Function at 0x140003600
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x58]
sub rsp, 0x158
xor r12d, r12d
mov qword [rbp - 0x68], rdx
mov qword [rsp + 0x60], r12
lea r14, str.ntdll.dll
mov qword [rbp + 0xb8], r12
xorps xmm0, xmm0
mov qword [rbp - 0x60], r12
mov rcx, r14
mov qword [rbp + 0x18], r12
lea edx, [r12 + 0x5c]
mov dword [rbp + 0xb0], r12d
mov qword [rbp + 0x28], r12
mov dword [rbp + 0x38], r12d
mov qword [rbp + 0x30], r12
movdqu xmmword [rbp + 0x40], xmm0
mov dword [rbp + 0x20], 0x30
mov eax, r8d
mov qword [rbp + 0x10], rax
mov rax, qword gs:[0x60]
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
call fcn.1400061c4
test rax, rax
mov esi, r12d
setne sil
mov rcx, r14
test esi, esi
je 0x1400036a5
mov rdx, qword [rbx + 0x40]
jmp 0x1400036a9
mov rdx, qword [rbx + 0x50]
call fcn.140009cf4
test eax, eax
je 0x140003723
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140003698
xor edx, edx
mov rcx, r14
call fcn.140001880
mov rcx, rax
mov edx, 0x7f6f58fc
call fcn.140001b50
mov rbx, rax
test rax, rax
jne 0x1400036de
mov rcx, r12
jmp 0x140003727
mov edx, 0x104
mov dword [rbp - 0x54], r12d
mov rcx, r14
mov qword [rbp - 0x50], r14
call fcn.140009638
add ax, ax
mov qword [rsp + 0x68], r12
mov word [rbp - 0x58], ax
lea r9, [rsp + 0x68]
add ax, 2
lea r8, [rbp - 0x58]
xor edx, edx
mov word [rbp - 0x56], ax
xor ecx, ecx
call rbx
mov rcx, qword [rsp + 0x68]
test eax, eax
cmovs rcx, r12
jmp 0x140003727
mov rcx, qword [rbx + 0x20]
mov edx, 0xa0fe24ca
call fcn.140001b50
mov rcx, qword gs:[0x60]
mov edx, 0x5c
mov qword [rbp + 8], rax
mov rdi, qword [rcx + 0x18]
mov rcx, r14
add rdi, 0x20
mov rbx, qword [rdi]
call fcn.1400061c4
test rax, rax
mov esi, r12d
setne sil
mov rcx, r14
test esi, esi
je 0x14000376d
mov rdx, qword [rbx + 0x40]
jmp 0x140003771
mov rdx, qword [rbx + 0x50]
call fcn.140009cf4
test eax, eax
je 0x1400037eb
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140003760
xor edx, edx
mov rcx, r14
call fcn.140001880
mov rcx, rax
mov edx, 0x7f6f58fc
call fcn.140001b50
mov rbx, rax
test rax, rax
jne 0x1400037a6
mov rcx, r12
jmp 0x1400037ef
mov edx, 0x104
mov dword [rbp - 0x44], r12d
mov rcx, r14
mov qword [rbp - 0x40], r14
call fcn.140009638
add ax, ax
mov qword [rsp + 0x70], r12
mov word [rbp - 0x48], ax
lea r9, [rsp + 0x70]
add ax, 2
lea r8, [rbp - 0x48]
xor edx, edx
mov word [rbp - 0x46], ax
xor ecx, ecx
call rbx
mov rcx, qword [rsp + 0x70]
test eax, eax
cmovs rcx, r12
jmp 0x1400037ef
mov rcx, qword [rbx + 0x20]
mov edx, 0x920fe68b
call fcn.140001b50
mov rcx, qword gs:[0x60]
mov edx, 0x5c
mov r13, rax
mov rdi, qword [rcx + 0x18]
mov rcx, r14
add rdi, 0x20
mov rbx, qword [rdi]
call fcn.1400061c4
test rax, rax
mov esi, r12d
setne sil
mov rcx, r14
test esi, esi
je 0x140003834
mov rdx, qword [rbx + 0x40]
jmp 0x140003838
mov rdx, qword [rbx + 0x50]
call fcn.140009cf4
test eax, eax
je 0x1400038b2
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140003827
xor edx, edx
mov rcx, r14
call fcn.140001880
mov rcx, rax
mov edx, 0x7f6f58fc
call fcn.140001b50
mov rbx, rax
test rax, rax
jne 0x14000386d
mov rcx, r12
jmp 0x1400038b6
mov edx, 0x104
mov dword [rbp - 0x34], r12d
mov rcx, r14
mov qword [rbp - 0x30], r14
call fcn.140009638
add ax, ax
mov qword [rsp + 0x78], r12
mov word [rbp - 0x38], ax
lea r9, [rsp + 0x78]
add ax, 2
lea r8, [rbp - 0x38]
xor edx, edx
mov word [rbp - 0x36], ax
xor ecx, ecx
call rbx
mov rcx, qword [rsp + 0x78]
test eax, eax
cmovs rcx, r12
jmp 0x1400038b6
mov rcx, qword [rbx + 0x20]
mov edx, 0x93f44486
call fcn.140001b50
mov rcx, qword gs:[0x60]
mov edx, 0x5c
mov r15, rax
mov rdi, qword [rcx + 0x18]
mov rcx, r14
add rdi, 0x20
mov rbx, qword [rdi]
call fcn.1400061c4
test rax, rax
mov esi, r12d
setne sil
nop
mov rcx, r14
test esi, esi
je 0x1400038fd
mov rdx, qword [rbx + 0x40]
jmp 0x140003901
mov rdx, qword [rbx + 0x50]
call fcn.140009cf4
test eax, eax
je 0x140003978
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1400038f0
xor edx, edx
mov rcx, r14
call fcn.140001880
mov rcx, rax
mov edx, 0x7f6f58fc
call fcn.140001b50
mov rbx, rax
test rax, rax
jne 0x140003936
mov rcx, r12
jmp 0x14000397c
mov edx, 0x104
mov dword [rbp - 0x24], r12d
mov rcx, r14
mov qword [rbp - 0x20], r14
call fcn.140009638
add ax, ax
mov qword [rbp - 0x80], r12
mov word [rbp - 0x28], ax
lea r9, [rbp - 0x80]
add ax, 2
lea r8, [rbp - 0x28]
xor edx, edx
mov word [rbp - 0x26], ax
xor ecx, ecx
call rbx
mov rcx, qword [rbp - 0x80]
test eax, eax
cmovs rcx, r12
jmp 0x14000397c
mov rcx, qword [rbx + 0x20]
mov edx, 0x57003f17
call fcn.140001b50
mov rcx, qword gs:[0x60]
mov edx, 0x5c
mov r12, rax
mov rdi, qword [rcx + 0x18]
mov rcx, r14
add rdi, 0x20
mov rbx, qword [rdi]
call fcn.1400061c4
xor esi, esi
test rax, rax
setne sil
mov rcx, r14
test esi, esi
je 0x1400039c0
mov rdx, qword [rbx + 0x40]
jmp 0x1400039c4
mov rdx, qword [rbx + 0x50]
call fcn.140009cf4
test eax, eax
je 0x140003a3c
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1400039b3
xor edx, edx
mov rcx, r14
call fcn.140001880
mov rcx, rax
mov edx, 0x7f6f58fc
call fcn.140001b50
mov rbx, rax
test rax, rax
jne 0x1400039f9
mov rcx, rax
jmp 0x140003a40
xor edi, edi
mov qword [rbp - 0x10], r14
mov edx, 0x104
mov dword [rbp - 0x14], edi
mov rcx, r14
call fcn.140009638
add ax, ax
mov qword [rbp - 0x78], rdi
mov word [rbp - 0x18], ax
lea r9, [rbp - 0x78]
add ax, 2
lea r8, [rbp - 0x18]
xor edx, edx
mov word [rbp - 0x16], ax
xor ecx, ecx
call rbx
mov rcx, qword [rbp - 0x78]
test eax, eax
cmovs rcx, rdi
jmp 0x140003a40
mov rcx, qword [rbx + 0x20]
mov edx, 0xc5950dc5
call fcn.140001b50
mov rcx, qword gs:[0x60]
mov edx, 0x5c
mov r14, rax
mov rdi, qword [rcx + 0x18]
lea rcx, str.ntdll.dll
add rdi, 0x20
mov rbx, qword [rdi]
call fcn.1400061c4
xor ecx, ecx
test rax, rax
mov esi, ecx
setne sil
nop dword [rax]
lea rcx, str.ntdll.dll
test esi, esi
je 0x140003a91
mov rdx, qword [rbx + 0x40]
jmp 0x140003a95
mov rdx, qword [rbx + 0x50]
call fcn.140009cf4
test eax, eax
je 0x140003b13
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140003a80
lea rdi, str.ntdll.dll
xor edx, edx
mov rcx, rdi
call fcn.140001880
mov rcx, rax
mov edx, 0x7f6f58fc
call fcn.140001b50
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140003ad2
mov ecx, esi
jmp 0x140003b19
mov edx, 0x104
mov dword [rbp - 4], esi
mov rcx, rdi
mov qword [rbp], rdi
call fcn.140009638
add ax, ax
mov qword [rbp - 0x70], rsi
mov word [rbp - 8], ax
lea r9, [rbp - 0x70]
add ax, 2
lea r8, [rbp - 8]
xor edx, edx
mov word [rbp - 6], ax
xor ecx, ecx
call rbx
mov rcx, qword [rbp - 0x70]
test eax, eax
cmovs rcx, rsi
jmp 0x140003b19
mov rcx, qword [rbx + 0x20]
xor esi, esi
mov edx, 0x6feb9c9
call fcn.140001b50
mov rbx, rax
test r15, r15
je 0x140003c06
mov rax, qword [rbp + 8]
test rax, rax
je 0x140003c06
test r13, r13
je 0x140003c06
test r12, r12
je 0x140003c06
test r14, r14
je 0x140003c06
test rbx, rbx
je 0x140003c06
lea r9, [rbp + 0x10]
mov edx, 0x1fffff
lea r8, [rbp + 0x20]
lea rcx, [rbp + 0xb8]
call rax
test eax, eax
js 0x140003c06
mov rcx, qword [rbp + 0xb8]
lea r9, [rbp - 0x68]
mov dword [rsp + 0x28], 4
lea rdx, [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x20], 0x3000
call r13
test eax, eax
js 0x140003c06
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rbp + 0xb8]
test rdx, rdx
je 0x140003c03
mov r9, qword [rbp + 0xa8]
mov r8, qword [rbp + 0xa0]
mov qword [rsp + 0x20], rsi
call r12
mov rcx, qword [rbp + 0xb8]
test eax, eax
js 0x140003c03
lea rax, [rbp + 0xb0]
mov r9d, 0x20
lea r8, [rbp - 0x68]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x60]
call r14
test eax, eax
jns 0x140003c1c
mov rcx, qword [rbp + 0xb8]
call r15
xor eax, eax
add rsp, 0x158
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rax, qword [rsp + 0x60]
lea rcx, [rbp - 0x60]
mov r9, qword [rbp + 0xb8]
xor r8d, r8d
mov qword [rsp + 0x50], rsi
mov edx, 0x1fffff
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call rbx
test eax, eax
jne 0x140003bfc
mov rax, qword [rbp - 0x60]
jmp 0x140003c08