Function at 0x14003e050
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1b0
mov eax, 0x9038c4cb
mov ecx, eax
mov dl, byte [rsp + 0x1af]
mov byte [rsp + 0x1af], 0
mov word [rsp + 0x19e], 0xece3
mov r8, qword [rsp + 0x1a0]
mov byte [rsp + 0x19d], 0x8d
mov dword [rsp + 0x198], 0x4c86ecd0
mov qword [rsp + 0x190], 0x22b48552
mov r9, qword [rsp + 0x190]
mov eax, 0x28427894
mov r10d, eax
sub r10, r9
mov qword [rsp + 0x170], r10
mov eax, dword [rsp + 0x1a8]
mov r11d, eax
xor r11d, 0x3aa7f1b0
mov dword [rsp + 0x1a8], r11d
mov r11d, dword [rsp + 0x198]
xor r11d, 0x4e967784
mov r9, r8
add r9, 0x2797f011
mov qword [rsp + 0x1a0], r9
mov dword [rsp + 0x164], r11d
lea r9, [rsp + 0xa0]
mov byte [rsp + 0x1af], dl
movzx r11d, word [rsp + 0x1ac]
mov si, r11w
lea r10, [rsp + 0xf0]
mov edi, r11d
or edi, 0x207e
mov bx, di
mov word [rsp + 0x1ac], bx
mov bpl, byte [rsp + 0x19d]
add bpl, 0xde
mov byte [rsp + 0xa0], bpl
mov bpl, byte [rsp + 0x19d]
add bpl, 0xd8
mov byte [rsp + 0xa1], bpl
imul r14, r8, 0x2c81ee39
mov qword [rsp + 0x1a0], r14
mov r14, r8
not r14
mov bpl, byte [rsp + 0x19d]
mov qword [rsp + 0x1a0], r14
add bpl, 0xe5
mov byte [rsp + 0xa2], bpl
mov r15, r8
add r15, 0x1ece5b06
mov qword [rsp + 0x1a0], r15
imul r15, r8, 0x3c739ce1
mov qword [rsp + 0x1a0], r15
mov bpl, byte [rsp + 0x19d]
xor bpl, 0xe3
mov byte [rsp + 0x1af], 0x13
mov byte [rsp + 0xa3], bpl
mov dword [rsp + 0x1a8], eax
test byte [rax + rbp*4], ah
add dword [rax], eax
add byte [rax - 0x76], al
lodsb al, byte [rsi]
and al, 0x9d
add dword [rax], eax
add byte [rbp - 0x77], cl
invalid
add r15, 0x17e3655f
mov qword [rsp + 0x1a0], r15
add bpl, 0xd8
mov byte [rsp + 0xa4], bpl
or r11d, 0x970
mov bx, r11w
mov word [rsp + 0x1ac], bx
mov r15, r8
or r15, 0x3a2ae4eb
mov qword [rsp + 0x1a0], r15
mov bpl, byte [rsp + 0x19d]
mov r11d, eax
add r11d, 0x55ca9cd2
mov dword [rsp + 0x1a8], r11d
add bpl, 0xdf
mov byte [rsp + 0xa5], bpl
mov bpl, 0xc7
mov dword [rsp + 0x84], eax
mov al, dl
mul bpl
mov byte [rsp + 0x1af], al
mov al, byte [rsp + 0x19d]
xor al, 0xbe
mov dword [rsp + 0x1a8], 0x248a503d
mov byte [rsp + 0xa6], al
mov al, byte [rsp + 0x19d]
mov bpl, 0xbf
sub bpl, al
mov byte [rsp + 0xa7], bpl
mov al, byte [rsp + 0x19d]
mov bpl, 0xbb
sub bpl, al
mov byte [rsp + 0xa8], bpl
mov al, byte [rsp + 0x19d]
mov r11d, dword [rsp + 0x84]
mov dword [rsp + 0x1a8], r11d
xor al, 0xe9
mov byte [rsp + 0xa9], al
mov al, dl
or al, 0xb9
mov byte [rsp + 0x1af], al
mov al, byte [rsp + 0x19d]
mov qword [rsp + 0x1a0], r8
xor al, 0xe1
mov byte [rsp + 0xaa], al
mov al, byte [rsp + 0x19d]
mov qword [rsp + 0x1a0], r14
mov r15, r8
add r15, 0x531e1042
mov bpl, 0xf9
sub bpl, al
mov qword [rsp + 0x1a0], r15
mov byte [rsp + 0xab], bpl
mov al, byte [rsp + 0x19d]
add al, 0x73
mov byte [rsp + 0xac], al
mov edi, r8d
and edi, 0x2dedff7
mov r15d, edi
mov qword [rsp + 0x1a0], r15
mov al, byte [rsp + 0x19d]
xor al, 0xd3
mov byte [rsp + 0xad], al
mov qword [rsp + 0x1a0], r8
movaps xmm0, xmmword [0x1400420e0]
movaps xmmword [rsp + 0xf0], xmm0
mov al, dl
or al, 0x6d
mov byte [rsp + 0x1af], al
mov bx, word [rsp + 0x19e]
mov r12w, 0xed11
sub r12w, bx
mov word [rsp + 0x100], r12w
mov word [rsp + 0x1ac], 0xf51c
mov byte [rsp + 0x1af], 0xf
mov bx, word [rsp + 0x19e]
xor bx, 0xec87
mov word [rsp + 0x1ac], si
mov word [rsp + 0x102], bx
mov word [rsp + 0x1ac], 0x73c6
imul r15, r8, 0x7ce22b81
mov bx, word [rsp + 0x19e]
mov qword [rsp + 0x1a0], r15
xor bx, 0xec8f
mov word [rsp + 0x104], bx
xor r11d, 0x7b122f3f
mov dword [rsp + 0x1a8], r11d
mov bx, word [rsp + 0x19e]
add bx, 0x1389
mov word [rsp + 0x106], bx
mov byte [rsp + 0x1af], 0xb4
mov bx, word [rsp + 0x19e]
mov r12w, 0xece3
sub r12w, bx
mov word [rsp + 0x108], r12w
add dword [rax], eax
add byte [rax - 0x7774cb30], cl
test byte [rdi + rbp*4], ah
add dword [rax], eax
add byte [rax - 0x776afb30], cl
test byte [rdi + rbp*4], ah
add dword [rax], eax
add byte [rsi - 0x75], ah
pushfq
and al, 0x9e
add dword [rax], eax
add byte [rcx + rcx*4 - 0x4c], cl
and al, 0xa0
add dword [rax], eax
add byte [rsi - 0x7f], ah
mov ebp, 0x9c8966ec
and al, 0xa
add dword [rax], eax
add byte [rsi - 0x39], ah
test byte [rsp], ah
add dword [rax], eax
add byte [rax], al
add byte [rax - 0x39], cl
test byte [rsp + rbx], ah
add dword [rax], eax
add byte [rax], al
add byte [rax], al
add byte [rax - 0x39], cl
test byte [rsp + rdx], ah
add dword [rax], eax
add byte [rax], al
add byte [rax], al
add byte [rax - 0x39], cl
test byte [rsp + rcx], ah
add dword [rax], eax
add byte [rax], al
add byte [rax], al
add byte [rax - 0x39], cl
test byte [rax + riz*4], ah
add dword [rax], eax
add byte [rdi + rbx - 0x76b2819a], al
invalid
add r14, 0xe119fad
movsx r11d, byte [rsp + 0xbb]
mov bx, r11w
mov qword [rsp + 0x1a0], r14
mov word [rsp + 0x126], bx
movsx r11d, byte [rsp + 0xbc]
mov bx, r11w
mov word [rsp + 0x1ac], 0x17dd
mov word [rsp + 0x128], bx
mov al, dl
and al, 0xc4
mov byte [rsp + 0x1af], al
movsx r11d, byte [rsp + 0xbd]
mov bx, r11w
mov r14, r8
or r14, 0x5e3f6c0
mov qword [rsp + 0x1a0], r14
mov al, dl
xor al, 0xb4
mov byte [rsp + 0x1af], al
mov word [rsp + 0x12a], bx
mov al, dl
and al, 0x5d
mov byte [rsp + 0x1af], al
movsx r11d, byte [rsp + 0xbe]
mov bx, r11w
mov word [rsp + 0x12c], bx
mov r11d, dword [rsp + 0x84]
mov dword [rsp + 0x1a8], r11d
mov al, byte [rsp + 0xbf]
movsx edi, al
mov bx, di
mov word [rsp + 0x12e], bx
mov qword [rsp + 0x1a0], rcx
mov edi, dword [rsp + 0x198]
add edi, 0xb3791360
mov rcx, r8
xor rcx, 0xffffffffffffffff
mov r14, qword gs:[edi]
mov qword [rsp + 0x1a0], rcx
mov bx, si
xor bx, 0xe42f
mov rax, qword [r14 + 0x60]
mov word [rsp + 0x1ac], bx
mov rax, qword [rax + 0x18]
mov rcx, rax
add rcx, 0x20
mov rax, qword [rax + 0x20]
mov qword [rsp + 0xe8], 0
cmp rax, rcx
mov byte [rsp + 0x83], dl
mov qword [rsp + 0x78], r8
mov qword [rsp + 0x70], r10
mov qword [rsp + 0x68], r9
mov word [rsp + 0x66], si
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rax
je 0x14003ec0d
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x88], rax
jmp 0x14003e8ee
mov al, byte [rsp + 0x83]
xor al, al
mov byte [rsp + 0x1af], al
mov rcx, qword [rsp + 0xe0]
mov edx, dword [rsp + 0x84]
and edx, 0xe19c5c8
mov r8d, dword [rsp + 0x164]
mov dword [rsp + 0x1a8], edx
mov edx, dword [rsp + 0x198]
mov r9w, word [rsp + 0x66]
xor r9w, 0xbf99
mov word [rsp + 0x1ac], r9w
add edx, 0xe3ee3248
mov qword [rsp + 0x180], rcx
cmp r8d, edx
ja 0x14003e77d
mov rax, qword [rsp + 0x78]
or rax, 0x7d7bfeb1
mov qword [rsp + 0x1a0], rax
mov ecx, dword [rsp + 0x84]
xor ecx, 0x554d589b
mov rax, qword [rsp + 0x180]
mov dword [rsp + 0x1a8], ecx
mov rax, qword [rax]
mov ecx, dword [rsp + 0x84]
mov dword [rsp + 0x1a8], ecx
mov qword [rsp + 0x88], rax
mov rdx, qword [rsp + 0x78]
add rdx, 0x363bae10
mov qword [rsp + 0x1a0], rdx
mov qword [rsp + 0xe8], 0
mov rdx, qword [rsp + 0x58]
cmp rax, rdx
je 0x14003ec0d
jmp 0x14003e8ee
mov eax, 0x195f4937
mov ecx, eax
mov dx, 0xece3
mov r8b, 0x14
mov al, byte [rsp + 0x83]
mul r8b
sub dx, word [rsp + 0x19e]
mov byte [rsp + 0x1af], al
mov r9, qword [rsp + 0x90]
mov qword [rsp + 0x188], r9
mov r9, qword [rsp + 0x188]
mov r10, qword [rsp + 0x140]
mov r11d, dword [rsp + 0x84]
and r11d, 0x105f6ef9
mov dword [rsp + 0x1a8], r11d
mov si, word [r10 + r9*2]
mov word [rsp + 0x156], si
mov word [rsp + 0x1ac], 0x5168
mov si, word [rsp + 0x156]
mov byte [rsp + 0x1af], 0xe7
mov r9, qword [rsp + 0x78]
sub rcx, r9
mov qword [rsp + 0x1a0], rcx
cmp si, dx
je 0x14003eade
jmp 0x14003e843
xor eax, eax
mov ecx, eax
mov eax, dword [rsp + 0x198]
mov word [rsp + 0x1ac], 0xdaf1
add eax, 0xb0d9cca
mov edx, dword [rsp + 0x84]
mov dword [rsp + 0x1a8], edx
mov r8, rsp
mov dword [r8 + 0x20], eax
mov r8, qword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
xor eax, eax
mov r9d, eax
mov qword [rsp + 0x48], rcx
mov rcx, r9
mov rdx, r9
mov qword [rsp + 0x40], r8
mov r8, r9
mov r10, qword [rsp + 0x40]
call r10
xor r11d, r11d
mov ecx, r11d
mov si, word [rsp + 0x66]
mov word [rsp + 0x1ac], si
mov dword [rsp + 0x3c], eax
mov rax, rcx
add rsp, 0x1b0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov eax, 0x306da082
mov ecx, eax
mov rdx, qword [rsp + 0x190]
add rdx, 0xffffffffe096026f
mov qword [rsp + 0x98], rdx
sub rcx, qword [rsp + 0x190]
mov rdx, qword [rsp + 0x98]
mov dword [rsp + 0x1a8], 0x67356406
cmp rdx, rcx
jb 0x14003e9db
jmp 0x14003e7ff
mov eax, 0x7e7af752
mov ecx, eax
mov word [rsp + 0x1ac], 0x13ad
mov rdx, qword [rsp + 0x78]
sub rcx, rdx
mov r8, qword [rsp + 0x190]
add r8, 0xffffffffdd4b7aaf
movzx eax, word [rsp + 0x156]
mov qword [rsp + 0x30], rcx
mov ecx, eax
mov qword [rsp + 0x28], r8
call fcn.14003ed80
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x1a0], rdx
mov rdx, qword [rsp + 0x188]
mov r9b, byte [rsp + 0x83]
and r9b, 0xc5
mov r10w, word [rsp + rdx*2 + 0xf0]
mov byte [rsp + 0x1af], r9b
mov rdx, qword [rsp + 0x28]
add rdx, qword [rsp + 0x188]
mov qword [rsp + 0xd8], rdx
mov rdx, qword [rsp + 0x78]
sub rdx, 0x7c5f4f49
mov qword [rsp + 0x1a0], rdx
cmp r10w, ax
je 0x14003e7ff
jmp 0x14003e5f8
mov ax, 0xece3
mov cx, 0xece4
mov rdx, qword [rsp + 0x88]
mov qword [rsp + 0xe0], rdx
mov r8w, word [rsp + 0x66]
or r8w, 0x2fd3
mov rdx, qword [rsp + 0xe0]
mov word [rsp + 0x1ac], r8w
mov r9d, dword [rsp + 0x84]
and r9d, r9d
mov r8w, word [rsp + 0x19e]
mov dword [rsp + 0x1a8], r9d
sub cx, r8w
mov word [rsp + 0x1ac], 0x9b02
mov rdx, qword [rdx + 0x20]
mov qword [rsp + 0x138], rdx
mov qword [rsp + 0x1a0], 0x6c01264
mov rdx, qword [rsp + 0xe0]
mov r10, qword [rsp + 0xe0]
mov r8w, word [rdx + 0x48]
mov r11w, word [rsp + 0x66]
and r11w, 0x7a63
mov word [rsp + 0x1ac], r11w
sub ax, word [rsp + 0x19e]
mov qword [rsp + 0x1a0], 0x6fabf5f7
mov rdx, qword [r10 + 0x50]
mov qword [rsp + 0x140], rdx
shr r8w, cl
mov qword [rsp + 0x1a0], 0xa44ae14
mov word [rsp + 0xd6], r8w
cmp word [rsp + 0xd6], ax
je 0x14003e5f8
jmp 0x14003ecd7
mov qword [rsp + 0x1a0], 0x7dae7bf5
mov rax, qword [rsp + 0xc8]
mov dword [rsp + 0x1a8], 0x315998f1
mov rcx, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0x78]
and rdx, 0x5e735375
mov qword [rsp + 0x1a0], rdx
mov rdx, qword [rsp + 0xd8]
mov r8, qword [rsp + 0x138]
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0xe8], r8
cmp rcx, rax
jb 0x14003e6da
jmp 0x14003ec0d
mov eax, 0xb031bcf8
sub eax, dword [rsp + 0x198]
mov dword [rsp + 0x168], eax
mov eax, dword [rsp + 0x168]
mov ecx, dword [rsp + 0x198]
add ecx, 0x30fc1202
cmp eax, ecx
je 0x14003e5f8
mov eax, 0x22b48552
mov ecx, eax
mov eax, dword [rsp + 0x84]
and eax, 0x23b908b
mov dword [rsp + 0x1a8], eax
mov eax, dword [rsp + 0x84]
and eax, 0x12a2e192
mov rdx, qword [rsp + 0x190]
mov dword [rsp + 0x1a8], eax
sub rcx, rdx
movzx eax, word [rsp + 0xd6]
mov edx, eax
mov qword [rsp + 0xc8], rdx
mov qword [rsp + 0x90], rcx
mov r8b, byte [rsp + 0x83]
or r8b, 0x71
mov byte [rsp + 0x1af], r8b
jmp 0x14003e6da
mov eax, 0x3b36f496
mov ecx, eax
mov eax, 0x325eedae
mov edx, eax
sub rdx, qword [rsp + 0x190]
mov qword [rsp + 0x1a0], 0x2840a257
mov qword [rsp + 0x158], rdx
sub rcx, qword [rsp + 0x190]
mov word [rsp + 0x1ac], 0xbfa7
mov eax, dword [rsp + 0x84]
sub eax, 0x17094650
mov rdx, qword [rsp + 0x158]
mov dword [rsp + 0x1a8], eax
mov eax, dword [rsp + 0x84]
or eax, eax
mov dword [rsp + 0x1a8], eax
cmp rdx, rcx
je 0x14003eb8a
jmp 0x14003eb8a
mov ax, word [rsp + 0x19e]
xor ax, 0xece3
mov cx, word [rsp + 0x17e]
mov qword [rsp + 0x1a0], 0x7ec84049
mov rdx, qword [rsp + 0x138]
mov qword [rsp + 0xe8], rdx
cmp cx, ax
je 0x14003ec0d
jmp 0x14003e5f8
mov eax, 0x49a1114b
mov ecx, eax
lea rdx, [rsp + 0xf0]
mov r8b, 0x18
mov r9w, word [rsp + 0x66]
sub r9w, 0xabd1
mov word [rsp + 0x1ac], r9w
mov r10, qword [rsp + 0x190]
mov r11, qword [rsp + 0x188]
mov bl, byte [rsp + 0x83]
sub r8b, bl
shl r11, 1
add rdx, r11
mov byte [rsp + 0x1af], r8b
sub rcx, r10
mov qword [rsp + 0x148], rdx
mov dword [rsp + 0x1a8], 0x91800d0
mov rdx, qword [rsp + 0x170]
sub bl, 0x6d
mov byte [rsp + 0x1af], bl
cmp rcx, rdx
jbe 0x14003ea73
jmp 0x14003ec47
mov qword [rsp + 0x1a0], 0x35b15a4f
mov rax, qword [rsp + 0x78]
xor rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0xe8]
mov qword [rsp + 0x1a0], rax
mov rax, rcx
add rsp, 0x1b0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov al, byte [rsp + 0x19d]
xor al, 0xb7
mov cl, byte [rsp + 0x83]
or cl, 0x50
mov byte [rsp + 0x1af], cl
mov rdx, qword [rsp + 0x148]
mov r8w, word [rdx]
mov word [rsp + 0x17e], r8w
mov cl, byte [rsp + 0x19d]
mov r8w, word [rsp + 0x66]
xor r8w, 0xf4d6
mov word [rsp + 0x1ac], r8w
mov r8w, word [rsp + 0x66]
or r8w, r8w
xor cl, 0x59
mov word [rsp + 0x1ac], r8w
mov byte [rsp + 0xd5], al
mov al, byte [rsp + 0xd5]
mov rdx, qword [rsp + 0x78]
or rdx, 0x62323215
mov qword [rsp + 0x1a0], rdx
cmp cl, al
ja 0x14003eb4c
jmp 0x14003e7ff
mov eax, 0x88b922b6
mov ecx, 0xbe1bf5df
mov rdx, qword [rsp + 0x78]
xor rdx, 0xffffffffffffffff
mov qword [rsp + 0x1a0], rdx
mov r8d, dword [rsp + 0x198]
mov r9d, dword [rsp + 0x84]
imul r10d, r9d, 0x1401c0f9
mov dword [rsp + 0x1a8], r10d
sub ecx, r8d
mov r11b, byte [rsp + 0x83]
and r11b, 0x2c
mov byte [rsp + 0x1af], r11b
mov dword [rsp + 0x16c], ecx
mov ecx, dword [rsp + 0x198]
mov rdx, qword [rsp + 0x78]
or rdx, 0x4f3aa24b
mov qword [rsp + 0x1a0], rdx
sub eax, ecx
mov r11b, byte [rsp + 0x83]
xor r11b, 0xff
mov byte [rsp + 0x1af], r11b
cmp eax, dword [rsp + 0x16c]
je 0x14003e9db
jmp 0x14003ea44