Function at 0x1400063c0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1168
call fcn.14004a200
sub rsp, rax
mov r12, r8
mov r13, rdx
mov r14, rcx
lea rax, [0x141d277ca]
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x168]
mov rcx, qword [rsp + 0x168]
movabs rax, 0x3f3305521d022260
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x168]
mov rdx, qword [rsp + 0x168]
call fcn.140034570
mov esi, dword [rax]
movzx edi, word [rax + 4]
movzx ebx, byte [rax + 6]
movzx eax, byte [0x141d43a20]
mov edx, 7
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x14000726e
mov r15, rax
mov qword [rsp + 0x58], r14
shl ebx, 0x10
or edi, ebx
mov eax, edi
shr eax, 0x10
xor al, 0x44
movzx eax, al
mov byte [r15 + 6], al
shl rax, 0x30
mov ecx, edi
shr ecx, 8
xor cl, 8
movzx ecx, cl
shl rcx, 0x28
or rcx, rax
xor dil, 0xaf
movzx eax, dil
shl rax, 0x20
or rax, rcx
xor esi, 0xc5cdfc6f
mov dword [r15], esi
shr rax, 0x20
mov word [r15 + 4], ax
lea rax, [0x141d28e64]
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x168]
mov rcx, qword [rsp + 0x168]
movabs rax, 0x7e4c36b02b863acd
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x168]
mov rdx, qword [rsp + 0x168]
call fcn.140033fa0
mov esi, dword [rax]
movzx ebx, byte [rax + 4]
movzx eax, byte [0x141d43a20]
mov edx, 5
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x14000726e
mov r14, rax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x68], r15
xor bl, 0x3e
xor esi, 0x3cd68905
mov byte [rax + 4], bl
mov dword [rax], esi
lea rax, [0x141d30cb1]
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x168]
mov rcx, qword [rsp + 0x168]
movabs rax, 0xa5e55359fb510b22
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x168]
mov rdx, qword [rsp + 0x168]
call fcn.1400340b0
mov esi, dword [rax]
movzx edi, word [rax + 4]
movzx ebx, byte [rax + 6]
movzx eax, byte [0x141d43a20]
mov edx, 7
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x14000726e
mov r15, rax
shl ebx, 0x10
or edi, ebx
mov eax, edi
shr eax, 0x10
xor al, 3
movzx eax, al
mov byte [r15 + 6], al
shl rax, 0x30
mov ecx, edi
shr ecx, 8
xor cl, 0xe7
movzx ecx, cl
shl rcx, 0x28
or rcx, rax
xor dil, 0x41
movzx eax, dil
shl rax, 0x20
or rax, rcx
xor esi, 0x720b8ac8
mov dword [r15], esi
shr rax, 0x20
mov word [r15 + 4], ax
lea rax, [0x141d25161]
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x168]
mov rcx, qword [rsp + 0x168]
movabs rax, 0xc3fdb757c544ca27
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x168]
mov rdx, qword [rsp + 0x168]
call fcn.140034a20
mov rsi, qword [rax]
movzx ebx, byte [rax + 8]
movzx eax, byte [0x141d43a20]
mov edx, 9
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x14000726e
mov r13, rax
xor bl, 0x5d
movabs rax, 0x363ffd31be45ffcf
xor rsi, rax
mov qword [r13], rsi
mov byte [r13 + 8], bl
lea rax, [0x141d21476]
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x168]
mov rcx, qword [rsp + 0x168]
movabs rax, 0x89a401a50d485e82
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x168]
mov rdx, qword [rsp + 0x168]
call fcn.140034810
mov esi, dword [rax]
movzx edi, word [rax + 4]
movzx ebx, byte [rax + 6]
movzx eax, byte [0x141d43a20]
mov edx, 7
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x14000726e
mov r12, rax
shl ebx, 0x10
or edi, ebx
mov eax, edi
shr eax, 0x10
xor al, 0xeb
movzx eax, al
mov byte [r12 + 6], al
shl rax, 0x30
mov ecx, edi
shr ecx, 8
xor cl, 0xaa
movzx ecx, cl
shl rcx, 0x28
or rcx, rax
xor dil, 0x8d
movzx eax, dil
shl rax, 0x20
or rax, rcx
xor esi, 0x7dcdab7c
mov dword [r12], esi
shr rax, 0x20
mov word [r12 + 4], ax
lea rax, [0x141d30d89]
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x168]
mov rcx, qword [rsp + 0x168]
movabs rax, 0x4ca962e320b82c1c
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x168]
mov rdx, qword [rsp + 0x168]
call fcn.140034f40
mov esi, dword [rax]
movzx ebx, byte [rax + 4]
movzx eax, byte [0x141d43a20]
mov edx, 5
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x14000726e
mov rbp, rax
xor bl, 0x46
xor esi, 0xbb41d460
mov byte [rax + 4], bl
mov dword [rax], esi
lea rax, [0x141d2ab2e]
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x168]
mov rcx, qword [rsp + 0x168]
movabs rax, 0x3812edeb20062938
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x168]
mov rdx, qword [rsp + 0x168]
call fcn.140035300
mov rsi, qword [rax]
movzx eax, byte [0x141d43a20]
mov edx, 8
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x14000726e
movabs rcx, 0x9cb3135f0c1846de
xor rsi, rcx
mov qword [rsp + 0x60], rax
mov qword [rax], rsi
lea rax, [0x141d27711]
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x168]
mov rcx, qword [rsp + 0x168]
movabs rax, 0x25aaeccda9c0c36d
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x168]
mov rdx, qword [rsp + 0x168]
call fcn.140035370
mov esi, dword [rax]
movzx edi, word [rax + 4]
movzx eax, byte [0x141d43a20]
mov edx, 6
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x14000726e
mov rbx, rax
mov eax, edi
shr eax, 8
xor al, 0xe
movzx eax, al
shl rax, 0x28
xor dil, 0x12
movzx ecx, dil
shl rcx, 0x20
or rcx, rax
xor esi, 0xcd0846bd
mov dword [rbx], esi
shr rcx, 0x20
mov word [rbx + 4], cx
movzx eax, byte [0x141d43a20]
mov edx, 0x80
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x14000726e
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0x68]
mov qword [rbx], rax
mov qword [rbx + 8], 7
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 5
mov qword [rbx + 0x20], r15
mov qword [rbx + 0x28], 7
mov qword [rbx + 0x30], r13
mov qword [rbx + 0x38], 9
mov qword [rbx + 0x40], r12
mov qword [rbx + 0x48], 7
mov qword [rbx + 0x50], rbp
mov qword [rbx + 0x58], 5
mov rax, qword [rsp + 0x60]
mov qword [rbx + 0x60], rax
mov qword [rbx + 0x68], 8
mov qword [rsp + 0xa0], rcx
mov qword [rbx + 0x70], rcx
mov qword [rbx + 0x78], 6
mov eax, dword [0x141d43a24]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 0x18]
cmp rax, 1
jne 0x14000725f
mov eax, dword [0x141d43a24]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rsi, qword [rax + 0x20]
inc qword [rsi]
je 0x14000726e
mov rax, qword [rsi + 0x110]
cmp rax, 0x40
jb 0x1400069cf
lea rdx, [rsi + 0x10]
lea rcx, [rsi + 0x120]
mov rax, qword [rsi + 0x158]
test rax, rax
jle 0x1400069c8
cmp qword [rsi + 0x160], 0
js 0x1400069c8
add rax, 0xffffffffffffff00
mov qword [rsi + 0x158], rax
call fcn.14001c780
jmp 0x1400069cd
call fcn.14003be50
xor eax, eax
mov qword [rsp + 0x98], r14
lea rcx, [rax + 1]
cmp dword [rsi + rax*4 + 0x10], 0
mov qword [rsp + 0x50], rsi
mov qword [rsi + 0x110], rcx
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x88], rbp
js 0x140006a9b
lea rax, [0x141d2e7bb]
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x168]
mov rcx, qword [rsp + 0x168]
movabs rax, 0x83d88f8644403159
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x168]
mov rdx, qword [rsp + 0x168]
call fcn.1400351e0
mov rdi, qword [rax]
mov rsi, qword [rax + 8]
movzx eax, byte [0x141d43a20]
mov r14d, 0x10
mov edx, 0x10
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x14000726e
mov rbp, rax
movabs rax, 0xafe99f415baab5ea
xor rsi, rax
movabs rax, 0x592c6a95f12651bd
xor rdi, rax
mov qword [rbp], rdi
mov qword [rbp + 8], rsi
jmp 0x140006b60
mov r12, r13
mov r13, r15
lea rax, [0x141d2cc89]
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x168]
mov rcx, qword [rsp + 0x168]
movabs rax, 0xc91f4da29724f297
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x168]
mov rdx, qword [rsp + 0x168]
call fcn.140033fc0
mov r15, qword [rax]
mov edi, dword [rax + 8]
movzx esi, word [rax + 0xc]
movzx ebp, byte [rax + 0xe]
movzx eax, byte [0x141d43a20]
mov r14d, 0xf
mov edx, 0xf
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x14000726e
shl ebp, 0x10
or esi, ebp
mov r8d, esi
shr r8d, 0x10
xor r8b, 0x7c
mov ecx, esi
shr ecx, 8
xor cl, 2
xor sil, 0xa4
xor edi, 0xb72e3e56
movabs rdx, 0xa60cd2bb9b09d9c3
xor r15, rdx
mov qword [rax], r15
mov dword [rax + 8], edi
mov byte [rax + 0xc], sil
mov byte [rax + 0xd], cl
mov byte [rax + 0xe], r8b
mov r15, r13
mov r13, r12
mov rbp, rax
lea rdi, [rsp + 0x150]
mov r9d, 8
mov rcx, rdi
mov rsi, qword [rsp + 0x50]
mov rdx, rsi
mov r8, rbx
call fcn.140005f20
lea rcx, [rsp + 0x138]
mov r9d, 8
mov rdx, rsi
mov r8, rbx
call fcn.140005f20
lea rcx, [rsp + 0xe8]
mov rdx, rbp
mov r8, r14
mov r9, rdi
call fcn.14003e310
mov rdi, qword [rsp + 0xf0]
mov r14, qword [rsp + 0xf8]
mov rcx, rdi
mov rdx, r14
call fcn.14002e4a0
test rax, rax
jne 0x14000726e
mov qword [rsp + 0x80], r15
lea rcx, [rsp + 0x108]
lea r9, [rsp + 0x138]
mov rdx, rdi
mov r8, r14
call fcn.14003e310
mov r14, qword [rsp + 0x110]
mov rdi, qword [rsp + 0x118]
mov rcx, r14
mov rdx, rdi
call fcn.14002e4a0
test rax, rax
jne 0x14000726e
test rdi, rdi
js 0x14000726e
je 0x140006c48
movzx eax, byte [0x141d43a20]
xor ecx, ecx
mov rdx, rdi
call fcn.14002f460
test rax, rax
je 0x14000726e
mov r15, rax
mov rsi, rdi
jmp 0x140006c50
mov r15d, 1
xor esi, esi
mov rcx, r15
mov rdx, r14
mov r8, rdi
call fcn.140055470
mov qword [rsp + 0x168], rsi
mov qword [rsp + 0x170], r15
mov qword [rsp + 0x178], rdi
mov byte [rsp + 0x180], 0
lea rcx, [rsp + 0x168]
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x30]
call fcn.14002cfc0
mov rsi, qword [rsp + 0x168]
mov r15, qword [rsp + 0x170]
mov r14, qword [rsp + 0x178]
mov dword [rsp + 0x168], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x170], xmm0
mov dword [rsp + 0x180], 7
mov qword [rsp + 0x184], 0
mov word [rsp + 0x18c], 0
mov byte [rsp + 0x189], 1
mov byte [rsp + 0x18c], 1
mov byte [rsp + 0x18b], 1
lea r8, [rsp + 0x168]
mov rcx, r15
mov rdx, r14
call fcn.140033680
test rax, rax
jne 0x14000726e
mov rdi, rdx
mov qword [rsp + 0x48], rdx
xor eax, eax
mov rcx, qword [rsp + 0x58]
cmp rax, qword [rcx]
jo 0x140007270
mov rdx, qword [rcx + 8]
mov r8, qword [rcx + 0x10]
lea rcx, [rsp + 0x48]
call fcn.14003e1c0
test rax, rax
jne 0x14000726e
mov qword [rsp + 0x40], rsi
lea rcx, [rsp + 0x168]
mov rdx, rdi
call fcn.140033920
cmp dword [rsp + 0x168], 2
je 0x14000726e
mov qword [rsp + 0x78], r13
mov rsi, qword [rsp + 0x1a0]
mov rdi, qword [rsp + 0x48]
cmp rsi, 0x2a1fffff
mov qword [rsp + 0x30], r15
ja 0x140006e27
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x168], 0
lea r8, [rsp + 0x168]
mov rcx, rdi
xor edx, edx
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400072ce
lea r12, [rsp + 0x168]
mov r8d, 0x1000
mov rcx, r12
xor edx, edx
call fcn.140055b10
mov ebp, 0x2a200000
sub rbp, rsi
lea r13, [rsp + 0x48]
nop dword [rax]
cmp rbp, 0x1000
mov r15d, 0x1000
cmovb r15, rbp
mov rcx, r13
mov rdx, r12
mov r8, r15
call fcn.14003e1c0
test rax, rax
jne 0x14000726e
sub rbp, r15
jne 0x140006df0
mov rbp, qword [rsp + 0x38]
mov r15, qword [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
js 0x14000726e
je 0x140006e88
movzx eax, byte [0x141d43a20]
xor ecx, ecx
mov rdx, r14
call fcn.14002f460
test rax, rax
je 0x14000726e
mov r13, rax
mov rcx, rax
mov rdx, r15
mov r8, r14
call fcn.140055470
movzx eax, byte [0x141d43a20]
xor ecx, ecx
mov rdx, r14
call fcn.14002f460
test rax, rax
je 0x14000726e
mov rdi, rax
mov rsi, r14
jmp 0x140006ea5
mov r13d, 1
mov ecx, 1
mov rdx, r15
mov r8, r14
call fcn.140055470
xor esi, esi
mov edi, 1
movabs r15, 0x8000000000000000
mov rcx, rdi
mov rdx, r13
mov r8, r14
call fcn.140055470
mov qword [rsp + 0x168], rsi
mov qword [rsp + 0x170], rdi
mov qword [rsp + 0x178], r14
mov byte [rsp + 0x180], 0
mov qword [rsp + 0x188], 0
mov qword [rsp + 0x190], 8
mov qword [rsp + 0x198], 0
mov qword [rsp + 0x1f0], 0
mov qword [rsp + 0x200], 0
mov word [rsp + 0x208], 0
mov qword [rsp + 0x1a0], r15
mov dword [rsp + 0x22c], 0
mov word [rsp + 0x228], 0
mov word [rsp + 0x230], 0
mov dword [rsp + 0x1c0], 6
mov dword [rsp + 0x1d0], 6
mov dword [rsp + 0x1e0], 6
mov qword [rsp + 0x210], 0
mov qword [rsp + 0x220], 0
test r14, r14
je 0x140006f9a
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [rsp + 0x22c], 0x8000000
mov dword [rsp + 0x128], 0
lea rcx, [rsp + 0xa8]
lea rdx, [rsp + 0x168]
lea r8, [rsp + 0x128]
call fcn.140025d30
mov rdi, qword [rsp + 0xa8]
mov r13, qword [rsp + 0xb8]
cmp r13, 2
jne 0x140006fe8
mov r12, rdi
jmp 0x14000702d
mov r14, qword [rsp + 0xb0]
mov r12, qword [rsp + 0xc0]
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0xc8], 0
sete sil
cmp qword [rsp + 0xd8], 0
sete byte [rsp + 0x2f]
mov r15, rbp
lea rax, [0x141d2e951]
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0xa8]
mov rcx, qword [rsp + 0xa8]
movabs rax, 0x229018c6f99397d5
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0xa8]
mov rdx, qword [rsp + 0xa8]
call fcn.140034460
mov rcx, qword [rax]
mov rcx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
movzx eax, word [rax + 0x20]
cmp r13d, 2
je 0x14000726e
mov rbp, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call rbp
mov rcx, r14
call rbp
test r13, r13
je 0x1400070b2
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test sil, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x98]
mov r12, qword [rsp + 0x78]
mov r13, qword [rsp + 0x88]
mov rbp, r15
jne 0x1400070e5
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test byte [rsp + 0x2f], 1
mov rcx, qword [rsp + 0x38]
jne 0x1400070f7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x168]
call section..text
cmp qword [rsi], 0
mov r15, qword [rsp + 0x80]
je 0x140007125
mov r8, qword [rsi + 8]
mov rcx, qword [0x141d439e8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rsp + 0x40], 0
je 0x140007141
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rsp + 0x108], 0
mov rsi, qword [rsp + 0x50]
je 0x140007168
mov r8, qword [rsp + 0x110]
mov rcx, qword [0x141d439e8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rsp + 0xe8], 0
je 0x14000718a
mov r8, qword [rsp + 0xf0]
mov rcx, qword [0x141d439e8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, rbp
call qword [sym.imp.KERNEL32.dll_HeapFree]
dec qword [rsi]
jne 0x1400071b9
dec qword [rsi + 8]
jne 0x1400071b9
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x141d439e8]
mov rsi, qword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
mov r8, rbx
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, rdi
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, r14
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, r15
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, r12
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x90]
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, r13
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x60]
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0xa0]
call rsi
nop
add rsp, 0x1168
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test rax, rax
jne 0x14000726e
call fcn.140056450
jmp 0x140006963
ud2
lea rax, [0x141d2d4c8]
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x168]
mov rcx, qword [rsp + 0x168]
movabs rax, 0x8f6f02532b011409
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x168]
mov rdx, qword [rsp + 0x168]
call fcn.140034d00
mov rcx, qword [rax]
mov rcx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov ecx, dword [rax + 0x20]
movzx eax, word [rax + 0x24]
ud2
call qword [sym.imp.KERNEL32.dll_GetLastError]
ud2