Function at 0x1400021d9
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process filename

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x258
mov ebx, 0x8cdc5dc2
xorps xmm0, xmm0
lea rax, [rsp + 0x98]
movups xmmword [rax + 8], xmm0
xor ecx, ecx
mov qword [rax + 0x18], rcx
movups xmmword [rax + 0x138], xmm0
movups xmmword [rax + 0x150], xmm0
movups xmmword [rax + 0x160], xmm0
movups xmmword [rax + 0x170], xmm0
movups xmmword [rax + 0x180], xmm0
movups xmmword [rax + 0x190], xmm0
movups xmmword [rax + 0x1a0], xmm0
movups xmmword [rax + 0x1b0], xmm0
mov dword [rax], 0x17171717
lea rdx, [rbx + 0x6aa75b2a]
mov qword [rax + 0x20], rdx
mov word [rax + 0x28], cx
mov qword [rax + 0x30], rcx
mov qword [rax + 0x38], 0x2802c609
mov word [rax + 0x40], cx
mov qword [rax + 0x48], rcx
lea rdx, [rbx + 0x164c2341]
mov qword [rax + 0x50], rdx
mov word [rax + 0x58], cx
mov qword [rax + 0x60], rcx
mov qword [rax + 0x68], 0x10c0e85d
mov word [rax + 0x70], cx
mov qword [rax + 0x78], rcx
mov qword [rax + 0x80], 0x4b82f718
mov word [rax + 0x88], cx
mov qword [rax + 0x90], rcx
mov qword [rax + 0x98], 0x7bc23928
mov word [rax + 0xa0], cx
mov qword [rax + 0xa8], rcx
mov qword [rax + 0xb0], rbx
mov word [rax + 0xb8], cx
mov qword [rax + 0xc0], rcx
mov qword [rax + 0xc8], 0x66163fbb
mov word [rax + 0xd0], cx
mov qword [rax + 0xd8], rcx
lea rdx, [rbx + 0x53f9bff0]
mov qword [rax + 0xe0], rdx
mov word [rax + 0xe8], cx
mov qword [rax + 0xf0], rcx
mov qword [rax + 0xf8], 0x40d6e69d
mov word [rax + 0x100], cx
mov qword [rax + 0x108], rcx
mov qword [rax + 0x110], 0x350dca99
mov word [rax + 0x118], cx
mov qword [rax + 0x120], rcx
mov qword [rax + 0x128], 0x2dbc736d
mov word [rax + 0x130], cx
mov dword [rax + 0x148], 0x6ddb9555
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0xf0]
mov r8d, dword [rcx + 0xe8]
lea r9d, [r8 + 1]
mov dword [rcx + 0xe8], r9d
mov qword [rdx + r8*8], rax
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
je 0x1400025b1
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov rdi, qword [rcx + rdx*8]
test rdi, rdi
je 0x1400023ac
cmp dword [rdi], 0x17171717
je 0x1400023b9
inc rdx
cmp rax, rdx
jne 0x14000239b
jmp 0x1400025b1
mov ecx, 0x1edab0ed
call fcn.140001913
mov qword [rdi + 0x10], rax
lea rdx, [rbx + 0x11690c81]
mov rcx, rax
call fcn.1400019a1
mov qword [rdi + 8], rax
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x20]
call fcn.1400019a1
mov qword [rdi + 0x18], rax
mov rcx, rax
call fcn.140001bc3
mov word [rdi + 0x28], ax
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x38]
call fcn.1400019a1
mov qword [rdi + 0x30], rax
mov rcx, rax
call fcn.140001bc3
mov word [rdi + 0x40], ax
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x50]
call fcn.1400019a1
mov qword [rdi + 0x48], rax
mov rcx, rax
call fcn.140001bc3
mov word [rdi + 0x58], ax
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x68]
call fcn.1400019a1
mov qword [rdi + 0x60], rax
mov rcx, rax
call fcn.140001bc3
mov word [rdi + 0x70], ax
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x80]
call fcn.1400019a1
mov qword [rdi + 0x78], rax
mov rcx, rax
call fcn.140001bc3
mov word [rdi + 0x88], ax
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x98]
call fcn.1400019a1
mov qword [rdi + 0x90], rax
mov rcx, rax
call fcn.140001bc3
mov word [rdi + 0xa0], ax
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0xb0]
call fcn.1400019a1
mov qword [rdi + 0xa8], rax
mov rcx, rax
call fcn.140001bc3
mov word [rdi + 0xb8], ax
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0xc8]
call fcn.1400019a1
mov qword [rdi + 0xc0], rax
mov rcx, rax
call fcn.140001bc3
mov word [rdi + 0xd0], ax
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0xe0]
call fcn.1400019a1
mov qword [rdi + 0xd8], rax
mov rcx, rax
call fcn.140001bc3
mov word [rdi + 0xe8], ax
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0xf8]
call fcn.1400019a1
mov qword [rdi + 0xf0], rax
mov rcx, rax
call fcn.140001bc3
mov word [rdi + 0x100], ax
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x110]
call fcn.1400019a1
mov qword [rdi + 0x108], rax
mov rcx, rax
call fcn.140001bc3
mov word [rdi + 0x118], ax
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x128]
call fcn.1400019a1
mov qword [rdi + 0x120], rax
mov rcx, rax
call fcn.140001bc3
mov word [rdi + 0x130], ax
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
je 0x1400025b1
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov rsi, qword [rcx + rdx*8]
test rsi, rsi
je 0x1400025a9
cmp dword [rsi], 0x17171717
je 0x1400025b6
inc rdx
cmp rax, rdx
jne 0x140002598
call fcn.1400064c0
mov ecx, dword [rsi + 0x148]
call fcn.140001913
mov qword [rsi + 0x140], rax
lea rdx, [rbx + 0x64f5aa0e]
mov rcx, rax
call fcn.1400019a1
mov qword [rsi + 0x138], rax
mov al, 1
test al, al
je 0x140002a16
mov al, byte [section..bss]
mov ecx, 0xa
call fcn.140001a93
test rax, rax
je 0x140002a1b
mov ecx, 5
mov word [rax], 0x77
lea rdi, [rsp + 0x28]
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], 1
lea rbp, [0x1400071bf]
mov r15w, 1
mov ebx, 1
xor esi, esi
lea r12, [0x1400071c8]
test rbp, rbp
je 0x140002664
test si, si
je 0x14000264d
xor ecx, ecx
mov r13d, esi
jmp 0x140002729
cmp rbp, r12
je 0x140002664
movzx r13d, byte [rbp]
test r13b, r13b
js 0x140002696
inc rbp
jmp 0x140002727
mov r14, qword [rsp + 0x28]
cmp r15w, 1
jne 0x140002797
xor r15d, r15d
mov ebp, 0
mov r13d, 0
mov r8d, 0
cmp rbx, r14
jne 0x140002732
jmp 0x140002773
mov ecx, r13d
and ecx, 0x1f
movzx r8d, byte [rbp + 1]
and r8d, 0x3f
cmp r13b, 0xdf
jbe 0x1400026dd
movzx edx, byte [rbp + 2]
shl r8d, 6
and edx, 0x3f
or edx, r8d
cmp r13b, 0xf0
jb 0x1400026ec
movzx r13d, byte [rbp + 3]
add rbp, 4
and ecx, 7
shl ecx, 0x12
shl edx, 6
and r13d, 0x3f
or r13d, edx
or r13d, ecx
jmp 0x1400026f8
add rbp, 2
shl ecx, 6
or ecx, r8d
mov r13d, ecx
jmp 0x140002727
add rbp, 3
shl ecx, 0xc
or edx, ecx
mov r13d, edx
cmp r13d, 0xffff
jbe 0x140002727
lea edx, [r13 + 0xff0000]
shr edx, 0xa
or edx, 0xd800
and r13d, 0x3ff
or r13d, 0xdc00
mov ecx, r13d
mov r13d, edx
jmp 0x140002729
xor ecx, ecx
cmp rbx, qword [rsp + 0x28]
je 0x140002744
mov esi, ecx
mov word [rax + rbx*2], r13w
inc rbx
mov qword [rsp + 0x38], rbx
jmp 0x140002639
lea rax, [0x1400071be]
sub rax, rbp
add rax, 0xc
movabs rdx, 0xaaaaaaaaaaaaaaab
mul rdx
shr rdx, 1
movzx r8d, r15w
cmp cx, 1
sbb r8, 0xffffffffffffffff
add r8, rdx
mov esi, ecx
inc r8
mov qword [rsp + 0x20], 2
mov r9d, 2
mov rcx, rdi
mov rdx, rbx
call fcn.1400017d0
mov rax, qword [rsp + 0x30]
jmp 0x140002732
mov rdi, qword [rsp + 0x30]
lea rax, [rdi - 2]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x1400027a0
mov qword [rsp + 0x90], 0
mov r8, qword gs:[0x60]
mov ecx, dword [r8 + 0xe8]
test rcx, rcx
je 0x1400029e9
sub eax, edi
mov edx, eax
add edx, 2
mov r8, qword [r8 + 0xf0]
xor r9d, r9d
mov r12, qword [r8 + r9*8]
test r12, r12
je 0x1400027f4
cmp dword [r12], 0x17171717
je 0x140002801
inc r9
cmp rcx, r9
jne 0x1400027e1
jmp 0x1400029e9
mov r10, qword [r12 + 8]
lea r8, [rsp + 0x28]
mov word [r8], ax
mov word [r8 + 2], dx
mov qword [r8 + 8], rdi
lea rbx, [rsp + 0x90]
xor ecx, ecx
xor edx, edx
mov r9, rbx
call r10
mov rbx, qword [rbx]
test rbx, rbx
je 0x1400029e9
mov edx, 0x142e89c3
mov rcx, rbx
call fcn.1400019a1
mov qword [rsp + 0x88], rax
mov edx, 0x32206eb8
mov rcx, rbx
call fcn.1400019a1
mov qword [rsp + 0x80], rax
mov esi, 0x8cdc5dc2
lea rdx, [rsi + 0x425a68ac]
mov rcx, rbx
call fcn.1400019a1
mov qword [rsp + 0x78], rax
lea rdx, [rsi + 0x5a581b2d]
mov rcx, rbx
call fcn.1400019a1
mov qword [rsp + 0x70], rax
mov edx, 0x7c8bc2cf
mov rcx, rbx
call fcn.1400019a1
mov qword [rsp + 0x68], rax
mov edx, 0x7c8b3515
mov rcx, rbx
call fcn.1400019a1
mov qword [rsp + 0x60], rax
mov edx, 0x185953a4
mov rcx, rbx
call fcn.1400019a1
mov qword [rsp + 0x58], rax
lea rdx, [rsi + 0x230ade6d]
mov rcx, rbx
call fcn.1400019a1
mov qword [rsp + 0x50], rax
mov edx, 0xd454eb1
mov rcx, rbx
call fcn.1400019a1
mov qword [rsp + 0x48], rax
mov edx, 0x4b91706c
mov rcx, rbx
call fcn.1400019a1
mov qword [rsp + 0x40], rax
mov edx, 0x307204e
mov rcx, rbx
call fcn.1400019a1
mov r13, rax
lea rdx, [rsi + 0x490d1ae7]
mov rcx, rbx
call fcn.1400019a1
mov rbp, rax
lea rdx, [rsi + 0x41aa4943]
mov rcx, rbx
call fcn.1400019a1
mov r15, rax
add rsi, 0xf41336c
mov rcx, rbx
mov rdx, rsi
call fcn.1400019a1
mov rcx, qword [rsp + 0x88]
mov qword [r12 + 0x150], rcx
mov rcx, qword [rsp + 0x80]
mov qword [r12 + 0x158], rcx
mov rcx, qword [rsp + 0x78]
mov qword [r12 + 0x160], rcx
mov rcx, qword [rsp + 0x70]
mov qword [r12 + 0x168], rcx
mov rcx, qword [rsp + 0x68]
mov qword [r12 + 0x170], rcx
mov rcx, qword [rsp + 0x60]
mov qword [r12 + 0x178], rcx
mov rcx, qword [rsp + 0x58]
mov qword [r12 + 0x180], rcx
mov rcx, qword [rsp + 0x50]
mov qword [r12 + 0x188], rcx
mov rcx, qword [rsp + 0x48]
mov qword [r12 + 0x190], rcx
mov rcx, qword [rsp + 0x40]
mov qword [r12 + 0x198], rcx
mov qword [r12 + 0x1a0], r13
mov qword [r12 + 0x1a8], rbp
mov qword [r12 + 0x1b0], r15
mov qword [r12 + 0x1b8], rax
test r14, r14
je 0x1400029fc
add r14, r14
mov rcx, rdi
mov rdx, r14
call fcn.140001b3a
call fcn.140003014
nop
add rsp, 0x258
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400061c0
mov ecx, 0xa
call fcn.1400061d0
int3