Function at 0x14005c0c0
Capabilities:
Access pe header
Access peb ldr_data
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov dword [r11 + 0x18], r8d
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov edi, r8d
mov r13, rdx
mov r15, rcx
mov esi, r8d
mov dword [rsp + 0x30], r8d
mov r14, qword [rsp + 0xd8]
mov qword [rsp + 0x38], r14
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x40], rax
xor ebx, ebx
cmp qword [r11 + 0x28], rbx
je 0x14005c12a
mov eax, 0xc00000f3
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov qword [rcx], 0
test rdx, rdx
je 0x14005c13d
mov qword [rdx], 0
bt r8d, 0x1e
jb 0x14005c16e
lea rdx, [rsp + 0xd0]
mov rcx, r9
call fcn.14005ca50
mov r12d, 0xc000007b
test al, al
cmove ebx, r12d
mov dword [rsp + 0x34], ebx
mov rax, qword [rsp + 0xe0]
jmp 0x14005c174
mov r12d, 0xc000007b
jmp 0x14005c1a7
test ebx, ebx
js 0x14005c42f
and edi, 0x10000000
mov ecx, edi
cmove ecx, esi
mov dword [rsp + 0x30], ecx
xor esi, esi
test edi, edi
cmove rsi, r14
mov qword [rsp + 0x40], rsi
xor edx, edx
test edi, edi
cmove rdx, rax
mov qword [rsp + 0x48], rdx
test cl, 4
je 0x14005c1ef
test rsi, rsi
je 0x14005c3b9
test rdx, rdx
je 0x14005c3b9
test rsi, rsi
je 0x14005c2c6
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r14, rax
test rax, rax
je 0x14005c4f7
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rbx, qword [rcx + 0x18]
add rbx, 0x10
mov qword [rsp + 0x38], rbx
mov rdi, qword [rbx]
cmp rdi, rbx
je 0x14005c2c6
mov rax, rbx
nop dword [rax + rax]
mov rbx, rdi
mov rdi, qword [rdi]
cmp qword [rbx + 0x10], 0
je 0x14005c2bd
movzx r8d, word [rbx + 0x58]
shr r8, 1
sub r8, 4
mov rdx, qword [rbx + 0x60]
mov rcx, rsi
call fcn.14018e700
test eax, eax
je 0x14005c281
movzx r8d, word [rbx + 0x58]
shr r8, 1
mov rdx, qword [rbx + 0x60]
mov rcx, rsi
call fcn.14018e700
test eax, eax
jne 0x14005c2b8
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov rsi, rax
test rax, rax
je 0x14005c2b3
mov rcx, qword [rbx + 0x30]
call fcn.14005ab70
test rax, rax
je 0x14005c2b3
mov ecx, dword [rsi + 0x1c]
cmp dword [r14 + 0x1c], ecx
jne 0x14005c2b3
mov ecx, dword [rsi + 0x54]
cmp dword [r14 + 0x54], ecx
je 0x14005c320
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
cmp rdi, rax
jne 0x14005c240
mov r8d, dword [rsp + 0xd0]
mov rdx, qword [rsp + 0xc8]
mov rcx, r15
call fcn.14005a3f0
mov ebx, eax
test eax, eax
js 0x14005c66a
cmp eax, 0x4000000e
je 0x14005c66a
mov rcx, qword [r15]
call fcn.14005ab70
mov r14, rax
test rax, rax
jne 0x14005c3ce
mov ecx, 7
int 0x29
call qword [sym.imp.KERNEL32.dll_DebugBreak]
mov ecx, 0xc0000141
call qword [sym.imp.KERNEL32.dll_ExitProcess]
test byte [rax + 0xe], 8
je 0x14005c3b9
mov eax, dword [rsp + 0x30]
test al, 2
jne 0x14005c3b9
call fcn.14005eca0
dec eax
cmp eax, 7
ja case.default.0x14005c355
cdqe
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x5c67c]
add rcx, rdx
jmp rcx
movzx eax, word [rbx + 0x6c]
mov ecx, 0xffff
cmp ax, cx
je case.default.0x14005c355
inc ax
mov word [rbx + 0x6c], ax
jmp case.default.0x14005c355
movzx eax, word [rbx + 0x6c]
mov ecx, 0xffff
cmp ax, cx
je 0x14005c383
inc ax
mov word [rbx + 0x6c], ax
mov rcx, qword [rbx + 0x98]
mov eax, dword [rcx + 0x18]
cmp eax, 0xffffffff
je case.default.0x14005c355
inc eax
mov dword [rcx + 0x18], eax
mov rax, qword [rbx + 0x30]
mov qword [r15], rax
test r13, r13
je 0x14005c3a7
mov qword [r13], rbx
xor eax, eax
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov eax, 0xc00000f1
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
or byte [rax + 0xc], 2
mov rcx, qword [r15]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov qword [rsp + 0x40], rax
movzx ecx, word [rax + 0x5e]
mov eax, 0x400
mov edi, dword [rsp + 0x30]
or edi, 1
and cx, ax
cmove edi, dword [rsp + 0x30]
mov dword [rsp + 0xd0], edi
bt edi, 0x1c
jae 0x14005c441
mov rcx, r14
call fcn.14005ccc0
test eax, eax
je 0x14005c422
mov edx, 1
mov rcx, r14
call fcn.14005cd30
test eax, eax
jne 0x14005c42f
mov ebx, 0xc0000142
mov rcx, qword [r15]
call fcn.14005aa90
mov eax, ebx
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rbx, qword [r15]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x14005c4e6
xor r12d, r12d
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x14005c477
call fcn.14005e890
mov rcx, rax
call fcn.14005e830
mov r12, rax
test r12, r12
je 0x14005c49f
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, rsi
call fcn.14005d720
mov rcx, r12
test al, al
jne 0x14005c4a7
call fcn.14005e860
mov r12d, 0xc0000017
jmp 0x14005c4e6
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
mov r8, rbx
mov edx, edi
call fcn.14005d330
test al, al
jne 0x14005c50a
mov rcx, r12
call fcn.14005e860
mov rcx, qword [rsp + 0x58]
call fcn.14005e860
mov rcx, qword [rsp + 0x68]
call fcn.14005e860
mov r12d, 0xc0000001
xor edx, edx
mov rcx, qword [r15]
call fcn.14005c7e0
mov qword [r15], 0
mov eax, r12d
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.14005eca0
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rsi, qword [rcx + 0x18]
call fcn.14005e6e0
mov rbx, rax
lea rdi, [r12 + 0x70]
lea rcx, [r12 + 0x58]
mov dl, 1
call fcn.14005e610
mov ecx, eax
shl rcx, 4
add rcx, rbx
mov rax, qword [rcx + 8]
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov qword [rax], rdi
mov qword [rcx + 8], rdi
lea rcx, [rsi + 0x10]
mov rax, qword [rcx + 8]
mov qword [r12], rcx
mov qword [r12 + 8], rax
mov qword [rax], r12
mov qword [rcx + 8], r12
lea rdx, [r12 + 0x10]
lea rcx, [rsi + 0x20]
mov rax, qword [rcx + 8]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov qword [rax], rdx
mov qword [rcx + 8], rdx
lea rdx, [r12 + 0x20]
lea rcx, [rsi + 0x30]
mov rax, qword [rcx + 8]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov qword [rax], rdx
mov qword [rcx + 8], rdx
xor edi, edi
mov ebx, edi
or word [r14 + 0xe], 1
test r13, r13
je 0x14005c5b5
mov qword [r13], r12
mov esi, dword [rsp + 0xd0]
test sil, 2
jne 0x14005c5c8
or word [r14 + 0xe], 8
test sil, 1
jne 0x14005c613
mov rax, qword [rsp + 0x40]
mov edx, dword [rax + 0x50]
mov rcx, qword [r14 + 0x10]
call fcn.14005dac0
mov ebx, eax
test eax, eax
jns 0x14005c60d
xor edx, edx
mov rcx, qword [r15]
call fcn.14005c7e0
mov qword [r15], rdi
test r13, r13
je 0x14005c5fb
mov qword [r13], rdi
mov eax, ebx
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
or word [r14 + 0xe], 2
test sil, 8
jne 0x14005c63a
mov rcx, r12
call fcn.14005eb40
mov ebx, eax
test eax, eax
jns 0x14005c634
bt esi, 0x1d
jae 0x14005c5e5
mov ebx, 0x7fffffff
jmp 0x14005c63a
or word [r14 + 0xe], 4
mov rcx, r14
call fcn.14005ccc0
test eax, eax
je 0x14005c65b
mov edx, 1
mov rcx, r14
call fcn.14005cd30
test eax, eax
jne 0x14005c42f
xor edx, edx
mov rcx, qword [r15]
call fcn.14005c7e0
mov eax, 0xc0000142
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret