Function at 0x1401a1c40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
cmp dword [0x14004d00c], 0
jmp 0x14019bf83
inc dword [0x14004d00c]
pushfq
call fcn.14019a2b8
stc
push r13w
mov word [rsp], r10w
call fcn.14019ae57
cmp eax, 0xb54623b3
adc al, 0x25
mov ah, 0x2a
movabs r12, 0xdaa360214d
add byte [rax], al
adc byte [rax], al
add byte [rax + 0x31], dl
add al, byte [rax]
je 0x14019a378
js 0x14019a389
and al, 0x6d
outsb dx, byte [rsi]
add byte [rax], al
add byte [rax], al
push rax
add al, byte [r8]
add byte [rax], al
add byte [rsi], ch
je 0x14019a38c
js 0x14019a39d
and al, 0x6d
outsb dx, byte [rsi]
and al, 0x30
xor byte [rax], al
nop
add al, byte [r8]
loopne 0x14019a339
add byte [rax], al
je 0x14019a3a0
je 0x14019a3a0
js 0x14019a3b1
and al, 0x78
add byte [rax], al
push rax
add al, byte [rax]
lock add eax, dword [rax]
add byte [rsi], ch
imul esp, dword [rcx + riz*2 + 0x74], reloc.USER32.dll_CreateWindowExW
add byte [rax], al
add al, dh
push rbx
add al, byte [rax]
sub byte [rax], al
add byte [rax], al
xor byte cs:[rax], dh
invalid
and byte [rdx + rax], dl
or byte [rax], al
add byte [rax], al
push r10
push rsp
and al, 0x58
add byte [r8], al
add byte [rax], al
add byte [rax], ch
push rsp
add al, byte [rax]
sub byte [rdx + rax], dl
or byte [rax], al
add byte [rax], al
push r10
push rsp
and al, 0x58
pop r10
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], dh
push rsp
add al, byte [rax]
xor byte [rdx + rax], dl
or byte [rax], al
add byte [rax], al
push r10
push rsp
and al, 0x58
add byte [r8], al
add byte [rax], al
cmp byte [rdx + rax], dl
add byte [rax], al
add byte [rax], bh
push rsp
add al, byte [rax]
or byte [rax], al
add byte [rax], al
push r10
push rsp
and al, 0x58
add byte [r8], al
add byte [rax + 0x54], al
add al, byte [rax]
or byte [rax], al
add byte [rax], al
push r10
push rsp
and al, 0x58
add byte [r8], al
add byte [rax + 0x54], cl
add al, byte [rax]
sub byte [rax], al
add byte [rax], al
push r10
push rsp
and al, 0x58
add byte [r8], al
add byte [rax], al
jo 0x14019a446
add al, byte [rax]
or byte [rax], al
add byte [rax], al
push r10
push rsp
and al, 0x58
pop r10
add byte [rax], al
add byte [rax], al
js 0x14019a45a
add al, byte [rax]
or byte [rax], al
add byte [rax], al
push r10
push rsp
and al, 0x58
push rax
add byte [r8], al
add byte [rax], al
adc byte [rdx + rax], 0x18
add byte [rax], al
add byte [rsi], ch
push r10
push rsp
and al, 0x58
push rax
pop rax
add byte [rax], al
add byte [rax], al
cwde
push rsp
add al, byte [rax]
or byte [rax], al
add byte [rax], al
push r10
push rsp
and al, 0x58
push rax
pop rax
add byte [r8], al
add byte [rax + 0x8000254], ah
add byte [rax], al
add byte [rsi], ch
push r10
add byte [rax], al
push r10
push rsp
and al, 0x58
push rax
pop rdx
add byte [rax], al
add byte [rax], al
test al, 0x54
add al, byte [rax]
or byte [rax], al
add byte [rax], al
push r10
push rsp
and al, 0x58
push rsp
add byte [r8], al
add byte [rax], al
mov al, 0x54
add al, byte [rax]
adc byte [rax], al
add byte [rax], al
push r10
push rsp
and al, 0x58
push rsp
pop rdx
add byte [rax], al
add byte [rax], al
rcl byte [rdx + rax], 0xc0
in eax, 0
add byte [rsi], ch
jb 0x14019a4eb
invalid
invalid
mov r8d, dword [rsp]
mov r8, qword [rsp + 0xa9]
lea rsp, [rsp + 0xb8]
jmp 0x14019bfd8
ror r8, cl
lea r8, [rsi + r12]
mov r8b, 0x17
lea r8, [rsi + rsi]
std
shl r8d, cl
jmp 0x14019bdb4
push r8
lea rsp, [rsp + 1]
call fcn.14019be69
pop qword [rsp + 0x1a]
lea rsp, [rsp + 0x16]
pop word [rsp + 7]
jmp 0x14019bfaa
je 0x14019a2d9
lea rsp, [rsp + 0x10]
add rsp, 8
jmp 0x14019bf44
mov qword [rsp + 5], r13
push word [rsp + 0xc]
pushfq
lea rsp, [rsp + 9]
jmp 0x14019c004
mov word [rsp + 0xa], r8w
pop word [rsp]
pop word [rsp + 4]
push word [rsp + 9]
push qword [rsp + 4]
mov qword [rsp + 6], r10
jmp 0x14019bf94
popfq
jmp 0x14019c349
mov word [rsp + 0xf], r10w
push qword [rsp + 6]
mov byte [rsp + 0x1b], r12b
jmp 0x14019c037
mov dword [rsp + 0x11], esi
push word [rsp + 7]
mov dword [rsp + 4], edi
mov byte [rsp + 8], bpl
mov dword [rsp + 7], edi
push word [rsp + 4]
jmp 0x14019bfee
pushfq
mov qword [rsp + 4], r10
pop qword [rsp + 0xb]
mov byte [rsp + 6], al
pop word [rsp + 0x17]
call fcn.14019c021
cmpsb byte [rsi], byte [rdi]
and dh, byte [rax - 0x1c33dd29]
sbb dh, byte [rbp + 0x64]
mov rbx, qword [rsp]
lea rsp, [rsp + 5]
add r8d, 0x386e8f63
stc
lea rsp, [rsp + 3]
mov rbx, qword [rsp + 0xa0]
jmp 0x14019bdce
lea rax, [0x14004eb35]
call fcn.14019c399
invalid
call 0x1401a1008
jmp 0x1401a1caf
pushfq
mov byte [rsp + 2], r12b
jmp 0x1401a1cd5
mov rax, qword [rax + riz]
mov rax, qword [rax + riz + 0x10]
push rax
jmp 0x1401a1003
mov rax, qword gs:[0x60]
mov rax, qword [rax + riz + 0x18]
mov rax, qword [rax + riz + 0x30]
jmp 0x1401a1c7a
pop rax
sub rax, 0x1a1008
push rax
jmp 0x14019a270
push qword [rsp + 0x14]
mov qword [rsp + 0xe], rbx
mov dword [rsp + 0x2d], esi
lea rsp, [rsp + 4]
lea rsp, [rsp + 0x38]
jmp 0x1401a1c9a