Function at 0x1400e9290
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x58]
sub rsp, 0x120
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x1401a7d98]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov r15, r8
mov qword [rsp + 0x78], rdx
mov rsi, rcx
mov qword [rsp + 0x58], rcx
lea rcx, [rbp - 8]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop dword [rax + rax]
nop
mov rax, qword [r15]
mov rcx, r15
mov rax, qword [rax + 0x18]
call qword [case.0x14010a1e6.0]
mov r13d, eax
lea r12, [rsi + 0x30]
mov rbx, qword [r12]
test rbx, rbx
je 0x1400e9307
mov rbx, qword [rbx]
and qword [rsp + 0x50], 0
mov edi, 8
cmp word [rbp - 8], di
jne 0x1400e9328
mov rdx, qword [rbp]
lea rcx, [rsp + 0x50]
call fcn.1400d4650
jmp 0x1400e937b
lea rcx, [rbp - 0x30]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop dword [rax + rax]
nop
mov r9d, edi
xor r8d, r8d
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x30]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
nop dword [rax + rax]
test eax, eax
js 0x1400e9814
mov rdx, qword [rbp - 0x28]
lea rcx, [rsp + 0x50]
call fcn.1400d4650
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop dword [rax + rax]
nop
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x1400e938a
mov r8, qword [rax]
jmp 0x1400e938d
xor r8d, r8d
mov dword [rsp + 0x20], r13d
mov r9, rbx
lea rdx, str.Found_type_library_in_file__ls__guid__ls__contains__d_types__n
mov ecx, 1
call fcn.1400e2f04
nop
lea rcx, [rsp + 0x50]
call fcn.1400d3c1c
xor r14d, r14d
test r13d, r13d
je 0x1400e97c6
and qword [rsp + 0x48], 0
xor ebx, ebx
mov qword [rsp + 0x40], rbx
and qword [rbp - 0x48], rbx
and qword [rbp - 0x18], rbx
mov rax, qword [r15]
lea r8, [rbp - 0x10]
mov edx, r14d
mov rcx, r15
mov rax, qword [rax + 0x28]
call qword [case.0x14010a1e6.0]
test eax, eax
jns 0x1400e93f2
jmp 0x1400e978e
mov rax, qword [r15]
mov rdi, qword [rax + 0x20]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400e940f
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x10]
call qword [case.0x14010a1e6.0]
and qword [rbp - 0x18], 0
lea r8, [rbp - 0x18]
mov edx, r14d
mov rcx, r15
mov rax, rdi
call qword [case.0x14010a1e6.0]
test eax, eax
jns 0x1400e9430
jmp 0x1400e978e
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400e9809
mov rax, qword [rcx]
lea rdx, [rbp - 0x48]
mov rax, qword [rax + 0x18]
call qword [case.0x14010a1e6.0]
test eax, eax
jns 0x1400e9457
jmp 0x1400e978e
mov rax, qword [r15]
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x40]
mov edx, r14d
mov rcx, r15
mov rax, qword [rax + 0x48]
call qword [case.0x14010a1e6.0]
test eax, eax
js 0x1400e957e
mov rdi, qword [rbp - 0x40]
test rdi, rdi
je 0x1400e9502
mov rax, qword gs:[0x60]
xor edx, edx
lea r8d, [rdx + 0x18]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
mov qword [rbp - 0x68], rax
test rax, rax
je 0x1400e94cb
and qword [rax + 8], 0
mov dword [rax + 0x10], 1
mov qword [rax], rdi
jmp 0x1400e94cd
xor ebx, ebx
mov qword [rsp + 0x68], rbx
test rbx, rbx
je 0x1400e981c
lea rcx, [rsp + 0x48]
call fcn.1400d3c1c
mov qword [rsp + 0x48], rbx
lock inc dword [rbx + 0x10]
lea rcx, [rsp + 0x68]
call fcn.1400d3c1c
and qword [rbp - 0x40], 0
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rbp - 0x38]
test rdi, rdi
je 0x1400e957e
mov rax, qword gs:[0x60]
xor edx, edx
lea r8d, [rdx + 0x18]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
mov qword [rbp - 0x60], rax
test rax, rax
je 0x1400e9547
and qword [rax + 8], 0
mov dword [rax + 0x10], 1
mov qword [rax], rdi
jmp 0x1400e9549
xor ebx, ebx
mov qword [rsp + 0x70], rbx
test rbx, rbx
je 0x1400e981c
lea rcx, [rsp + 0x40]
call fcn.1400d3c1c
mov qword [rsp + 0x40], rbx
lock inc dword [rbx + 0x10]
lea rcx, [rsp + 0x70]
call fcn.1400d3c1c
and qword [rbp - 0x38], 0
mov rbx, qword [rsp + 0x40]
mov edi, dword [rbp - 0x10]
lea eax, [rdi - 3]
cmp eax, 1
jbe 0x1400e9712
cmp edi, 5
jne 0x1400e9763
mov rax, qword [rbp - 0x48]
movups xmm0, xmmword [rax]
movdqu xmmword [rbp - 0x80], xmm0
xor edi, edi
cmp qword [rsi + 0x20], rdi
jbe 0x1400e95d5
mov rdx, qword [rsi + 0x10]
mov rcx, rdx
mov r8, qword [rbp - 0x78]
mov r9, qword [rbp - 0x80]
mov rax, qword [rcx]
cmp qword [rax + 0x18], r9
jne 0x1400e95c8
cmp qword [rax + 0x20], r8
je 0x1400e9640
inc rdi
add rcx, 8
cmp rdi, qword [rsi + 0x20]
jb 0x1400e95b9
xor edi, edi
test rdi, rdi
jne 0x1400e9695
mov rax, qword gs:[0x60]
xor edx, edx
lea r8d, [rdi + 0x58]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rdi, rax
mov qword [rbp - 0x58], rax
xor ecx, ecx
test rax, rax
je 0x1400e9646
lea rax, fcn.1400df270
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rcx
mov qword [rdi + 0x28], rcx
mov qword [rdi + 0x30], rcx
mov qword [rdi + 0x38], rcx
mov qword [rdi + 0x40], rcx
mov qword [rdi + 0x48], rcx
mov qword [rdi + 0x50], rcx
xorps xmm0, xmm0
movups xmmword [rdi + 0x18], xmm0
jmp 0x1400e9649
mov rdi, qword [rdx + rdi*8]
jmp 0x1400e95d7
mov rdi, rcx
mov rdx, qword [rsi + 0x20]
lea rcx, [rsi + 0x10]
call fcn.1400e3230
mov qword [rax], rdi
mov rbx, qword [r12]
test rbx, rbx
je 0x1400e967c
mov r8, qword [rbx + 8]
test r8, r8
jne 0x1400e967f
mov rcx, qword [rbx]
call fcn.1400f74b8
mov qword [rbx + 8], rax
mov r8, rax
jmp 0x1400e967f
xor r8d, r8d
lea rdx, str.CManGenLib.ProcessTlb::Appending_class__S_n
mov ecx, 1
call fcn.1400e2f04
mov rbx, qword [rsp + 0x40]
lea rsi, [rdi + 0x10]
lea rax, [rsp + 0x40]
cmp rsi, rax
je 0x1400e96b7
mov rcx, rsi
call fcn.1400d3c1c
mov qword [rsi], rbx
test rbx, rbx
je 0x1400e96b7
lock inc dword [rbx + 0x10]
mov rax, qword [rbp - 0x48]
movups xmm0, xmmword [rax]
movdqu xmmword [rdi + 0x18], xmm0
lea rbx, [rdi + 8]
lea rax, [rsp + 0x48]
cmp rbx, rax
je 0x1400e96ea
mov rcx, rbx
call fcn.1400d3c1c
mov rax, qword [rsp + 0x48]
mov qword [rbx], rax
test rax, rax
je 0x1400e96ea
lock inc dword [rax + 0x10]
add rdi, 0x28
cmp rdi, r12
je 0x1400e975e
mov rcx, rdi
call fcn.1400d3c1c
mov rax, qword [r12]
mov qword [rdi], rax
mov rsi, qword [rsp + 0x58]
test rax, rax
je 0x1400e9763
lock inc dword [rax + 0x10]
jmp 0x1400e9763
mov rax, qword [rbp - 0x48]
mov ecx, 0x140
test word [rax + 0x3a], cx
setne bl
lea rax, [rsp + 0x60]
mov qword [rbp - 0x50], rax
mov rcx, qword [rbp - 0x18]
mov qword [rsp + 0x60], rcx
test rcx, rcx
je 0x1400e9747
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14010a1e6.0]
nop
mov r9b, bl
mov r8d, edi
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
call fcn.1400dfb00
jmp 0x1400e9763
mov rsi, qword [rsp + 0x58]
mov rdx, qword [rbp - 0x48]
test rdx, rdx
je 0x1400e978e
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400e97fe
mov rax, qword [rcx]
mov rax, qword [rax + 0x98]
call qword [case.0x14010a1e6.0]
and qword [rbp - 0x48], 0
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400e97a5
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14010a1e6.0]
nop
lea rcx, [rsp + 0x40]
call fcn.1400d3c1c
nop
lea rcx, [rsp + 0x48]
call fcn.1400d3c1c
inc r14d
cmp r14d, r13d
jb 0x1400e93bd
lea rcx, [rbp - 8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.140109af0
mov rbx, qword [rsp + 0x178]
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004003
call fcn.1400f72d8
int3
mov ecx, 0x80004003
call fcn.1400f72d8
nop
mov ecx, eax
call fcn.1400f72d8
nop
mov ecx, 0x8007000e
call fcn.1400f72d8
int3