Function at 0x14008a150
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
cmp qword [rdx + 0x88], 2
je 0x14008ab15
mov r13, rdx
mov r12, rcx
mov eax, dword [rdx + 0x258]
mov rsi, qword [rdx + 0x238]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0xc0], rax
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0xc0]
mov r8d, 0x3000
mov r9d, 4
call fcn.14008adb0
cmp eax, 0xb
je 0x14008a1e4
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0xc0]
mov r8d, 0x3000
mov r9d, 4
call fcn.14008adb0
cmp eax, 0xb
jne 0x14008a6a9
mov rbx, qword [r13 + 0x330]
mov rax, qword [r13 + 0x338]
mov qword [rsp + 0xa8], rax
test rax, rax
je 0x14008a245
mov rdi, qword [r13 + 0x438]
mov r14, qword [rsp + 0xa8]
shl r14, 6
xor r15d, r15d
nop word cs:[rax + rax]
mov edx, dword [rbx + r15 + 0x2c]
add rdx, rdi
mov ecx, dword [rbx + r15 + 0x24]
mov r8d, dword [rbx + r15 + 0x28]
add rcx, qword [rsp + 0x20]
call fcn.1400ea9f0
add r15, 0x40
cmp r14, r15
jne 0x14008a220
cmp qword [r13 + 0x100], 0
je 0x14008ab15
mov r14, qword [rsp + 0x20]
mov rax, r14
sub rax, rsi
je 0x14008a342
mov ecx, dword [r13 + 0x110]
test ecx, ecx
je 0x14008a342
cmp dword [r13 + 0x114], 0
je 0x14008a342
add rcx, r14
mov edx, 1
mov r8d, dword [rcx + 4]
test r8, r8
jne 0x14008a2b3
jmp 0x14008a334
xor r8d, r8d
add rcx, r8
mov r8d, dword [rcx + 4]
test r8, r8
je 0x14008a334
cmp r8d, 0xa
jb 0x14008a324
lea r9, [r8 - 8]
shr r9, 0x3f
add r8, r9
add r8, 0xfffffffffffffff8
sar r8, 1
cmp r8, 2
cmovl r8, rdx
xor r9d, r9d
jmp 0x14008a2e8
inc r9
cmp r8, r9
je 0x14008a320
movzx r10d, word [rcx + r9*2 + 8]
mov r11d, r10d
and r11d, 0xf000
cmp r11d, 0xa000
jne 0x14008a2e0
mov r11d, dword [rcx]
and r10d, 0xfff
add r10, r11
add qword [r14 + r10], rax
jmp 0x14008a2e0
mov r8d, dword [rcx + 4]
add rcx, r8
mov r8d, dword [rcx + 4]
test r8, r8
jne 0x14008a2b3
cmp dword [rcx], 0
jne 0x14008a2a0
mov r14, qword [rsp + 0x20]
cmp qword [r13 + 0xa0], 0
je 0x14008ab15
cmp dword [r13 + 0xb4], 0
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0x78], r12
je 0x14008a705
mov esi, dword [r13 + 0xb0]
test esi, esi
je 0x14008a705
add rsi, r14
lea rax, [r14 + 2]
mov qword [rsp + 0xb8], rax
mov r12d, dword [rsi + 0xc]
test r12, r12
jne 0x14008a3b0
cmp dword [rsi + 0x10], 0
jne 0x14008a3b0
cmp dword [rsi], 0
jne 0x14008a3b0
cmp dword [rsi + 4], 0
jne 0x14008a3b0
cmp dword [rsi + 8], 0
je 0x14008a6f8
nop dword [rax]
add r12, r14
mov rcx, r12
call fcn.1400de720
lea r8, [rax + 1]
lea rcx, [rsp + 0x48]
mov rdx, r12
call fcn.1400d7360
cmp qword [rsp + 0x48], 0
jne 0x14008a6c0
mov r12, qword [rsp + 0x58]
test r12, r12
js 0x14008ab2f
mov r13, qword [rsp + 0x50]
je 0x14008a420
movzx eax, byte [0x140120b70]
mov r15d, 1
mov edx, 1
mov rcx, r12
call fcn.14004bac0
test rax, rax
je 0x14008ab42
mov rdi, rax
jmp 0x14008a425
mov edi, 1
mov rcx, rdi
mov rdx, r13
mov r8, r12
call fcn.1400ea9f0
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x28]
mov qword [rsp + 0xc8], rax
lea rax, [0x1400118a0]
mov qword [rsp + 0xd0], rax
lea rax, [0x1401005f0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 2
mov qword [rsp + 0x68], 0
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x48]
call fcn.1400cd360
mov rdi, qword [rsp + 0x88]
mov rcx, rdi
call sub.KERNEL32.dll_LoadLibraryA
mov r13, rax
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14008a4da
mov r8d, 1
mov rcx, rdi
call fcn.14004bad0
test r13, r13
mov r15, r13
mov r12, qword [rsp + 0x40]
cmove r15, r12
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x14008a503
mov rcx, qword [rsp + 0x30]
mov r8d, 1
call fcn.14004bad0
test r13, r13
mov rdi, qword [rsp + 0xb8]
je 0x14008a6dc
mov eax, dword [rsi]
mov qword [rsp + 0xd8], rsi
mov ecx, dword [rsi + 0x10]
add rcx, r14
lea rdx, [r14 + rax]
test rax, rax
mov qword [rsp + 0x40], rcx
cmove rdx, rcx
mov qword [rsp + 0xe0], rdx
mov r13, qword [rdx]
test r13, r13
je 0x14008a680
xor r12d, r12d
jmp 0x14008a58e
movzx edx, r13w
mov rcx, r15
call sub.KERNEL32.dll_GetProcAddress
mov rcx, rax
test rax, rax
je 0x14008a6d2
mov rdx, qword [rsp + 0x40]
mov qword [rdx + r12], rcx
mov rcx, qword [rsp + 0xe0]
mov r13, qword [rcx + r12 + 8]
add r12, 8
mov rbp, rax
test r13, r13
je 0x14008a683
test r13, r13
js 0x14008a550
cmp byte [rdi + r13], 0
je 0x14008a680
add r13, rdi
mov rcx, r13
call fcn.1400de720
lea r8, [rax + 1]
lea rcx, [rsp + 0x48]
mov rdx, r13
call fcn.1400d7360
cmp qword [rsp + 0x48], 0
jne 0x14008a6c0
mov r13, qword [rsp + 0x58]
test r13, r13
js 0x14008ab03
mov rsi, r15
mov r15, qword [rsp + 0x50]
je 0x14008a610
movzx eax, byte [0x140120b70]
mov edi, 1
mov edx, 1
mov rcx, r13
call fcn.14004bac0
test rax, rax
je 0x14008ab17
mov rdi, qword [rsp + 0xb8]
jmp 0x14008a615
mov eax, 1
mov rcx, rax
mov rdx, r15
mov r8, r13
mov r15, rax
call fcn.1400ea9f0
mov qword [rsp + 0x80], r13
mov qword [rsp + 0xb0], r15
mov qword [rsp + 0x88], r15
mov qword [rsp + 0x90], r13
lea rcx, [rsp + 0x28]
mov r15, rsi
mov rdx, rsi
lea r8, [rsp + 0x80]
call fcn.14008acb0
cmp dword [rsp + 0x28], 0
jne 0x14008a6c7
mov rcx, qword [rsp + 0x30]
mov rax, rbp
jmp 0x14008a568
mov rax, rbp
mov rsi, qword [rsp + 0xd8]
add rsi, 0x14
mov qword [rsp + 0x40], r15
mov rbp, rax
mov r12d, dword [rsi + 0xc]
test r12, r12
jne 0x14008a3b0
jmp 0x14008a392
mov dword [r12 + 4], eax
mov dword [r12 + 8], edx
mov dword [r12], 1
jmp 0x14008aadf
mov eax, 5
jmp 0x14008a6e1
mov eax, dword [rsp + 0x2c]
mov r12d, dword [rsp + 0x30]
jmp 0x14008a6e1
mov eax, 2
mov r12d, ebp
jmp 0x14008a6e1
mov eax, 1
mov rcx, qword [rsp + 0x78]
mov dword [rcx + 4], eax
mov dword [rcx + 8], r12d
mov dword [rcx], 1
jmp 0x14008aadf
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0xa0]
cmp byte [r13 + 0x499], 0
je 0x14008a969
cmp qword [r13 + 0xd0], 0
je 0x14008a969
mov ebp, dword [r13 + 0xe4]
test ebp, ebp
je 0x14008a969
mov esi, dword [r13 + 0xe0]
lea rax, [0x1400f3ea5]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rdx, 0x3bb7a42b6558afaf
mov qword [rsp + 0x48], rdx
mov rdx, qword [rsp + 0x48]
call fcn.14008abc0
mov r15, qword [rax]
mov edi, dword [rax + 8]
movzx eax, byte [0x140120b70]
mov ecx, 0xc
mov edx, 1
call fcn.14004bac0
test rax, rax
je 0x14008ab5a
xor edi, 0x8f5e7ace
movabs rcx, 0xfa935370d51270f6
xor r15, rcx
mov qword [rax], r15
mov dword [rax + 8], edi
mov qword [rsp + 0x28], 0xc
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0xc
lea rax, [rsp + 0x28]
mov qword [rsp + 0xc8], rax
lea rax, [0x1400118a0]
mov qword [rsp + 0xd0], rax
lea rax, [0x1401005f0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 2
mov qword [rsp + 0x68], 0
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
lea rcx, [rsp + 0x80]
lea r12, [rsp + 0x48]
mov rdx, r12
call fcn.1400cd360
mov rdi, qword [rsp + 0x88]
mov rcx, rdi
call sub.KERNEL32.dll_LoadLibraryA
mov r15, rax
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14008a84e
mov r8d, 1
mov rcx, rdi
call fcn.14004bad0
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x14008a868
mov rcx, qword [rsp + 0x30]
mov r8d, 1
call fcn.14004bad0
test r15, r15
je 0x14008a969
mov qword [rsp + 0x40], rsi
lea rax, [0x1400fb3fd]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
movabs rax, 0x45768957e9781b12
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
call fcn.14008ac60
mov r13, qword [rax]
mov r12, qword [rax + 8]
movzx edi, word [rax + 0x10]
movzx esi, byte [rax + 0x12]
movzx eax, byte [0x140120b70]
mov ecx, 0x13
mov edx, 1
call fcn.14004bac0
test rax, rax
je 0x14008ab69
shl esi, 0x10
or edi, esi
mov ecx, edi
shr ecx, 0x10
xor cl, 0xa
mov edx, edi
shr edx, 8
xor dl, 0x37
xor dil, 0x15
movabs r8, 0xda086a10ab4d2f42
xor r12, r8
movabs r8, 0xa12987e854d8dd51
xor r13, r8
mov qword [rax], r13
mov qword [rax + 8], r12
mov byte [rax + 0x10], dil
mov byte [rax + 0x11], dl
mov byte [rax + 0x12], cl
mov qword [rsp + 0x48], 0x13
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x13
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0x48]
mov rdx, r15
call fcn.14008acb0
cmp dword [rsp + 0x80], 0
jne 0x14008a969
mov rcx, qword [rsp + 0x40]
add rcx, r14
mov eax, ebp
mov edx, 0xaaaaaaab
imul rdx, rax
shr rdx, 0x23
mov r8, r14
call qword [rsp + 0x88]
mov r15, qword [rsp + 0xa8]
test r15, r15
je 0x14008aa62
add rbx, 8
shl r15, 6
movabs rdi, 0x8000000000000000
mov ebp, 1
mov r12d, 0x10
lea rsi, [rsp + 0x80]
lea r14, [rsp + 0x28]
jmp 0x14008aa04
mov r13d, dword [rbx + 0x34]
mov eax, r13d
shr eax, 0x1f
mov r8d, r13d
shr r8d, 0x1a
and r8d, 0xffffffe0
add r8d, 0x20
test r13d, 0x40000000
lea eax, [rax + rax + 2]
cmove eax, ebp
cmove r8d, r12d
test r13d, 0x20000000
cmove r8d, eax
mov rcx, rsi
mov rdx, r14
call fcn.14008b100
cmp eax, 0xb
jne 0x14008aaf3
add rbx, 0x40
add r15, 0xffffffffffffffc0
je 0x14008aa62
mov eax, dword [rbx + 0x20]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14008a9fa
mov eax, dword [rbx + 0x1c]
add rax, qword [rsp + 0x20]
mov qword [rsp + 0x80], rax
cmp qword [rbx], rdi
je 0x14008a9b0
lea rcx, [rsp + 0x48]
mov rdx, rbx
call fcn.1400cd120
mov rdx, qword [rsp + 0x48]
mov r13d, dword [rbx + 0x34]
lea rax, [rdx*2]
test rax, rax
je 0x14008a9b4
mov rcx, qword [rsp + 0x50]
mov r8d, 1
call fcn.14004bad0
jmp 0x14008a9b4
mov rsi, qword [rsp + 0x20]
mov rax, qword [rsp + 0xa0]
cmp qword [rax + 0x160], 0
je 0x14008aad0
cmp dword [rax + 0x174], 0
mov rbx, qword [rsp + 0x78]
je 0x14008aad5
mov eax, dword [rax + 0x170]
test eax, eax
je 0x14008aad5
mov rdi, qword [rsi + rax + 0x18]
mov rax, qword [rdi]
test rax, rax
je 0x14008aad5
add rdi, 8
nop word cs:[rax + rax]
mov rcx, rsi
mov edx, 2
xor r8d, r8d
call rax
mov rax, qword [rdi]
add rdi, 8
test rax, rax
jne 0x14008aab0
mov rsi, qword [rsp + 0x20]
jmp 0x14008aad5
mov rbx, qword [rsp + 0x78]
mov qword [rbx + 8], rsi
mov dword [rbx], 0
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x78]
mov dword [rcx + 4], eax
mov dword [rcx + 8], edx
jmp 0x14008a6ed
xor edi, edi
mov rcx, rdi
mov rdx, qword [rsp + 0xb0]
call fcn.14006d9c0
ud2
mov qword [rsp + 0xb0], r13
mov rcx, rdi
mov rdx, qword [rsp + 0xb0]
call fcn.14006d9c0
xor r15d, r15d
mov rcx, r15
mov rdx, qword [rsp + 0x98]
call fcn.14006d9c0
mov qword [rsp + 0x98], r12
mov rcx, r15
mov rdx, qword [rsp + 0x98]
call fcn.14006d9c0
mov ecx, 1
mov edx, 0xc
call fcn.14006d9c0
mov ecx, 1
mov edx, 0x13
call fcn.14006d9c0
int3