Function at 0x140002af0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x14002b018]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rax, qword gs:[0x60]
lea r13, str.ntdll.dll
xor ebx, ebx
mov rcx, r13
mov r12d, ebx
mov rsi, qword [rax + 0x18]
add rsi, 0x20
lea edx, [rbx + 0x5c]
mov rdi, qword [rsi]
call fcn.1400061c4
test rax, rax
mov r14d, ebx
setne r14b
mov rcx, r13
test r14d, r14d
je 0x140002b65
mov rdx, qword [rdi + 0x40]
jmp 0x140002b69
mov rdx, qword [rdi + 0x50]
call fcn.140009cf4
test eax, eax
je 0x140002bdf
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140002b57
xor edx, edx
mov rcx, r13
call fcn.140001880
mov rcx, rax
mov edx, 0x7f6f58fc
call fcn.140001b50
mov rdi, rax
test rax, rax
jne 0x140002b9e
mov rcx, rbx
jmp 0x140002be3
mov edx, 0x104
mov dword [rbp - 0x2d], ebx
mov rcx, r13
mov qword [rbp - 0x29], r13
call fcn.140009638
add ax, ax
mov qword [rbp - 0x41], rbx
mov word [rbp - 0x31], ax
lea r9, [rbp - 0x41]
add ax, 2
lea r8, [rbp - 0x31]
xor edx, edx
mov word [rbp - 0x2f], ax
xor ecx, ecx
call rdi
mov rcx, qword [rbp - 0x41]
test eax, eax
cmovs rcx, rbx
jmp 0x140002be3
mov rcx, qword [rdi + 0x20]
mov edx, 0x188e251d
call fcn.140001b50
mov r14, rax
lea rcx, str.Kernel32.dll
mov rax, qword gs:[0x60]
mov edx, 0x5c
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
call fcn.1400061c4
test rax, rax
mov r15d, ebx
setne r15b
nop
lea rcx, str.Kernel32.dll
test r15d, r15d
je 0x140002c32
mov rdx, qword [rdi + 0x40]
jmp 0x140002c36
mov rdx, qword [rdi + 0x50]
call fcn.140009cf4
test eax, eax
je 0x140002cb3
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140002c20
xor edx, edx
mov rcx, r13
call fcn.140001880
mov rcx, rax
mov edx, 0x7f6f58fc
call fcn.140001b50
mov rdi, rax
test rax, rax
jne 0x140002c6b
mov rcx, rbx
jmp 0x140002cb7
lea rax, str.Kernel32.dll
mov dword [rbp - 0x1d], ebx
mov rcx, rax
mov qword [rbp - 0x19], rax
mov edx, 0x104
call fcn.140009638
add ax, ax
mov qword [rbp - 0x39], rbx
mov word [rbp - 0x21], ax
lea r9, [rbp - 0x39]
add ax, 2
lea r8, [rbp - 0x21]
xor edx, edx
mov word [rbp - 0x1f], ax
xor ecx, ecx
call rdi
mov rcx, qword [rbp - 0x39]
test eax, eax
cmovs rcx, rbx
jmp 0x140002cb7
mov rcx, qword [rdi + 0x20]
mov edx, 0x9605a86c
call fcn.140001b50
mov rsi, rax
test r14, r14
je 0x140002dbe
test rax, rax
je 0x140002dbe
xor edx, edx
lea r9, [rbp - 0x49]
xor r8d, r8d
lea ecx, [rdx + 5]
call r14
movups xmm0, xmmword [0x140028188]
lea rdx, [rbp + 7]
mov edi, eax
movsd xmm1, qword [0x140028198]
lea rcx, [rbp - 0x11]
movzx eax, word [0x1400281a0]
mov r8d, 0x1b
mov word [rbp + 0x1f], ax
movzx eax, byte [0x1400281a2]
mov byte [rbp + 0x21], al
mov dword [rbp - 0x11], 0x42ad28de
mov dword [rbp - 0xd], 0x63ef6bbe
mov dword [rbp - 9], 0x7a585af
mov dword [rbp - 5], 0x7882c5fb
mov byte [rbp - 1], bl
movups xmmword [rbp + 7], xmm0
movsd qword [rbp + 0x17], xmm1
call fcn.140001cb0
cmp edi, 0xc0000004
jne 0x140002d80
nop
mov ecx, dword [rbp - 0x49]
call fcn.140010fa4
mov rbx, rax
test rax, rax
je 0x140002db0
mov r8d, dword [rbp - 0x49]
lea r9, [rbp - 0x49]
mov rdx, rax
mov ecx, 5
call r14
mov edi, eax
cmp eax, 0xc0000004
je 0x140002d50
nop dword [rax]
test rbx, rbx
je 0x140002da2
test qword [rbx + 0x50], 0xfffffffffffffffb
je 0x140002da2
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x140002da2
lea rdx, [rbp + 7]
call rsi
test eax, eax
je 0x140002db5
mov eax, dword [rbx]
add rbx, rax
test eax, eax
jne 0x140002d80
mov rax, r12
jmp 0x140002dc0
movsxd rax, edi
jmp 0x140002dc0
mov r12, qword [rbx + 0x50]
mov rax, r12
jmp 0x140002dc0
xor eax, eax
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400049b0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret