Function at 0x1400935b0
Capabilities:
Access peb ldr_data
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x140303960]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rax, qword gs:[0x58]
xor r15d, r15d
mov ecx, 0x165c
mov r14, rdx
mov dword [rsp + 0x60], 0x104
mov r9d, 0x13d8
mov rsi, qword [rax]
mov eax, dword [rcx + rsi]
test al, 1
jne 0x140093665
movups xmm0, xmmword [0x1402e1738]
or eax, 1
lea rdx, [rsp + 0x50]
mov dword [rcx + rsi], eax
mov r8d, r15d
mov eax, dword [0x1402e1748]
mov dword [rsp + 0x50], eax
xor eax, eax
mov ecx, r9d
add rcx, rsi
movaps xmmword [rsp + 0x40], xmm0
mov qword [rcx], r15
mov dword [rcx + 8], r15d
mov byte [rcx + 0xc], r15b
mov dword [rcx + 0x10], eax
lea rax, [rsp + 0x50]
sub rcx, rax
mov eax, dword [rdx]
inc r8d
mov dword [rcx + rdx + 0x10], eax
lea rdx, [rdx + 4]
cmp r8d, 1
jb 0x140093652
mov r8d, r9d
add r8, rsi
cmp byte [r8 + 0xc], r15b
jne 0x1400936d2
lea rcx, [r8 + 0x10]
mov r9d, r15d
nop dword [rax + rax]
mov eax, dword [r8 + 4]
mov edx, dword [r8]
lea r10d, [rax + 1]
cmp edx, r10d
je 0x1400936b7
lea r10d, [rax + 2]
cmp edx, r10d
je 0x1400936b7
cmp edx, eax
je 0x1400936bf
lea r10d, [rax + 4]
cmp edx, r10d
jne 0x1400936b0
add eax, 3
xor dword [rcx], eax
inc dword [r8]
jmp 0x140093680
add eax, 5
cmp edx, eax
jne 0x1400936c5
xor dword [rcx], r10d
inc dword [r8]
jmp 0x140093680
lea eax, [r9 - 0x7a]
xor dword [rcx], eax
inc r9d
add rcx, 4
cmp r9d, 1
jb 0x140093680
mov ebx, dword [r8 + 0x10]
mov byte [r8 + 0xc], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x60]
mov edx, ebx
mov rcx, rax
lea r8, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameA]
mov ecx, 0x1ad4
mov r9d, 0x1580
mov eax, dword [rcx + rsi]
test al, 1
jne 0x140093763
movups xmm0, xmmword [0x1402e17b0]
or eax, 1
lea rdx, [rsp + 0x50]
mov dword [rcx + rsi], eax
mov r8d, r15d
mov eax, dword [0x1402e17c0]
mov dword [rsp + 0x50], eax
xor eax, eax
mov ecx, r9d
add rcx, rsi
movaps xmmword [rsp + 0x40], xmm0
mov qword [rcx], r15
mov dword [rcx + 8], r15d
mov byte [rcx + 0xc], r15b
mov dword [rcx + 0x10], eax
lea rax, [rsp + 0x50]
sub rcx, rax
nop word [rax + rax]
mov eax, dword [rdx]
inc r8d
mov dword [rcx + rdx + 0x10], eax
lea rdx, [rdx + 4]
cmp r8d, 1
jb 0x140093750
mov r8d, r9d
add r8, rsi
cmp byte [r8 + 0xc], r15b
jne 0x1400937d2
lea rcx, [r8 + 0x10]
mov r9d, r15d
nop word [rax + rax]
mov eax, dword [r8 + 4]
mov edx, dword [r8]
lea r10d, [rax + 1]
cmp edx, r10d
je 0x1400937b7
lea r10d, [rax + 2]
cmp edx, r10d
je 0x1400937b7
cmp edx, eax
je 0x1400937bf
lea r10d, [rax + 4]
cmp edx, r10d
jne 0x1400937b0
add eax, 3
xor dword [rcx], eax
inc dword [r8]
jmp 0x140093780
add eax, 5
cmp edx, eax
jne 0x1400937c5
xor dword [rcx], r10d
inc dword [r8]
jmp 0x140093780
lea eax, [r9 - 0x79]
xor dword [rcx], eax
inc r9d
add rcx, 4
cmp r9d, 1
jb 0x140093780
mov edi, dword [r8 + 0x10]
mov ecx, 0x14c4
mov byte [r8 + 0xc], 1
mov r9d, 0x1898
mov eax, dword [rcx + rsi]
test al, 1
jne 0x140093843
movups xmm0, xmmword [0x1402e1540]
or eax, 1
lea rdx, [rsp + 0x50]
mov dword [rcx + rsi], eax
mov r8d, r15d
mov eax, dword [0x1402e1550]
mov dword [rsp + 0x50], eax
xor eax, eax
mov ecx, r9d
add rcx, rsi
movaps xmmword [rsp + 0x40], xmm0
mov qword [rcx], r15
mov dword [rcx + 8], r15d
mov byte [rcx + 0xc], r15b
mov dword [rcx + 0x10], eax
lea rax, [rsp + 0x50]
sub rcx, rax
nop
mov eax, dword [rdx]
inc r8d
mov dword [rcx + rdx + 0x10], eax
lea rdx, [rdx + 4]
cmp r8d, 1
jb 0x140093830
mov r8d, r9d
add r8, rsi
cmp byte [r8 + 0xc], r15b
jne 0x1400938b2
lea rcx, [r8 + 0x10]
mov r9d, r15d
nop word [rax + rax]
mov eax, dword [r8 + 4]
mov edx, dword [r8]
lea r10d, [rax + 1]
cmp edx, r10d
je 0x140093897
lea r10d, [rax + 2]
cmp edx, r10d
je 0x140093897
cmp edx, eax
je 0x14009389f
lea r10d, [rax + 4]
cmp edx, r10d
jne 0x140093890
add eax, 3
xor dword [rcx], eax
inc dword [r8]
jmp 0x140093860
add eax, 5
cmp edx, eax
jne 0x1400938a5
xor dword [rcx], r10d
inc dword [r8]
jmp 0x140093860
lea eax, [r9 - 0x79]
xor dword [rcx], eax
inc r9d
add rcx, 4
cmp r9d, 1
jb 0x140093860
mov ebx, dword [r8 + 0x10]
mov ecx, 0x160c
mov byte [r8 + 0xc], 1
mov r9d, 0x1468
mov eax, dword [rcx + rsi]
test al, 1
jne 0x140093923
movups xmm0, xmmword [0x1402e1c60]
or eax, 1
lea rdx, [rsp + 0x50]
mov dword [rcx + rsi], eax
mov r8d, r15d
mov eax, dword [0x1402e1c70]
mov dword [rsp + 0x50], eax
xor eax, eax
mov ecx, r9d
add rcx, rsi
movaps xmmword [rsp + 0x40], xmm0
mov qword [rcx], r15
mov dword [rcx + 8], r15d
mov byte [rcx + 0xc], r15b
mov dword [rcx + 0x10], eax
lea rax, [rsp + 0x50]
sub rcx, rax
nop
mov eax, dword [rdx]
inc r8d
mov dword [rcx + rdx + 0x10], eax
lea rdx, [rdx + 4]
cmp r8d, 1
jb 0x140093910
mov r8d, r9d
add r8, rsi
cmp byte [r8 + 0xc], r15b
jne 0x140093992
lea rcx, [r8 + 0x10]
mov r9d, r15d
nop word [rax + rax]
mov eax, dword [r8 + 4]
mov edx, dword [r8]
lea r10d, [rax + 1]
cmp edx, r10d
je 0x140093977
lea r10d, [rax + 2]
cmp edx, r10d
je 0x140093977
cmp edx, eax
je 0x14009397f
lea r10d, [rax + 4]
cmp edx, r10d
jne 0x140093970
add eax, 3
xor dword [rcx], eax
inc dword [r8]
jmp 0x140093940
add eax, 5
cmp edx, eax
jne 0x140093985
xor dword [rcx], r10d
inc dword [r8]
jmp 0x140093940
lea eax, [r9 - 0x7a]
xor dword [rcx], eax
inc r9d
add rcx, 4
cmp r9d, 1
jb 0x140093940
mov r11d, dword [r8 + 0x10]
mov ecx, 0x163c
mov byte [r8 + 0xc], 1
mov r9d, 0x1410
mov eax, dword [rcx + rsi]
test al, 1
jne 0x140093a03
movups xmm0, xmmword [0x1402e17c8]
or eax, 1
lea rdx, [rsp + 0x50]
mov dword [rcx + rsi], eax
mov r8d, r15d
mov eax, dword [0x1402e17d8]
mov dword [rsp + 0x50], eax
xor eax, eax
mov ecx, r9d
add rcx, rsi
movaps xmmword [rsp + 0x40], xmm0
mov qword [rcx], r15
mov dword [rcx + 8], r15d
mov byte [rcx + 0xc], r15b
mov dword [rcx + 0x10], eax
lea rax, [rsp + 0x50]
sub rcx, rax
nop
mov eax, dword [rdx]
inc r8d
mov dword [rcx + rdx + 0x10], eax
lea rdx, [rdx + 4]
cmp r8d, 1
jb 0x1400939f0
mov r10d, r9d
add r10, rsi
cmp byte [r10 + 0xc], r15b
jne 0x140093a72
lea rcx, [r10 + 0x10]
mov r8d, r15d
nop word [rax + rax]
mov eax, dword [r10 + 4]
mov edx, dword [r10]
lea r9d, [rax + 1]
cmp edx, r9d
je 0x140093a57
lea r9d, [rax + 2]
cmp edx, r9d
je 0x140093a57
cmp edx, eax
je 0x140093a5f
lea r9d, [rax + 4]
cmp edx, r9d
jne 0x140093a50
add eax, 3
xor dword [rcx], eax
inc dword [r10]
jmp 0x140093a20
add eax, 5
cmp edx, eax
jne 0x140093a65
xor dword [rcx], r9d
inc dword [r10]
jmp 0x140093a20
lea eax, [r8 - 0x7a]
xor dword [rcx], eax
inc r8d
add rcx, 4
cmp r8d, 1
jb 0x140093a20
mov edx, dword [r10 + 0x10]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], edi
mov r8d, r11d
mov dword [rsp + 0x20], ebx
mov byte [r10 + 0xc], 1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140093d70
mov eax, 0x19e4
mov r9d, 0x15f8
mov ecx, dword [rax + rsi]
test cl, 1
jne 0x140093b13
movups xmm0, xmmword [0x1402e1b40]
or ecx, 1
lea rdx, [rsp + 0x50]
mov dword [rax + rsi], ecx
mov r8d, r15d
mov eax, dword [0x1402e1b50]
mov dword [rsp + 0x50], eax
xor eax, eax
mov ecx, r9d
add rcx, rsi
movaps xmmword [rsp + 0x40], xmm0
mov qword [rcx], r15
mov dword [rcx + 8], r15d
mov byte [rcx + 0xc], r15b
mov dword [rcx + 0x10], eax
lea rax, [rsp + 0x50]
sub rcx, rax
nop
mov eax, dword [rdx]
inc r8d
mov dword [rcx + rdx + 0x10], eax
lea rdx, [rdx + 4]
cmp r8d, 1
jb 0x140093b00
mov r8d, r9d
add r8, rsi
cmp byte [r8 + 0xc], r15b
jne 0x140093b82
lea rcx, [r8 + 0x10]
mov r9d, r15d
nop word [rax + rax]
mov eax, dword [r8 + 4]
mov edx, dword [r8]
lea r10d, [rax + 1]
cmp edx, r10d
je 0x140093b67
lea r10d, [rax + 2]
cmp edx, r10d
je 0x140093b67
cmp edx, eax
je 0x140093b6f
lea r10d, [rax + 4]
cmp edx, r10d
jne 0x140093b60
add eax, 3
xor dword [rcx], eax
inc dword [r8]
jmp 0x140093b30
add eax, 5
cmp edx, eax
jne 0x140093b75
xor dword [rcx], r10d
inc dword [r8]
jmp 0x140093b30
lea eax, [r9 - 0x78]
xor dword [rcx], eax
inc r9d
add rcx, 4
cmp r9d, 1
jb 0x140093b30
mov ebx, dword [r8 + 0x10]
mov ecx, 0x1430
mov byte [r8 + 0xc], 1
mov r9d, 0x13f8
mov eax, dword [rcx + rsi]
test al, 1
jne 0x140093bf3
movups xmm0, xmmword [0x1402e1b40]
or eax, 1
lea rdx, [rsp + 0x50]
mov dword [rcx + rsi], eax
mov r8d, r15d
mov eax, dword [0x1402e1b50]
mov dword [rsp + 0x50], eax
xor eax, eax
mov ecx, r9d
add rcx, rsi
movaps xmmword [rsp + 0x40], xmm0
mov qword [rcx], r15
mov dword [rcx + 8], r15d
mov byte [rcx + 0xc], r15b
mov dword [rcx + 0x10], eax
lea rax, [rsp + 0x50]
sub rcx, rax
nop
mov eax, dword [rdx]
inc r8d
mov dword [rcx + rdx + 0x10], eax
lea rdx, [rdx + 4]
cmp r8d, 1
jb 0x140093be0
mov r8d, r9d
add r8, rsi
cmp byte [r8 + 0xc], r15b
jne 0x140093c62
lea rcx, [r8 + 0x10]
mov r9d, r15d
nop word [rax + rax]
mov eax, dword [r8 + 4]
mov edx, dword [r8]
lea r10d, [rax + 1]
cmp edx, r10d
je 0x140093c47
lea r10d, [rax + 2]
cmp edx, r10d
je 0x140093c47
cmp edx, eax
je 0x140093c4f
lea r10d, [rax + 4]
cmp edx, r10d
jne 0x140093c40
add eax, 3
xor dword [rcx], eax
inc dword [r8]
jmp 0x140093c10
add eax, 5
cmp edx, eax
jne 0x140093c55
xor dword [rcx], r10d
inc dword [r8]
jmp 0x140093c10
lea eax, [r9 - 0x78]
xor dword [rcx], eax
inc r9d
add rcx, 4
cmp r9d, 1
jb 0x140093c10
mov r11d, dword [r8 + 0x10]
mov ecx, 0x1a28
mov byte [r8 + 0xc], 1
mov r9d, 0x1a70
mov eax, dword [rcx + rsi]
test al, 1
jne 0x140093cd3
movups xmm0, xmmword [0x1402e1c48]
or eax, 1
lea rdx, [rsp + 0x50]
mov dword [rcx + rsi], eax
mov r8d, r15d
mov eax, dword [0x1402e1c58]
mov dword [rsp + 0x50], eax
xor eax, eax
mov ecx, r9d
add rcx, rsi
movaps xmmword [rsp + 0x40], xmm0
mov qword [rcx], r15
mov dword [rcx + 8], r15d
mov byte [rcx + 0xc], r15b
mov dword [rcx + 0x10], eax
lea rax, [rsp + 0x50]
sub rcx, rax
nop
mov eax, dword [rdx]
inc r8d
mov dword [rcx + rdx + 0x10], eax
lea rdx, [rdx + 4]
cmp r8d, 1
jb 0x140093cc0
mov r8d, r9d
add r8, rsi
cmp byte [r8 + 0xc], r15b
jne 0x140093d42
lea rcx, [r8 + 0x10]
mov r9d, r15d
nop word [rax + rax]
mov eax, dword [r8 + 4]
mov edx, dword [r8]
lea r10d, [rax + 1]
cmp edx, r10d
je 0x140093d27
lea r10d, [rax + 2]
cmp edx, r10d
je 0x140093d27
cmp edx, eax
je 0x140093d2f
lea r10d, [rax + 4]
cmp edx, r10d
jne 0x140093d20
add eax, 3
xor dword [rcx], eax
inc dword [r8]
jmp 0x140093cf0
add eax, 5
cmp edx, eax
jne 0x140093d35
xor dword [rcx], r10d
inc dword [r8]
jmp 0x140093cf0
lea eax, [r9 - 0x78]
xor dword [rcx], eax
inc r9d
add rcx, 4
cmp r9d, 1
jb 0x140093cf0
mov byte [r8 + 0xc], 1
mov r9d, r11d
mov r8d, dword [r8 + 0x10]
xor edx, edx
mov qword [rsp + 0x28], r15
mov rcx, rdi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test rax, rax
jne 0x140093da6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r14 + 8], r15
mov qword [r14], r15
mov rax, r14
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1402376c0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [r14 + 8], rax
mov qword [r14], rdi
jmp 0x140093d77