Function at 0x1401b3500
Capabilities:
Access peb ldr_data
Hash data using djb2

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x218
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x190], 0xfffffffffffffffe
mov dword [rbp + 0x114], edx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
add rax, 0x10
jmp 0x1401b355f
mov r8d, 0x1505
cmp r8d, 0x1edab0ed
je 0x1401b35d3
mov rax, qword [rax]
mov rdx, qword [rax + 0x30]
test rdx, rdx
je 0x1401b4217
movzx edi, word [rax + 0x58]
test rdi, rdi
je 0x1401b3550
mov r9, qword [rax + 0x60]
mov r8d, 0x1505
xor r10d, r10d
nop word cs:[rax + rax]
movzx r11d, byte [r9 + r10]
test r11b, r11b
jne 0x1401b35a4
inc r10
cmp r10, rdi
jb 0x1401b3590
jmp 0x1401b3556
lea esi, [r11 - 0x20]
cmp r11b, 0x61
movzx r11d, r11b
movzx esi, sil
cmovb esi, r11d
mov r11d, r8d
shl r11d, 5
add r11d, r8d
movzx r8d, sil
add r8d, r11d
inc r10
cmp r10, rdi
jb 0x1401b3590
jmp 0x1401b3556
mov qword [rbp + 0x120], rcx
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x90], 0
mov byte [rbp + 0x18f], 1
lea rcx, [rbp + 0xa0]
call fcn.1401b49c0
mov rax, qword [rbp + 0xa0]
mov rcx, qword [rbp + 0xa8]
xor edx, edx
mov r8, rax
test rax, rax
setne dl
je 0x1401b3625
mov r8, qword [rbp + 0xb0]
mov qword [rbp + 0x38], rdx
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x58], rdx
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x70], rcx
mov qword [rbp + 0x78], r8
nop word cs:[rax + rax]
lea rcx, [rbp + 0xa0]
lea rdx, [rbp + 0x38]
call fcn.1401b5460
mov rax, qword [rbp + 0xa0]
test rax, rax
je 0x1401b3e52
mov rcx, qword [rbp + 0xb0]
lea r9, [rcx + rcx*2]
mov rdx, qword [rax + r9*8 + 8]
movabs r8, 0x8000000000000000
cmp rdx, r8
je 0x1401b3e52
mov r8, qword [rax + r9*8 + 0x10]
mov qword [rbp + 0x150], r8
mov r9, qword [rax + r9*8 + 0x18]
cmp r9, 2
jb 0x1401b36ce
mov r8, qword [rbp + 0x150]
movzx r8d, word [r8]
cmp r8d, 0x775a
je 0x1401b36ea
test rdx, rdx
je 0x1401b3660
mov r8d, 1
mov rcx, qword [rbp + 0x150]
call fcn.14002bee0
jmp 0x1401b3660
mov qword [rbp + 0x98], rdx
mov rax, qword [rax + rcx*8 + 0x110]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x138], 0
mov qword [rbp + 0x140], 1
mov qword [rbp + 0x148], 0
mov qword [rsp + 0x20], 2
lea rcx, [rbp + 0xa0]
mov rdx, qword [rbp + 0x150]
mov qword [rbp + 0x28], r9
mov r8, r9
lea r9, str.Zwcalled__Option::unwrap____on_a__None__value
call fcn.1401db1b0
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0xa8]
mov qword [rbp + 0x180], rax
mov rcx, qword [rbp + 0xb8]
mov r14, qword [rbp + 0xc0]
mov rbx, qword [rbp + 0xc8]
mov rax, qword [rbp + 0xd8]
mov qword [rbp + 0x178], rax
mov rdi, qword [rbp + 0xe8]
mov rsi, qword [rbp + 0xf0]
mov r12, qword [rbp + 0xf8]
mov r15, qword [rbp + 0x100]
mov eax, ecx
shr eax, 0x10
mov dword [rbp + 0x174], eax
lea rax, [r15 - 1]
mov qword [rbp + 0x128], rax
mov rax, rcx
mov qword [rbp + 0x160], rcx
and rax, 0xffffffffff00ff00
mov qword [rbp + 0x18], rax
lea rax, [r12 - 1]
mov qword [rbp + 0x20], rax
mov ecx, 1
xor edx, edx
xor eax, eax
mov qword [rbp + 0x158], rax
mov qword [rbp + 0x118], r14
jmp 0x1401b381d
mov r14, qword [rbp + 0x118]
mov rcx, qword [rbp + 0x140]
mov word [rcx + rdx], 0x744e
add rdx, 2
mov qword [rbp + 0x148], rdx
mov rax, qword [rbp + 0x168]
mov qword [rbp + 0x158], rax
mov qword [rbp + 0x130], rdx
cmp qword [rbp + 0x10], 0
je 0x1401b39b0
mov rax, qword [rbp + 0x128]
lea rdx, [rbx + rax]
cmp rdx, rsi
jae 0x1401b3db2
movzx eax, byte [rbp + 0x174]
shl rax, 0x10
movzx r8d, byte [rbp + 0x160]
or r8, qword [rbp + 0x18]
or r8, rax
cmp qword [rbp + 0x178], 0xffffffffffffffff
je 0x1401b39f0
mov r9, r15
sub r9, r8
mov r10d, 1
sub r10, qword [rbp + 0x180]
movzx eax, byte [rdi + rdx]
bt r14, rax
jb 0x1401b38c3
add rbx, r15
mov rax, qword [rbp + 0x128]
add rax, rbx
cmp rax, rsi
jae 0x1401b3db2
nop
movzx edx, byte [rdi + rax]
bt r14, rdx
jb 0x1401b38ba
add rbx, r15
add rax, r15
cmp rax, rsi
jb 0x1401b38a0
jmp 0x1401b3db2
xor eax, eax
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x180]
mov rax, qword [rbp + 0x178]
cmp rdx, rax
cmova rax, rdx
cmp rax, r15
jae 0x1401b3910
lea r11, [rdi + rbx]
mov rdx, rax
nop word cs:[rax + rax]
lea r13, [rbx + rdx]
cmp r13, rsi
jae 0x1401b41f9
movzx r13d, byte [r12 + rdx]
cmp r13b, byte [r11 + rdx]
jne 0x1401b3980
inc rdx
cmp r15, rdx
jne 0x1401b38f0
mov rax, qword [rbp + 0x180]
nop word [rax + rax]
cmp qword [rbp + 0x178], rax
jae 0x1401b3ae0
dec rax
cmp rax, r15
jae 0x1401b41de
lea rdx, [rax + rbx]
cmp rdx, rsi
jae 0x1401b41c7
movzx r11d, byte [r12 + rax]
cmp r11b, byte [rdi + rdx]
je 0x1401b3920
add rbx, r8
mov qword [rbp + 0x178], r9
mov rax, qword [rbp + 0x128]
lea rdx, [rbx + rax]
cmp rdx, rsi
jb 0x1401b387e
jmp 0x1401b3db2
add rbx, r10
add rbx, rdx
xor eax, eax
mov qword [rbp + 0x178], rax
mov rax, qword [rbp + 0x128]
lea rdx, [rbx + rax]
cmp rdx, rsi
jb 0x1401b387e
jmp 0x1401b3db2
cmp byte [rbp + 0x174], 0
jne 0x1401b3db2
mov rax, rsi
mov r13, qword [rbp + 0x180]
test r13, r13
je 0x1401b3b17
mov rax, rsi
sub rax, r13
jbe 0x1401b3b11
cmp byte [rdi + r13], 0xc0
jge 0x1401b3b17
jmp 0x1401b4236
mov r10, qword [rbp + 0x180]
lea rax, [r10 - 1]
cmp rax, r15
setb byte [rbp + 0x178]
mov r9, qword [rbp + 0x20]
add r10, r9
jmp 0x1401b3a26
add rbx, r15
mov rdx, qword [rbp + 0x128]
add rdx, rbx
cmp rdx, rsi
jae 0x1401b3db2
movzx edx, byte [rdi + rdx]
bt r14, rdx
jae 0x1401b3a10
cmp qword [rbp + 0x180], r15
jae 0x1401b3a73
mov rdx, rbx
not rdx
lea r11, [rdi + rbx]
mov r14, qword [rbp + 0x180]
nop word [rax + rax]
lea r13, [rbx + r14]
cmp r13, rsi
jae 0x1401b41f2
movzx r13d, byte [r12 + r14]
cmp r13b, byte [r11 + r14]
jne 0x1401b3ab8
inc r14
dec rdx
cmp r15, r14
jne 0x1401b3a50
test byte [rbp + 0x178], 1
je 0x1401b3d94
lea rdx, [rax + rbx]
mov r11, r10
mov r14, qword [rbp + 0x180]
nop
sub r14, 1
jb 0x1401b3af0
cmp rdx, rsi
jae 0x1401b41c7
movzx r13d, byte [r11]
dec r11
lea r9, [rdx - 1]
cmp r13b, byte [rdi + rdx]
mov rdx, r9
je 0x1401b3a90
add rbx, r8
jmp 0x1401b3abe
neg rdx
mov rbx, rdx
mov rdx, qword [rbp + 0x128]
add rdx, rbx
cmp rdx, rsi
mov r14, qword [rbp + 0x118]
jb 0x1401b3a26
jmp 0x1401b3db2
xor eax, eax
mov qword [rbp + 0x178], rax
jmp 0x1401b3afb
mov qword [rbp + 0x178], 0xffffffffffffffff
lea rax, [rbx + r15]
mov r13, rbx
mov rdx, rax
mov qword [rbp + 0x168], rax
mov rbx, rax
jmp 0x1401b3b75
jne 0x1401b4236
test rax, rax
je 0x1401b3b3d
movzx r8d, byte [rdi + r13]
movzx edx, r8b
test dl, dl
js 0x1401b3b88
mov eax, edx
cmp byte [rbp + 0x160], 0
jne 0x1401b3bf0
jmp 0x1401b3ccb
cmp byte [rbp + 0x160], 0
je 0x1401b3db2
mov rax, qword [rbp + 0x160]
xor al, 1
mov qword [rbp + 0x160], rax
mov dword [rbp + 0x174], 0
mov r13, qword [rbp + 0x180]
mov rax, r13
mov qword [rbp + 0x168], r13
mov rdx, qword [rbp + 0x130]
mov r14, qword [rbp + 0x158]
jmp 0x1401b3c29
mov eax, edx
and eax, 0x1f
movzx r9d, byte [rdi + r13 + 1]
and r9d, 0x3f
cmp dl, 0xe0
jb 0x1401b3bdd
movzx edx, byte [rdi + r13 + 2]
shl r9d, 6
and edx, 0x3f
or edx, r9d
cmp r8b, 0xf0
jb 0x1401b3cb9
movzx r8d, byte [rdi + r13 + 3]
and eax, 7
shl eax, 0x12
shl edx, 6
and r8d, 0x3f
or r8d, edx
or eax, r8d
cmp byte [rbp + 0x160], 0
jne 0x1401b3bf0
jmp 0x1401b3ccb
shl eax, 6
or eax, r9d
cmp byte [rbp + 0x160], 0
je 0x1401b3ccb
mov rdx, qword [rbp + 0x130]
mov r14, qword [rbp + 0x158]
mov rax, qword [rbp + 0x160]
xor al, 1
mov qword [rbp + 0x160], rax
mov dword [rbp + 0x174], 0
mov qword [rbp + 0x180], r13
mov rax, r13
mov qword [rbp + 0x168], r13
sub r13, r14
mov rax, qword [rbp + 0x138]
sub rax, rdx
cmp rax, r13
jae 0x1401b3c58
lea rcx, [rbp + 0x138]
mov r8, r13
call fcn.1401e2dc0
mov rcx, qword [rbp + 0x140]
mov rdx, qword [rbp + 0x148]
add r14, qword [rbp + 0x150]
add rcx, rdx
mov rax, r14
mov r14, rdx
mov rdx, rax
mov r8, r13
call fcn.1401dfb90
mov rdx, r14
add rdx, r13
mov qword [rbp + 0x148], rdx
mov rax, qword [rbp + 0x138]
sub rax, rdx
cmp rax, 1
ja 0x1401b37f0
mov r8d, 2
lea rcx, [rbp + 0x138]
call fcn.1401e2dc0
mov r14, qword [rbp + 0x118]
mov rdx, qword [rbp + 0x148]
jmp 0x1401b37f7
shl eax, 0xc
or eax, edx
cmp byte [rbp + 0x160], 0
jne 0x1401b3bf0
cmp eax, 0x110000
je 0x1401b3db2
mov edx, 1
cmp eax, 0x80
jb 0x1401b3cfc
mov edx, 2
cmp eax, 0x800
jb 0x1401b3cfc
cmp eax, 0x10000
mov edx, 4
sbb rdx, 0
mov rax, rsi
add rdx, qword [rbp + 0x180]
je 0x1401b3d21
mov rax, rsi
sub rax, rdx
jbe 0x1401b3d1b
cmp byte [rdi + rdx], 0xbf
jg 0x1401b3d21
jmp 0x1401b422f
jne 0x1401b422f
mov qword [rbp + 0x168], rdx
test rax, rax
mov rdx, qword [rbp + 0x130]
mov r14, qword [rbp + 0x158]
je 0x1401b3d60
mov rax, qword [rbp + 0x168]
movzx eax, byte [rdi + rax]
mov r8b, 1
mov qword [rbp + 0x160], r8
test al, al
js 0x1401b3d86
mov r13, qword [rbp + 0x168]
jmp 0x1401b3bfe
mov dword [rbp + 0x174], 0
mov r13, qword [rbp + 0x168]
mov qword [rbp + 0x180], r13
xor eax, eax
mov qword [rbp + 0x160], rax
jmp 0x1401b3c29
cmp al, 0xe0
mov r13, qword [rbp + 0x168]
jmp 0x1401b3bfe
mov qword [rbp + 0x178], 0xffffffffffffffff
cmp qword [rbp + 0x180], 0
je 0x1401b3afb
jmp 0x1401b41de
mov r8, qword [rbp + 0x28]
mov rbx, qword [rbp + 0x158]
sub r8, rbx
mov rax, qword [rbp + 0x138]
mov rdx, qword [rbp + 0x130]
sub rax, rdx
cmp rax, r8
jae 0x1401b3df6
lea rcx, [rbp + 0x138]
mov rsi, r8
call fcn.1401e2dc0
mov rcx, qword [rbp + 0x140]
mov rdx, qword [rbp + 0x148]
mov r8, rsi
add rbx, qword [rbp + 0x150]
add rcx, rdx
mov rdi, rdx
mov rdx, rbx
mov rsi, r8
call fcn.1401dfb90
add rdi, rsi
mov qword [rbp + 0xb0], rdi
movups xmm0, xmmword [rbp + 0x138]
movaps xmmword [rbp + 0xa0], xmm0
lea rcx, [rbp + 0x80]
lea rdx, [rbp + 0xa0]
mov r8, qword [rbp + 0x30]
call fcn.1401b51a0
mov rdx, qword [rbp + 0x98]
test rdx, rdx
jne 0x1401b36d3
jmp 0x1401b3660
mov byte [rbp + 0x18f], 1
lea rcx, [rbp + 0xa0]
lea rdx, [rbp + 0x38]
call fcn.1401b5460
mov rax, qword [rbp + 0xa0]
test rax, rax
je 0x1401b3eca
lea rsi, [rbp + 0xa0]
lea rdi, [rbp + 0x38]
mov rcx, qword [rbp + 0xb0]
lea rcx, [rcx + rcx*2]
mov rdx, qword [rax + rcx*8 + 8]
test rdx, rdx
je 0x1401b3eac
lea rax, [rax + rcx*8]
add rax, 8
mov rcx, qword [rax + 8]
mov r8d, 1
call fcn.14002bee0
mov byte [rbp + 0x18f], 1
mov rcx, rsi
mov rdx, rdi
call fcn.1401b5460
mov rax, qword [rbp + 0xa0]
test rax, rax
jne 0x1401b3e80
mov rcx, qword [rbp + 0x80]
test rcx, rcx
je 0x1401b3f1d
mov rdx, qword [rbp + 0x88]
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xb0], rcx
mov qword [rbp + 0xb8], rdx
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0xd0], rcx
mov qword [rbp + 0xd8], rdx
mov ecx, 1
jmp 0x1401b3f21
xor ecx, ecx
xor eax, eax
mov qword [rbp + 0xa0], rcx
mov qword [rbp + 0xc0], rcx
mov qword [rbp + 0xe0], rax
mov byte [rbp + 0x18f], 0
lea rcx, [rbp + 0x38]
lea rdx, [rbp + 0xa0]
call fcn.1401b4c90
mov rsi, qword [rbp + 0x40]
mov rbx, qword [rbp + 0x48]
lea rax, [rbp + 0x138]
mov qword [rbp + 0xa0], rax
mov byte [rbp + 0x18e], 1
lea r8, [rbp + 0xa0]
mov rcx, rsi
mov rdx, rbx
call fcn.1401b59a0
mov rdi, qword [rbp + 0x38]
mov r15, rbx
shl r15, 5
lea r14, [rsi + r15]
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xa8], rdi
mov qword [rbp + 0xb8], r14
mov r12, rsi
test rbx, rbx
je 0x1401b40a3
add r15, 0xffffffffffffffe0
lea rbx, [rsi + 0x28]
xor r13d, r13d
mov rax, rsi
jmp 0x1401b3fd7
inc r13d
add r15, 0xffffffffffffffe0
add rbx, 0x20
mov rax, r12
cmp r12, r14
je 0x1401b40e4
lea r12, [rax + 0x20]
mov rdx, qword [rax]
movabs rcx, 0x8000000000000000
cmp rdx, rcx
je 0x1401b40a3
mov qword [rbp + 0x180], rdx
mov rcx, qword [rax + 8]
mov qword [rbp + 0x178], rcx
mov rdx, qword [rax + 0x10]
mov ecx, 0x1505
test rdx, rdx
je 0x1401b4070
xor r8d, r8d
nop word cs:[rax + rax]
mov r9, qword [rbp + 0x178]
movzx r9d, byte [r9 + r8]
test r9b, r9b
jne 0x1401b403b
inc r8
cmp r8, rdx
jb 0x1401b4020
jmp 0x1401b4070
lea r10d, [r9 - 0x20]
cmp r9b, 0x61
movzx r9d, r9b
movzx r10d, r10b
cmovb r10d, r9d
mov r9d, ecx
shl r9d, 5
add r9d, ecx
movzx ecx, r10b
add ecx, r9d
inc r8
cmp r8, rdx
jb 0x1401b4020
nop dword [rax + rax]
cmp ecx, dword [rbp + 0x114]
je 0x1401b4111
mov rdx, qword [rbp + 0x180]
test rdx, rdx
je 0x1401b3fc0
mov r8d, 1
mov rcx, qword [rbp + 0x178]
call fcn.14002bee0
jmp 0x1401b3fc0
mov qword [rbp + 0xb0], r12
sub r14, r12
je 0x1401b40e4
shr r14, 5
add r12, 8
jmp 0x1401b40c9
add r12, 0x20
dec r14
je 0x1401b40e4
mov rdx, qword [r12 - 8]
test rdx, rdx
je 0x1401b40c0
mov rcx, qword [r12]
mov r8d, 1
call fcn.14002bee0
jmp 0x1401b40c0
test rdi, rdi
je 0x1401b40fe
shl rdi, 5
mov r8d, 8
mov rcx, rsi
mov rdx, rdi
call fcn.14002bee0
mov rax, qword [rbp + 0x120]
mov qword [rax], 0
jmp 0x1401b41b3
mov rcx, qword [rax + 0x18]
mov qword [rbp + 0xb0], r12
call fcn.1401b4580
test rax, rax
je 0x1401b4259
mov rax, qword [rbp + 0x120]
mov word [rax + 8], r13w
mov qword [rax + 0x10], rdx
mov qword [rax], 1
mov rdx, qword [rbp + 0x180]
test rdx, rdx
je 0x1401b415f
mov r8d, 1
mov rcx, qword [rbp + 0x178]
call fcn.14002bee0
cmp r14, r12
je 0x1401b4192
shr r15, 5
jmp 0x1401b4179
add rbx, 0x20
dec r15
je 0x1401b4192
mov rdx, qword [rbx - 8]
test rdx, rdx
je 0x1401b4170
mov rcx, qword [rbx]
mov r8d, 1
call fcn.14002bee0
jmp 0x1401b4170
test rdi, rdi
je 0x1401b41ac
shl rdi, 5
mov r8d, 8
mov rcx, rsi
mov rdx, rdi
call fcn.14002bee0
mov rax, qword [rbp + 0x120]
add rsp, 0x218
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r8, [0x14027d788]
mov rcx, rdx
mov rdx, rsi
call fcn.1401edaa0
jmp 0x1401b4271
lea r8, [0x14027d770]
mov rcx, rax
mov rdx, r15
call fcn.1401edaa0
jmp 0x1401b4271
mov rax, qword [rbp + 0x180]
add rbx, rax
cmp rsi, rbx
cmova rbx, rsi
lea r8, [0x14027d7a0]
mov rcx, rbx
mov rdx, rsi
call fcn.1401edaa0
jmp 0x1401b4271
lea rcx, str.Failed_to_get_loaded_module_by_nameC:Usersuser.cargogitcheckouts_syscalls_rs_2ef22f7ace249b7a_b3868d8_syscalls_src_syscall_resolve.rs
lea r8, [0x14027d860]
mov edx, 0x23
call fcn.1401ed860
mov qword [rbp + 0x180], rdx
lea rax, [0x14027d7b8]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, rsi
mov r8, qword [rbp + 0x180]
mov r9, rsi
call fcn.1401ee110
jmp 0x1401b4271
lea rcx, str.Failed_to_get_syscall_instruction_address_from_ntdll
lea r8, [0x14027d8b0]
mov edx, 0x34
call fcn.1401ed860
ud2