Function at 0x140004ab0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov ecx, 8
xor edi, edi
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x30], edi
lea edx, [rcx + 0x18]
call fcn.14000eeb4
mov qword [rsp + 0x38], rax
mov r14, rax
test rax, rax
je 0x14000504f
mov rax, qword gs:[0x60]
xor r15d, r15d
xor r13d, r13d
xor r12d, r12d
mov ebp, 1
mov dword [rsp + 0x34], ebp
mov rcx, qword [rax + 0x18]
mov rsi, qword [rcx + 0x10]
mov qword [rsp + 0x50], rsi
test rsi, rsi
je 0x140004ff7
jmp 0x140004b34
mov ebp, dword [rsp + 0x34]
mov rbx, qword [rsi + 0x60]
test rbx, rbx
je 0x140004e0d
mov r8d, 6
lea rdx, str.api_ms
mov rcx, rbx
call fcn.140015f50
test eax, eax
je 0x140004e0d
mov rdi, qword [rsi + 0x50]
test ebp, ebp
jne 0x140004bdb
lea rcx, str.____Hooks__t_tNo_hooks_found_in_this_module._n
call fcn.140001070
test r15, r15
je 0x140004b82
mov rcx, r15
call fcn.140014434
xor r15d, r15d
test r12, r12
je 0x140004bad
mov rcx, qword [r12 + 0x80]
test rcx, rcx
je 0x140004ba5
call fcn.140014434
mov qword [r12 + 0x80], 0
mov rcx, r12
call fcn.140014434
test r13, r13
je 0x140004be1
mov rcx, qword [r13 + 0x80]
test rcx, rcx
je 0x140004bce
call fcn.140014434
mov qword [r13 + 0x80], 0
mov rcx, r13
call fcn.140014434
xor r13d, r13d
jmp 0x140004be1
xor ebp, ebp
mov dword [rsp + 0x34], ebp
mov r9, qword [rsi + 0x30]
lea rcx, str.____Hooks__t_ws___ws_:_0x_p_n
mov r8, rdi
mov rdx, rbx
call fcn.140001070
mov rcx, qword [rsi + 0x30]
mov edx, 1
mov ebx, dword [rsp + 0x34]
mov edi, ebx
call fcn.140008190
mov r12, rax
test rax, rax
je 0x140004fe9
cmp qword [rax + 0x50], 0
je 0x140004fe9
mov rbx, qword [rsi + 0x50]
mov edx, 1
lea r8d, [rdx + 0x41]
call fcn.140006d80
mov rcx, rbx
call rax
cmp eax, 0xffffffff
je 0x140004fe0
test al, 0x10
jne 0x140004fe0
mov rcx, qword [rsi + 0x50]
call fcn.1400030b0
mov qword [rsp + 0x60], rax
mov ebx, edi
mov dword [rsp + 0x34], ebx
mov r15, rax
test rax, rax
je 0x140004fe9
xor edx, edx
mov rcx, rax
call fcn.140008190
mov dword [rsp + 0x34], ebx
mov r13, rax
test rax, rax
je 0x140004fe9
mov rdx, qword [r12 + 0x20]
mov rcx, rax
call fcn.140007ce0
xor eax, eax
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x40], eax
cmp dword [r13 + 0x60], eax
jbe 0x140004fe9
mov dword [rsp + 0x34], edi
nop dword [rax]
mov rdx, qword [r13 + 0x58]
mov rcx, r13
mov edx, dword [rdx + rax*4]
call fcn.140007c50
mov rdx, rax
mov rcx, r13
mov rsi, rax
call fcn.140008360
mov r10, qword [r13 + 0x48]
mov edi, eax
mov rax, qword [r13 + 0x30]
xor r8d, r8d
movzx r9d, word [rax + 6]
test r9d, r9d
je 0x140004d01
lea rdx, [r10 + 8]
mov ecx, dword [rdx + 4]
cmp ecx, edi
ja 0x140004cf5
add ecx, dword [rdx]
cmp edi, ecx
jb 0x140004d24
inc r8d
add rdx, 0x28
cmp r8d, r9d
jb 0x140004ce8
xor eax, eax
test dword [rax + 0x24], 0x20000000
je 0x140004deb
mov rdx, rsi
mov rcx, r13
call fcn.140008360
test eax, eax
jne 0x140004d2e
xor r15d, r15d
jmp 0x140004d3b
lea rcx, [r8 + r8*4]
lea rax, [r10 + rcx*8]
jmp 0x140004d03
mov edx, eax
mov rcx, r13
call fcn.140007c50
mov r15, rax
mov rdx, rsi
mov rcx, r12
call fcn.140008360
test eax, eax
jne 0x140004d4e
xor ebp, ebp
jmp 0x140004d5b
mov edx, eax
mov rcx, r12
call fcn.140007c50
mov rbp, rax
mov r14d, dword [rsp + 0x30]
xor ecx, ecx
test r14, r14
je 0x140004d81
mov rax, qword [rsp + 0x38]
add rax, 8
cmp qword [rax], rbp
je 0x140004deb
inc rcx
add rax, 0x20
cmp rcx, r14
jb 0x140004d70
mov rdx, rsi
mov rcx, r13
call fcn.140008360
test eax, eax
jne 0x140004d94
xor ebx, ebx
jmp 0x140004da1
mov edx, eax
mov rcx, r13
call fcn.140007c50
mov rbx, rax
mov rdx, rsi
mov rcx, r12
call fcn.140008360
test eax, eax
jne 0x140004db4
xor edx, edx
jmp 0x140004dc1
mov edx, eax
mov rcx, r12
call fcn.140007c50
mov rdx, rax
mov rcx, rbx
sub rdx, rbx
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
cmp byte [rcx], al
jne 0x140004e86
inc rcx
mov rax, rcx
sub rax, rbx
cmp rax, 0x18
jb 0x140004dd0
mov edi, dword [rsp + 0x30]
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
cmp eax, dword [r13 + 0x60]
jb 0x140004cb0
mov rsi, qword [rsp + 0x50]
mov r15, qword [rsp + 0x60]
mov ebx, dword [rsp + 0x34]
mov rax, qword gs:[0x60]
mov rsi, qword [rsi]
mov qword [rsp + 0x50], rsi
mov rcx, qword [rax + 0x18]
cmp rsi, qword [rcx + 0x10]
je 0x140004e35
test rsi, rsi
jne 0x140004b30
test ebx, ebx
jne 0x140004e45
lea rcx, str.____Hooks__t_tNo_hooks_found_in_this_module._n
call fcn.140001070
mov rcx, qword [rsp + 0x48]
cmp edi, ecx
jb 0x140004ff2
lea edx, [rcx + 1]
mov eax, 0x20
mul rdx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, qword [rsp + 0x38]
mov rdx, rax
call fcn.140015a1c
mov r14, rax
test rax, rax
je 0x140005038
jmp 0x140004ff7
mov r8d, edi
lea rcx, str.____Hooks__t_tHook_detected_in_function__s__0x_08lx_
mov rdx, rsi
call fcn.140001070
mov rcx, rbp
mov dword [rsp + 0x34], 1
call fcn.140004960
mov r8, rax
test rax, rax
jne 0x140004ec1
lea rcx, str....but_not_a_JMP__maybe_a_false_positive__data_export__or_unimplemented_hook_recognition_n
call fcn.140001070
jmp 0x140004deb
mov rax, qword gs:[0x60]
mov rdi, 0xffffffffffffffff
mov r9, rdi
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
test rdx, rdx
je 0x140004f13
mov rcx, qword [rdx + 0x30]
cmp rcx, r8
ja 0x140004ef8
mov rax, r8
sub rax, rcx
cmp rax, r9
jae 0x140004ef8
mov r9, rax
mov rax, qword gs:[0x60]
mov rdx, qword [rdx]
mov rcx, qword [rax + 0x18]
cmp rdx, qword [rcx + 0x10]
je 0x140004f13
test rdx, rdx
jne 0x140004ee1
xor ebx, ebx
mov rcx, rdi
inc rcx
cmp byte [rsi + rcx], bl
jne 0x140004f18
mov eax, 0x28
cmp rax, rcx
je 0x140004f59
nop word [rax + rax]
lea rcx, [0x14003344c]
call fcn.140001070
inc ebx
mov rax, rdi
inc rax
cmp byte [rsi + rax], 0
jne 0x140004f41
mov ecx, 0x28
sub rcx, rax
mov eax, ebx
cmp rax, rcx
jb 0x140004f30
mov rax, qword [rsp + 0x48]
mov edi, dword [rsp + 0x30]
cmp edi, eax
jb 0x140004fa2
add eax, eax
mov ecx, eax
mov qword [rsp + 0x48], rax
mov eax, 0x20
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, qword [rsp + 0x38]
mov rdx, rax
call fcn.140015a1c
mov qword [rsp + 0x38], rax
mov rbx, rax
test rax, rax
je 0x14000504f
jmp 0x140004fa7
mov rbx, qword [rsp + 0x38]
lea rcx, [0x140033450]
call fcn.140001070
shl r14, 5
mov rdx, r15
mov rcx, rbp
mov qword [r14 + rbx + 8], rbp
mov qword [r14 + rbx], r15
mov qword [r14 + rbx + 0x10], rsi
call fcn.140004560
inc edi
mov qword [r14 + rbx + 0x18], rax
mov dword [rsp + 0x30], edi
jmp 0x140004def
mov edi, dword [rsp + 0x30]
jmp 0x140004e0d
mov edi, dword [rsp + 0x30]
jmp 0x140004e11
mov r14, qword [rsp + 0x38]
lea r11, [rsp + 0x70]
mov eax, edi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
shl rax, 5
mov qword [rax + r14 + 8], 0
mov qword [rax + r14], 0
mov qword [rax + r14 + 0x10], 0
mov rax, r14
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, str.realloc_failed_n
call fcn.140001070
mov ecx, 1
call fcn.14000eea8
int3
mov ecx, 1
call fcn.14000eea8
int3