Function at 0x14000e6b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rdx
mov rdi, rcx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov ecx, dword [rax + 0x3c]
movzx edx, word [rax + rcx + 6]
test rdx, rdx
je 0x14000eaf5
lea r8, [rax + rcx]
movzx ecx, word [rax + rcx + 0x14]
lea r9, [r8 + rcx]
add rcx, r8
add rcx, 0x18
lea rdx, [rdx + rdx*4]
lea r8, [r9 + rdx*8]
add r8, 0x18
xor edx, edx
vpbroadcastb ymm0, byte [0x1400f801e]
xor r9d, r9d
jmp 0x14000e72d
add rcx, 0x28
cmp rcx, r8
je 0x14000ea65
test byte [rcx + 0x27], 0x20
je 0x14000e720
mov r15d, dword [rcx + 8]
cmp r15, 0x11
jb 0x14000e720
mov ebx, dword [rcx + 0xc]
add rbx, rax
lea r10, [rbx + r15]
lea r11, [r10 - 0x10]
cmp r11, rbx
jbe 0x14000e877
cmp dword [rbx], 0x20ec8348
je 0x14000e9f5
lea r14, [rbx + 0x11]
cmp r15d, 0x41
jb 0x14000e806
cmp r15d, 0xa1
jb 0x14000e7e0
lea r13, [r15 + rbx]
add r13, 0xffffffffffffff70
nop word cs:[rax + rax]
vpcmpeqb ymm1, ymm0, ymmword [r14]
vpmovmskb ebp, ymm1
test ebp, ebp
jne 0x14000e833
vpcmpeqb ymm1, ymm0, ymmword [r14 + 0x20]
vpmovmskb ebp, ymm1
test ebp, ebp
jne 0x14000e83c
vpcmpeqb ymm1, ymm0, ymmword [r14 + 0x40]
vpmovmskb ebp, ymm1
test ebp, ebp
jne 0x14000e849
vpcmpeqb ymm1, ymm0, ymmword [r14 + 0x60]
vpmovmskb ebp, ymm1
test ebp, ebp
jne 0x14000e856
sub r14, 0xffffffffffffff80
cmp r14, r13
jbe 0x14000e790
add rbx, r15
add rbx, 0xffffffffffffffd0
cmp r14, rbx
ja 0x14000e806
nop dword [rax]
vpcmpeqb ymm1, ymm0, ymmword [r14]
vpmovmskb ebp, ymm1
test ebp, ebp
jne 0x14000e833
add r14, 0x20
cmp r14, rbx
jbe 0x14000e7f0
cmp r14, r11
jae 0x14000e870
mov rbx, r11
sub rbx, r14
nop word cs:[rax + rax]
cmp byte [r14], 0xe9
je 0x14000e870
inc r14
dec rbx
jne 0x14000e820
mov r14, r11
jmp 0x14000e870
tzcnt ebx, ebp
add r14, rbx
jmp 0x14000e870
tzcnt ebx, ebp
add r14, rbx
add r14, 0x20
jmp 0x14000e870
tzcnt ebx, ebp
add r14, rbx
add r14, 0x40
jmp 0x14000e870
tzcnt ebx, ebp
add r14, rbx
add r14, 0x60
nop word cs:[rax + rax]
add r14, 0xfffffffffffffff0
mov rbx, r14
cmp rbx, r11
jae 0x14000e720
lea r14, [r10 - 0x30]
lea r15, [r10 - 0x90]
jmp 0x14000e8a8
tzcnt r13d, ebp
add rbx, r13
lea r13, [rbx - 0x10]
cmp rbx, r10
mov rbx, r13
jae 0x14000e720
cmp dword [rbx], 0x20ec8348
je 0x14000e989
add rbx, 0x11
cmp r14, rbx
jb 0x14000e95d
cmp r15, rbx
jb 0x14000e914
nop word cs:[rax + rax]
vpcmpeqb ymm1, ymm0, ymmword [rbx]
vpmovmskb ebp, ymm1
test ebp, ebp
jne 0x14000e890
vpcmpeqb ymm1, ymm0, ymmword [rbx + 0x20]
vpmovmskb ebp, ymm1
test ebp, ebp
jne 0x14000e92a
vpcmpeqb ymm1, ymm0, ymmword [rbx + 0x40]
vpmovmskb ebp, ymm1
test ebp, ebp
jne 0x14000e93b
vpcmpeqb ymm1, ymm0, ymmword [rbx + 0x60]
vpmovmskb ebp, ymm1
test ebp, ebp
jne 0x14000e94c
sub rbx, 0xffffffffffffff80
cmp rbx, r15
jbe 0x14000e8d0
jmp 0x14000e914
add rbx, 0x20
cmp rbx, r14
ja 0x14000e95d
vpcmpeqb ymm1, ymm0, ymmword [rbx]
vpmovmskb ebp, ymm1
test ebp, ebp
je 0x14000e910
jmp 0x14000e890
tzcnt r13d, ebp
add rbx, r13
add rbx, 0x20
jmp 0x14000e898
tzcnt r13d, ebp
add rbx, r13
add rbx, 0x40
jmp 0x14000e898
tzcnt r13d, ebp
add rbx, r13
add rbx, 0x60
jmp 0x14000e898
cmp rbx, r11
jae 0x14000e898
mov r13, r11
sub r13, rbx
nop dword [rax]
cmp byte [rbx], 0xe9
je 0x14000e898
inc rbx
dec r13
jne 0x14000e970
mov rbx, r11
jmp 0x14000e898
movzx ebp, word [rbx + 0xe]
cmp ebp, 0x8b48
jne 0x14000e8b4
movzx ebp, word [rbx + 4]
cmp ebp, 0x8b44
jne 0x14000e8b4
cmp byte [rbx + 8], 0x8d
jne 0x14000e8b4
lea r13, [rbx + 0xa]
mov rbp, r10
sub rbp, r13
cmp rbp, 4
jb 0x14000e8b4
movsxd rbp, dword [r13]
add r13, rbp
add r13, 4
cmp r12, r13
movzx ebp, r9b
mov r9d, 1
cmove r9d, ebp
test rdx, rdx
cmove r9d, ebp
inc rdx
mov r12, r13
jmp 0x14000e8b4
movzx ebp, word [rbx + 4]
cmp ebp, 0x8b44
jne 0x14000e760
movzx ebp, word [rbx + 0xe]
cmp ebp, 0x8b48
jne 0x14000e760
cmp byte [rbx + 0x10], 0xe9
jne 0x14000e760
cmp byte [rbx + 8], 0x8d
jne 0x14000e760
lea r14, [r15 - 0xe]
cmp r14, 0xfffffffffffffffb
ja 0x14000e760
movsxd r14, dword [rbx + 0xa]
add r14, rbx
add r14, 0xe
cmp r12, r14
movzx ebp, r9b
mov r9d, 1
cmove r9d, ebp
test rdx, rdx
cmove r9d, ebp
inc rdx
mov r12, r14
jmp 0x14000e760
test rdx, rdx
setne al
test r9b, r9b
sete cl
and cl, al
xor eax, eax
cmp cl, 1
jne 0x14000ec97
test r12, r12
je 0x14000ec97
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
mov rcx, 0xffffffffffffffff
mov edx, 0x24
mov r9d, 4
vzeroupper
call qword [0x14012f128]
mov r14d, dword [rsp + 0x30]
cmp dword [0x7ffe0260], 0x4a61
jb 0x14000eafc
mov ecx, 0x30
call fcn.14000abb0
mov rbx, rax
add rax, 0x28
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 0
lea rax, [0x14000f680]
xor rax, r14
mov ecx, r14d
ror rax, cl
mov qword [rbx + 0x20], rax
jmp 0x14000eb27
xor eax, eax
jmp 0x14000ec97
mov ecx, 0x20
call fcn.14000abb0
mov rbx, rax
mov dword [rax + 0x10], 1
mov eax, r14d
lea rdx, [0x14000f680]
xor rdx, rax
mov ecx, r14d
ror rdx, cl
mov qword [rbx + 0x18], rdx
lea rax, [r12 + 8]
mov rcx, qword [r12 + 8]
mov qword [rbx], rcx
mov rcx, qword [r12 + 8]
mov rcx, qword [rcx + 8]
mov qword [rbx + 8], rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0x1000
lea r13, [rsp + 0x3c]
mov qword [rsp + 0x20], r13
lea r14, [rsp + 0x30]
lea r15, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
mov rdx, r14
mov r8, r15
mov r9d, pe_nt_image_headers64
call qword [0x14012f1c0]
mov rax, qword [r12 + 8]
mov qword [rax + 8], rbx
mov qword [r12 + 8], rbx
mov r9d, dword [rsp + 0x3c]
mov qword [rsp + 0x20], r13
mov rcx, 0xffffffffffffffff
mov rdx, r14
mov r8, r15
call qword [0x14012f1c0]
mov rax, qword gs:[0x60]
or byte [rax + 0x50], 4
mov rcx, rdi
call fcn.14012e12e
mov rcx, rsi
call fcn.14012e12e
mov rax, qword gs:[0x60]
and byte [rax + 0x50], 0xfb
mov r14, qword [rbx]
mov r15, qword [rbx + 8]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x40], 0x1000
mov qword [rsp + 0x20], r13
lea rsi, [rsp + 0x30]
lea rdi, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
mov rdx, rsi
mov r8, rdi
mov r9d, pe_nt_image_headers64
call qword [0x14012f1c0]
mov qword [r15], r14
mov r9d, dword [rsp + 0x3c]
mov qword [rsp + 0x20], r13
mov rcx, 0xffffffffffffffff
mov rdx, rsi
mov r8, rdi
call qword [0x14012f1c0]
lea rax, [r14 + 8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0x1000
mov qword [rsp + 0x20], r13
lea rsi, [rsp + 0x30]
lea rdi, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
mov rdx, rsi
mov r8, rdi
mov r9d, pe_nt_image_headers64
call qword [0x14012f1c0]
mov qword [r14 + 8], r15
mov r9d, dword [rsp + 0x3c]
mov qword [rsp + 0x20], r13
mov rcx, 0xffffffffffffffff
mov rdx, rsi
mov r8, rdi
call qword [0x14012f1c0]
add rbx, 0xfffffffffffffff0
mov rcx, rbx
call fcn.140009440
mov al, 1
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
vzeroupper
ret