Function at 0x14001b110
Capabilities:
Load ntoskrnl
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1400a3c40]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, rdx
mov r14, qword [0x1408e97c0]
mov ebx, reloc.WS2_32.dll_recv
mov rax, qword gs:[0x58]
add rbx, qword [rax]
xor edi, edi
mov eax, dword [rbx]
cmp dword [0x1408e99e0], eax
jle 0x14001b1fe
lea rcx, [0x1408e99e0]
call fcn.14005bf78
cmp dword [0x1408e99e0], 0xffffffff
jne 0x14001b1fe
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], recv
mov byte [rsp + 0x20], dil
lea r8d, [rdi + 0xc]
lea rdx, [0x140091748]
lea rcx, [rsp + 0x20]
call fcn.140003650
nop
lea rcx, [rsp + 0x20]
call fcn.140019f10
mov qword [0x1408e99c0], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14001b1f2
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b1ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b3d0
call fcn.14005c324
nop
lea rcx, [0x1408e99e0]
call fcn.14005bf18
mov eax, dword [rbx]
cmp dword [0x1408e99dc], eax
jle 0x14001b243
lea rcx, [0x1408e99dc]
call fcn.14005bf78
cmp dword [0x1408e99dc], 0xffffffff
jne 0x14001b243
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140091748]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [0x1408e99a8], rax
lea rcx, [0x1408e99dc]
call fcn.14005bf18
mov eax, dword [rbx]
cmp dword [0x1408e997c], eax
jle 0x14001b27c
lea rcx, [0x1408e997c]
call fcn.14005bf78
cmp dword [0x1408e997c], 0xffffffff
jne 0x14001b27c
mov rax, qword [0x1408e99a8]
mov qword [0x1408e9980], rax
lea rcx, [0x1408e997c]
call fcn.14005bf18
mov ecx, 0x5a4d
mov rax, qword [0x1408e9980]
cmp word [rax], cx
je 0x14001b297
mov rcx, rdi
mov eax, edi
jmp 0x14001b378
mov eax, dword [rbx]
cmp dword [0x1408e99f0], eax
jle 0x14001b2db
lea rcx, [0x1408e99f0]
call fcn.14005bf78
cmp dword [0x1408e99f0], 0xffffffff
jne 0x14001b2db
mov rax, qword [0x1408e9980]
movsxd rcx, dword [rax + 0x3c]
add rcx, qword [0x1408e99a8]
mov qword [0x1408e99b0], rcx
lea rcx, [0x1408e99f0]
call fcn.14005bf18
mov rax, qword [0x1408e99b0]
cmp dword [rax], 0x4550
jne 0x14001b28d
mov ebx, dword [rax + 0x50]
movdqa xmm0, xmmword [0x140092870]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x78737850
mov dword [rsp + 0x34], 0x78757853
mov rsi, qword [0x1408e99a8]
add rbx, rsi
mov rax, rbx
mov rcx, rbx
sub rcx, rsi
cmp rcx, 0xc
jl 0x14001b36a
lea r11, [rbx - 0xc]
mov r10, rsi
nop dword [rax + rax]
mov r8, r10
lea rcx, [rsp + 0x20]
nop dword [rax + rax]
movzx r9d, word [rcx]
movzx edx, r9w
shr dx, 8
cmp dl, 0x3f
je 0x14001b356
cmp byte [r8], r9b
jne 0x14001b3c3
inc r8
add rcx, 2
lea rdx, [rsp + 0x38]
cmp rcx, rdx
jne 0x14001b340
mov rax, r10
mov rcx, rdi
cmp rax, rbx
cmovne rcx, rax
mov eax, ecx
sub eax, esi
mov r8d, dword [rcx + 1]
mov r10d, eax
add r8, qword [0x1408e99c0]
add r10, 5
add r8, r10
mov r9, rbp
mov rcx, r14
call fcn.1400100c0
test al, al
setne dil
mov eax, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14005bdd0
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
cmp r10, r11
je 0x14001b36a
inc r10
jmp 0x14001b330
call fcn.140027658
nop
int3