Function at 0x14002bae4
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov rax, qword [0x14000dfc0]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov edx, dword [rcx]
mov rdi, rcx
sub edx, 0xb
je 0x14002bc34
sub edx, 1
je 0x14002bbdd
cmp edx, 1
je 0x14002bb83
lea rcx, [rbp - 0x19]
call qword [sym.imp.ntoskrnl.exe_KeQuerySystemTimePrecise]
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 0x19]
call qword [sym.imp.ntoskrnl.exe_ExSystemTimeToLocalTime]
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x11]
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
mov rax, qword gs:[0x188]
movsx r8d, word [rbp + 0x1f]
movsx ecx, word [rbp + 0x23]
movsx edx, word [rbp + 0x21]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r8d
lea r8, [0x140043a40]
jmp 0x14002bc89
lea rcx, [rbp - 0x11]
call qword [sym.imp.ntoskrnl.exe_KeQuerySystemTimePrecise]
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x11]
call qword [sym.imp.ntoskrnl.exe_ExSystemTimeToLocalTime]
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
mov rax, qword gs:[0x188]
movsx r8d, word [rbp + 0x1f]
movsx ecx, word [rbp + 0x23]
movsx edx, word [rbp + 0x21]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r8d
lea r8, [0x140043a00]
jmp 0x14002bc89
lea rcx, [rbp - 0x11]
call qword [sym.imp.ntoskrnl.exe_KeQuerySystemTimePrecise]
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x11]
call qword [sym.imp.ntoskrnl.exe_ExSystemTimeToLocalTime]
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
mov rax, qword gs:[0x188]
movsx r8d, word [rbp + 0x1f]
movsx ecx, word [rbp + 0x23]
movsx edx, word [rbp + 0x21]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r8d
lea r8, [0x1400439b0]
jmp 0x14002bc89
lea rcx, [rbp - 0x11]
call qword [sym.imp.ntoskrnl.exe_KeQuerySystemTimePrecise]
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x11]
call qword [sym.imp.ntoskrnl.exe_ExSystemTimeToLocalTime]
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
mov rax, qword gs:[0x188]
movsx r8d, word [rbp + 0x1f]
movsx ecx, word [rbp + 0x23]
movsx edx, word [rbp + 0x21]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r8d
lea r8, [0x140043960]
movsx r9d, word [rbp + 0x1d]
mov edx, 0x80000002
mov ecx, 0x51
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_KeQuerySystemTimePrecise]
lea rdx, [rbp - 1]
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_ExSystemTimeToLocalTime]
lea rdx, [rbp + 0x27]
lea rcx, [rbp - 1]
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
mov rcx, qword gs:[0x188]
movsx edx, word [rbp + 0x33]
movsx r8d, word [rbp + 0x31]
mov eax, dword [rdi + 8]
movsx r10d, word [rbp + 0x2f]
movsx r9d, word [rbp + 0x2d]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rcx
mov ecx, 0x51
mov dword [rsp + 0x30], edx
mov edx, 0x80000002
mov dword [rsp + 0x28], r8d
lea r8, [0x140043a90]
mov dword [rsp + 0x20], r10d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
xor esi, esi
cmp dword [rdi + 4], esi
jbe 0x14002bddc
mov ecx, dword [rdi]
sub ecx, 0xb
je 0x14002bd31
sub ecx, 1
je 0x14002bd31
cmp ecx, 1
je 0x14002bd31
xor eax, eax
jmp 0x14002bd36
mov eax, 0x28
imul eax, esi
lea rcx, [rbp + 7]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_KeQuerySystemTimePrecise]
lea rdx, [rbp + 0xf]
lea rcx, [rbp + 7]
call qword [sym.imp.ntoskrnl.exe_ExSystemTimeToLocalTime]
lea rdx, [rbp + 0x37]
lea rcx, [rbp + 0xf]
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
mov rcx, qword gs:[0x188]
mov eax, dword [rbx + rdi + 0x18]
movsx edx, word [rbp + 0x43]
movsx r8d, word [rbp + 0x41]
movsx r10d, word [rbp + 0x3f]
movsx r9d, word [rbp + 0x3d]
mov dword [rsp + 0x60], eax
mov eax, dword [rbx + rdi + 0x1c]
mov dword [rsp + 0x58], eax
mov eax, dword [rbx + rdi + 0x10]
mov dword [rsp + 0x50], eax
mov eax, dword [rbx + rdi + 0x14]
mov dword [rsp + 0x48], eax
mov rax, qword [rbx + rdi + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
mov ecx, 0x51
mov dword [rsp + 0x30], edx
mov edx, 0x80000002
mov dword [rsp + 0x28], r8d
lea r8, [0x140043ae0]
mov dword [rsp + 0x20], r10d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
inc esi
cmp esi, dword [rdi + 4]
jb 0x14002bd1c
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140003b50
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret