Function at 0x14001a910
Capabilities:
Access peb ldr_data
Enumerate pe sections
Get ntdll base address

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x14003c010]
xor rax, rsp
mov qword [rbp - 8], rax
lea rcx, str.___Parsing_LdrpThunkSignature_For_Clean_Syscalls._n_n
call fcn.14001a8b0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rbx, qword [rcx + 0x10]
cmp qword [rbx + 0x30], 0
je 0x14001a974
nop
mov rcx, qword [rbx + 0x60]
lea rdx, str.ntdll.dll
mov r8d, 9
call fcn.140023750
test eax, eax
je 0x14001a987
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], 0
jne 0x14001a950
lea rcx, str.____Cannot_find_NTDLL._n
call fcn.14001a8b0
xor eax, eax
jmp 0x14001aaf9
mov qword [rsp + 0x50], rsi
xor edx, edx
mov qword [rsp + 0x58], rdi
movzx r9d, dx
mov rdi, qword [rbx + 0x30]
mov qword [rsp + 0x60], r14
movsxd rcx, dword [rdi + 0x3c]
lea rbx, [rdi + 0x18]
add rbx, rcx
movzx eax, word [rcx + rdi + 0x14]
movzx r11d, word [rcx + rdi + 6]
add rbx, rax
cmp dx, r11w
jae 0x14001aae8
lea rsi, [0x1400391d8]
nop word [rax + rax]
movzx r10d, r9w
lea rax, [r10 + r10*4]
lea r8, [rbx + rax*8]
mov rax, rdx
nop
movzx ecx, byte [r8 + rax]
inc rax
cmp cl, byte [rsi + rax - 1]
jne 0x14001aa5f
cmp rax, 6
jne 0x14001a9e0
lea rax, [r10 + r10*4]
mov ecx, dword [rbx + rax*8 + 0xc]
mov r8d, dword [rbx + rax*8 + 8]
add rcx, rdi
je 0x14001aae8
cmp r8d, 0x50
jb 0x14001aae8
add r8d, 0xffffffb0
je 0x14001aae8
nop
mov eax, edx
cmp dword [rax + rcx], 0xb8d18b4c
jne 0x14001aa53
cmp dword [rax + rcx + 0x10], 0xb8d18b4c
jne 0x14001aa53
cmp dword [rax + rcx + 0x20], 0xb8d18b4c
jne 0x14001aa53
cmp dword [rax + rcx + 0x30], 0xb8d18b4c
jne 0x14001aa53
cmp dword [rax + rcx + 0x40], 0xb8d18b4c
je 0x14001aa6f
inc edx
cmp edx, r8d
jb 0x14001aa20
jmp 0x14001aae8
inc r9w
cmp r9w, r11w
jb 0x14001a9d0
jmp 0x14001aae8
mov ebx, dword [rax + rcx + 0x44]
mov edi, dword [rax + rcx + 4]
mov esi, dword [rax + rcx + 0x14]
mov r14d, dword [rax + rcx + 0x34]
test ebx, ebx
je 0x14001aae8
mov edx, edi
lea rcx, str.___NtOpenFile_syscall_number..............:__02x_n
call fcn.14001a8b0
mov edx, esi
lea rcx, str.___NtCreateSection_syscall_number.........:__02x_n
call fcn.14001a8b0
mov edx, r14d
lea rcx, str.___NtOpenSection_syscall_number...........:__02x_n
call fcn.14001a8b0
mov edx, ebx
lea rcx, str.___NtMapViewOfSection_syscall_number......:__02x_n_n
call fcn.14001a8b0
xor ecx, ecx
mov edx, 0x100
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r10, rax
test rax, rax
jne 0x14001ab10
lea rcx, str.____Cannot_allocate_memory_for_syscals_stubs._n
call fcn.14001a8b0
xor eax, eax
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x60]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14001fdb0
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
lea rcx, [r10 + 0x80]
mov dword [rbp - 0x20], 0xb8d18b4c
mov dword [rbp - 0x1c], 0
lea r9, [rbp - 0x10]
movsd xmm0, qword [rbp - 0x20]
mov edx, 0x100
movsd qword [rax], xmm0
mov r8d, 0x20
mov dword [rbp - 0x20], 0xb8d18b4c
mov dword [rbp - 0x1c], 0
movsd xmm0, qword [rbp - 0x20]
mov dword [rbp - 0x20], 0xb8d18b4c
mov dword [rbp - 0x1c], 0
mov qword [0x14003fda0], rcx
mov word [rbp - 0x18], 0x50f
movzx eax, word [rbp - 0x18]
mov word [r10 + 8], ax
mov byte [r10 + 0xa], 0xc3
mov dword [r10 + 4], edi
movsd qword [r10 + 0x40], xmm0
movsd xmm0, qword [rbp - 0x20]
mov word [rbp - 0x18], 0x50f
movzx eax, word [rbp - 0x18]
mov word [r10 + 0x48], ax
mov byte [r10 + 0x4a], 0xc3
mov dword [r10 + 0x44], esi
movsd qword [rcx], xmm0
mov word [rbp - 0x18], 0x50f
movzx eax, word [rbp - 0x18]
mov word [rcx + 8], ax
mov byte [rcx + 0xa], 0xc3
mov dword [rcx + 4], r14d
lea rcx, [r10 + 0xc0]
mov qword [0x14003fda8], rcx
mov dword [rbp - 0x20], 0xb8d18b4c
mov dword [rbp - 0x1c], 0
movsd xmm0, qword [rbp - 0x20]
movsd qword [rcx], xmm0
mov word [rbp - 0x18], 0x50f
movzx eax, word [rbp - 0x18]
mov word [rcx + 8], ax
mov byte [rcx + 0xa], 0xc3
mov dword [rcx + 4], ebx
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 1
jmp 0x14001aaea