Function at 0x140037cf0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x168
mov eax, 0x853bdbf
mov ecx, eax
mov dl, 0xb6
mov r8, qword [rsp + 0x160]
mov word [rsp + 0x15e], 0x8d3d
mov byte [rsp + 0x153], 0xbe
mov eax, dword [rsp + 0x158]
mov r9d, eax
or r9d, 0x17561777
mov dword [rsp + 0x158], r9d
mov dword [rsp + 0x14c], 0x1e3c0121
mov qword [rsp + 0x140], 0xf0db322
mov r10, qword [rsp + 0x140]
xor r10, 0x7029b389
mov qword [rsp + 0x128], r10
mov r9d, eax
add r9d, 0x7795c941
mov dword [rsp + 0x158], r9d
mov r9d, dword [rsp + 0x14c]
xor r9d, 0x78b7b0cf
mov dword [rsp + 0xac], r9d
lea r10, [rsp + 0x80]
lea r11, [rsp + 0xc0]
mov si, word [rsp + 0x154]
mov bl, byte [rsp + 0x157]
mov dil, 0x91
mov dword [rsp + 0x58], eax
mov al, bl
mul dil
mov byte [rsp + 0x157], al
mov r9d, 0x4aa1ee3f
mov ebp, dword [rsp + 0x58]
sub r9d, ebp
mov al, byte [rsp + 0x153]
xor al, 0xd0
mov dword [rsp + 0x158], r9d
mov byte [rsp + 0x80], al
mov qword [rsp + 0x160], 0x44c0fd20
mov al, byte [rsp + 0x153]
add al, 0xb6
mov byte [rsp + 0x81], al
mov al, byte [rsp + 0x153]
xor al, 0xda
mov byte [rsp + 0x82], al
and ebp, 0x7eca5326
mov dword [rsp + 0x158], ebp
mov al, byte [rsp + 0x153]
xor al, 0xd2
mov byte [rsp + 0x83], al
mov al, byte [rsp + 0x153]
add al, 0xae
mov byte [rsp + 0x84], al
mov qword [rsp + 0x160], 0x4e8434fb
mov byte [rsp + 0x157], 0xc2
mov al, byte [rsp + 0x153]
mov dil, 0xec
sub dil, al
mov byte [rsp + 0x85], dil
mov al, byte [rsp + 0x153]
mov word [rsp + 0x154], 0x13de
mov dil, 0x22
sub dil, al
mov al, bl
or al, 0x55
mov byte [rsp + 0x157], al
mov byte [rsp + 0x86], dil
mov word [rsp + 0x154], si
mov al, byte [rsp + 0x153]
mov word [rsp + 0x154], 0
add al, 0xae
mov qword [rsp + 0x160], 0x7effff9f
mov byte [rsp + 0x87], al
mov r14, r8
xor r14, 0xeb1f6dd
mov al, byte [rsp + 0x153]
mov dil, 0x2a
sub dil, al
mov qword [rsp + 0x160], r14
mov byte [rsp + 0x88], dil
mov al, byte [rsp + 0x153]
add al, 0x42
mov byte [rsp + 0x89], al
mov r9d, dword [rsp + 0x58]
and r9d, 0x73f6092b
mov al, byte [rsp + 0x153]
mov dword [rsp + 0x158], r9d
add al, 0x5c
mov byte [rsp + 0x8a], al
movaps xmm0, xmmword [str.ntdll.dlkernel32]
movaps xmmword [rsp + 0xc0], xmm0
mov r15w, word [rsp + 0x15e]
mov r9d, dword [rsp + 0x58]
mov dword [rsp + 0x158], r9d
add r15w, 0x732f
mov word [rsp + 0xd0], r15w
mov byte [rsp + 0x157], bl
mov al, 0x40
sub al, bl
mov r15w, word [rsp + 0x15e]
mov byte [rsp + 0x157], al
add r15w, 0x72c3
mov word [rsp + 0xd2], r15w
mov r14, r8
add r14, 0x643f40ab
mov r15w, word [rsp + 0x15e]
add r15w, 0x72dd
mov qword [rsp + 0x160], r14
mov word [rsp + 0xd4], r15w
mov dword [rsp + 0x158], 0x2caf1f63
mov word [rsp + 0xf6], 0
mov qword [rsp + 0xee], 0
mov qword [rsp + 0xe6], 0
mov qword [rsp + 0xde], 0
mov qword [rsp + 0xd6], 0
mov byte [rsp + 0x157], bl
movsx ebp, byte [rsp + 0x9c]
mov r15w, bp
mov word [rsp + 0xf8], r15w
mov dword [rsp + 0x158], r9d
movsx ebp, byte [rsp + 0x9d]
mov r15w, bp
mov word [rsp + 0xfa], r15w
movsx ebp, byte [rsp + 0x9e]
mov r15w, bp
mov word [rsp + 0xfc], r15w
mov al, bl
or al, 0xa6
mov byte [rsp + 0x157], al
mov al, byte [rsp + 0x9f]
movsx ebp, al
mov r15w, bp
mov word [rsp + 0xfe], r15w
mov ebp, dword [rsp + 0x14c]
xor ebp, 0x1e3c0111
add r9d, 0x63680577
mov dword [rsp + 0x158], r9d
mov r9d, dword [rsp + 0x58]
add r9d, r9d
mov r14, qword gs:[ebp]
mov dword [rsp + 0x158], r9d
mov dil, bl
and dil, 0x82
mov byte [rsp + 0x157], dil
mov r15w, si
or r15w, r15w
mov rax, qword [r14 + 0x60]
mov word [rsp + 0x154], r15w
mov r14, r8
or r14, 0x63ddad90
mov qword [rsp + 0x160], r14
sub dl, bl
mov rax, qword [rax + 0x18]
mov byte [rsp + 0x157], dl
mov r14, rax
add r14, 0x20
mov byte [rsp + 0x157], 0xff
mov rax, qword [rax + 0x20]
mov dword [rsp + 0x158], 0x301b2437
sub rcx, r8
mov qword [rsp + 0x160], rcx
mov qword [rsp + 0x138], 0
cmp rax, r14
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r8
mov byte [rsp + 0x3f], bl
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x28], r11
mov word [rsp + 0x26], si
je 0x140038346
jmp 0x14003845d
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x60], rax
jmp 0x14003826e