Function at 0x14005d330
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, r9
mov rsi, r8
mov r12d, edx
mov rbx, rcx
call fcn.14005e890
mov r8, rax
xor edx, edx
mov rcx, rbx
call fcn.140137f50
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov rbp, rax
test rax, rax
je case.default.0x14005d3ce
xor dil, dil
xor r15b, r15b
xor r14d, r14d
lea edx, [r14 + 1]
cmp dword [rax + 0xfc], r14d
je 0x14005d3ab
mov ecx, dword [rax + 0xf8]
test ecx, ecx
je 0x14005d3ab
movzx r15d, dl
test byte [rcx + rsi + 0x10], dl
cmovne r14d, edx
call fcn.14005eca0
dec eax
cmp eax, 7
ja case.default.0x14005d3ce
cdqe
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x5d6f4]
add rcx, rdx
jmp rcx
mov eax, 1
mov dword [rbx + 0x114], eax
mov ecx, dword [0x14070b620]
mov rax, qword gs:[0x58]
mov edx, 4
mov rdi, qword [rax + rcx*8]
add rdi, rdx
mov eax, dword [rdi]
cmp dword [0x14070a188], eax
jg 0x14005d69e
lea rcx, [rbx + 0x100]
call qword [sym.imp.ntdll.dll_NtQuerySystemTime]
mov rax, qword [rbp + 0x30]
mov qword [rbx + 0xf8], rax
xor edx, edx
mov rcx, r13
call fcn.14005e610
mov dword [rbx + 0x108], eax
mov dword [rbx + 0x10c], 4
mov eax, dword [rdi]
cmp dword [0x14070a168], eax
jg 0x14005d668
mov rcx, qword [0x14070a160]
test rcx, rcx
je case.default.0x14005d3ce
lea rdi, [rcx - 0xc8]
xor r8b, r8b
nop
cmp rsi, qword [rdi + 0x30]
jae 0x14005d47b
mov rax, qword [rdi + 0xc8]
test rax, rax
je 0x14005d495
lea rdi, [rax - 0xc8]
jmp 0x14005d460
jbe 0x14005d4aa
mov rax, qword [rdi + 0xd0]
test rax, rax
je 0x14005d492
lea rdi, [rax - 0xc8]
jmp 0x14005d460
mov r8b, 1
lea r9, [rbx + 0xc8]
lea rdx, [rdi + 0xc8]
call fcn.14005e570
jmp 0x14005d4cb
mov rax, qword [rdi + 0x98]
inc dword [rax + 0x18]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xa]
call fcn.14005ebe0
test al, al
je 0x14005d4cb
inc dword [rdi + 0x114]
mov ecx, 0x50
call fcn.14005e830
mov qword [rbx + 0x98], rax
test rax, rax
je case.default.0x14005d3ce
lea rcx, [rbx + 0xa0]
mov qword [rcx], rax
mov qword [rbx + 0xa8], rax
mov qword [rax], rcx
mov rax, qword [rbx + 0x98]
mov qword [rax + 8], rcx
mov rax, qword [rbx + 0x98]
mov dword [rax + 0x38], 9
mov rax, qword [rbx + 0x98]
mov ecx, 1
mov dword [rax + 0x18], ecx
cmp byte [0x14070a184], 0
je 0x14005d534
mov rax, qword [rbx + 0x98]
mov dword [rax + 0x1c], ecx
movzx ecx, r15b
shl ecx, 0x16
mov eax, dword [rbx + 0x68]
and eax, 0xffbffdff
or ecx, eax
btr ecx, 0x18
shl r12d, 9
not r12d
and r12d, 0x200
or ecx, r12d
shl r14d, 0x18
or ecx, r14d
or ecx, 0x840cc
mov dword [rbx + 0x68], ecx
mov dil, 1
call fcn.14005e890
cmp rax, 0xe0
jne case.0x14005d3ce.2
mov rax, qword [rbp + 0x30]
mov qword [rbx + 0xd0], rax
lea rcx, [rbx + 0xd8]
call qword [sym.imp.ntdll.dll_NtQuerySystemTime]
call fcn.14005e890
cmp rax, 0xc8
je 0x14005d5ac
call fcn.14005e890
cmp rax, 0xe0
jne case.0x14005d3ce.1
lea rax, [rbx + 0x98]
mov qword [rax], rax
mov qword [rbx + 0xa0], rax
lea rax, [rbx + 0xb8]
mov qword [rax], rax
mov qword [rbx + 0xc0], rax
lea rax, [rbx + 0xa8]
mov qword [rax], rax
mov qword [rbx + 0xb0], rax
mov qword [rbx + 0x30], rsi
mov eax, dword [rbp + 0x50]
mov dword [rbx + 0x40], eax
mov eax, dword [rbp + 8]
mov dword [rbx + 0x80], eax
movups xmm0, xmmword [r13]
movups xmmword [rbx + 0x58], xmm0
mov rax, qword [rsp + 0x80]
movups xmm0, xmmword [rax]
movups xmmword [rbx + 0x48], xmm0
mov eax, dword [rbp + 0x28]
add rax, rsi
mov qword [rbx + 0x38], rax
mov eax, 1
mov word [rbx + 0x6c], ax
test dil, dil
jne 0x14005d63a
mov dword [rbx + 0x68], 0x8c004
mov eax, dword [rbx + 0x68]
mov ecx, 0x48c004
test r15b, r15b
cmovne eax, ecx
mov dword [rbx + 0x68], eax
lea rax, [rbx + 0x70]
mov qword [rax], rax
mov qword [rbx + 0x78], rax
mov al, 1
jmp 0x14005d64b
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, [0x14070a168]
call fcn.140134534
cmp dword [0x14070a168], 0xffffffff
jne 0x14005d444
call fcn.14005cde0
mov qword [0x14070a160], rax
lea rcx, [0x14070a168]
call fcn.1401344d4
jmp 0x14005d444
lea rcx, [0x14070a188]
call fcn.140134534
cmp dword [0x14070a188], 0xffffffff
jne 0x14005d404
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], 3
mov r9d, 6
xor r8d, r8d
lea edx, [r9 - 4]
mov ecx, r9d
call fcn.14005ec60
mov byte [0x14070a184], al
lea rcx, [0x14070a188]
call fcn.1401344d4
jmp 0x14005d404