Function at 0x14002a620
Capabilities:
Access peb ldr_data
Check os version
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
movaps xmmword [rsp + 0xe0], xmm6
mov eax, 0x30
mov rax, qword gs:[eax]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rsi, qword [rax + 0x30]
movsxd rax, dword [rsi + 0x3c]
mov edx, dword [rax + rsi + 0x138]
mov ebx, dword [rax + rsi + 0x13c]
add rbx, rsi
mov rcx, qword [rdx + rbx - 0x20]
mov r14, qword [rdx + rbx - 0x18]
mov rdi, qword [rdx + rbx - 0x10]
mov rax, qword [rdx + rbx - 8]
lea r11, [r14 + 7]
and r11, 0xfffffffffffffff8
mov rdx, rbx
test r11, r11
je 0x14002a6bc
test rdx, rdx
je 0x14002a6bc
lea r8, [rdx + 8]
add r11, 0xfffffffffffffff8
mov qword [rsp + 0x30], rax
xor r9d, r9d
cmp r9, 8
je 0x14002a6b7
mov r10b, byte [rsp + r9 + 0x30]
xor byte [rdx + r9], r10b
inc r9
jmp 0x14002a6a3
mov rdx, r8
jmp 0x14002a689
test rcx, rcx
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x68], rdi
je 0x14002a6f0
js 0x14002ac91
mov edx, 1
mov rsi, rcx
call fcn.14002ad80
mov qword [rsp + 0x28], rax
test rax, rax
jne 0x14002a6fd
mov rcx, rsi
jmp 0x14002ac8a
mov rsi, rcx
mov eax, 1
mov qword [rsp + 0x28], rax
mov ecx, 0x536
call fcn.14002ae9d
mov r12, rax
mov r13, rdx
mov ecx, 0x192
call fcn.14002ae9d
mov rbp, rax
mov rdi, rdx
xorps xmm6, xmm6
movups xmmword [rsp + 0x32], xmm6
and dword [rsp + 0x42], 0
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0xb0], xmm0
mov rax, qword [rsp + 0x3e]
mov qword [rsp + 0xbe], rax
mov eax, 0x30
mov rax, qword gs:[eax]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
mov r8d, 0x190
xor edx, edx
call fcn.14002a5b2
test rax, rax
je 0x14002ac85
mov r15, rax
mov qword [rax + 0x18], r12
mov qword [rax + 0x20], r13
mov qword [rax + 0x28], 0x536
mov qword [rax + 0x30], rbp
mov qword [rax + 0x38], rdi
mov qword [rax + 0x40], 0x192
mov rcx, rax
add rcx, 0x58
xor edi, edi
mov r8d, 0x11e
xor edx, edx
call fcn.14002e0f1
lea r9, [rsp + 0xb8]
movzx eax, word [r9 - 8]
mov word [r15 + 0x176], ax
mov qword [rsp + 0x80], r15
mov byte [r15 + 0x18c], 1
and dword [r15 + 8], 0
and dword [r15], 0
and word [r15 + 0x18d], 0
movups xmmword [r15 + 0x48], xmm6
and dword [r15 + 0x188], 0
movups xmmword [r15 + 0x178], xmm6
mov qword [r9 - 8], r15
mov rbp, qword [rsp + 0x28]
mov qword [r9], rbp
mov r13, rsi
mov qword [r9 + 8], rsi
and qword [r9 + 0x10], 0
mov byte [r9 + 0x18], dil
mov byte [rsp + 0x20], dil
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.14002aed4
cmp al, 4
jne 0x14002a85b
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [rsp + 0xb0]
movups xmm1, xmmword [rsp + 0xc0]
movaps xmmword [rsp + 0x40], xmm1
movaps xmmword [rsp + 0x30], xmm0
mov edi, 2
test al, al
je 0x14002a86a
mov rsi, qword [rsp + 0x78]
jmp 0x14002a89f
lea rcx, [rsp + 0xb0]
call fcn.14002dfb9
jmp 0x14002a8ae
mov al, 1
lea r9, [rsp + 0x38]
mov byte [r9 + 0x18], al
mov rcx, qword [r9 - 8]
mov byte [rsp + 0x20], al
lea rdx, [0x14002e288]
xor r8d, r8d
call fcn.14002aed4
cmp al, 4
mov rsi, qword [rsp + 0x78]
jne 0x14002a89f
mov rax, qword [rsp + 0x30]
mov edi, dword [rax]
mov ebx, dword [rax + 4]
lea rcx, [rsp + 0x30]
call fcn.14002dfb9
cmp edi, 2
jne 0x14002a8c8
lea rcx, [rsp + 0x80]
call fcn.14002a089
mov rcx, rbp
mov rdx, r13
call fcn.14002a06f
jmp 0x14002a8c6
lea rcx, [rsp + 0x80]
call fcn.14002a089
test edi, edi
cmove ebx, edi
cmp qword [rsp + 0x68], rbx
jne 0x14002a8bb
lea rdi, [rsp + 0x30]
movabs rdx, 0x7d52b10b2b6fca23
mov rcx, rdi
call fcn.14002a104
cmp byte [rdi], 0
jne 0x14002a966
lea rbx, [rsp + 0x30]
mov rdi, qword [rbx + 8]
movabs r8, 0x69d265fe6b1c110f
mov rcx, rbx
mov rdx, rdi
call fcn.14002a1d5
cmp byte [rbx], 0
jne 0x14002a966
lea rbx, [rsp + 0x30]
mov r14, qword [rbx + 8]
movabs r8, 0x578960f1fc7fff25
mov rcx, rbx
mov rdx, rdi
call fcn.14002a1d5
cmp byte [rbx], 0
jne 0x14002a966
lea rbx, [rsp + 0x30]
mov r12, qword [rbx + 8]
movabs r8, 0xed1006223abbbd53
mov rcx, rbx
mov rdx, rdi
call fcn.14002a1d5
cmp byte [rbx], 0
je 0x14002a9a1
mov al, byte [rsp + 0x31]
movzx r12d, al
mov rcx, rbp
mov rdx, r13
call fcn.14002a06f
cmp r12b, 3
jne 0x14002a8c6
xor eax, eax
movaps xmm6, xmmword [rsp + 0xe0]
add rsp, 0xf8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test r14, r14
je 0x14002a96e
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0x60], r13
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x68], rax
movsxd r15, dword [rbp + 0x3c]
mov rax, rbp
add rbp, r15
add rbp, 0x11c
add r15, rax
mov eax, dword [rbp - 0xf4]
mov qword [rsp + 0x90], rax
mov rax, qword [rbp - 0xec]
mov qword [rsp + 0x98], rax
mov eax, dword [rbp - 0x8c]
mov qword [rsp + 0x88], rax
mov eax, dword [rbp - 0x88]
mov dword [rsp + 0x74], eax
mov edi, dword [rbp - 0x6c]
mov r13d, dword [rbp - 0x68]
movzx eax, word [rbp - 0x116]
imul rbx, rax, 0x28
xor r14d, r14d
cmp rbx, r14
je 0x14002aa66
mov edx, dword [rbp + r14]
test rdx, rdx
je 0x14002aa60
mov r8d, dword [rbp + r14 - 4]
test r8d, r8d
je 0x14002aa60
add r8d, edx
cmp r8d, edx
jb 0x14002ac9f
cmp qword [rsp + 0x60], r8
jb 0x14002aca7
sub r8, rdx
add rdx, qword [rsp + 0x28]
mov ecx, dword [rbp + r14 - 8]
add rcx, rsi
call fcn.14002e025
add r14, 0x28
jmp 0x14002aa1b
test r13d, r13d
mov rcx, qword [rsp + 0x98]
je 0x14002ab08
cmp rcx, rsi
je 0x14002ab08
test edi, edi
je 0x14002ab08
mov rax, rsi
sub rax, rcx
lea rcx, [rdi + rsi]
mov rdx, rax
shr rdx, 0x30
lea r8, [0x14002acb8]
cmp dword [rcx], 0
je 0x14002ab08
mov r9d, dword [rcx + 4]
add r9, 0xfffffffffffffff8
shr r9, 1
xor r10d, r10d
cmp r9, r10
je 0x14002aaff
movzx r11d, word [rcx + r10*2 + 8]
mov edi, r11d
shr edi, 0xc
cmp edi, 0xa
ja case.0x14002aae0.5
and r11d, 0xfff
add r11, rsi
mov ebx, dword [rcx]
movsxd rdi, dword [r8 + rdi*4]
add rdi, r8
jmp rdi
add word [rbx + r11], dx
jmp case.0x14002aae0.0
add word [rbx + r11], ax
jmp case.0x14002aae0.0
add dword [rbx + r11], eax
jmp case.0x14002aae0.0
add qword [rbx + r11], rax
inc r10
jmp 0x14002aab3
mov r9d, dword [rcx + 4]
add rcx, r9
jmp 0x14002aaa0
mov rax, qword [rsp + 0x88]
test eax, eax
je 0x14002abc3
cmp dword [rsp + 0x74], 0
je 0x14002abc3
add rax, rsi
xor edi, edi
mov qword [rsp + 0xa0], r15
imul r13, rdi, 0x14
mov r14d, dword [rax + r13]
test r14, r14
je 0x14002abc3
mov r15, rax
add r13, rax
mov ecx, dword [r13 + 0xc]
add rcx, rsi
call qword [rsp + 0xa8]
mov rbx, rax
test rax, rax
jne 0x14002ab64
mov al, byte [0x2000]
add r14, rsi
mov r13d, dword [r13 + 0x10]
add r13, rsi
xor ebp, ebp
mov rax, qword [r14 + rbp*8]
test rax, rax
je 0x14002abb0
js 0x14002ab91
lea rdx, [rax + rsi]
add rdx, 2
mov rax, rdx
cmp byte [rax], 0
lea rax, [rax + 1]
jne 0x14002ab86
jmp 0x14002ab94
movzx edx, ax
mov rcx, rbx
call r12
test rax, rax
jne 0x14002aba6
mov cl, byte [0x3000]
mov qword [r13 + rbp*8], rax
inc rbp
jmp 0x14002ab70
inc rdi
mov rax, r15
mov r15, qword [rsp + 0xa0]
jmp 0x14002ab30
movzx eax, word [r15 + 6]
add r15, 0x110
imul rdi, rax, 0x28
xor r14d, r14d
mov ebp, 1
mov r12d, 2
lea rbx, [rsp + 0x30]
mov r13d, 0x40
cmp rdi, r14
je 0x14002ac64
mov eax, dword [r15 + r14 + 0x1c]
bt eax, 0x1d
mov ecx, 0x10
cmovae ecx, ebp
mov r8d, 0x20
cmovae r8d, r12d
bt eax, 0x1e
cmovae r8d, ecx
test eax, eax
jns 0x14002ac3a
test r8b, 2
jne 0x14002ac32
and eax, 0x60000000
or r8d, 4
cmp eax, 0x60000000
cmove r8d, r13d
jmp 0x14002ac3a
and r8d, 0xfffffff1
or r8d, 4
mov edx, dword [r15 + r14]
mov ecx, dword [r15 + r14 + 4]
add rcx, rsi
and dword [rsp + 0x30], 0
mov r9, rbx
call qword [rsp + 0x68]
cmp eax, 1
je 0x14002ac5e
mov al, byte [0x1000]
add r14, 0x28
jmp 0x14002abec
mov rdi, qword [rsp + 0x90]
add rdi, rsi
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x60]
call fcn.14002a06f
call rdi
jmp 0x14002a983
mov ecx, 0x190
call fcn.14002ada0
ud2
call fcn.14002adb0
ud2
call fcn.14002e170
ud2
mov rcx, rdx
mov rdx, r8
jmp 0x14002acaf
mov rcx, r8
mov rdx, qword [rsp + 0x60]
call fcn.14002e170
ud2