Function at 0x140037bb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
mov ax, 0x32f7
mov byte [rsp + 0x147], 0xae
mov word [rsp + 0x12c], 0x1167
mov cl, byte [rsp + 0x137]
mov dword [rsp + 0x128], 0x741644b9
mov edx, dword [rsp + 0x130]
mov r8d, 0x605994ab
sub r8d, edx
mov dword [rsp + 0x130], r8d
mov qword [rsp + 0x120], 0x23120ab9
mov r9, qword [rsp + 0x138]
lea r10, [rsp + 0xe0]
mov r11, r9
add r11, 0x34397cfe
mov qword [rsp + 0x138], r11
lea r11, [rsp + 0x60]
mov r8d, edx
add r8d, r8d
mov dword [rsp + 0x130], r8d
mov byte [rsp + 0x137], 0x3c
mov bl, byte [rsp + 0x147]
mov sil, bl
xor sil, 0xc0
mov byte [rsp + 0xe0], sil
mov r8d, edx
imul r8d, r8d
mov dword [rsp + 0x130], r8d
movzx r8d, word [rsp + 0x12e]
mov di, r8w
mov sil, 0x22
sub sil, bl
mov ebp, r8d
or ebp, 0x5de8
mov r14w, bp
mov word [rsp + 0x12e], r14w
mov byte [rsp + 0xe1], sil
mov r15, r9
xor r15, 0x7aa1e670
mov qword [rsp + 0x138], r15
xor bl, 0xca
mov byte [rsp + 0xe2], bl
mov bl, byte [rsp + 0x147]
mov dword [rsp + 0x130], edx
add bl, 0xbe
mov byte [rsp + 0xe3], bl
mov bl, byte [rsp + 0x147]
add bl, 0xbe
mov r15, r9
not r15
mov byte [rsp + 0xe4], bl
mov ebp, 0xffffe495
sub ebp, r8d
mov r14w, bp
mov bl, byte [rsp + 0x147]
mov sil, 0xdc
sub sil, bl
mov word [rsp + 0x12e], r14w
mov byte [rsp + 0xe5], sil
mov bl, byte [rsp + 0x147]
add bl, 0xb6
mov byte [rsp + 0xe6], bl
mov qword [rsp + 0x138], r15
mov bl, byte [rsp + 0x147]
add bl, 0xbe
mov word [rsp + 0x12e], di
mov byte [rsp + 0xe7], bl
mov bl, byte [rsp + 0x147]
mov byte [rsp + 0x137], cl
add bl, 0xbe
mov byte [rsp + 0xe8], bl
mov byte [rsp + 0xe9], 0
mov qword [rsp + 0x138], 0xd005088
mov r8d, 0x631278d
sub r8d, edx
mov dword [rsp + 0x130], r8d
mov bl, byte [rsp + 0x147]
xor bl, 0x89
mov byte [rsp + 0xea], bl
movaps xmm0, xmmword [str.ntdll.dlkernel32]
movaps xmmword [rsp + 0x60], xmm0
mov r12, r9
add r12, 0xfffffffffd071cbd
mov qword [rsp + 0x138], r12
mov r14w, word [rsp + 0x12c]
mov qword [rsp + 0x138], r15
mov r13w, 0x11d3
sub r13w, r14w
mov word [rsp + 0x70], r13w
mov r8d, edx
or r8d, 0x6cacba23
mov dword [rsp + 0x130], r8d
mov r14w, word [rsp + 0x12c]
xor r14w, 0x1167
mov word [rsp + 0x72], r14w
mov r14w, word [rsp + 0x12c]
mov r13w, 0x118e
sub r13w, r14w
mov qword [rsp + 0x138], 0x9be6d1d
mov word [rsp + 0x74], r13w
mov word [rsp + 0x96], 0
mov qword [rsp + 0x8e], 0
mov qword [rsp + 0x86], 0
mov qword [rsp + 0x7e], 0
mov qword [rsp + 0x76], 0
movsx r8d, byte [rsp + 0xfc]
mov r14w, r8w
mov word [rsp + 0x12e], 0
mov bl, cl
add bl, 0x2c
mov byte [rsp + 0x137], bl
mov qword [rsp + 0x138], r9
mov word [rsp + 0x98], r14w
movsx r8d, byte [rsp + 0xfd]
mov r14w, r8w
mov word [rsp + 0x9a], r14w
mov r8d, edx
not r8d
mov dword [rsp + 0x130], r8d
mov dword [rsp + 0x130], 0x77250c89
movsx r8d, byte [rsp + 0xfe]
mov r14w, r8w
mov word [rsp + 0x9c], r14w
mov bl, byte [rsp + 0xff]
movsx r8d, bl
mov r14w, r8w
mov word [rsp + 0x12e], 0x103a
mov word [rsp + 0x9e], r14w
sub ax, di
mov word [rsp + 0x12e], ax
mov r8d, dword [rsp + 0x128]
xor r8d, 0x74164489
mov dword [rsp + 0x130], 0x2dc1fd56
mov r15, qword gs:[r8d]
imul rax, r9, 0x5b7db855
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x138], r9
mov word [rsp + 0x12e], 0xa5d2
mov rax, qword [r15 + 0x60]
mov rax, qword [rax + 0x18]
mov r15, rax
add r15, 0x20
mov bl, cl
xor bl, 0xff
mov byte [rsp + 0x137], bl
mov rax, qword [rax + 0x20]
mov byte [rsp + 0x137], 0x69
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0x138], 0x571119e3
cmp rax, r15
mov word [rsp + 0x56], di
mov byte [rsp + 0x55], cl
mov dword [rsp + 0x50], edx
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
je 0x140038239
jmp 0x1400381c0
mov al, byte [rsp + 0x55]
mov byte [rsp + 0x137], al
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x118], rcx
jmp 0x140038295