77]
xor ebx, ebx
mov rsi, qword [rbp + 0x7f]
mov r11, r8
mov qword [rbp - 0x39], r9
mov r12, rdx
mov qword [rbp - 0x59], r8
mov rdi, rcx
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x41], rsi
mov dword [rbp - 9], ebx
test r8, r8
jne 0x1400aee57
int3
test r9, r9
jne 0x1400aee5d
int3
test rax, rax
jne 0x1400aee63
int3
and qword [rax], rbx
xor r14d, r14d
mov qword [rbp - 0x51], r14
cmp byte [rsi], bl
je 0x1400aeeaf
call fcn.1400af818
cmp r12, rax
jbe 0x1400aeeaf
mov rcx, rdi
call fcn.1400af7cc
test al, al
jne 0x1400aeeaf
mov rcx, rdi
call fcn.1400af818
mov rdx, r12
mov r9, rsi
sub rdx, rax
xor r8d, r8d
mov rcx, rdi
call fcn.1400af570
test eax, eax
js 0x1400af03f
mov r11, qword [rbp - 0x59]
mov rsi, qword [rdi + 8]
lea r13, [r11 + r12]
movabs rax, 0x1000000000000
mov r15, r12
shr r15, 0x24
cmp r13, rax
cmova r13, rax
sub rsi, qword [rdi]
sar rsi, 3
shr r13, 0x24
lea rax, [rsi - 1]
cmp r13, rax
jbe 0x1400aefb8
lea rdx, [r13 + 1]
mov rcx, rdi
call fcn.1400ae3c4
test eax, eax
js 0x1400af03f
mov r14, qword [rdi]
mov rax, qword [rdi + 8]
sub rax, r14
sar rax, 3
cmp rsi, rax
jae 0x1400aefb1
mov rax, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rax + 0x30]
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
test rax, rax
je 0x1400aef41
and qword [rax], rbx
and qword [rax + 8], rbx
and qword [rax + 0x10], rbx
cmp qword [r14 + rsi*8], rbx
je 0x1400aef48
int3
mov qword [r14 + rsi*8], rax
test rax, rax
je 0x1400aef70
mov r14, qword [rdi]
inc rsi
mov rax, qword [rdi + 8]
sub rax, r14
sar rax, 3
cmp rsi, rax
jb 0x1400aef12
mov ebx, dword [rbp - 9]
mov r14, qword [rbp - 0x51]
jmp 0x1400aefb4
lea rax, str.onecore_basexml_stream_bufferedstream.cpp
mov dword [rbp - 0x19], 0x2e9
mov qword [rbp - 0x29], rax
lea rcx, [rbp - 0x29]
lea rax, str.CIndex_class_Windows::Auto_class_CIndex_class_Windows::Auto_class_CIndex_class_Windows::Auto_struct__LBLOB__12_12____12_24____12_36_::WriteAt
mov r8d, 0xc0000017
mov qword [rbp - 0x21], rax
lea rax, str._this__Index_.Allocate__
mov qword [rbp - 0x11], rax
call fcn.1400c81b4
mov eax, 0xc0000017
jmp 0x1400af03f
mov r14, rbx
mov r11, qword [rbp - 0x59]
cmp r15, r13
ja 0x1400af036
mov rsi, qword [rbp - 0x41]
movabs rdx, 0x1000000000
and qword [rbp - 0x49], 0
mov r8, r11
mov rax, qword [rdi]
movabs rcx, 0xfffffffff
mov r9, qword [rbp - 0x39]
add r9, r14
mov qword [rsp + 0x28], rsi
cmp r11, rdx
cmova r8, rdx
mov rdx, r12
and rdx, rcx
lea rcx, [rbp - 0x49]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax + r15*8]
call fcn.1400aea44
test eax, eax
js 0x1400af03f
mov rax, qword [rbp - 0x49]
inc r15
mov r11, qword [rbp - 0x59]
add r14, rax
sub r11, rax
add r12, rax
mov qword [rbp - 0x59], r11
movabs rdx, 0x1000000000
cmp r15, r13
jbe 0x1400aefcb
mov rax, qword [rbp - 0x31]
mov qword [rax], r14
mov eax, ebx
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.140109af0
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret