Function at 0x1400aea44
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0x98
mov rax, qword [0x1401a7d98]
xor rax, rsp
mov qword [rbp - 1], rax
mov rax, qword [rbp + 0x77]
xor ebx, ebx
mov r11, qword [rbp + 0x7f]
mov r10, r8
mov qword [rbp - 0x39], r9
mov r12, rdx
mov qword [rbp - 0x59], r8
mov rdi, rcx
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x41], r11
mov dword [rbp - 9], ebx
test r8, r8
jne 0x1400aea97
int3
test r9, r9
jne 0x1400aea9d
int3
test rax, rax
jne 0x1400aeaa3
int3
and qword [rax], rbx
xor r14d, r14d
mov qword [rbp - 0x51], r14
cmp byte [r11], bl
je 0x1400aeb0e
call fcn.1400af534
cmp r12, rax
jbe 0x1400aeb0e
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
sub rax, rcx
and rax, 0xfffffffffffffff8
cmp rax, 0x8000
jne 0x1400aeae0
mov rcx, qword [rcx + 0x7ff8]
call fcn.1400adc8c
jmp 0x1400aeae2
xor al, al
test al, al
jne 0x1400aeb0e
mov rcx, rdi
call fcn.1400af534
mov rdx, r12
mov r9, r11
sub rdx, rax
xor r8d, r8d
mov rcx, rdi
call fcn.1400af2e8
test eax, eax
js 0x1400aec8a
mov r10, qword [rbp - 0x59]
mov rsi, qword [rdi + 8]
lea r13, [r10 + r12]
movabs rax, 0x1000000000
mov r15, r12
shr r15, 0x18
cmp r13, rax
cmova r13, rax
sub rsi, qword [rdi]
sar rsi, 3
shr r13, 0x18
lea rax, [rsi - 1]
cmp r13, rax
jbe 0x1400aec14
lea rdx, [r13 + 1]
mov rcx, rdi
call fcn.1400ae550
test eax, eax
js 0x1400aec8a
mov r14, qword [rdi]
mov rax, qword [rdi + 8]
sub rax, r14
sar rax, 3
cmp rsi, rax
jae 0x1400aec0d
mov rax, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rax + 0x30]
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
test rax, rax
je 0x1400aeba0
and qword [rax], rbx
and qword [rax + 8], rbx
and qword [rax + 0x10], rbx
cmp qword [r14 + rsi*8], rbx
je 0x1400aeba7
int3
mov qword [r14 + rsi*8], rax
test rax, rax
je 0x1400aebcf
mov r14, qword [rdi]
inc rsi
mov rax, qword [rdi + 8]
sub rax, r14
sar rax, 3
cmp rsi, rax
jb 0x1400aeb71
mov ebx, dword [rbp - 9]
mov r14, qword [rbp - 0x51]
jmp 0x1400aec10
lea rax, str.onecore_basexml_stream_bufferedstream.cpp
mov dword [rbp - 0x19], 0x2e9
mov qword [rbp - 0x29], rax
lea rcx, [rbp - 0x29]
lea rax, str.CIndex_class_Windows::Auto_class_CIndex_class_Windows::Auto_struct__LBLOB__12_12____12_24_::WriteAt
mov r8d, 0xc0000017
mov qword [rbp - 0x21], rax
lea rax, str._this__Index_.Allocate__
mov qword [rbp - 0x11], rax
call fcn.1400c81b4
mov eax, 0xc0000017
jmp 0x1400aec8a
mov r14, rbx
mov r10, qword [rbp - 0x59]
cmp r15, r13
ja 0x1400aec81
mov rsi, qword [rbp - 0x41]
mov edx, 0x1000000
and qword [rbp - 0x49], 0
lea rcx, [rbp - 0x49]
mov rax, qword [rdi]
mov r8, r10
mov r9, qword [rbp - 0x39]
add r9, r14
mov qword [rsp + 0x28], rsi
cmp r10, rdx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax + r15*8]
cmova r8, rdx
mov rdx, r12
and edx, 0xffffff
call fcn.1400adf64
test eax, eax
js 0x1400aec8a
mov rax, qword [rbp - 0x49]
inc r15
mov r10, qword [rbp - 0x59]
add r14, rax
sub r10, rax
add r12, rax
mov qword [rbp - 0x59], r10
mov edx, 0x1000000
cmp r15, r13
jbe 0x1400aec22
mov rax, qword [rbp - 0x31]
mov qword [rax], r14
mov eax, ebx
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.140109af0
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret