Function at 0x1800134ec
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x78]
sub rsp, 0x178
mov dword [rsp + 0x70], 0x17d1
mov r11, r8
mov rax, qword [rbp + 0xe0]
mov esi, 1
mov qword [rbp - 0x20], rax
mov r10, rdx
mov rax, qword [rbp + 0xe8]
mov qword [rbp - 0x28], rax
mov eax, dword [0x18004e4a4]
mov byte [rsp + 0x61], al
movzx eax, word [0x18004e4bc]
mov qword [rbp - 0x48], rax
mov eax, 0xed49
movzx r13d, word [0x18004e4bc]
mov word [rsp + 0x64], ax
movzx eax, word [0x18004e4a0]
mov byte [rsp + 0x78], al
mov qword [rbp - 0x30], r8
mov r8, qword [0x18004e440]
movzx eax, byte [0x18004e357]
mov qword [rbp - 0x50], 0x86b0
mov qword [rbp - 0x60], 0x371c
mov word [rsp + 0x6c], ax
mov eax, 0xe99f
mov dword [rbp - 0x78], 0x5b
mov dword [rbp - 0x80], 0x7cf6
mov dword [rsp + 0x7c], 0x75ea
mov word [rsp + 0x6c], ax
mov dword [rbp - 0x58], r9d
movzx r9d, word [0x18004e484]
mov dword [rsp + 0x74], 0xab
mov eax, dword [0x18004e468]
mov byte [rsp + 0x60], al
movsx eax, byte [str.__._AVCallbackLogger]
mov dword [rsp + 0x70], 0x9f6b181b
mov dword [rsp + 0x70], 0xedc05c5d
mov dword [rsp + 0x70], eax
movzx eax, word [0x18004e45c]
mov eax, 0x22b7
mov qword [rbp - 0x38], rdx
mov word [rsp + 0x68], ax
mov rdx, rcx
mov byte [rsp + 0x68], 0xdd
movzx eax, word [0x18004e458]
mov eax, 0x93ca
mov qword [rbp - 0x70], rcx
mov word [rsp + 0x68], ax
lea ecx, [rsi + 0xa]
movzx eax, word [0x18004e394]
mov eax, dword [0x18004e47c]
mov word [rsp + 0x68], ax
mov rax, qword [0x18004e4d8]
movzx eax, byte [0x18004e396]
mov dword [rsp + 0x70], 0xa4c594d8
mov dword [rsp + 0x70], eax
movsxd rax, dword [0x18004e47c]
mov qword [rbp - 0x68], rax
movzx eax, word [0x18004e4e4]
mov byte [rsp + 0x68], al
mov al, byte [0x18004e353]
mov byte [rsp + 0x68], al
movzx eax, word [0x18004e4e4]
mov rax, qword [0x18004e450]
mov eax, dword [0x1803ff7c0]
mov dword [rsp + 0x70], 0xbb35
mov dword [rsp + 0x68], eax
mov byte [0x18004e356], 0xdd
mov eax, dword [rsp + 0x68]
add eax, 0x5a
mov dword [rsp + 0x70], eax
mov eax, dword [0x18004e480]
add eax, esi
mov dword [0x18004e480], eax
mov eax, dword [rsp + 0x68]
add eax, 0xf2
mov dword [rbp - 0x68], eax
mov eax, dword [rsp + 0x68]
add eax, 0x18a
mov dword [rsp + 0x68], eax
movzx eax, word [rsp + 0x64]
add ax, si
mov word [rsp + 0x64], ax
sub rcx, rsi
jne 0x1800136ba
xor edi, edi
cmp byte [0x18004e367], dil
jne 0x180013753
movzx ecx, word [0x18004e4e4]
mov edx, edi
mov rax, qword [0x18004e450]
cmp rcx, rax
mov rax, qword [0x18004e4a8]
setb dl
add rax, 0xf62d
cmp rdx, rax
jae 0x180013708
mov rax, qword [0x18004e490]
jmp 0x18001374f
test r8, r8
je 0x180013714
mov eax, dword [rbp - 0x80]
mov edx, esi
jmp 0x180013716
mov edx, edi
mov eax, dword [rsp + 0x74]
mov ecx, edi
mov cl, sil
cmp edx, ecx
jbe 0x180013733
mov al, byte [0x18004e37b]
add al, 0x65
mov byte [0x18004e37b], al
jmp 0x18001374f
mov eax, dword [rsp + 0x74]
imul ecx, eax, 0x7683
test ecx, ecx
je 0x18001374f
mov al, byte [0x18004e353]
sub al, 0x1f
mov byte [0x18004e397], al
mov rdx, qword [rbp - 0x70]
or r15, 0xffffffffffffffff
mov r12, r15
inc r12
cmp byte [rdx + r12], dil
jne 0x18001375a
movzx ecx, byte [0x18004e353]
movabs rax, 0x66d102d3ca90f
add rcx, rax
mov rbx, r15
and qword [0x18004e430], rcx
inc rbx
cmp byte [r10 + rbx], dil
jne 0x180013781
movzx eax, byte [0x18004e356]
mov edx, edi
cmp ax, word [0x18004e484]
mov ecx, edi
mov al, byte [0x18004e356]
setne dl
mov qword [rbp - 0x68], rbx
cmp al, 0x50
setne cl
cmp edx, ecx
jbe 0x1800137c5
mov rax, qword [rbp - 0x60]
mov dword [0x18004e468], 0xf8c5
jmp 0x180013871
mov eax, dword [rbp - 0x80]
not eax
test eax, eax
jne 0x1800137da
mov al, byte [0x18004e397]
mov edx, edi
test al, al
je 0x1800137dc
mov edx, esi
movzx eax, word [0x18004e4b8]
cmp eax, edx
je 0x18001380d
movzx eax, word [rsp + 0x64]
mov ecx, 0x1b31
xor ax, r13w
mov word [rsp + 0x64], ax
movzx eax, byte [0x18004e396]
xor ax, cx
add word [0x18004e3bc], ax
jmp 0x180013871
mov eax, dword [rsp + 0x7c]
mov edx, edi
movzx ecx, word [0x18004e394]
movzx eax, word [0x18004e4b8]
cmp ecx, edx
jne 0x18001385b
movzx ecx, word [rsp + 0x64]
mov eax, dword [rsp + 0x74]
test cx, cx
cmove dx, ax
mov eax, 0xc4
and dx, ax
mov rax, qword [0x18004e4d8]
not ax
or ax, dx
mov word [0x18004e484], ax
mov qword [rbp - 0x60], 0xa6c4
jmp 0x180013871
mov al, byte [rsp + 0x60]
test al, al
je 0x180013871
mov eax, r13d
not eax
add eax, r13d
mov dword [0x18004e47c], eax
inc r15
cmp byte [r11 + r15], dil
jne 0x180013871
mov rax, qword [rbp - 0x50]
movzx edx, byte [rsp + 0x60]
movsx eax, word [0x18004e458]
cmp eax, edx
jle 0x1800138ab
mov rax, qword [0x18004e4d8]
add byte [0x18004e396], al
movzx eax, word [0x18004e4e8]
mov word [0x1804c069e], ax
jmp 0x1800138cb
movzx edx, word [0x18004e4e4]
movzx eax, word [0x18004e4e4]
sub dx, ax
movsx eax, byte [rsp + 0x61]
sub dx, ax
mov word [0x18004e4e4], dx
movzx r14d, word [0x18004e4bc]
mov rax, qword [0x18004e4a8]
movzx eax, word [rsp + 0x6c]
mov eax, dword [0x1803ff7c0]
shr r14w, 4
mov dword [0x18004e47c], eax
test r13d, r13d
je 0x18001397e
movzx ecx, word [0x18004e484]
cmp rcx, qword [0x18004e430]
jbe 0x180013931
movzx ecx, word [0x18004e4e0]
movabs rax, 0xb99bebce67f0a
imul rcx, rax
mov rax, qword [0x18004e4d8]
sub rax, rcx
mov qword [0x18004e4d8], rax
jmp 0x180013989
test r9, r9
je 0x18001394e
movzx eax, word [0x18004e460]
mov ecx, 0x3329
sub ax, cx
mov word [0x18004e4a0], ax
jmp 0x180013989
test cx, cx
je 0x180013989
movzx eax, word [0x18004e4b8]
mov rcx, qword [rbp - 0x50]
not eax
cdqe
not rcx
xor rcx, rax
sub rcx, 0xe0
mov qword [0x18004e4a8], rcx
mov eax, dword [0x18004e468]
jmp 0x180013989
movzx eax, byte [rsp + 0x60]
xor eax, r9d
mov dword [rbp - 0x78], eax
xor edx, edx
lea rcx, [rbp + 0x10]
lea r8d, [rdx + 0x58]
call fcn.18002b7c0
movsxd rax, dword [rsp + 0x74]
xor r9d, r9d
mov qword [rsp + 0x40], rdi
mov rdx, r12
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
lea r8d, [r9 + 4]
mov qword [rbp - 0x40], rdi
mov qword [rsp + 0x20], rdi
lea rdi, [sub.mozglue.dll_export_full.dll_Ordinal_127]
mov rcx, rdi
mov qword [rbp - 0x80], rax
call fcn.18000b68c
mov rsi, rax
xor r9d, r9d
xor eax, eax
mov rdx, rbx
mov qword [rsp + 0x40], rax
mov rcx, rdi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea r8d, [rax + 4]
mov qword [rsp + 0x20], rax
call fcn.18000b68c
mov rbx, rax
xor r9d, r9d
xor eax, eax
mov rdx, r15
mov qword [rsp + 0x40], rax
mov rcx, rdi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea r8d, [rax + 4]
mov qword [rsp + 0x20], rax
call fcn.18000b68c
mov r8, qword [rbp - 0x70]
mov rdi, rax
xor eax, eax
mov r9, r12
mov qword [rsp + 0x40], rax
lea r12, [0x18002cd34]
mov qword [rsp + 0x38], rax
mov rdx, rsi
mov qword [rsp + 0x30], rax
mov rcx, r12
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call fcn.18000b68c
mov r9, qword [rbp - 0x68]
xor eax, eax
mov r8, qword [rbp - 0x38]
mov rdx, rbx
mov qword [rsp + 0x40], rax
mov rcx, r12
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call fcn.18000b68c
mov r8, qword [rbp - 0x30]
xor eax, eax
mov qword [rsp + 0x40], rax
mov r9, r15
mov qword [rsp + 0x38], rax
mov rdx, rdi
mov qword [rsp + 0x30], rax
mov rcx, r12
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call fcn.18000b68c
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov rcx, qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rdx, [rbp - 0x18]
mov qword [rsp + 0x28], r15
xor r9d, r9d
mov r8, rsi
mov qword [rsp + 0x20], r15
call fcn.18000b68c
mov rdx, rdi
lea rcx, [rbp - 8]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rbp - 8]
xor r9d, r9d
lea edi, [r15 + 1]
xor r8d, r8d
mov dword [rsp + 0x50], edi
lea rdx, [rbp - 0x18]
mov qword [rsp + 0x48], r15
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_RtlCreateProcessParametersEx]
mov ecx, dword [rsp + 0x68]
mov ebx, eax
imul edx, ecx, 0x3b2
mov ecx, dword [rsp + 0x70]
add ecx, edx
cmp ecx, 0x654
je 0x180013ce9
movzx edx, word [rbp - 0x80]
mov eax, 0x6f2c
imul edx, eax
mov word [rsp + 0x64], dx
test ebx, ebx
jns 0x180013ce9
cmp byte [0x18004e367], 0x25
ja 0x180013be5
movzx r8d, word [rsp + 0x64]
mov edx, 0xe0
movzx ecx, word [rsp + 0x6c]
call fcn.1800147c0
mov r14b, al
test al, al
jg 0x180013bde
mov r8d, 0x295
mov al, byte [rsp + 0x60]
mov eax, dword [0x18004e468]
mov rdx, qword [rbp - 0x48]
movsx rcx, byte [rsp + 0x78]
sub rdx, rax
imul ecx, edx
not ecx
mov dword [0x18004e480], ecx
movzx eax, word [rsp + 0x6c]
add ax, di
mov word [rsp + 0x6c], ax
sub r8, rdi
jne 0x180013ba8
jmp 0x180013bf8
mov byte [rsp + 0x60], 0x9b
jmp 0x180013bf8
movzx ecx, byte [0x18004e353]
mov rax, qword [rbp - 0x50]
add al, cl
mov byte [0x18004e353], al
mov eax, dword [0x1803ff7c0]
xor ecx, ecx
mov dword [rsp + 0x74], eax
mov rax, qword [rbp - 0x60]
mov eax, dword [rsp + 0x7c]
add al, 0x36
mov qword [rsp + 0x30], 0x24
mov byte [0x18004e356], al
lea eax, [r13 + 0x72]
mov dword [0x18004e478], eax
mov eax, dword [rsp + 0x74]
add eax, 0x2f3
mov qword [rsp + 0x28], r15
mov dword [rbp - 0x80], eax
movsx r9, byte [rsp + 0x61]
mov rax, qword [rbp - 0x48]
mov r8, qword [rbp - 0x48]
movzx edx, byte [0x18004e396]
mov qword [rsp + 0x20], rax
call fcn.180014668
mov byte [rsp + 0x60], al
mov al, byte [rsp + 0x60]
test al, al
jne 0x180013c7d
mov eax, 0xa97a
mov word [rsp + 0x64], ax
mov rax, qword [0x18004e488]
mov qword [0x18004e448], rax
jmp 0x180013ca4
cmp qword [0x18004e430], r15
mov ecx, r15d
mov eax, dword [rsp + 0x7c]
sete cl
add eax, ecx
mov rcx, r15
mov rax, qword [rbp - 0x60]
sete cl
sub rax, rcx
mov qword [0x18004e470], rax
mov eax, dword [rsp + 0x74]
add eax, 0x2ab
mov dword [rsp + 0x70], eax
mov eax, dword [0x18004e47c]
mov eax, dword [rsp + 0x74]
add eax, 0x343
mov qword [0x18004e428], 2
mov dword [rbp - 0x68], eax
mov ecx, dword [rbp - 0x80]
mov eax, dword [rbp - 0x80]
imul ecx, eax
mov eax, dword [rsp + 0x70]
imul ecx, ecx, 0x118
cmp ecx, eax
jne 0x180013e28
mov qword [rbp + 0x10], 0x58
mov ebx, 8
mov dword [rbp + 0x18], r15d
mov edx, ebx
mov rcx, qword gs:[0x60]
lea r8d, [rbx + 0x58]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
mov qword [rax], 0x28
mov qword [rax + 8], 0x20005
movzx ecx, word [rbp - 0x18]
mov qword [rax + 0x10], rcx
mov rcx, qword [rbp - 0x10]
mov qword [rax + 0x18], rcx
mov ecx, dword [rbp - 0x58]
test ecx, ecx
je 0x180013d74
mov r8d, dword [rbp - 0x78]
movsx edx, r14b
cmp edx, r8d
je 0x180013d5f
mov al, byte [rsp + 0x61]
test al, al
je 0x180013d5f
movzx eax, word [0x18004e45c]
movzx eax, word [0x18004e4bc]
call fcn.18000f40c
mov qword [rdi + 0x38], rax
mov qword [rdi + 0x28], 0x60000
mov qword [rdi + 0x30], rbx
mov rdx, qword [rbp - 0x28]
lea rax, [rbp + 0x10]
mov rcx, qword [rbp - 0x20]
mov r8d, 0x1fffff
mov qword [rsp + 0x50], rdi
mov r9d, r8d
mov qword [rsp + 0x48], rax
mov rax, qword [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov eax, dword [rbp + 0xf8]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp + 0xf0]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call fcn.180004a00
mov rdx, qword gs:[0x60]
mov r9, rdi
mov rcx, qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor r8d, r8d
mov qword [rsp + 0x40], r15
mov ebx, eax
mov qword [rsp + 0x38], r15
mov rdx, qword [rdx + 0x30]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call fcn.18000b68c
mov rdx, qword [rbp - 0x40]
xor r9d, r9d
mov rcx, qword [sym.imp.ntdll.dll_RtlDestroyProcessParameters]
xor r8d, r8d
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call fcn.18000b68c
mov eax, ebx
add rsp, 0x178
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret