Function at 0x14001b340
Capabilities:
Load ntoskrnl
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1400a3c40]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, rdx
mov r14, qword [0x1409ffc00]
mov ebx, reloc.WS2_32.dll_recv
mov rax, qword gs:[0x58]
add rbx, qword [rax]
xor edi, edi
mov eax, dword [rbx]
cmp dword [0x1409ffe20], eax
jle 0x14001b42e
lea rcx, [0x1409ffe20]
call fcn.14005b5b8
cmp dword [0x1409ffe20], 0xffffffff
jne 0x14001b42e
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], send
mov byte [rsp + 0x20], dil
lea r8d, [rdi + 0xc]
lea rdx, [0x140091748]
lea rcx, [rsp + 0x20]
call fcn.140003650
nop
lea rcx, [rsp + 0x20]
call fcn.140019f00
mov qword [0x1409ffe00], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14001b422
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b41c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b600
call fcn.14005b964
nop
lea rcx, [0x1409ffe20]
call fcn.14005b558
mov eax, dword [rbx]
cmp dword [0x1409ffe1c], eax
jle 0x14001b473
lea rcx, [0x1409ffe1c]
call fcn.14005b5b8
cmp dword [0x1409ffe1c], 0xffffffff
jne 0x14001b473
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140091748]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [0x1409ffde8], rax
lea rcx, [0x1409ffe1c]
call fcn.14005b558
mov eax, dword [rbx]
cmp dword [0x1409ffdbc], eax
jle 0x14001b4ac
lea rcx, [0x1409ffdbc]
call fcn.14005b5b8
cmp dword [0x1409ffdbc], 0xffffffff
jne 0x14001b4ac
mov rax, qword [0x1409ffde8]
mov qword [0x1409ffdc0], rax
lea rcx, [0x1409ffdbc]
call fcn.14005b558
mov ecx, 0x5a4d
mov rax, qword [0x1409ffdc0]
cmp word [rax], cx
je 0x14001b4c7
mov rcx, rdi
mov eax, edi
jmp 0x14001b5a8
mov eax, dword [rbx]
cmp dword [0x1409ffe30], eax
jle 0x14001b50b
lea rcx, [0x1409ffe30]
call fcn.14005b5b8
cmp dword [0x1409ffe30], 0xffffffff
jne 0x14001b50b
mov rax, qword [0x1409ffdc0]
movsxd rcx, dword [rax + 0x3c]
add rcx, qword [0x1409ffde8]
mov qword [0x1409ffdf0], rcx
lea rcx, [0x1409ffe30]
call fcn.14005b558
mov rax, qword [0x1409ffdf0]
cmp dword [rax], 0x4550
jne 0x14001b4bd
mov ebx, dword [rax + 0x50]
movdqa xmm0, xmmword [0x140092760]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x78737850
mov dword [rsp + 0x34], 0x78757853
mov rsi, qword [0x1409ffde8]
add rbx, rsi
mov rax, rbx
mov rcx, rbx
sub rcx, rsi
cmp rcx, 0xc
jl 0x14001b59a
lea r11, [rbx - 0xc]
mov r10, rsi
nop dword [rax + rax]
mov r8, r10
lea rcx, [rsp + 0x20]
nop dword [rax + rax]
movzx r9d, word [rcx]
movzx edx, r9w
shr dx, 8
cmp dl, 0x3f
je 0x14001b586
cmp byte [r8], r9b
jne 0x14001b5f3
inc r8
add rcx, 2
lea rdx, [rsp + 0x38]
cmp rcx, rdx
jne 0x14001b570
mov rax, r10
mov rcx, rdi
cmp rax, rbx
cmovne rcx, rax
mov eax, ecx
sub eax, esi
mov r8d, dword [rcx + 1]
mov r10d, eax
add r8, qword [0x1409ffe00]
add r10, 5
add r8, r10
mov r9, rbp
mov rcx, r14
call fcn.1400100b0
test al, al
setne dil
mov eax, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14005b410
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
cmp r10, r11
je 0x14001b59a
inc r10
jmp 0x14001b560
call fcn.140026c98
nop
int3