Function at 0x1400030e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x14002b018]
xor rax, rsp
mov qword [rbp + 0x240], rax
xor edi, edi
lea rcx, [rbp + 0x30]
xor edx, edx
mov qword [rsp + 0x30], rdi
mov r8d, 0x208
call fcn.140006350
mov rax, qword gs:[0x60]
lea r15, str.Advapi32.dll
lea edx, [rdi + 0x5c]
mov rcx, r15
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rbx, qword [rsi]
call fcn.1400061c4
test rax, rax
mov r14d, edi
setne r14b
mov rcx, r15
test r14d, r14d
je 0x14000316e
mov rdx, qword [rbx + 0x40]
jmp 0x140003172
mov rdx, qword [rbx + 0x50]
call fcn.140009cf4
test eax, eax
je 0x1400031f4
mov rbx, qword [rbx]
cmp rbx, rsi
jne 0x140003160
xor edx, edx
lea rcx, str.ntdll.dll
call fcn.140001880
mov rcx, rax
mov edx, 0x7f6f58fc
call fcn.140001b50
mov rbx, rax
test rax, rax
jne 0x1400031ab
mov rcx, rdi
jmp 0x1400031f8
mov edx, 0x104
mov dword [rsp + 0x5c], edi
mov rcx, r15
mov qword [rsp + 0x60], r15
call fcn.140009638
add ax, ax
mov qword [rsp + 0x38], rdi
mov word [rsp + 0x58], ax
lea r9, [rsp + 0x38]
add ax, 2
lea r8, [rsp + 0x58]
xor edx, edx
mov word [rsp + 0x5a], ax
xor ecx, ecx
call rbx
mov rcx, qword [rsp + 0x38]
test eax, eax
cmovs rcx, rdi
jmp 0x1400031f8
mov rcx, qword [rbx + 0x20]
mov edx, 0x3e819e88
call fcn.140001b50
mov rcx, qword gs:[0x60]
mov edx, 0x5c
mov r13, rax
mov rsi, qword [rcx + 0x18]
mov rcx, r15
add rsi, 0x20
mov rbx, qword [rsi]
call fcn.1400061c4
test rax, rax
mov r14d, edi
setne r14b
mov rcx, r15
test r14d, r14d
je 0x14000323e
mov rdx, qword [rbx + 0x40]
jmp 0x140003242
mov rdx, qword [rbx + 0x50]
call fcn.140009cf4
test eax, eax
je 0x1400032c4
mov rbx, qword [rbx]
cmp rbx, rsi
jne 0x140003230
xor edx, edx
lea rcx, str.ntdll.dll
call fcn.140001880
mov rcx, rax
mov edx, 0x7f6f58fc
call fcn.140001b50
mov rbx, rax
test rax, rax
jne 0x14000327b
mov rcx, rdi
jmp 0x1400032c8
mov edx, 0x104
mov dword [rsp + 0x6c], edi
mov rcx, r15
mov qword [rsp + 0x70], r15
call fcn.140009638
add ax, ax
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x68], ax
lea r9, [rsp + 0x40]
add ax, 2
lea r8, [rsp + 0x68]
xor edx, edx
mov word [rsp + 0x6a], ax
xor ecx, ecx
call rbx
mov rcx, qword [rsp + 0x40]
test eax, eax
cmovs rcx, rdi
jmp 0x1400032c8
mov rcx, qword [rbx + 0x20]
mov edx, 0x1ca1ffa8
call fcn.140001b50
mov rcx, qword gs:[0x60]
mov edx, 0x5c
mov r12, rax
mov rsi, qword [rcx + 0x18]
mov rcx, r15
add rsi, 0x20
mov rbx, qword [rsi]
call fcn.1400061c4
test rax, rax
mov r14d, edi
setne r14b
mov rcx, r15
test r14d, r14d
je 0x14000330e
mov rdx, qword [rbx + 0x40]
jmp 0x140003312
mov rdx, qword [rbx + 0x50]
call fcn.140009cf4
test eax, eax
je 0x140003393
mov rbx, qword [rbx]
cmp rbx, rsi
jne 0x140003300
xor edx, edx
lea rcx, str.ntdll.dll
call fcn.140001880
mov rcx, rax
mov edx, 0x7f6f58fc
call fcn.140001b50
mov rbx, rax
test rax, rax
jne 0x14000334b
mov rcx, rdi
jmp 0x140003397
mov edx, 0x104
mov dword [rsp + 0x7c], edi
mov rcx, r15
mov qword [rbp - 0x80], r15
call fcn.140009638
add ax, ax
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x78], ax
lea r9, [rsp + 0x48]
add ax, 2
lea r8, [rsp + 0x78]
xor edx, edx
mov word [rsp + 0x7a], ax
xor ecx, ecx
call rbx
mov rcx, qword [rsp + 0x48]
test eax, eax
cmovs rcx, rdi
jmp 0x140003397
mov rcx, qword [rbx + 0x20]
mov edx, 0x287439ed
call fcn.140001b50
mov rcx, qword gs:[0x60]
mov edx, 0x5c
mov r15, rax
mov rsi, qword [rcx + 0x18]
lea rcx, str.Kernel32.dll
add rsi, 0x20
mov rbx, qword [rsi]
call fcn.1400061c4
test rax, rax
mov r14d, edi
setne r14b
lea rcx, str.Kernel32.dll
test r14d, r14d
je 0x1400033e5
mov rdx, qword [rbx + 0x40]
jmp 0x1400033e9
mov rdx, qword [rbx + 0x50]
call fcn.140009cf4
test eax, eax
je 0x14000346b
mov rbx, qword [rbx]
cmp rbx, rsi
jne 0x1400033d3
xor edx, edx
lea rcx, str.ntdll.dll
call fcn.140001880
mov rcx, rax
mov edx, 0x7f6f58fc
call fcn.140001b50
mov rbx, rax
test rax, rax
je 0x14000346f
lea rax, str.Kernel32.dll
mov dword [rbp - 0x74], edi
mov rcx, rax
mov qword [rbp - 0x70], rax
mov edx, 0x104
call fcn.140009638
add ax, ax
mov qword [rsp + 0x50], rdi
mov word [rbp - 0x78], ax
lea r9, [rsp + 0x50]
add ax, 2
lea r8, [rbp - 0x78]
xor edx, edx
mov word [rbp - 0x76], ax
xor ecx, ecx
call rbx
mov rcx, qword [rsp + 0x50]
test eax, eax
cmovs rcx, rdi
mov rdi, rcx
jmp 0x14000346f
mov rdi, qword [rbx + 0x20]
mov edx, 0x887dce6c
mov rcx, rdi
call fcn.140001b50
test r13, r13
je 0x1400035c0
test r12, r12
je 0x1400035c0
test r15, r15
je 0x1400035c0
test rax, rax
je 0x1400035c0
mov r8d, 0x104
lea rdx, [rbp + 0x30]
xor ecx, ecx
call rax
mov eax, dword [0x140028238]
lea rdx, [rbp - 0x30]
movaps xmm0, xmmword [0x1400281e0]
lea rcx, [rbp - 0x68]
movaps xmm1, xmmword [0x1400281f0]
mov r8d, 0x5d
movaps xmmword [rbp - 0x30], xmm0
movaps xmm0, xmmword [0x140028200]
mov dword [rbp + 0x28], eax
movzx eax, byte [0x14002823c]
movaps xmmword [rbp - 0x10], xmm0
movaps xmm0, xmmword [0x140028220]
movaps xmmword [rbp - 0x20], xmm1
movaps xmm1, xmmword [0x140028210]
mov byte [rbp + 0x2c], al
mov eax, dword [0x140028250]
movaps xmmword [rbp + 0x10], xmm0
movups xmm0, xmmword [0x140028240]
mov dword [rbp - 0x40], eax
movzx eax, byte [0x140028254]
movaps xmmword [rbp], xmm1
movsd xmm1, qword [0x140028230]
movups xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x68], 0x42ad28de
mov dword [rbp - 0x64], 0x63ef6bbe
mov dword [rbp - 0x60], 0x7a585af
mov dword [rbp - 0x5c], 0x7882c5fb
mov byte [rbp - 0x58], 0
movsd qword [rbp + 0x20], xmm1
mov byte [rbp - 0x3c], al
call fcn.140001cb0
mov r8d, 0x15
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x68]
call fcn.140001cb0
lea rax, [rsp + 0x30]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x30]
mov rcx, 0xffffffff80000001
call r13
test eax, eax
jne 0x1400035c0
mov rcx, qword [rsp + 0x30]
lea rax, [rbp + 0x30]
mov dword [rsp + 0x28], 0x104
lea rdx, [rbp - 0x50]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call r12
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x1400035f2
call r15
xor eax, eax
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.1400049b0
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call r15
mov eax, 1
jmp 0x1400035c2