Function at 0x1408b3bc0
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
bswap ebp
sal bp, cl
not bp
push rbx
push rsi
push rdi
clc
sal bpl, 0xe4
push r12
and ebp, 0xbe01af3
sar bpl, 0x18
push r13
sub bpl, 0x91
push r14
movzx bp, dl
clc
push r15
bsr bp, si
bt ebp, 0x2a
ror bpl, cl
lea rbp, [rax - 0xae8]
cmp sp, r10w
sub rsp, 0xba8
jmp 0x1408b3c15
mov qword [rbp - 0x40], 0xfffffffffffffffe
jmp 0x1408b3c22
movaps xmmword [rax - 0x58], xmm6
mov rbx, rcx
movsx r8, r10w
ror ecx, 0x6e
xor edx, edx
movsx r8w, r13b
mov r8b, 5
movzx r8w, dl
mov r8d, 0x248
movzx ecx, r10w
movsx ecx, r11w
setl ch
lea rcx, [rbp + 0x160]
jmp 0x1408b3c5c
call fcn.1408c0e31
xor r14d, r14d
movsx rdx, ax
mov qword [rsp + 0x40], r14
cqo
movzx dx, cl
movzx ecx, di
mov rdx, rbx
bswap rcx
movzx ecx, si
mov ch, 0xe4
lea rcx, [rbp - 0x50]
jmp 0x1408b3c8b
call 0x140328550
movaps xmm6, xmmword [rbp - 0x50]
movaps xmmword [rsp + 0x50], xmm6
movd edi, xmm6
movzx edx, di
rcl rsi, cl
shr dx, 1
ror sil, 0xa1
setle sil
lea esi, [r14 + 1]
stc
test sil, 0x7e
sub dx, si
jmp 0x1408b3cc0
je 0x1408b3d49
mov rcx, qword [rbp - 0x48]
shl ah, cl
bt rax, 0x82
movzx eax, dx
clc
cmp word [rcx + rax*2], 0x5c
jmp 0x1408b3cdf
je 0x1408b3d08
cmp word [rcx + rax*2], 0x2f
je 0x1408b3d08
mov eax, 0xffff
add dx, ax
jmp 0x1408b3cfd
jne 0x1408b3cd1
jmp 0x1408b3d49
movzx eax, dx
lea rcx, [rcx + rax*2]
cmp r14d, 0xb8377a
add rcx, 2
cmp dl, dil
mov qword [rsp + 0x58], rcx
add dx, dx
sub di, dx
test r8b, 0x95
sub di, 2
mov word [rsp + 0x52], di
jmp 0x1408b3d3a
mov word [rsp + 0x50], di
jmp 0x1408b3d44
movaps xmm6, xmmword [rsp + 0x50]
cmp qword [0x140074d88], r14
jmp 0x1408b3d55
jne 0x1408b3dee
mov rax, qword gs:[0x60]
movzx r9d, si
cwd
mov rcx, qword [rax + 0x18]
lahf
movsx ax, spl
movzx dx, r11b
mov rax, qword [rcx + 0x10]
cdq
cqo
mov cx, bx
mov rcx, qword [rax]
cqo
jmp 0x1408b3d91
mov qword [rbp + 0xb00], r14
cqo
cwd
bswap rdx
lea r9, [rbp + 0xb00]
cdq
cwd
mov edx, 0x1e64b2a0
jmp 0x1408b3db3
mov rcx, qword [rcx + 0x30]
call fcn.140007fc0
mov rcx, qword [rbp + 0xb00]
shrd r8w, di, 0x9d
sar dh, cl
test eax, eax
movsx rdx, r15w
movsx r8w, dil
cmovs rcx, r14
bts dx, sp
cmovne r8, r10
btr dx, 0xa5
mov qword [0x140074d88], rcx
lea r8, [rsp + 0x40]
add dx, 0x50e5
mov rdx, qword [rsp + 0x58]
cmc
test rax, rcx
jmp 0x1408b3e06
xor ecx, ecx
call 0x14035399e
test eax, eax
jmp 0x1408b3e15
je 0x1408b3e2a
mov rax, qword [rsp + 0x40]
jmp 0x1408b3e25
jmp 0x1408b4910
lea rdx, [0x140047c24]
movsx ecx, r11w
movsxd rcx, r10d
xchg cx, cx
mov ecx, esi
jmp 0x1408b3e42
call 0x1402f39b1
mov qword [rsp + 0x70], rax
test rax, rax
jmp 0x1408b3e55
jne 0x1408b3e68
mov rbx, r14
jmp 0x1408b3e63
jmp 0x1408b48f5
mov rdx, rbx
movsx rcx, r8w
movzx rcx, ax
lea rcx, [rbp + 0x10]
jmp 0x1408b3e7c
call fcn.1400020ec
lea rax, [0x1400757e0]
mov cx, r14w
setnp ch
movzx ecx, r9w
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x20]
xchg rcx, rcx
movzx ecx, r11w
movzx rcx, r10w
mov qword [rbp + 0x178], rax
movzx cx, bpl
xchg cl, cl
lea rcx, [rbp + 0x160]
jmp 0x1408b3ec3
call 0x1404771c5
mov r13d, r14d
cmp bpl, 0x95
movzx rdi, bx
rcr r15b, 0x6e
mov dword [rbp + 0xb00], r14d
btc rdi, 0xe3
movzx rbx, r12w
cmc
movzx ebx, word [rsp + 0x50]
jmp 0x1408b3ef8
shr rbx, 1
shl dil, 0xac
adc cl, 0xdc
mov qword [rsp + 0x50], rbx
rcr edi, 0x46
clc
bts cx, r9w
mov r15d, 0x208
lea rdi, [rbp + reloc.COMCTL32.dll_RemoveWindowSubclass]
bsr cx, bp
stc
mov cx, dx
xor eax, eax
setp cl
jmp 0x1408b3f32
mov rcx, r15
rep stosb byte [rdi], al
mov ax, bp
movzx cx, spl
mov eax, dword [rbp + 0x40]
bswap ecx
xchg cl, ch
movsx ecx, r14w
mov dword [rsp + 0x60], eax
mov ecx, 0x9c40
jmp 0x1408b3f58
call 0x1400fd2c2
mov r15, rax
test rax, rax
jmp 0x1408b3f69
je 0x1408b47a6
rdtsc
cmp dh, 0xde
movzx ecx, di
btc cx, sp
shl rdx, 0x20
or rax, rdx
setge ch
mov rcx, rax
call 0x1401bc111
mov rcx, r15
jmp 0x1408b3f96
call 0x1408b3a21
mov r12, rax
test rcx, r10
cmc
cmp sil, cl
test rax, rax
je 0x1408b44fe
mov rdi, r12
test ch, 0xb7
cmc
sub rdi, r14
jmp 0x1408b3fbd
call 0x14024bcaa
cdqe
movzx r13d, r15w
movzx r13w, r11b
xor edx, edx
bt r13d, r13d
div rdi
sal r13w, 0xb4
lea rdx, [rdx + r14]
shl ax, cl
mov r13, qword [r15 + rdx*8]
clc
mov rax, qword [r15 + r14*8]
clc
cmp sil, 0x96
test r8w, r11w
mov qword [r15 + rdx*8], rax
mov qword [r15 + r14*8], r13
or rsi, 0xffffffffffffffff
sub edi, edi
jmp 0x1408b4008
inc rsi
cmc
cmp word [r13 + rsi*2], di
jmp 0x1408b4017
jne 0x1408b4008
cmp rsi, rbx
jmp 0x1408b4025
jbe 0x1408b44a4
mov rcx, r13
jmp 0x1408b4033
call 0x140753dc3
test rax, rax
jne 0x1408b44a4
mov qword [rsp + 0x68], rdi
lea r9, [rbp + 0xb08]
jmp 0x1408b405c
lea r8, [rsp + 0x68]
jmp 0x1408b4066
call fcn.14000af9c
cmp dword [rbp + 0xb08], edi
jmp 0x1408b4076
jge 0x1408b4089
mov al, dil
jmp 0x1408b4084
jmp 0x1408b4142
mov rdx, r13
movsx cx, bpl
movsxd rcx, r14d
bswap rcx
lea rcx, [rbp - 0x38]
jmp 0x1408b40a0
call 0x1405bc257
mov dword [rbp - 0x28], 0x30
cbw
mov rax, rsi
cwde
mov rax, qword [rsp + 0x68]
jmp 0x1408b40bd
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x10], 0x40
lahf
movsx eax, bp
lea rax, [rbp - 0x38]
mov qword [rbp - 0x18], rax
jmp 0x1408b40d9
xorps xmm0, xmm0
movdqu xmmword [rbp - 8], xmm0
lea r8, [rbp - 0x28]
movsxd rcx, r14d
not cx
mov edx, 5
setns ch
lea rcx, [rsp + 0x78]
call fcn.140606626
mov edi, eax
movzx rcx, r11w
mov dword [rbp + 0xb08], eax
movzx ecx, r8w
xchg ecx, ecx
jmp 0x1408b4114
mov rcx, qword [rsp + 0x78]
jmp 0x1408b411e
call fcn.14066a3ba
mov rcx, qword [rsp + 0x68]
call fcn.140780644
xor eax, eax
rcr al, cl
shr al, cl
test edi, edi
setns al
test esi, 0x4a0b4d86
stc
xor edi, edi
clc
test al, al
jmp 0x1408b4149
jne 0x1408b44a4
mov ebx, 0x104
sete cl
mov edx, ebx
lea rcx, [rbp + 0x880]
jmp 0x1408b4165
call 0x1403aad40
lea r8, [0x14005bf70]
mov edx, edi
mov edx, ebx
movsxd rcx, r15d
lea rcx, [rbp + 0x880]
call 0x1401b94ff
mov r8, r13
movzx cx, r12b
mov edx, ebx
movzx rcx, sp
movsx cx, r8b
mov cx, 0x1e39
lea rcx, [rbp + 0x880]
jmp 0x1408b41a9
call 0x140435fe0
mov qword [rsp + 0x30], rdi
rcr rcx, 0x82
mov dword [rsp + 0x28], 0x80
mov r8b, spl
cmp r10b, r10b
mov dword [rsp + 0x20], 3
cwd
sbb cx, si
xor r9d, r9d
movsx r8w, r13b
cqo
mov dh, 0xb0
mov edx, 0x80000000
xchg ch, cl
mov r8, 0x772911c0
cmovne cx, r11w
lea r8d, [r9 + 1]
movzx rcx, si
mov cl, 0xc5
xchg ch, ch
lea rcx, [rbp + 0x880]
call 0x1406566fa
mov rbx, rax
cmc
cmp rax, 0xffffffffffffffff
je 0x1408b449c
xor r9d, r9d
rcr cl, 0x84
sar cl, cl
inc rcx
xor r8d, r8d
sub edx, edx
jmp 0x1408b4234
mov rcx, rax
call 0x14029cf7d
cmp eax, 0xffffffff
jmp 0x1408b4245
je 0x1408b4462
mov qword [rsp + 0x20], rdi
movsx rdx, r15w
bswap r8w
mov edx, esi
lea r9, [rbp + 0xaf8]
bswap rdx
cmovae cx, bp
cqo
mov r8d, 0x40
movzx dx, r12b
lea rdx, [rbp + 0x50]
mov ch, 0x16
mov rcx, rbx
movzx cx, al
mov rcx, rbx
call 0x1401b09f0
test eax, eax
jmp 0x1408b4293
je 0x1408b4462
cmp dword [rbp + 0xaf8], 0x40
jmp 0x1408b42a5
jne 0x1408b4462
mov eax, 0x5a4d
cmp word [rbp + 0x50], ax
jmp 0x1408b42b9
jne 0x1408b4462
mov edx, dword [rbp + 0x8c]
jmp 0x1408b42cd
test edx, edx
jmp 0x1408b42d4
je 0x1408b4462
sub r9d, r9d
shl ch, cl
bswap ecx
xor r8d, r8d
mov cl, 0x18
mov rcx, rbx
jmp 0x1408b42ee
call 0x14062e01b
cmp eax, 0xffffffff
jmp 0x1408b42fc
je 0x1408b4462
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0xaf8]
movzx rcx, r13w
xchg rdx, rdx
mov r8d, 0x108
lea rdx, [rbp + 0x50]
mov ch, 0xac
mov rcx, rbx
jmp 0x1408b432a
call 0x140566d38
test eax, eax
jmp 0x1408b4337
je 0x1408b4462
cmp dword [rbp + 0xaf8], 0x108
jmp 0x1408b434c
jne 0x1408b4462
cmp dword [rbp + 0x50], 0x4550
jmp 0x1408b435e
jne 0x1408b4462
mov eax, 0x8664
cmp word [rbp + 0x54], ax
jmp 0x1408b4372
jne 0x1408b4462
movzx eax, word [rbp + 0x66]
mov ecx, 0x2022
cmc
cmp cx, r12w
and ax, cx
clc
test r14d, esp
cmp si, 0x61fc
cmp ax, cx
jmp 0x1408b439a
jne 0x1408b4462
mov eax, 0x20b
cmc
clc
cmp word [rbp + 0x68], ax
jmp 0x1408b43b0
jne 0x1408b4462
movzx eax, word [rbp + 0xac]
cmp r8b, 0xa7
rol cl, cl
sub ax, 2
mov ecx, 1
stc
cmp bp, cx
cmp ax, cx
jmp 0x1408b43d8
ja 0x1408b4462
test byte [rbp + 0xae], 0x40
jmp 0x1408b43ea
je 0x1408b4462
cmp dword [rbp + 0x78], edi
jmp 0x1408b43f8
je 0x1408b4462
cmp dword [rbp + 0xd4], 0x10
jmp 0x1408b440a
jb 0x1408b4462
cmp dword [rbp + 0x148], edi
jne 0x1408b4462
cmp dword [rbp + 0x14c], edi
jne 0x1408b4462
cmp dword [rbp + 0xf0], edi
jmp 0x1408b4433
je 0x1408b4462
cmp dword [rbp + 0xf4], edi
jmp 0x1408b4444
je 0x1408b4462
mov eax, dword [rsp + 0x60]
test r9, rcx
cmp dword [rbp + 0xa0], eax
jmp 0x1408b445c
jae 0x1408b4473
mov edi, 1
setnp ch
mov ecx, 0x4aa127f6
movzx ecx, r12w
mov rcx, rbx
call fcn.14060ae7f
test dil, dil
jmp 0x1408b4483
jne 0x1408b449c
lea eax, [rsi + 1]
cmp eax, 0x104
jmp 0x1408b4496
jb 0x1408b44bf
mov rbx, qword [rsp + 0x50]
or rsi, rsi
mov esi, 1
clc
add r14, rsi
cmp r15w, ax
cmp r14, r12
jae 0x1408b44f6
jmp 0x1408b3fae
mov r8, r13
movzx cx, al
mov cx, bp
seto dh
mov edx, 0x104
mov ch, 0x6a
movzx cx, dil
lea rcx, [rbp + reloc.COMCTL32.dll_RemoveWindowSubclass]
jmp 0x1408b44e5
call 0x1405a100d
mov esi, 1
add r13d, 0x52ab548c
mov r13d, dword [rbp + 0xb00]
stc
sub r14d, r14d
shld rdi, r10, 0x30
rcr dil, cl
shr dil, 0x2c
mov edi, r14d
test r12, r12
jmp 0x1408b4519
je 0x1408b4545
mov rcx, qword [r15 + rdi*8]
jmp 0x1408b4528
call 0x1403bad5d
lea rdi, [rdi + rsi]
cmp r8b, 0xd7
cmc
cmp rdi, r12
jmp 0x1408b453f
jb 0x1408b451f
mov rcx, r15
jmp 0x1408b454d
call 0x1407182cf
lea rax, [rbp + reloc.COMCTL32.dll_RemoveWindowSubclass]
cmp r13b, sil
jmp 0x1408b4562
or rdx, 0xffffffffffffffff
jmp 0x1408b456b
inc rdx
cmc
cmp word [rax + rdx*2], r14w
jmp 0x1408b4579
jne 0x1408b456b
mov r15d, 0x208
jmp 0x1408b458a
test edx, edx
jmp 0x1408b4591
je 0x1408b47af
lea rdi, [rbp - 0x80]
rol ch, 0xc5
neg cx
xor eax, eax
jmp 0x1408b45ac
lea ecx, [rax + 0x30]
jmp 0x1408b45b4
rep stosb byte [rdi], al
movdqu xmmword [rbp - 0x60], xmm6
lea rax, [rbp + reloc.COMCTL32.dll_RemoveWindowSubclass]
mov qword [rbp - 0x78], rax
movsxd rdi, r10d
add dx, dx
xor cx, bx
inc ecx
sar ch, 0xc8
mov word [rbp - 0x80], dx
clc
stc
shl rdx, 0x2c
mov word [rbp - 0x7e], r15w
sub edx, edi
lea rdi, [rbp + 0x3b0]
not cl
ror dh, cl
shld cx, r13w, 0x67
sub eax, eax
mov ecx, 0x4d0
cqo
mov dh, 0x7a
cwd
rep stosb byte [rdi], al
movzx edx, bx
mov dword [rbp + 0x3e0], 0x100010
not cl
cbw
mov rax, qword [0x140074d88]
mov qword [rbp + 0x410], rax
mov qword [rbp + 0x420], 0x440
cqo
cwd
movzx dx, r14b
lea rdx, [rbp + 0x3b0]
bswap cx
movzx rcx, cx
mov rcx, 0xfffffffffffffffe
jmp 0x1408b4653
call fcn.140384302
test eax, eax
jmp 0x1408b465f
js 0x1408b47af
lea r8, [rbp - 0x80]
cwd
shld rdx, rdx, 0xd0
lea rdx, [0x140048638]
cmp sil, dl
xor ecx, ecx
jmp 0x1408b4681
call 0x140624b0e
mov rbx, qword gs:[0x30]
mov rdi, qword [rbx + 0x28]
btc r9, rsi
ror r9b, cl
mov qword [rbx + 0x28], r14
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x80]
cmc
cmp cx, 0x22e8
sub edx, edx
sub ecx, ecx
call 0x1400c68ba
mov esi, eax
bswap rdx
mov qword [rbx + 0x28], rdi
setl r8b
mov dword [rbp - 0x6c], eax
mov eax, 1
sal r8d, 7
movsx edx, r10w
neg dl
mov dword [rbp - 0x70], eax
lea r8, [rbp - 0x80]
ror dh, 0x21
lea rdx, [0x140048638]
cmp ax, r13w
xor ecx, ecx
call 0x14054a024
lea rdi, [rbp + 0x3b0]
btc dx, ax
btr dx, 0x11
mov dx, r12w
sub eax, eax
mov ecx, 0x4d0
seta dh
rep stosb byte [rdi], al
mov dword [rbp + 0x3e0], 0x100010
bswap cx
mov qword [rbp + 0x410], r14
setnp cl
mov edx, edi
mov qword [rbp + 0x420], 0x400
lea rdx, [rbp + 0x3b0]
movsx cx, r15b
lea rcx, [rax - 2]
jmp 0x1408b474d
call 0x140422cb5
test esi, esi
jmp 0x1408b4759
js 0x1408b47af
mov rbx, qword [rsp + 0x40]
cmp r12b, bl
cmp r10b, 0x3c
cmp dword [rbp + 0x198], r14d
jne 0x1408b47e9
test rbx, rbx
jmp 0x1408b4780
je 0x1408b47b9
mov rcx, rbx
jmp 0x1408b478e
call 0x1407598c1
mov rbx, r14
mov qword [rsp + 0x40], rbx
jmp 0x1408b47a1
jmp 0x1408b47b9
mov r15d, 0x208
movzx ebx, dx
mov rbx, qword [rsp + 0x40]
jmp 0x1408b47b9
mov esi, 1
cmp r10b, r13b
add r13d, esi
mov dword [rbp + 0xb00], r13d
cmp r13d, 3
jmp 0x1408b47d4
jae 0x1408b47e9
mov rbx, qword [rsp + 0x50]
jmp 0x1408b47e4
jmp 0x1408b3f16
lea rdi, [rbp + reloc.COMCTL32.dll_RemoveWindowSubclass]
dec cl
xor eax, eax
movzx cx, r8b
setno cl
bswap rcx
mov rcx, r15
rep stosb byte [rdi], al
mov rdi, qword [rbp + 0x10]
test rdi, rdi
jmp 0x1408b4810
je 0x1408b4842
mov rcx, qword [rbp + 0x18]
test bl, r13b
jmp 0x1408b4823
test rcx, rcx
jmp 0x1408b482b
je 0x1408b4842
rep stosb byte [rdi], al
shl bx, cl
movzx ebx, sp
mov rbx, qword [rsp + 0x40]
cmp r9d, ebx
cmc
test rbx, rbx
jmp 0x1408b484a
jne 0x1408b4882
xor edx, edx
mov r8d, 0x800
bswap rcx
not ch
movzx ecx, r8w
mov rcx, qword [rbp + 0xaf0]
call 0x14026b2a6
mov rbx, rax
jmp 0x1408b4876
mov qword [rsp + 0x40], rax
not cx
mov cx, r9w
lea rcx, [rbp + 0x160]
call 0x1404cff7d
mov rdx, qword [rbp + 0x10]
test sp, si
cmp r14b, 0xa
test rdx, rdx
jmp 0x1408b48a2
je 0x1408b48ee
mov rcx, qword [rdx - 8]
cmp r13w, ax
test rcx, rcx
jmp 0x1408b48b8
je 0x1408b48ca
mov rdi, rdx
stc
xor eax, eax
rep stosb byte [rdi], al
movzx ecx, r13w
mov rcx, qword [rdx - 0x10]
jmp 0x1408b48d3
call 0x14080015b
mov qword [rbp + 0x10], r14
cmp di, di
btr rax, 0xf6
sub ax, r14w
mov qword [rbp + 0x18], r14
nop
mov rax, qword [rsp + 0x70]
clc
cmc
test rax, rax
je 0x1408b4906
mov rcx, rax
call 0x1403283ff
mov rax, rbx
jmp 0x1408b4910
movaps xmm6, xmmword [rsp + 0xb90]
add rsp, 0xba8
pop r15
pop r14
bswap ebx
movsx r13w, dl
movzx si, bpl
pop r13
movzx si, r8b
pop r12
movsx bx, sil
mov si, 0x610a
movzx ebp, sp
pop rdi
pop rsi
mov bp, r15w
movzx rbx, r13w
jmp 0x1408b4953
pop rbx
setne bpl
movsx rbp, si
pop rbp
jmp 0x1408b4962
ret