Function at 0x140035930
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xa18]
sub rsp, 0xaf0
mov qword [rbp + 0x1e8], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movaps xmmword [rax - 0x38], xmm6
mov rbx, r9
mov rdi, r8
mov rsi, rdx
xor r12d, r12d
xorps xmm6, xmm6
movdqu xmmword [rbp + 0x20], xmm6
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
lea rcx, [rbp - 0x58]
call fcn.14003520c
nop
movq rax, xmm6
mov qword [rbp + 0x20], rax
cmp byte [rbp - 0x50], r12b
cmovne rax, qword [rbp - 0x58]
mov qword [rbp + 0x20], rax
mov rax, qword gs:[0x60]
movzx ecx, byte [rax + 0x123]
mov eax, dword [0x7ffe026c]
shl eax, 4
or eax, dword [0x7ffe0270]
shl eax, 4
or ecx, eax
cmp ecx, 0x630
jb 0x1400359f0
movabs rax, 0x20000000000
mov qword [rbp - 0x20], rax
lea r8, [rbp - 0x20]
xor edx, edx
lea rcx, [rbp + 0x28]
call fcn.140009700
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2000004
mov r9, rbx
mov r8, rdi
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.140003088
nop
lea rax, [rsp + 0x40]
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x50]
call fcn.140036e88
nop
lea r9, [rsp + 0x78]
lea r8, [rbp - 0x70]
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x60]
call fcn.14003581c
nop
mov rsi, qword [rbp - 0x60]
mov qword [rbp - 0x68], r12
mov rbx, qword [rbp - 0x48]
mov qword [rbp - 0x10], rbx
mov eax, dword [0x140071834]
mov dword gs:[0x68], eax
mov edi, 4
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 0x3000
lea r9, [rbp - 0x10]
xor r8d, r8d
lea rdx, [rbp - 0x68]
mov rcx, qword [rsp + 0x40]
call fcn.1400558a0
test eax, eax
js 0x140036289
mov rdx, qword [rbp - 0x68]
mov eax, dword [0x140071844]
mov dword gs:[0x68], eax
mov qword [rsp + 0x20], r12
mov r9, rbx
mov r8, rsi
mov rcx, qword [rsp + 0x40]
call fcn.1400558a0
test eax, eax
js 0x1400362ca
mov edx, dword [rbp - 0x70]
add rdx, 0xffff
and rdx, 0xffffffffffff0000
lea r8d, [rdi + 0x3c]
lea rcx, [rsp + 0x60]
call fcn.14000513c
nop
mov r9d, edi
or r8, 0xffffffffffffffff
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x60]
call fcn.1400051dc
nop
lea r9d, [rdi + 0x3c]
mov r8, qword [rsp + 0x40]
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.1400051dc
nop
mov r14, qword [rbp - 0x30]
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x58], rax
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x140036237
movsxd rbx, dword [rsi + 0x3c]
add rbx, rsi
cmp dword [rbx], 0x4550
jne 0x140036237
mov r13d, 0x10b
movzx eax, word [rbx + 0x18]
sub ax, r13w
mov ecx, 0xfeff
test cx, ax
jne 0x140036230
mov r8d, dword [rbx + 0x54]
mov rdx, rsi
mov rcx, r14
call fcn.140058d50
movzx edi, word [rbx + 0x14]
add rdi, 0x28
movzx r15d, r12w
mov eax, 1
cmp r12w, word [rbx + 6]
jae 0x140035bb6
add rdi, rbx
test dword [rdi + 0x14], 0xe0000000
je 0x140035ba7
cmp dword [rdi], r12d
je 0x140035ba7
mov r8d, dword [rdi]
mov edx, dword [rdi + 4]
add rdx, rsi
mov ecx, dword [rdi - 4]
add rcx, r14
call fcn.140058d50
mov eax, 1
add r15w, ax
add rdi, 0x28
cmp r15w, word [rbx + 6]
jb 0x140035b80
lea rax, sym.MZ_xW___H__OT_8NyUaVr_v8_0Iv85__E_ZR9g2
mov rdi, r14
sub rdi, rax
lea rdx, [0x140071930]
add rdi, rdx
mov rcx, rdi
mov r8d, 0x860
call fcn.140058d50
mov byte [rdi], 1
mov rax, qword gs:[0x30]
mov ecx, dword [rax + 0x40]
mov dword [rdi + 4], ecx
mov rax, qword [rbp - 0x68]
mov qword [rdi + 0x640], rax
mov rax, qword [rbp - 0x48]
mov qword [rdi + 0x648], rax
mov qword [rsp + 0x68], r12
mov eax, dword [0x140071830]
mov dword gs:[0x68], eax
lea r8, [rsp + 0x68]
mov edx, 0xf00ff
or rbx, 0xffffffffffffffff
mov rcx, rbx
call fcn.1400558a0
test eax, eax
js 0x14003631b
mov qword [rbp - 0x40], r12
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 0xf000e
lea r9, [rbp - 0x40]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x14003636b
mov rbx, qword [rbp - 0x40]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140035c82
call qword [0x140073728]
mov qword [rsp + 0x68], r12
mov qword [rdi + 0x10], rbx
test r14, r14
jne 0x140035c90
mov rcx, r12
jmp 0x140035c97
movsxd rcx, dword [r14 + 0x3c]
add rcx, r14
mov esi, r12d
mov eax, 0x20b
mov r15d, 8
cmp word [rcx + 0x18], r13w
je 0x140035cd6
cmp word [rcx + 0x18], ax
jne 0x140036411
mov r9, qword [rsp + 0x58]
mov r8, r9
sub r8, qword [rcx + 0x30]
cmp dword [rcx + 0x84], 5
jbe 0x140035d70
mov eax, 0xb0
jmp 0x140035cf3
mov eax, dword [rcx + 0x34]
mov r9, qword [rsp + 0x58]
mov r8, r9
sub r8, rax
cmp dword [rcx + 0x74], 5
jbe 0x140035d70
mov eax, 0xa0
test r8, r8
je 0x140035d70
mov r11d, dword [rax + rcx + 4]
test r11d, r11d
je 0x140035d70
mov edx, dword [rax + rcx]
add rdx, r14
test r11d, r11d
je 0x140035d70
mov ecx, dword [rdx + 4]
add esi, ecx
sub rcx, r15
shr rcx, 1
mov ebx, dword [rdx]
add rbx, r14
add rdx, r15
jmp 0x140035d59
dec ecx
movzx r10d, word [rdx]
movzx eax, r10w
mov r9d, 0xfff
and ax, r9w
movzx r9d, ax
add r9, rbx
shr r10d, 0xc
cmp r10d, 3
je 0x140035d52
cmp r10d, 0xa
jne 0x140035d55
add qword [r9], r8
jmp 0x140035d55
add dword [r9], r8d
add rdx, 2
test ecx, ecx
jne 0x140035d22
test rdx, rdx
je 0x140036411
cmp esi, r11d
jb 0x140035d0d
mov r9, qword [rsp + 0x58]
movsxd rax, dword [r14 + 0x3c]
mov qword [rax + r14 + 0x30], r9
mov eax, dword [0x1400718f8]
mov dword gs:[0x68], eax
mov qword [rsp + 0x20], r12
mov r9d, 0x30
lea r8, [rbp + 0x1f0]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call fcn.1400558a0
mov edx, 0xd0001b05
test eax, eax
js 0x1400363c5
mov rax, qword [rbp + 0x1f8]
test rax, rax
je 0x1400363c3
lea rbx, [rax + 0x10]
mov eax, dword [0x1400718dc]
mov dword gs:[0x68], eax
mov qword [rsp + 0x20], r12
mov r9, r15
lea r8, [rbp - 8]
mov rdx, rbx
mov rcx, qword [rsp + 0x40]
call fcn.1400558a0
test eax, eax
js 0x140036462
mov rax, qword [rbp - 8]
mov qword [rdi + 8], rax
mov eax, dword [0x140071844]
mov dword gs:[0x68], eax
mov qword [rsp + 0x20], r12
mov r9, r15
lea r8, [rsp + 0x58]
mov rdx, rbx
mov rcx, qword [rsp + 0x40]
call fcn.1400558a0
test eax, eax
js 0x1400364b2
mov rdi, qword [rdi + 8]
mov eax, dword [0x1400718dc]
mov dword gs:[0x68], eax
mov qword [rsp + 0x20], r12
mov r9d, 0x40
lea r8, [rbp + 0x220]
mov rdx, rdi
mov rcx, qword [rsp + 0x40]
call fcn.1400558a0
mov ebx, eax
test eax, eax
js 0x140035fa6
movsxd rsi, dword [rbp + 0x25c]
lea rdx, [rdi + rsi]
mov eax, dword [0x1400718dc]
mov dword gs:[0x68], eax
mov qword [rsp + 0x20], r12
mov r9d, 0x108
lea r8, [rbp + 0x260]
mov rcx, qword [rsp + 0x40]
call fcn.1400558a0
mov ebx, eax
test eax, eax
js 0x140035fa6
mov eax, 0x20b
cmp word [rbp + 0x278], ax
jne 0x140035ec3
lea rax, [rbp + 0x330]
mov ecx, 0xd0
jmp 0x140035ecf
lea rax, [rbp + 0x320]
mov ecx, 0xc0
lea rdx, [rsi + rcx]
cmp dword [rax + 4], r12d
je 0x140035fa3
cmp dword [rax], r12d
je 0x140035fa3
add rdi, rdx
mov qword [rbp], r15
mov qword [rbp + 0x60], rdi
mov r13d, 1
mov dword [rbp + 0xa20], r13d
mov eax, dword [0x140071848]
mov dword gs:[0x68], eax
lea rax, [rbp + 0xa20]
mov qword [rsp + 0x20], rax
lea r9d, [r13 + 3]
lea r8, [rbp]
lea rdx, [rbp + 0x60]
mov rcx, qword [rsp + 0x40]
call fcn.1400558a0
mov ebx, eax
mov esi, dword [rbp + 0xa20]
test eax, eax
js 0x140035fac
mov qword [rbp + 8], r12
mov eax, dword [0x140071844]
mov dword gs:[0x68], eax
mov qword [rsp + 0x20], r12
mov r9, r15
lea r8, [rbp + 8]
mov rdx, rdi
mov rcx, qword [rsp + 0x40]
call fcn.1400558a0
mov ebx, eax
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], rdi
mov dword [rsp + 0x70], r13d
mov eax, dword [0x140071848]
mov dword gs:[0x68], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, esi
lea r8, [rbp + 0x10]
lea rdx, [rbp + 0x18]
mov rcx, qword [rsp + 0x40]
call fcn.1400558a0
jmp 0x140035fac
mov ebx, r12d
mov r13d, 1
mov dword [rsp + 0x74], ebx
test ebx, ebx
js 0x140036502
lea r9, [rsp + 0x74]
mov r8, qword [rsp + 0x58]
mov rdx, r14
lea rcx, [rsp + 0x40]
call fcn.140004a0c
mov rdi, qword [rbp + 0x48]
mov qword [rbp + 0x48], r12
cmp qword [rbp - 0x30], r12
je 0x140035ffc
mov eax, dword [0x140071910]
mov dword gs:[0x68], eax
mov rdx, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x38]
call fcn.1400558a0
mov qword [rbp - 0x30], r12
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140036011
call qword [0x140073728]
mov qword [rsp + 0x60], r12
mov ebx, dword [rsp + 0x78]
add rbx, rdi
xor edx, edx
mov r8d, 0x670
lea rcx, [rbp + 0x370]
call fcn.140058aa0
mov dword [rbp + 0x3a0], 0x100003
mov eax, dword [0x140071810]
mov dword gs:[0x68], eax
lea rdx, [rbp + 0x370]
mov rcx, qword [rsp + 0x48]
call fcn.1400558a0
test eax, eax
js 0x140036552
mov word [rbp - 0x80], 0xb848
mov word [rbp - 0x76], 0xe0ff
mov qword [rbp - 0x7e], rbx
mov rbx, qword [rbp + 0x3f0]
mov r9d, 0x40
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1400368a4
mov edi, eax
mov ecx, dword [0x140071844]
mov dword gs:[0x68], ecx
mov qword [rsp + 0x20], r12
mov r9d, 0xc
lea r8, [rbp - 0x80]
mov rdx, rbx
mov rcx, qword [rsp + 0x40]
call fcn.1400558a0
test eax, eax
js 0x1400361df
mov r9d, edi
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1400368a4
lea rcx, [rsp + 0x48]
call fcn.140006524
mov byte [rbp + 0x58], r13b
mov eax, dword [0x140071880]
mov dword gs:[0x68], eax
xor edx, edx
or rcx, 0xffffffffffffffff
call fcn.1400558a0
nop
cmp qword [rbp - 0x60], r12
je 0x140036113
mov rax, qword gs:[0x60]
mov r8, qword [rbp - 0x60]
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop
cmp byte [rbp + 0x58], r12b
jne 0x140036136
mov rcx, qword [rbp + 0x50]
mov eax, dword [0x140071880]
mov dword gs:[0x68], eax
xor edx, edx
mov rcx, qword [rcx]
call fcn.1400558a0
nop
lea rax, [rsp + 0x48]
mov qword [rbp + 0xa20], rax
cmp byte [rsp + 0x54], r12b
jne 0x140036151
cmp qword [rsp + 0x48], 0xfffffffffffffffe
jne 0x140036156
mov qword [rsp + 0x48], r12
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14003616b
call qword [0x140073728]
mov qword [rsp + 0x48], r12
lea rax, [rsp + 0x40]
mov qword [rbp + 0xa20], rax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14003618c
call qword [0x140073728]
mov qword [rsp + 0x40], r12
cmp byte [rbp - 0x50], r12b
je 0x1400361b0
lea rax, [rbp - 0x58]
mov qword [rbp + 0xa20], rax
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1400361b0
call qword [0x140073728]
mov qword [rbp - 0x58], r12
lea rcx, [rbp + 0x28]
call fcn.140008f5c
lea r11, [rsp + 0xaf0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rcx, vtable.std::exception.0
mov qword [rbp + 0x188], rcx
xor eax, eax
mov qword [rbp + 0x190], rax
mov qword [rbp + 0x198], rax
lea rcx, [0x140080360]
mov qword [rbp + 0x188], rcx
mov dword [rbp + 0x1a0], 0xd0001f01
mov dword [rbp + 0x1a4], r12d
lea rdx, [0x1400a01c0]
lea rcx, [rbp + 0x188]
call fcn.140058c30
nop
mov eax, 0xc000035a
jmp 0x14003623c
mov eax, 0xc000007b
lea rcx, vtable.std::exception.0
mov qword [rbp + 0x1c8], rcx
xor ecx, ecx
mov qword [rbp + 0x1d0], rcx
mov qword [rbp + 0x1d8], rcx
lea rcx, [0x140080360]
mov qword [rbp + 0x1c8], rcx
mov dword [rbp + 0x1e0], eax
mov dword [rbp + 0x1e4], r12d
lea rdx, [0x1400a01c0]
lea rcx, [rbp + 0x1c8]
call fcn.140058c30
nop
lea rcx, vtable.std::exception.0
mov qword [rbp + 0x68], rcx
xor ecx, ecx
mov qword [rbp + 0x70], rcx
mov qword [rbp + 0x78], rcx
lea rcx, [0x140080360]
mov qword [rbp + 0x68], rcx
mov dword [rbp + 0x80], 0xd0001f00
mov dword [rbp + 0x84], eax
lea rdx, [0x1400a01c0]
lea rcx, [rbp + 0x68]
call fcn.140058c30
int3
lea rcx, vtable.std::exception.0
mov qword [rbp + 0x88], rcx
xor eax, eax
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], rax
lea rcx, [0x140080360]
mov qword [rbp + 0x88], rcx
mov dword [rbp + 0xa0], 0xd0001f01
mov dword [rbp + 0xa4], r12d
lea rdx, [0x1400a01c0]
lea rcx, [rbp + 0x88]
call fcn.140058c30
nop
lea rcx, vtable.std::exception.0
mov qword [rbp + 0xa8], rcx
xor ecx, ecx
mov qword [rbp + 0xb0], rcx
mov qword [rbp + 0xb8], rcx
lea rcx, [0x140080360]
mov qword [rbp + 0xa8], rcx
mov dword [rbp + 0xc0], 0xd0001b16
mov dword [rbp + 0xc4], eax
lea rdx, [0x1400a01c0]
lea rcx, [rbp + 0xa8]
call fcn.140058c30
nop
mov eax, dword gs:[0x68]
lea rcx, vtable.std::exception.0
mov qword [rbp + 0xc8], rcx
xor ecx, ecx
mov qword [rbp + 0xd0], rcx
mov qword [rbp + 0xd8], rcx
lea rcx, [0x140080360]
mov qword [rbp + 0xc8], rcx
mov dword [rbp + 0xe0], 0xd0001903
mov dword [rbp + 0xe4], eax
lea rdx, [0x1400a01c0]
lea rcx, [rbp + 0xc8]
call fcn.140058c30
nop
mov eax, edx
lea rcx, vtable.std::exception.0
mov qword [rbp + 0x1a8], rcx
xor ecx, ecx
mov qword [rbp + 0x1b0], rcx
mov qword [rbp + 0x1b8], rcx
lea rcx, [0x140080360]
mov qword [rbp + 0x1a8], rcx
mov dword [rbp + 0x1c0], edx
mov dword [rbp + 0x1c4], eax
lea rdx, [0x1400a01c0]
lea rcx, [rbp + 0x1a8]
call fcn.140058c30
int3
lea rcx, vtable.std::exception.0
mov qword [rbp + 0xe8], rcx
xor eax, eax
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], rax
lea rcx, [0x140080360]
mov qword [rbp + 0xe8], rcx
mov dword [rbp + 0x100], 0xc0000269
mov dword [rbp + 0x104], r12d
lea rdx, [0x1400a01c0]
lea rcx, [rbp + 0xe8]
call fcn.140058c30
int3
lea rcx, vtable.std::exception.0
mov qword [rbp + 0x108], rcx
xor ecx, ecx
mov qword [rbp + 0x110], rcx
mov qword [rbp + 0x118], rcx
lea rcx, [0x140080360]
mov qword [rbp + 0x108], rcx
mov dword [rbp + 0x120], 0xd0001b06
mov dword [rbp + 0x124], eax
lea rdx, [0x1400a01c0]
lea rcx, [rbp + 0x108]
call fcn.140058c30
int3
lea rcx, vtable.std::exception.0
mov qword [rbp + 0x128], rcx
xor ecx, ecx
mov qword [rbp + 0x130], rcx
mov qword [rbp + 0x138], rcx
lea rcx, [0x140080360]
mov qword [rbp + 0x128], rcx
mov dword [rbp + 0x140], 0xd0001b07
mov dword [rbp + 0x144], eax
lea rdx, [0x1400a01c0]
lea rcx, [rbp + 0x128]
call fcn.140058c30
int3
lea rcx, vtable.std::exception.0
mov qword [rbp + 0x148], rcx
xor eax, eax
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x158], rax
lea rcx, [0x140080360]
mov qword [rbp + 0x148], rcx
mov dword [rbp + 0x160], 0xd0001313
mov dword [rbp + 0x164], ebx
lea rdx, [0x1400a01c0]
lea rcx, [rbp + 0x148]
call fcn.140058c30
nop
lea rcx, vtable.std::exception.0
mov qword [rbp + 0x168], rcx
xor ecx, ecx
mov qword [rbp + 0x170], rcx
mov qword [rbp + 0x178], rcx
lea rcx, [0x140080360]
mov qword [rbp + 0x168], rcx
mov dword [rbp + 0x180], 0xd0001604
mov dword [rbp + 0x184], eax
lea rdx, [0x1400a01c0]
lea rcx, [rbp + 0x168]
call fcn.140058c30
int3