Function at 0x140006470
Capabilities:
Access peb ldr_data
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov eax, 8
xor edi, edi
mov ecx, eax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], edi
lea edx, [rax + 0x18]
call fcn.14000ef50
mov qword [rsp + 0x28], rax
mov rbp, rax
test rax, rax
je 0x140006995
mov rax, qword gs:[0x60]
xor r14d, r14d
xor r13d, r13d
xor r12d, r12d
mov r15d, 1
mov dword [rsp + 0x24], r15d
mov rcx, qword [rax + 0x18]
mov rsi, qword [rcx + 0x10]
mov qword [rsp + 0x40], rsi
test rsi, rsi
je 0x140006954
nop word [rax + rax]
movups xmm0, xmmword [rsi + 0x58]
psrldq xmm0, 8
movq rbx, xmm0
test rbx, rbx
je 0x1400068e4
mov rdi, qword [rsi + 0x50]
test r15d, r15d
jne 0x140006579
lea rcx, str.____Hooks__t_tNo_hooks_found_in_this_module._n
call fcn.140001070
test r14, r14
je 0x14000652c
mov rcx, r14
call fcn.140013e2c
xor r14d, r14d
test r12, r12
je 0x140006551
mov rcx, qword [r12 + 0x70]
test rcx, rcx
je 0x140006549
call fcn.140013e2c
mov qword [r12 + 0x70], 0
mov rcx, r12
call fcn.140013e2c
test r13, r13
je 0x140006581
mov rcx, qword [r13 + 0x70]
test rcx, rcx
je 0x14000656c
call fcn.140013e2c
mov qword [r13 + 0x70], 0
mov rcx, r13
call fcn.140013e2c
xor r13d, r13d
jmp 0x140006581
xor r15d, r15d
mov dword [rsp + 0x24], r15d
mov r9, qword [rsi + 0x30]
lea rcx, str.____Hooks__t_ws___ws_:_0x_p_n
mov r8, rdi
mov rdx, rbx
call fcn.140001070
mov rcx, qword [rsi + 0x30]
mov edx, 1
call fcn.140008dd0
mov r12, rax
test rax, rax
je 0x1400068e0
cmp qword [rax + 0x40], 0
je 0x1400068e0
mov rcx, qword [rsi + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400068e0
test al, 0x10
jne 0x1400068e0
mov rcx, qword [rsi + 0x50]
call fcn.1400044f0
mov qword [rsp + 0x48], rax
mov r14, rax
test rax, rax
je 0x1400068e0
xor edx, edx
mov rcx, rax
call fcn.140008dd0
mov r13, rax
test rax, rax
je 0x1400068e0
mov rdx, qword [r12 + 0x10]
mov rcx, rax
call fcn.140008b90
xor eax, eax
mov dword [rsp + 0x30], eax
cmp dword [r13 + 0x50], eax
jbe 0x1400068e0
mov ecx, eax
mov rax, qword [r13 + 0x48]
mov edx, dword [rax + rcx*4]
mov rcx, r13
call fcn.140008b00
mov rdx, rax
mov rcx, r13
mov rsi, rax
call fcn.140008f10
mov r10, qword [r13 + 0x38]
mov edi, eax
mov rax, qword [r13 + 0x20]
xor r8d, r8d
movzx r9d, word [rax + 6]
test r9d, r9d
je 0x140006679
lea rdx, [r10 + 8]
nop
mov ecx, dword [rdx + 4]
cmp ecx, edi
ja 0x14000666d
add ecx, dword [rdx]
cmp edi, ecx
jb 0x14000669c
inc r8d
add rdx, 0x28
cmp r8d, r9d
jb 0x140006660
xor eax, eax
test dword [rax + 0x24], 0x20000000
je 0x140006757
mov rdx, rsi
mov rcx, r13
call fcn.140008f10
test eax, eax
jne 0x1400066a6
xor r15d, r15d
jmp 0x1400066b3
lea rcx, [r8 + r8*4]
lea rax, [r10 + rcx*8]
jmp 0x14000667b
mov edx, eax
mov rcx, r13
call fcn.140008b00
mov r15, rax
mov rdx, rsi
mov rcx, r12
call fcn.140008f10
test eax, eax
jne 0x1400066c6
xor ebp, ebp
jmp 0x1400066d3
mov edx, eax
mov rcx, r12
call fcn.140008b00
mov rbp, rax
mov r14d, dword [rsp + 0x20]
xor ecx, ecx
test r14, r14
je 0x1400066f9
mov rax, qword [rsp + 0x28]
add rax, 8
cmp qword [rax], rbp
je 0x140006757
inc rcx
add rax, 0x20
cmp rcx, r14
jb 0x1400066e8
mov rdx, rsi
mov rcx, r13
call fcn.140008f10
test eax, eax
jne 0x14000670c
xor ebx, ebx
jmp 0x140006719
mov edx, eax
mov rcx, r13
call fcn.140008b00
mov rbx, rax
mov rdx, rsi
mov rcx, r12
call fcn.140008f10
test eax, eax
jne 0x14000672c
xor edx, edx
jmp 0x140006739
mov edx, eax
mov rcx, r12
call fcn.140008b00
mov rdx, rax
mov rcx, rbx
sub rdx, rbx
nop
movzx eax, byte [rdx + rcx]
cmp byte [rcx], al
jne 0x140006783
inc rcx
mov rax, rcx
sub rax, rbx
cmp rax, 0x18
jb 0x140006740
mov edi, dword [rsp + 0x20]
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
cmp eax, dword [r13 + 0x50]
jb 0x140006624
mov rsi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov r15d, dword [rsp + 0x24]
jmp 0x1400068e4
mov r8d, edi
lea rcx, str.____Hooks__t_tHook_detected_in_function__s__0x_08lx_
mov rdx, rsi
call fcn.140001070
mov rcx, rbp
mov dword [rsp + 0x24], 1
call fcn.1400063b0
mov r9, rax
test rax, rax
jne 0x1400067bb
lea rcx, str....but_not_a_JMP__maybe_a_false_positive__data_export__or_unimplemented_hook_recognition_n
call fcn.140001070
jmp 0x140006757
mov rax, qword gs:[0x60]
mov rdi, 0xffffffffffffffff
mov r8, rdi
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
test rdx, rdx
je 0x140006811
nop dword [rax + rax]
mov rcx, qword [rdx + 0x30]
cmp rcx, r9
ja 0x1400067f6
mov rax, r9
sub rax, rcx
cmp rax, r8
cmovb r8, rax
mov rax, qword gs:[0x60]
mov rdx, qword [rdx]
mov rcx, qword [rax + 0x18]
cmp rdx, qword [rcx + 0x10]
je 0x140006811
test rdx, rdx
jne 0x1400067e0
xor ebx, ebx
mov rcx, rdi
inc rcx
cmp byte [rsi + rcx], bl
jne 0x140006816
mov eax, 0x28
cmp rax, rcx
je 0x140006859
nop dword [rax + rax]
lea rcx, [0x140039d3c]
call fcn.140001070
inc ebx
mov rax, rdi
inc rax
cmp byte [rsi + rax], 0
jne 0x140006841
mov ecx, 0x28
sub rcx, rax
mov eax, ebx
cmp rax, rcx
jb 0x140006830
mov rax, qword [rsp + 0x38]
mov edi, dword [rsp + 0x20]
cmp edi, eax
jb 0x1400068a2
add eax, eax
mov ecx, eax
mov qword [rsp + 0x38], rax
mov eax, 0x20
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, qword [rsp + 0x28]
mov rdx, rax
call fcn.1400144d8
mov qword [rsp + 0x28], rax
mov rbx, rax
test rax, rax
je 0x140006995
jmp 0x1400068a7
mov rbx, qword [rsp + 0x28]
lea rcx, [0x140039d40]
call fcn.140001070
shl r14, 5
mov rdx, r15
mov rcx, rbp
mov qword [r14 + rbx + 8], rbp
mov qword [r14 + rbx], r15
mov qword [r14 + rbx + 0x10], rsi
call fcn.140005a10
inc edi
mov qword [r14 + rbx + 0x18], rax
mov dword [rsp + 0x20], edi
jmp 0x14000675b
mov edi, dword [rsp + 0x20]
mov rax, qword gs:[0x60]
mov rsi, qword [rsi]
mov qword [rsp + 0x40], rsi
mov rcx, qword [rax + 0x18]
cmp rsi, qword [rcx + 0x10]
je 0x140006908
test rsi, rsi
jne 0x1400064f0
test r15d, r15d
jne 0x140006919
lea rcx, str.____Hooks__t_tNo_hooks_found_in_this_module._n
call fcn.140001070
mov rax, qword [rsp + 0x38]
cmp edi, eax
jb 0x14000694f
lea edx, [rax + 1]
mov rcx, 0xffffffffffffffff
mov eax, 0x20
mul rdx
cmovo rax, rcx
mov rcx, qword [rsp + 0x28]
mov rdx, rax
call fcn.1400144d8
mov rbp, rax
test rax, rax
je 0x1400069a0
jmp 0x140006954
mov rbp, qword [rsp + 0x28]
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
shl rax, 5
mov qword [rax + rbp + 8], 0
mov qword [rax + rbp], 0
mov qword [rax + rbp + 0x10], 0
mov rax, rbp
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 1
call fcn.14000ef44
int3
lea rcx, str.realloc_failed_n
call fcn.140001070
mov ecx, 1
call fcn.14000ef44
int3