Function at 0x140130c06
Capabilities:
Access peb ldr_data

Disassembly:
mov al, byte [rdx - 0x75]
or al, 0x18
add rcx, r11
movzx eax, byte [rcx]
inc rcx
jmp 0x1401300ee
je 0x140130200
inc r8d
jmp 0x1401301f3
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1401300f9
cmp edx, 0xd985a5e4
jmp 0x1401300a9
test al, al
je 0x1401300af
nop dword [rax]
movsx eax, al
jmp 0x1401300b7
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1401302c8
mov rdi, qword [rax]
xchg rcx, rdi
mov r9, qword [rcx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
mov r11d, dword [rbx + r9 + 0x20]
nop dword [rax + rax]
jmp 0x1401302d6
test ah, al
add byte [rax], al
add byte [rcx - 1], al
shr cl, 0x6d
add byte [rax], al
add byte [rdx + 0xf], al
mov bh, 0x14
mov ecx, dword [rbx + r11 + 0x1c]
inc r8d
jmp 0x1401302d6
add rcx, r11
mov edi, dword [rcx + rdx*4]
je 0x1401302ae
jne 0x1401302ae
popf
jmp rcx
jmp 0x1401302f1
inc rcx
test al, al
je 0x140130261
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
jmp 0x140130219
mov r10d, r8d
mov edx, 0xdcedcaed
lea rax, [r9 + r10*4]
mov ecx, dword [rax + r11]
add rcx, r9
movzx eax, byte [rcx]
jmp 0x1401302ba
mov rcx, qword [rax + 0x18]
add rdi, r11
xchg rdx, rax
mov rdx, qword [rcx + 0x10]
xchg rdx, rax
xchg rdi, rcx
je 0x14013030b
jne 0x14013030b
jmp rax
jmp 0x140130230
test al, al
je 0x14013037b
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
jmp fcn.140130395
inc r8d
jmp 0x1401304ab
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
jmp 0x140130350
or r13d, 0xb799b8af
test r13d, 0xce5714a4
and ecx, 0x6d76d299
and ebp, 0xa27c94c9
inc rdi
call fcn.140130395
xchg rcx, r11
xchg r9, r13
mov r13, qword [rcx + 0x30]
xchg r9, r13
jne 0x14013047a
je 0x14013047a
pause
neg r11
bswap r13
test r11d, 0xe2de0dd6
jmp rax
jmp 0x140130496
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
mov r11d, dword [rbx + r9 + 0x20]
nop dword [rax]
mov r10d, r8d
mov edx, 0xc3efe229
lea rax, [r11 + r10*4]
add al, 0x93
jne 0x1401304ff
je 0x1401304ff
lea r13d, [rdi + 0x527b]
inc r14
jmp rcx
jmp 0x140130383
add r9, r10
mov byte [r9], 0xc3
test rbx, rbx
jmp 0x140130d86
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140130adc
jmp 0x140130c66
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rbx
mov rcx, qword [rsp + 0x30]
call rdi
jmp 0x140130bef
rdtsc
shl rdx, 0x18
loop 0x14013096c
jmp 0x140130a1a
sub r8, rcx
cmp r8, 0x4b
jb 0x140130af3
xchg rbx, rbp
jmp 0x140130aed
add rdi, r10
cmp rdi, r10
je 0x140130ae5
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140130ae5
jmp 0x140130e11
shl rdx, 1
shl rdx, 1
shl rdx, 1
or rax, rdx
xchg r9, r8
mov r9, rax
xchg r9, r8
jmp 0x140130c7e
jmp 0x140130dfc
mov qword [rbp + 0xd0], r13
lea rdx, [rsp + 0x48]
mov rcx, 0xffffffffffffffff
call r15
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
je 0x1401309fa
jne 0x1401309fa
rcr r9d, 0x92
movabs rdx, 0x624848000003f6e9
bswap rbp
call rax
lea r15d, [rbx - 0x490a]
jmp rax
jmp 0x140130df5
shl rdx, 7
shl rdx, 1
or rax, rdx
jmp 0x140130b8c
cmp r10, rcx
jb 0x14013094e
lea rax, [rbp + 0x20]
mov dword [rbp + 0x20], r13d
mov r9d, 0x20
jne 0x140130a56
je 0x140130a56
rcl r14d, 0x59
cmp edi, 0xad61571d
cmp r13, rbx
bswap r9
movabs r8, 0xa24150000026de9
push r13
jmp 0x140130cc8
or ebp, 0xc9f06346
call fcn.1401305d7
shr rcx, 1
shr rcx, 1
imul rcx, rcx, 0x64
jmp 0x140130977
je 0x140130e61
test r9d, r9d
jne 0x140130e20
mov rax, qword [rax]
jmp 0x1401309c4
mov rbp, r9
xchg rbp, rbx
mov rcx, qword [rsp + 0x48]
sub r10, 0x590abc86
add r10, 0x590acc86
add rcx, qword [rbp + 0xd0]
jmp 0x140130a29
lea r9d, [rdx + 0x7819]
call 0x140131342
xchg rbx, rax
mov r9, rbx
xchg rbx, rax
and r9d, 0xfff
jmp 0x1401308b3
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140130c68
cmp r8d, 0x99adc74c
jmp 0x140130ad6
test eax, eax
jne 0x140133725
mov r9d, 0x8000
xchg r12, r9
mov qword [rsp + 0x3a8], r9
add byte [rax], al
xchg r9, r12
lea r8, [rbp + 0xd0]
jmp 0x1401309c9
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
jmp 0x140130b9f
xchg r11, rdi
mov rax, rdi
xchg r11, rdi
mul r8
xchg r11, r8
mov rcx, r11
xchg r11, r8
je 0x140130cbd
xchg r13, rax
mov qword [rsp + 0x20], r13
xchg r13, rax
lea r8, [rbp + 0xd0]
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x48]
call r14
jmp 0x14013092c
je 0x140130984
rdtsc
shl rdx, 0xe
shl rdx, 0xc
shl rdx, 1
shl rdx, 2
je 0x140130dbc
jne 0x140130dbc
jb 0x140131085
ror ebp, 0x8b
jae 0x1401311b7
jmp 0x1401309aa
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
jmp 0x14013098c
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xab06c879
stosd dword [rdi], eax
lea rcx, [rbx + r9*4]
je 0x140130e42
jne 0x140130e42
jns 0x14013182f
call rcx
and r11d, 0x894105ac
movabs rdx, 0x2ca396fffffa7be9
jp 0x1401311dd
jmp 0x1401308c2
jge 0x14013108d
jge 0x1401310d5
jmp 0x140130f39
mov ecx, dword [rdi + 0x24]
add rcx, r10
mov dword [rsp + 0x30], 0xf6f6f6f6
mov dword [rsp + 0x3b], 0x7c6f7d7f
mov dword [rsp + 0x34], 0xf6f6f6f6
mov dword [rsp + 0x3f], 0x6e383c3d
movzx edx, word [rcx + r9*2]
je 0x140130e9f
jne 0x140130e9f
jmp rax
jmp 0x140130fa7
mov r8d, 0x800
call r9
xchg rcx, r9
mov rcx, rax
jmp 0x140130fb9
mov byte [rsp + rdx + 0x30], r13b
inc rdx
cmp rdx, 0xa
jb 0x140130eee
xor edx, edx
lea rcx, [rsp + 0x3b]
jmp 0x140130eb3
mov byte [rsp + 0x45], al
nop dword [rax + rax]
movzx eax, byte [rsp + rdx + 0x3b]
movzx ecx, byte [rsp + rdx + 0x30]
add cl, al
mov byte [rsp + rdx + 0x3b], cl
jmp 0x140130ec7
cmp ecx, 0x8a7f62cb
je 0x14013104a
inc r8d
jmp 0x140130fdb
imul ecx, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x140130f3c
jmp 0x140130f03
inc rdx
test al, al
je 0x140130f0f
nop dword [rax]
movsx eax, al
lea rdx, [rdx + 1]
xor eax, ecx
je 0x140130f7f
jne 0x140130f7f
cmp r9d, 0x3a15f260
ror r10d, 0xdb
pushfq
call rcx
lea edi, [rdx + 0x6503]
test ebx, 0x9154fe45
cpuid
rcr r10d, 0xb3
je 0x140130086
cmp r8d, 0x8b2fc5bb
test rcx, rdi
jmp rax
jmp 0x140130f17
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov word [rsp + 0x38], 0xf6f6
jmp 0x140131032
xchg r9, rcx
mov r8d, r13d
movsxd rcx, dword [rax + 0x3c]
mov r11d, dword [rcx + rax + 0x88]
add byte [rcx - 0x75], al
pop rsp
add esp, dword [rax]
nop word [rax + rax]
mov r10d, r8d
jmp 0x140130fe3
lea rcx, [rbx + r10*4]
mov edx, dword [rcx + r9]
mov ecx, 0xccdb5780
add rdx, r9
movzx eax, byte [rdx]
je 0x140131011
jne 0x140131011
ror r9d, 0xe6
syscall
lea r8d, [rcx - 0x2ac1]
jmp rcx
jmp 0x140130f2e
mov word [rsp + 0x43], 0x7676
mov r9d, dword [rcx + rdx*4]
mov rdx, r13
add r9, r10
xor eax, eax
jmp 0x140130ee5
mov ecx, dword [r11 + r9 + 0x24]
xchg r13, rax
mov r13, rax
xchg r13, rax
add rcx, r9
jne 0x140131081
je 0x140131081
call rcx
xor ebp, 0xca7831ca
jmp rax
jmp 0x1401311d0
add byte [rax - 0x5c], al
invalid
invalid
jb 0x140131539
mov dword [rsp + 0x78], 0xf6f6f6f6
xchg rdx, r13
mov r13, rdx
xchg r13, rdx
mov dword [rbp - 0x44], 0x4b4f565a
mov dword [rsp + 0x7c], 0xf6f6f6f6
jmp 0x1401313ee
cmp rdx, 0x43
jb 0x14013120a
mov r9d, 0x40
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x44]
xor ecx, ecx
call r10
jmp 0x14013126e
mov edx, 0xe58ca837
lea rax, [r9 + r10*4]
mov ecx, dword [rax + r11]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
jmp 0x140131416
mov dword [rbp - 0x2c], 0x7d732a71
mov dword [rbp - 0x6c], 0xf6f6f6f6
mov dword [rbp - 0x28], 0x8179782a
sub bh, byte [rax + 0x79]
add edi, 0xf6f69845
div dh
mov dword [rbp - 0x24], 0x6b806b2a
mov dword [rbp - 0x64], 0xf6f6f6f6
je 0x140131160
jne 0x140131160
lea r9d, [rcx - 0xace0]
jne 0x1401304b5
push rbp
ror r15d, 0xe2
rcr r15d, 0xb5
lea ecx, [rbx - 0xda9a]
call rax
test r13d, 0x77ef9bdd
pop r13
call rax
pushf
test r15, rbx
pushfq
test rsi, rdx
movabs rbx, 0x2374750000013ee9
pushfq
cmp r10, rbx
jmp 0x14013157a
jmp 0x1401312a3
mov dword [rsp + 0x5c], 0xf6f6f6f6
mov dword [rsp + 0x6c], 0x81596f78
mov dword [rsp + 0x60], 0xf6f6f6f6
mov dword [rsp + 0x70], 0x71787378
mov word [rsp + 0x64], 0xf6f6
mov dword [rsp + 0x74], 0x7f7d38
jmp 0x140131529
add cl, al
mov byte [rsp + rdx + 0x68], cl
mov byte [rsp + rdx + 0x58], r13b
inc rdx
cmp rdx, 0xf
jmp 0x140131095
cmp edx, 0xee9bd3e0
je 0x140131548
inc r8d
jmp 0x14013136f
movzx edx, word [rcx + r10*2]
mov ecx, dword [r11 + r9 + 0x1c]
add rcx, r9
mov r10d, dword [rcx + rdx*4]
add r10, r9
nop dword [rax]
jmp 0x14013148e
mov word [rbp - 0x48], 0xf6f6
mov dword [rbp - 4], 0x7f7d38
mov byte [rbp - 0x46], 0xf6
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbp + rdx - 0x44]
movzx ecx, byte [rsp + rdx + 0x78]
je 0x140131250
mov esp, 0x144cb60f
js 0x140131289
cmp dh, byte [rbp + 0x38]
jne 0x140131250
cpuid
lea ebp, [rbp - 0x795e]
ror r10d, 0xd5
cmp r15d, 0xa0bac8b6
js 0x140131dbf
cmp r9d, 0x32152165
test rsi, rbp
lea r15d, [rdx + 0x4b35]
rol r8d, 0x7a
add r9d, 0x112b29c9
int3
jmp 0x1401312f8
xchg rbx, rax
mov rbx, r13
xchg rbx, rax
nop word [rax + rax]
mov byte [rbp + rax - 0x44], r13b
inc rax
cmp rax, 0x43
cmp eax, 0x43
jmp 0x1401314a8
mov rax, qword [rcx + 0x10]
xchg rbp, rcx
mov rbp, qword [rax]
xchg rbp, rcx
jmp 0x140131356
mov dword [rbp - 0x20], 0x6c6b7673
mov dword [rbp - 0x60], 0xf6f6f6f6
mov dword [rbp - 0x1c], 0x792a6f76
mov dword [rbp - 0x5c], 0xf6f6f6f6
mov dword [rbp - 0x18], 0x13141478
mov dword [rbp - 0x58], 0xf6f6f6f6
jmp 0x14013139b
cmp rax, 0xf
jb 0x1401314b7
mov rax, qword gs:[0x60]
lea rdi, [0x140000000]
movsxd r15, dword [0x14000003c]
cmp eax, 0xffeced49
jmp 0x1401314c4
add cl, al
mov byte [rbp + rdx - 0x44], cl
mov byte [rsp + rdx + 0x78], r13b
inc rdx
jmp 0x1401310c0
mov dword [rbp - 0x78], 0xf6f6f6f6
mov dword [rbp - 0x34], 0x596f7873
mov dword [rbp - 0x74], 0xf6f6f6f6
mov dword [rbp - 0x30], 0x78737881
mov dword [rbp - 0x70], 0xf6f6f6f6
je 0x14013133a
jne 0x14013133a
sub ebp, 0x8f335c12
movabs r14, 0x3b895afffffdbfe9
lea ecx, [rdx - 0x5f4d]
call rax
sub r8d, 0x4a2ffedc
jmp 0x140131e77
jmp 0x1401310fe
mov r9, qword [rcx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
mov r11d, dword [rbx + r9 + 0x20]
nop dword [rax]
mov r10d, r8d
jmp 0x1401310e3
jb 0x140131497
mov dword [rsp + 0x58], 0xf6f6f6f6
pop rax
div dh
div dh
xchg rdx, r13
mov r13, rdx
xchg rdx, r13
mov dword [rsp + 0x68], 0x7371784f
jmp 0x140131171
mov dword [rbp - 0x14], 0x38818181
mov dword [rbp - 0x54], 0xf6f6f6f6
mov dword [rbp - 0x10], 0x7371786f
mov dword [rbp - 0x50], 0xf6f6f6f6
mov dword [rbp - 0xc], 0x81796f78
mov dword [rbp - 0x4c], 0xf6f6f6f6
mov dword [rbp - 8], 0x71787378
jmp 0x1401311ed
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140131421
jmp 0x1401311bc
mov dword [rbp - 0x40], 0x582a4f5d
mov dword [rbp - 0x80], 0xf6f6f6f6
mov dword [rbp - 0x3c], 0x444f5e59
mov dword [rbp - 0x7c], 0xf6f6f6f6
mov dword [rbp - 0x38], 0x71784f2a
jmp 0x14013130b
test al, al
je 0x1401311c8
nop dword [rax]
movsx eax, al
jne 0x140131469
je 0x140131469
test r10d, 0x158f0921
rcr r11d, 0xf5
xor r14d, 0x2bdfbe99
jmp rax
jmp 0x1401313d1
nop word [rax + rax]
mov byte [rsp + rax + 0x3b], r13b
inc rax
cmp rax, 0xa
jmp 0x140131377
jb 0x140131280
xchg rbx, r13
mov rax, rbx
xchg r13, rbx
mov byte [rsp + rax + 0x68], r13b
inc rax
jmp 0x1401312d2
mov r8d, r13d
add r15, rdi
mov rcx, qword [rax + 0x18]
je 0x140131506
jne 0x140131506
jne 0x140132018
dec r15
jmp rax
jmp 0x140131291
mov byte [rsp + 0x66], 0xf6
nop word [rax + rax]
movzx eax, byte [rsp + rdx + 0x68]
movzx ecx, byte [rsp + rdx + 0x58]
jmp 0x1401311a5
mov ecx, dword [rbx + r9 + 0x24]
add rcx, r9
movzx edx, word [rcx + r10*2]
mov ecx, dword [rbx + r9 + 0x1c]
add rcx, r9
mov r12d, dword [rcx + rdx*4]
je 0x14013158b
jne 0x14013158b
jl 0x140131ab4
pop rsi
lea r14d, [rdi + 0xd203]
cmp rbx, rdx
rcr r12d, 0x9f
movabs r9, 0x4eb30c00000348e9
rol esi, 0xfd
ja 0x140131ed5
jmp 0x1401318d8
ret
cmp dword [rbx + 0x10], r13d
jmp 0x140131a7e
xor dil, dil
cmp byte [rbx], 0x2e
jne 0x140131b02
mov eax, dword [rbx + 1]
cmp eax, 0x74616469
jne 0x140131aed
jmp 0x140131769
cmp byte [rbx + 5], 0x61
jne 0x140131b02
mov dil, 1
jmp 0x140131b02
invalid
je 0x1401322f1
cmp dword [rbx + 0xc], 0xfffffffe
jne 0x1401316f4
nop
or r8d, 0xb7c90a9b
pushfq
jmp 0x1401319b8
invalid
mov edx, dword [r15 + 0xd8]
add r12, r9
mov qword [rbp + 0x1a0], rdx
mov eax, dword [r15 + 0xdc]
mov dword [rbp + 0x120], eax
mov ecx, dword [r15 + 0xa0]
xchg rdx, rcx
jne 0x140131923
mov ebp, 0x8503
lea r8d, [rcx + 0x96d6]
pop r13
movabs r8, 0x14a0500000186e9
cmp r15d, 0x6e0e94c4
jp 0x140131e4e
bswap r11
cmp r9, rdi
int3
jne 0x1401319ad
cmp dword [rbx + 1], 0x63727372
je 0x1401322f1
cmp dword [rbx], 0x54494e49
jmp 0x140131844
lea edx, [rbx + 0xd790]
ror edi, 0xdf
jle 0x14013120e
rcl r12d, 0x26
lea r10d, [rbp + 0x68d6]
div r15
jno 0x140131d63
je 0x1401319e1
jne 0x1401319e1
jmp 0x14013174f
je 0x1401322f1
cmp dword [rbx + 0x14], r13d
je 0x1401322f1
cmp byte [rbx], 0x2e
jmp 0x14013199a
cmp eax, 0x74616470
jne 0x140131b02
cmp byte [rbx + 5], 0x61
je 0x1401322f1
mov eax, dword [rbx + 8]
lea r8, [rsp + 0x30]
cmp eax, dword [rbx + 0x10]
jmp 0x140132023
cmp r15, rbx
lea r15d, [rdi + 0xc422]
pushf
pop rdi
sub r11d, 0xc3ec36f0
jmp 0x140131e1c
add byte [rax], al
test ebp, 0x233b9c58
call 0x140130cc0
jmp rcx
retf 0xd37d
outsd dx, dword [rsi]
invalid
lea rax, [rbp + 0x20]
xchg r15, rsi
mov qword [rsp + 0x48], r15
xchg r15, rsi
xchg rbx, rax
mov qword [rsp + 0x20], rbx
jmp 0x140132055
mul rsi
test r8d, 0xa37070c5
lea r13d, [rbx - 0x43fd]
popf
jge 0x14013025c
lea r14d, [rcx - 0xeecd]
jmp 0x140131f3f
lea rax, [0x140000000]
add rsi, rax
mov dword [rbp + 0x20], r13d
jmp 0x140131c29
iretd
add byte [rax], al
jne 0x140131dcd
je 0x140131dcd
jmp rax
jmp 0x140131deb
jnp 0x140130409
jmp 0x1401318aa
add edi, edi
invalid
and ebp, 0xf14b9b4b
jmp 0x140131e94
cmp r13d, 0x615f3007
div r13
neg r10
jmp 0x140131b12
invalid
rol r9d, 0xe5
jg 0x140130b80
mov ebx, 0x253e9336
jge 0x140131c06
rcl r9d, 0x5a
jmp 0x140131fdc
jmp rax
add esp, 0x4c21242a
jmp 0x140131cea
lea rdx, [rsp + 0x48]
mov esi, dword [rbx + 0xc]
mov r9d, 0x40
cmovae eax, dword [rbx + 0x10]
mov rcx, 0xffffffffffffffff
mov r14d, eax
jmp 0x140131d0f
je 0x14013322a
cmp dword [rax + 4], r13d
je 0x14013322a
je 0x140132118
jne 0x140132118
popf
popfq
lea ebp, [rdx - 0xa0d7]
ror r13d, 0xdf
jae 0x140131380
jg 0x140132381
jge 0x140131913
pushf
mov r12d, 0x8567adc9
test r14d, 0xec416fe8
or ebx, 0xeb7da921
movabs r14, 0x89509000004dde9
dec r15
jne 0x1401322b4
jmp 0x1401325fa
push rbp
call 0x1401312b7
lea ebp, [rdi + 0x4cbd]
add ebp, 0x5a890985
cpuid
pop r14
lea edx, [rdx - 0x1c84]
push rbp
call rax
jne 0x140132151
lea rdx, [rbp + 0xe0]
invalid
invalid
sar edi, 0xff