Function at 0x4351e0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x43558e
push rbp
mov rbp, rsp
sub rsp, 0xa8
mov qword [rsp + 0x48], 0
mov rax, qword [sym.imp.kernel32.dll_DuplicateHandle]
lea rcx, [rsp + 0x48]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffffffffffffffff
mov qword [rsp + 0x10], 0xfffffffffffffffe
mov qword [rsp + 0x18], 0xffffffffffffffff
mov qword [rsp + 0x20], rcx
movups xmmword [rsp + 0x28], xmm15
mov qword [rsp + 0x38], 2
call fcn.00435b40
xorps xmm15, xmm15
mov r14, qword [0x00c7ad88]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x40], 0
nop
je 0x43552d
mov rax, qword [r14 + 0x30]
mov qword [rsp + 0x98], rax
test byte [rax], al
lea rcx, [rax + 0x5d0]
mov qword [rsp + 0xa0], rcx
nop
mov rax, rcx
call fcn.0040c380
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x98]
mov qword [rdx + 0x5d8], rcx
mov rax, qword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov rcx, qword [r14 + 0x30]
movups xmmword [rcx + 0x3c0], xmm15
call fcn.00435760
mov rcx, qword [rsp + 0x98]
mov qword [rcx + 0x48], rax
cmp qword [rcx + 0x5f0], 0
jne 0x43532e
cmp byte [0x00c7a514], 0
je 0x43532e
mov rax, qword [sym.imp.kernel32.dll_CreateWaitableTimerExW]
mov qword [rsp], rax
movups xmmword [rsp + 8], xmm15
mov qword [rsp + 0x18], 2
mov qword [rsp + 0x20], 0x100003
call fcn.004359c0
xorps xmm15, xmm15
mov r14, qword [0x00c7ad88]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x98]
mov qword [rcx + 0x5f0], rax
test rax, rax
je 0x4354cd
nop
nop
mov rax, qword [rsp + 0xa0]
call fcn.0040c5e0
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
mov rcx, qword [sym.imp.kernel32.dll_VirtualQuery]
lea rdx, [rsp + 0x50]
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], 0x30
call fcn.00435940
xorps xmm15, xmm15
mov r14, qword [0x00c7ad88]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
je 0x43546c
mov rax, qword [rsp + 0x58]
lea rcx, [rax + 0x4000]
mov qword [rsp + 0x80], rcx
mov rdx, qword [r14 + 8]
mov qword [rsp + 0x90], rdx
cmp rdx, rcx
jb 0x435401
sub rdx, rax
lea rax, [rdx - 0x4000]
cmp rax, 0x4000000
ja 0x435401
mov qword [r14], rcx
mov rax, qword [r14]
add rax, 0x13a0
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], rax
call fcn.004670c0
xorps xmm15, xmm15
mov r14, qword [0x00c7ad88]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0xa8
pop rbp
nop
ret
call fcn.00439a80
lea rax, [0x00579f90]
mov ebx, 0x13
call fcn.0043a300
mov rax, qword [rsp + 0x80]
nop
call fcn.0043a180
lea rax, [0x005adcd0]
mov ebx, 1
call fcn.0043a300
mov rax, qword [rsp + 0x90]
nop
call fcn.0043a180
lea rax, [0x00566f36]
mov ebx, 2
call fcn.0043a300
call fcn.00439ae0
lea rax, str.bad_g0_stackself_preempt__recovered_bad_recoverybad_g_statusentersyscallwirep:_p__m__p__statusreleasep:_m_sysmonwait_preemptoffcas64_failed_m__gsignal_byte_limit_nruntime:_spabi_mismatchinvalid_slothost_is_downillegal_seekGetLengthSidGetLastErrorGetStdHandleGetTempPathWLoadLibraryWReadConsoleWSetEndOfFileTransmitFileGetAddrInfoWnot_pollablemultipathtcpCIDR_address152587890625762939453125SCTPShutdownIPv6HopByHopIPv6FragmentDot11CtrlCTSDot11CtrlRTSDot11CtrlAckUSBInterruptcableport_axopalis_robotrpki_rtr_tlsmatip_type_amatip_type_bscoi2odialogmortgagewarehp_collectorhp_alarm_mgrmicrosoft_dsas_servermapappleqtcsrvrscc_securitypassword_chgcab_protocolcollaboratoroob_ws_httpsentrust_aaasentrust_aamsasipregistryieee_mms_sslentrust_kmshkerberos_admpkix_3_ca_ranetconf_beepboinc_clientbsquare_voipwarmspotMgmtamt_esd_protpt2_discoveravailant_mgrhpvmmcontrolsaphostctrlsd_cinema_rrpcommlinx_avlcaids_sensornucleus_sandanthony_dataslinkysearchsearch_agentopennl_voicedellpwrappkspictrographysti_envisionbmc_patroldbnetdb_exportXSIP_networkcuillamartinapple_licmantibet_serveribm_mqseriesnovell_lu6_2blueberry_lmeicon_serveroceansoft_lmmicromuse_lmgridgen_elmdarbortext_lmfacilityviewpay_per_viewrdb_dbs_disphypercube_lmsimbaexpressorbplus_iiopnetbill_crednetbill_authnetbill_prodnimrod_agentt128_gatewaylontalk_normalphatech_lmmicrocom_sbprsvp_encap_1rsvp_encap_2h323gatedisch323gatestath323hostcallms_streamingfunk_licensescientia_sdbtht_treasuretunstall_pncvirtual_timecanocentral0canocentral1nettgain_nmsvsat_controlglobal_wlinkelm_momentumjetcmeserverclose_combatbcs_lmservernetop_schooltr_rsrb_portx25_svc_portcypress_statshadowserversubmitservermobrien_chatah_esp_encapnewlixenginenewlixconfigautodesk_nlmbintec_admincaupc_remotesolera_epmaptouchnetplusmsfw_storagemsfw_replicamnp_exchangeonehome_helpdtv_chan_reqsimple_tx_rxcomotionbackibridge_dataibridge_mgmtnas_meteringtappi_boxnet3com_webviewwrs_registryservice_ctrllanmessengercompaq_httpsovsessionmgrtacticalauthsns_protocolfjitsuappmgrmgcp_gatewaybues_servicealtav_remmgtmti_tcs_commtaskman_portace_svr_propconclave_cpptalarian_mqskentrox_protfjappmgrbulkbtpp2audctr1call_loggingnicetec_mgmtsonuscallsigrvs_isdn_dcpworldfusion1worldfusion2discp_clientdiscp_serverservicemeterneverofflinesitaraserverinterintellipatrol_mq_gmpatrol_mq_nmtve_announcencdmirroringpn_requestertcim_controlnec_raidplusccs_softwaresrp_feedbackfjippol_cnslrsisysaccessveritas_tcp1lbc_watchdogvrts_at_portcqg_netlan_1amt_blc_portactivememoryttg_protocolvseconnectorpowergemplusfunk_dialoutelvin_serverelvin_clientamx_webadmin4_tieropmcliovrimosdbmanbullant_srappmsm_webrctlcns_srv_portveritas_vis1veritas_vis2origo_nativeresource_mgragri_gatewayredwood_chatosmosis_aeeadi_tracewareamt_cnf_protpolicyserverncacn_ip_tcpncadg_ip_udporbix_configcardbox_httpmctet_mastervtr_emulatorprism_deployapogeex_portspandataportembrace_dp_sembrace_dp_cvx_auth_portavsecuremgmtjmq_daemon_1jmq_daemon_2ferrari_foamsmartpacketsapparenet_tsapparenet_asapparenet_uicpqrpm_agentiscsi_targetaltav_tunnelibm_dial_outuser_managermcs_fastmailmcns_tel_retdirectv_softdirectv_tickcluster_discsns_channelsfujitsu_neatnetworklenssbiolink_authspiral_adminedm_mgr_syncgenisar_portslim_devicesifsf_hb_portseclayer_tcpseclayer_tlsdashpas_portartifact_msgnssocketporthacl_monitorsymantec_simtellumat_nmsbmc_jmx_portsharp_serverdist_upgradecs_remote_dbservistaitsmaudiojugglerxss_srv_portsplitlock_gwdell_rm_portnpds_trackerfaxstfx_portsagectlpanelws_discoverysun_as_iiopssentinel_entipcs_commandgw_call_portcbos_ip_portapw_registrylistmgr_portdvcprov_portremotedeploymsfw_controlwinshadow_hdasap_tcp_tlsciphire_dataciphire_servdandv_testerimoguia_portlistcrt_portexasoftport1symb_sb_portp2pcommunitylanrevserveriss_mgmt_sslnexus_portaldsmeter_iatcice_locationezmessagesrvcl_db_attachcl_db_remotehhb_handheldstat_resultsstat_scannerd_cinema_cspgeognosismanqsnet_workstqsnet_assistomabcastltkmelpro_tunnelctisystemmsgias_neighborplaysta2_appplaysta2_lobcontclientmsnetxms_agenttrinity_distcontamac_icmappserv_httpmagiccontrolsybasesrvmonhfcs_managerbitforestsrvtalarian_tcpppactivationsoc
mov ebx, 0xc
call fcn.00437fe0
call fcn.00468aa0
xorps xmm15, xmm15
mov r14, qword [0x00c7ad88]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x88], rax
call fcn.00439a80
lea rax, [0x00582e42]
mov ebx, 0x24
nop
call fcn.0043a300
mov rax, qword [rsp + 0x88]
call fcn.0043a040
call fcn.00439cc0
call fcn.00439ae0
lea rax, [0x00582348]
mov ebx, 0x22
call fcn.00437fe0
call fcn.00468aa0
xorps xmm15, xmm15
mov r14, qword [0x00c7ad88]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x88], rax
call fcn.00439a80
lea rax, [0x00585177]
mov ebx, 0x2d
call fcn.0043a300
mov rax, qword [rsp + 0x88]
call fcn.0043a040
call fcn.00439cc0
call fcn.00439ae0
lea rax, [0x00585a7f]
mov ebx, 0x30
call fcn.00437fe0
call fcn.00468aa0
xorps xmm15, xmm15
mov r14, qword [0x00c7ad88]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x88], rax
call fcn.00439a80
lea rax, [0x0058514a]
mov ebx, 0x2d
call fcn.0043a300
mov rax, qword [rsp + 0x88]
call fcn.0043a040
call fcn.00439cc0
call fcn.00439ae0
lea rax, [0x005833c3]
mov ebx, 0x25
call fcn.00437fe0
nop
call fcn.00465360
jmp fcn.004351e0