Function at 0x140114ca0
Capabilities:
Access peb ldr_data
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xb8
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r13, qword [rcx + 0x18]
add r13, 0x10
mov r12, qword [r13]
cmp r12, r13
je 0x140114f0f
nop dword [rax + rax]
movzx esi, word [r12 + 0x58]
mov rdi, qword [r12 + 0x60]
cmp rsi, qword [0x140210710]
jne 0x140114e6d
cmp byte [0x1402165de], 1
mov ecx, esi
mov r14, qword [str.dbghelp.dll]
jb 0x140114d51
shr rcx, 4
test rcx, rcx
je 0x140114d39
movdqu xmm0, xmmword [r14]
movdqu xmm1, xmmword [rdi]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140114d42
add rdi, 0x10
add r14, 0x10
sub rcx, 1
jne 0x140114d13
shr rsi, 1
and esi, 7
jmp 0x140114d80
and esi, 0xf
shl rcx, 4
add rsi, rcx
shr rsi, 1
jmp 0x140114d80
shr rcx, 3
test rcx, rcx
je 0x140114d7a
nop word [rax + rax]
mov rax, qword [r14]
cmp qword [rdi], rax
jne 0x140114e5e
add rdi, 8
add r14, 8
sub rcx, 1
jne 0x140114d60
shr rsi, 1
and esi, 3
test rsi, rsi
je 0x140114dc6
sub r14, rdi
nop dword [rax + rax]
movzx ecx, word [rdi]
movzx r15d, word [r14 + rdi]
cmp cx, r15w
je 0x140114dbc
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140114e6d
add rdi, 2
sub rsi, 1
jne 0x140114d90
test r12, r12
je 0x140114f0f
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r13, qword [rcx + 0x18]
add r13, 0x10
mov r12, qword [r13]
cmp r12, r13
je 0x140114f0f
movzx esi, word [r12 + 0x58]
mov rbx, qword [r12 + 0x60]
cmp rsi, qword [0x140210720]
jne 0x140115017
cmp byte [0x1402165de], 1
mov ecx, esi
mov r14, qword [str.symsrv.dll]
jb 0x140114e8e
shr rcx, 4
test rcx, rcx
je 0x140114e56
nop word [rax + rax]
movdqu xmm1, xmmword [r14]
movdqu xmm0, xmmword [rbx]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140114e7f
add rbx, 0x10
add r14, 0x10
sub rcx, 1
jne 0x140114e30
shr rsi, 1
and esi, 7
jmp 0x140114ec0
and esi, 7
lea rsi, [rsi + rcx*8]
shr rsi, 1
jmp 0x140114d80
mov r12, qword [r12]
cmp r12, r13
jne 0x140114ce0
jmp 0x140114f0f
and esi, 0xf
shl rcx, 4
add rsi, rcx
shr rsi, 1
jmp 0x140114ec0
shr rcx, 3
test rcx, rcx
je 0x140114eba
nop word [rax + rax]
mov rax, qword [r14]
cmp qword [rbx], rax
jne 0x140115008
add rbx, 8
add r14, 8
sub rcx, 1
jne 0x140114ea0
shr rsi, 1
and esi, 3
test rsi, rsi
je 0x140114f06
sub r14, rbx
nop dword [rax + rax]
movzx ecx, word [rbx]
movzx r15d, word [rbx + r14]
cmp cx, r15w
je 0x140114efc
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx edi, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp di, ax
jne 0x140115017
add rbx, 2
sub rsi, 1
jne 0x140114ed0
test r12, r12
jne 0x140115b90
mov rcx, qword [0x1402106d0]
xor r13d, r13d
mov word [rbp - 0x69], cx
mov edi, r13d
mov r12d, r13d
lea eax, [rcx + 2]
mov word [rbp - 0x67], ax
lea r14d, [r13 - 1]
mov rax, qword [str.SoftwareMicrosoftWindows_KitsInstalled_Roots]
mov qword [rbp - 0x61], rax
cmp rcx, 0xfffe
ja 0x140115077
lea rax, [rbp + 0x77]
xor r8d, r8d
lea r9, [rbp - 0x49]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x69]
lea rcx, [r13 - 3]
call fcn.140120390
test eax, eax
js 0x140115077
lea r8, ds:[rbp - 0x49]
mov edx, 0x20019
lea rcx, [rbp + 0x6f]
call qword [sym.imp.ntdll.dll_NtOpenKey]
mov rcx, qword [rbp + 0x77]
mov ebx, eax
test rcx, rcx
je 0x140114f97
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140115077
mov rcx, qword [rbp + 0x6f]
lea rdx, str.KitsRoot10
call sym.ProcessHacker.exe_PhQueryRegistryString
mov rbx, rax
mov rdi, rax
test rax, rax
je 0x140114fbf
cmp qword [rax], r12
jne 0x140114ff2
mov rcx, qword [rbp + 0x6f]
lea rdx, str.KitsRoot81
call sym.ProcessHacker.exe_PhQueryRegistryString
mov rdi, rax
test rbx, rbx
je 0x140114fed
lea rcx, [rbx - 0x10]
mov edx, r14d
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140114fed
call fcn.140106290
test rdi, rdi
je 0x14011502e
cmp qword [rdi], r12
je 0x14011502e
mov rcx, qword ds:[rbp + 0x6f]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x14011506e
and esi, 7
lea rsi, [rsi + rcx*8]
shr rsi, 1
jmp 0x140114ec0
mov r12, qword ds:[r12]
cmp r12, r13
jne 0x140114df1
jmp 0x140114f0f
mov rcx, qword [rbp + 0x6f]
lea rdx, str.KitsRoot
call sym.ProcessHacker.exe_PhQueryRegistryString
mov rcx, rdi
mov rdi, rax
test rcx, rcx
je 0x14011505f
add rcx, 0xfffffffffffffff0
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14011505f
call fcn.140106290
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.ntdll.dll_NtClose]
test rdi, rdi
je 0x140115077
cmp qword [rdi], r12
jne 0x1401151bd
mov rcx, qword [0x140210700]
mov rsi, rdi
mov word [rbp - 0x59], cx
lea eax, [rcx + 2]
mov word [rbp - 0x57], ax
mov rax, qword [str.SoftwareWow6432NodeMicrosoftWindows_KitsInstalled_Roots]
mov qword [rbp - 0x51], rax
cmp rcx, 0xfffe
ja 0x1401151b4
xor r8d, r8d
lea rax, [rbp + 0x7f]
lea r9, [rbp - 0x19]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x59]
lea rcx, [r8 - 3]
call fcn.140120390
test eax, eax
js 0x1401151b4
lea r8, ds:[rbp - 0x19]
mov edx, 0x20019
lea rcx, [rbp + 0x6f]
call qword [sym.imp.ntdll.dll_NtOpenKey]
mov rcx, qword [rbp + 0x7f]
mov ebx, eax
test rcx, rcx
je 0x1401150f7
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x1401151b4
mov rcx, qword [rbp + 0x6f]
lea rdx, str.KitsRoot10
call sym.ProcessHacker.exe_PhQueryRegistryString
mov rbx, rax
mov rdi, rax
test rsi, rsi
je 0x140115132
lea rcx, [rsi - 0x10]
mov r8d, r14d
lock xadd dword [rcx + 8], r8d
cmp r8d, 1
jne 0x140115132
call fcn.140106290
test rbx, rbx
je 0x14011513c
cmp qword [rbx], r12
jne 0x14011516f
mov rcx, qword [rbp + 0x6f]
lea rdx, str.KitsRoot81
call sym.ProcessHacker.exe_PhQueryRegistryString
mov rdi, rax
test rbx, rbx
je 0x14011516a
lea rcx, [rbx - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14011516a
call fcn.140106290
test rdi, rdi
je 0x140115174
cmp qword [rdi], r12
jne 0x1401151aa
mov rcx, qword ds:[rbp + 0x6f]
lea rdx, str.KitsRoot
call sym.ProcessHacker.exe_PhQueryRegistryString
mov rcx, rdi
mov rdi, rax
test rcx, rcx
je 0x1401151aa
add rcx, 0xfffffffffffffff0
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1401151aa
call fcn.140106290
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.ntdll.dll_NtClose]
test rdi, rdi
je 0x14011535f
mov rbx, qword [rdi]
mov rdx, qword [0x140213b58]
add rbx, 0x1e
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r15, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rbx + rcx], r13w
mov r8, qword [rdi]
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
call fcn.140165120
mov rcx, qword [rdi]
mov rdx, qword [r15 + 8]
movups xmm0, xmmword [str.Debuggersx64_]
movups xmmword [rdx + rcx], xmm0
movsd xmm1, qword [0x1401c8ba0]
movsd qword [rdx + rcx + 0x10], xmm1
mov eax, dword [0x1401c8ba8]
mov dword [rdx + rcx + 0x18], eax
movzx eax, word [0x1401c8bac]
mov word [rdx + rcx + 0x1c], ax
lea rcx, [rdi - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140115245
nop
call fcn.140106290
mov rbx, qword [0x140210710]
add rbx, qword [r15]
mov rdx, qword [0x140213b58]
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rbx + rcx], r13w
mov r8, qword [r15]
mov rdx, qword [r15 + 8]
mov rcx, qword [rax + 8]
call fcn.140165120
mov rcx, qword [r15]
add rcx, qword [rdi + 8]
mov r8, qword [0x140210710]
mov rdx, qword [str.dbghelp.dll]
call fcn.140165120
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [rdi - 0x10]
mov edx, r14d
mov rsi, rax
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1401152c5
nop dword [rax]
call fcn.140106290
mov rbx, qword [0x140210720]
add rbx, qword [r15]
mov rdx, qword [0x140213b58]
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rbx + rcx], r13w
mov r8, qword [r15]
mov rdx, qword [r15 + 8]
mov rcx, qword [rax + 8]
call fcn.140165120
mov rcx, qword [r15]
add rcx, qword [rdi + 8]
mov r8, qword [0x140210720]
mov rdx, qword [str.symsrv.dll]
call fcn.140165120
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [rdi - 0x10]
mov edx, r14d
mov r12, rax
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140115345
nop dword [rax]
call fcn.140106290
lea rcx, [r15 - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x14011535a
call fcn.140106290
test rsi, rsi
jne 0x14011536f
lea rcx, str.dbghelp.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test r12, r12
jne 0x140115386
lea rcx, str.symsrv.dll
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rsi, rsi
je 0x140115b90
movzx ecx, word [rsi]
mov ebx, 0x5a4d
cmp cx, bx
jne 0x1401153f6
mov edx, dword [rsi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x1401153f6
cmp dword [rdx + rsi], 0x4550
jne 0x1401153f6
lea r8, ds:[rsi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x1401153ed
cmp dword [r8 + 4], r13d
je 0x1401153ed
lea r9, [rsi + rax]
mov word [rsp + 0x28], r13w
lea rax, str.SymInitializeW
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
movzx ecx, word [rsi]
jmp 0x1401153f9
mov qword [0x140213d40], r13
jmp 0x140115405
mov rax, r13
mov qword [0x140213d40], rax
cmp cx, bx
jne 0x140115455
mov edx, dword [rsi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x140115455
cmp dword [rdx + rsi], 0x4550
jne 0x140115455
lea r8, [rsi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140115455
cmp dword [r8 + 4], r13d
je 0x140115455
lea r9, [rsi + rax]
mov word [rsp + 0x28], r13w
lea rax, str.SymCleanup
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
movzx ecx, word [rsi]
jmp 0x140115458
mov rax, r13
mov qword [0x140213d48], rax
nop
cmp cx, bx
jne 0x14011551d
mov edx, dword [rsi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x1401154bc
cmp dword [rdx + rsi], 0x4550
jne 0x1401154bc
lea r8, [rsi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x1401154bc
cmp dword [r8 + 4], r13d
je 0x1401154bc
lea r9, [rsi + rax]
mov word [rsp + 0x28], r13w
lea rax, str.SymEnumSymbolsW
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
movzx ecx, word [rsi]
cmp cx, bx
jne 0x14011551d
mov edx, dword [rsi + 0x3c]
movzx eax, cx
test edx, edx
je 0x140115520
cmp edx, 0x10000000
jae 0x140115520
cmp dword [rdx + rsi], 0x4550
jne 0x140115520
lea r8, [rsi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140115514
cmp dword [r8 + 4], r13d
je 0x140115514
lea r9, [rsi + rax]
mov word [rsp + 0x28], r13w
lea rax, str.SymFromAddrW
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
mov rdx, rax
movzx eax, word [rsi]
jmp 0x140115523
mov qword [0x140213d90], r13
jmp 0x140115532
movzx eax, cx
mov rdx, r13
mov qword [0x140213d90], rdx
movzx ecx, ax
cmp ax, bx
jne 0x14011558b
mov edx, dword [rsi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x14011558b
cmp dword [rdx + rsi], 0x4550
jne 0x14011558b
lea r8, [rsi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140115582
cmp dword [r8 + 4], r13d
je 0x140115582
lea r9, [rsi + rax]
mov word [rsp + 0x28], r13w
lea rax, str.SymFromNameW
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
movzx ecx, word [rsi]
jmp 0x14011558e
mov qword [0x140213d60], r13
jmp 0x14011559a
mov rax, r13
mov qword [0x140213d60], rax
cmp cx, bx
jne 0x1401155f6
mov edx, dword [rsi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x1401155f6
cmp dword [rdx + rsi], 0x4550
jne 0x1401155f6
lea r8, ds:[rsi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x1401155ed
cmp dword [r8 + 4], r13d
je 0x1401155ed
lea r9, [rsi + rax]
mov word [rsp + 0x28], r13w
lea rax, str.SymGetLineFromAddrW64
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
movzx ecx, word [rsi]
jmp 0x1401155f9
mov qword [0x140213d58], r13
jmp 0x140115605
mov rax, r13
mov qword [0x140213d58], rax
cmp cx, bx
jne 0x14011565e
mov edx, dword [rsi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x14011565e
cmp dword [rdx + rsi], 0x4550
jne 0x14011565e
lea r8, [rsi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140115655
cmp dword [r8 + 4], r13d
je 0x140115655
lea r9, [rsi + rax]
mov word [rsp + 0x28], r13w
lea rax, str.SymLoadModuleExW
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
movzx ecx, word [rsi]
jmp 0x140115661
mov qword [0x140213d68], r13
jmp 0x14011566d
mov rax, r13
mov qword [0x140213d68], rax
cmp cx, bx
jne 0x1401156c6
mov edx, dword [rsi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x1401156c6
cmp dword [rdx + rsi], 0x4550
jne 0x1401156c6
lea r8, [rsi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x1401156bd
cmp dword [r8 + 4], r13d
je 0x1401156bd
lea r9, [rsi + rax]
mov word [rsp + 0x28], r13w
lea rax, str.SymGetOptions
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
movzx ecx, word [rsi]
jmp 0x1401156c9
mov qword [0x140213da0], r13
jmp 0x1401156d5
mov rax, r13
mov qword [0x140213da0], rax
cmp cx, bx
jne 0x140115736
mov edx, dword ds:[rsi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x140115736
cmp dword [rdx + rsi], 0x4550
jne 0x140115736
lea r8, ds:[rsi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x14011572d
cmp dword [r8 + 4], r13d
je 0x14011572d
lea r9, [rsi + rax]
mov word [rsp + 0x28], r13w
lea rax, str.SymSetOptions
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
movzx ecx, word [rsi]
jmp 0x140115739
mov qword [0x140213d78], r13
jmp 0x140115749
mov rax, r13
mov qword [0x140213d78], rax
cmp cx, bx
jne 0x1401157fd
mov edx, dword [rsi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x14011579c
cmp dword [rdx + rsi], 0x4550
jne 0x14011579c
lea r8, [rsi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x14011579c
cmp dword [r8 + 4], r13d
je 0x14011579c
lea r9, [rsi + rax]
mov word [rsp + 0x28], r13w
lea rax, str.SymGetSearchPathW
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
movzx ecx, word [rsi]
cmp cx, bx
jne 0x1401157fd
mov edx, dword [rsi + 0x3c]
movzx eax, cx
test edx, edx
je 0x140115800
cmp edx, 0x10000000
jae 0x140115800
cmp dword [rdx + rsi], 0x4550
jne 0x140115800
lea r8, [rsi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x1401157f4
cmp dword [r8 + 4], r13d
je 0x1401157f4
lea r9, [rsi + rax]
mov word [rsp + 0x28], r13w
lea rax, str.SymSetSearchPathW
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
mov rdx, rax
movzx eax, word [rsi]
jmp 0x140115803
mov qword [0x140213da8], r13
jmp 0x140115816
movzx eax, cx
mov rdx, r13
mov qword [0x140213da8], rdx
movzx ecx, ax
cmp ax, bx
jne 0x1401158d9
mov edx, dword ds:[rsi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x140115870
cmp dword [rdx + rsi], 0x4550
jne 0x140115870
lea r8, ds:[rsi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140115870
cmp dword [r8 + 4], r13d
je 0x140115870
lea r9, [rsi + rax]
mov word [rsp + 0x28], r13w
lea rax, str.SymUnloadModule64
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
movzx ecx, word [rsi]
cmp cx, bx
jne 0x1401158d9
mov edx, dword [rsi + 0x3c]
movzx eax, cx
test edx, edx
je 0x1401158dc
nop word [rax + rax]
cmp edx, 0x10000000
jae 0x1401158dc
cmp dword [rdx + rsi], 0x4550
jne 0x1401158dc
lea r8, ds:[rsi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x1401158d0
cmp dword [r8 + 4], r13d
je 0x1401158d0
lea r9, [rsi + rax]
mov word [rsp + 0x28], r13w
lea rax, str.SymFunctionTableAccess64
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
mov rdx, rax
movzx eax, word [rsi]
jmp 0x1401158df
mov qword [0x140213d98], r13
jmp 0x1401158ee
movzx eax, cx
mov rdx, r13
mov qword [0x140213d98], rdx
movzx ecx, ax
cmp ax, bx
jne 0x140115947
mov edx, dword [rsi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x140115947
cmp dword [rdx + rsi], 0x4550
jne 0x140115947
lea r8, [rsi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x14011593e
cmp dword [r8 + 4], r13d
je 0x14011593e
lea r9, [rsi + rax]
mov word [rsp + 0x28], r13w
lea rax, str.SymGetModuleBase64
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
movzx ecx, word [rsi]
jmp 0x14011594a
mov qword [0x140213d50], r13
jmp 0x140115956
mov rax, r13
mov qword [0x140213d50], rax
cmp cx, bx
jne 0x1401159b6
mov edx, dword ds:[rsi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x1401159b6
cmp dword [rdx + rsi], 0x4550
jne 0x1401159b6
lea r8, ds:[rsi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x1401159ad
cmp dword [r8 + 4], r13d
je 0x1401159ad
lea r9, [rsi + rax]
mov word [rsp + 0x28], r13w
lea rax, str.SymRegisterCallbackW64
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
movzx ecx, word [rsi]
jmp 0x1401159b9
mov qword [0x140213d70], r13
jmp 0x1401159c5
mov rax, r13
mov qword [0x140213d70], rax
cmp cx, bx
jne 0x140115a1e
mov edx, dword [rsi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x140115a1e
cmp dword [rdx + rsi], 0x4550
jne 0x140115a1e
lea r8, [rsi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140115a15
cmp dword [r8 + 4], r13d
je 0x140115a15
lea r9, [rsi + rax]
mov word [rsp + 0x28], r13w
lea rax, str.StackWalk64
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
movzx ecx, word [rsi]
jmp 0x140115a21
mov qword [0x140213d88], r13
jmp 0x140115a2d
mov rax, r13
mov qword [0x140213d88], rax
cmp cx, bx
jne 0x140115a86
mov edx, dword [rsi + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x140115a86
cmp dword [rdx + rsi], 0x4550
jne 0x140115a86
lea r8, [rsi + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x140115a7d
cmp dword [r8 + 4], r13d
je 0x140115a7d
lea r9, [rsi + rax]
mov word [rsp + 0x28], r13w
lea rax, str.MiniDumpWriteDump
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
movzx ecx, word [rsi]
jmp 0x140115a89
mov qword [0x140213d80], r13
jmp 0x140115a99
mov rax, r13
mov qword [0x140213d80], rax
cmp cx, bx
jne 0x140115b90
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0xffffffe
ja 0x140115af1
cmp dword [rcx + rsi], 0x4550
jne 0x140115af1
lea r8, ds:[rsi + 0x88]
add r8, rcx
mov eax, dword [r8]
test eax, eax
je 0x140115af1
cmp dword [r8 + 4], r13d
je 0x140115af1
lea r9, [rsi + rax]
mov word [rsp + 0x28], r13w
lea rax, str.UnDecorateSymbolNameW
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
cmp word [rsi], bx
jne 0x140115b90
mov ecx, dword [rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0xffffffe
ja 0x140115b45
cmp dword [rcx + rsi], 0x4550
jne 0x140115b45
lea r8, [rsi + 0x88]
add r8, rcx
mov eax, dword [r8]
test eax, eax
je 0x140115b45
cmp dword [r8 + 4], r13d
je 0x140115b45
lea r9, [rsi + rax]
mov word [rsp + 0x28], r13w
lea rax, str.SymGetDiaSession
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
nop dword [rax]
cmp word [rsi], bx
jne 0x140115b90
mov ecx, dword [rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0xffffffe
ja 0x140115b90
cmp dword [rcx + rsi], 0x4550
jne 0x140115b90
lea r8, [rsi + 0x88]
add r8, rcx
mov eax, dword [r8]
test eax, eax
je 0x140115b90
cmp dword [r8 + 4], r13d
je 0x140115b90
lea r9, [rsi + rax]
mov word [rsp + 0x28], r13w
lea rax, str.SymFreeDiaString
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140104bd0
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret