Function at 0x14000143c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xor sil, sil
call fcn.1400094a4
mov ebx, eax
test eax, eax
jns 0x14000148f
cmp eax, 0xc000000d
jne 0x140001475
mov ecx, 0xc1008035
call fcn.14000a820
jmp 0x140001aee
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ecx, eax
call fcn.14000a894
jmp 0x140001aee
lea rcx, [0x14003b5ac]
call fcn.140009790
test al, al
jne 0x140001ab9
lea rcx, [0x14003b5b0]
call fcn.140009790
test al, al
jne 0x140001ab9
lea rcx, str.store
call fcn.1400097fc
mov r8, rax
mov r14d, 1
test rax, rax
je 0x140001518
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
cmp dword [rax + 0x18], r14d
je 0x140001501
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov ecx, 0xc1008001
mov ebx, 0xc000000d
jmp 0x14000146b
mov rax, qword [rax + 0x20]
mov qword [0x14004f750], rax
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
lea rcx, str.offline
call fcn.1400097fc
test rax, rax
je 0x14000156e
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, rax
mov rcx, qword [rcx + 0x30]
cmp dword [rax + 0x18], edx
je 0x14000155b
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov ecx, 0xc100802a
mov ebx, 0xc000000d
jmp 0x14000146b
mov byte [0x14004f759], r14b
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
lea rcx, [0x14003b5e0]
call fcn.1400097fc
test rax, rax
je 0x1400015c4
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, rax
mov rcx, qword [rcx + 0x30]
cmp dword [rax + 0x18], edx
je 0x1400015b1
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov ecx, 0xc1008002
mov ebx, 0xc000000d
jmp 0x14000146b
mov byte [0x14004f758], r14b
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
lea rcx, [0x14003b5e8]
call fcn.1400097fc
test rax, rax
je 0x140001603
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, rax
mov rcx, qword [rcx + 0x30]
cmp dword [rax + 0x18], edx
jne 0x140001540
mov byte [0x14004f75a], r14b
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
lea rcx, str.loglevel
call fcn.1400097fc
mov rdi, rax
test rax, rax
je 0x140001718
cmp dword [rax + 0x18], 0
je 0x1400016c5
mov rcx, qword [rax + 0x20]
lea rdx, str.tiwe
mov r8, r14
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140001648
mov ebx, r14d
jmp 0x1400016c7
mov rcx, qword [rdi + 0x20]
lea rdx, [0x14003b608]
mov r8, r14
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000166b
lea ebx, [rax + 2]
jmp 0x1400016c7
mov rcx, qword [rdi + 0x20]
lea rdx, [0x14003b60c]
mov r8, r14
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000168e
lea ebx, [rax + 3]
jmp 0x1400016c7
mov rcx, qword [rdi + 0x20]
lea rdx, [0x14003b610]
mov r8, r14
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400016b1
lea ebx, [rax + 4]
jmp 0x1400016c7
mov rcx, qword [rdi + 0x20]
call qword [sym.imp.msvcrt.dll__wtoi]
nop dword [rax + rax]
mov ebx, eax
jmp 0x1400016c7
xor ebx, ebx
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
cmp byte [0x14004f698], 0
mov sil, r14b
jne 0x140001718
cmp ebx, 5
jge 0x140001718
lea rax, [0x1400013b0]
mov dword [0x14004f688], ebx
mov qword [0x14004f690], rax
mov byte [0x14004f68c], r14b
mov byte [0x14004f698], r14b
lea rax, [0x14004f740]
cmp qword [0x14004f740], rax
je 0x140001738
lea rcx, str.enum
call fcn.140009790
test al, al
je 0x140001747
call fcn.140009e50
call fcn.140007130
jmp 0x140001a29
lea rcx, str.copy
call fcn.140009790
test al, al
je 0x140001766
call fcn.140009e50
call fcn.1400085a4
jmp 0x140001a29
lea rcx, str.delete
call fcn.140009790
test al, al
je 0x140001785
call fcn.140009e50
call fcn.1400091b4
jmp 0x140001a29
lea rcx, str.create
call fcn.140009790
test al, al
je 0x1400017a4
call fcn.140009e50
call fcn.140008980
jmp 0x140001a29
lea rcx, str.deletevalue
call fcn.140009790
test al, al
je 0x1400017c3
call fcn.140009e50
call fcn.140003efc
jmp 0x140001a29
lea rcx, [0x14003b670]
call fcn.140009790
test al, al
je 0x1400017e2
call fcn.140009e50
call fcn.140004154
jmp 0x140001a29
lea rcx, str.timeout
call fcn.140009790
test al, al
je 0x140001801
call fcn.140009e50
call fcn.140001b14
jmp 0x140001a29
lea rcx, [0x14003b688]
call fcn.140009790
test al, al
je 0x140001820
call fcn.140009e50
call fcn.140001ca0
jmp 0x140001a29
lea rcx, str.displayorder
call fcn.140009790
test al, al
je 0x14000183f
call fcn.140009e50
call fcn.140001e40
jmp 0x140001a29
lea rcx, str.toolsdisplayorder
call fcn.140009790
test al, al
je 0x14000185e
call fcn.140009e50
call fcn.1400020dc
jmp 0x140001a29
lea rcx, str.bootsequence
call fcn.140009790
test al, al
je 0x14000187d
call fcn.140009e50
call fcn.14000235c
jmp 0x140001a29
lea rcx, [0x14003b700]
call fcn.140009790
test al, al
je 0x140001899
call fcn.140009e50
xor ecx, ecx
jmp 0x140001a05
lea rcx, str.debug
call fcn.140009790
test al, al
je 0x1400018b5
call fcn.140009e50
xor ecx, ecx
jmp 0x140001a24
lea rcx, str.bootdebug
call fcn.140009790
test al, al
je 0x1400018d4
call fcn.140009e50
call fcn.140003ccc
jmp 0x140001a29
lea rcx, [0x14003b740]
call fcn.140009790
test al, al
je 0x1400018f3
call fcn.140009e50
call fcn.140006938
jmp 0x140001a29
lea rcx, [0x14003b758]
call fcn.140009790
test al, al
je 0x140001912
call fcn.140009e50
call fcn.140006c64
jmp 0x140001a29
lea rcx, str.bootems
call fcn.140009790
test al, al
je 0x140001931
call fcn.140009e50
call fcn.140006ee8
jmp 0x140001a29
lea rcx, str.createstore
call fcn.140009790
test al, al
je 0x14000194b
call fcn.1400098a4
jmp 0x140001a29
lea rcx, str.export
call fcn.140009790
test al, al
je 0x140001965
call fcn.140009a20
jmp 0x140001a29
lea rcx, str.import
call fcn.140009790
test al, al
je 0x14000197f
call fcn.140009b58
jmp 0x140001a29
lea rcx, str.sysstore
call fcn.140009790
test al, al
je 0x140001999
call fcn.140009ce8
jmp 0x140001a29
lea rcx, [0x14003b7c0]
call fcn.140009790
test al, al
je 0x1400019b3
call fcn.140009e50
mov ecx, r14d
jmp 0x140001a05
lea rcx, str.mirror
call fcn.140009790
test al, al
je 0x1400019cf
call fcn.140009e50
call fcn.140007aa8
jmp 0x140001a29
lea rcx, [0x14003b7f8]
call fcn.140009790
test al, al
je 0x1400019eb
call fcn.140009e50
mov ecx, 2
jmp 0x140001a05
lea rcx, [0x14003b820]
call fcn.140009790
test al, al
je 0x140001a0c
call fcn.140009e50
mov ecx, 3
call fcn.1400025dc
jmp 0x140001a29
lea rcx, str.event
call fcn.140009790
test al, al
je 0x140001a30
call fcn.140009e50
mov ecx, r14d
call fcn.140003950
mov ebx, eax
jmp 0x140001ac0
lea rcx, str.showpath
call fcn.140009790
test al, al
je 0x140001aa8
and qword [rsp + 0x40], 0
lea rcx, [rsp + 0x40]
call fcn.140013cbc
mov rdi, qword [rsp + 0x40]
mov ebx, eax
test eax, eax
js 0x140001a68
mov rdx, rdi
mov ecx, 0x1001032
call fcn.14000a820
test rdi, rdi
je 0x140001a8d
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
test ebx, ebx
jns 0x140001ac0
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ecx, eax
call fcn.14000a894
jmp 0x140001ac0
mov ecx, 0xc100802a
mov ebx, 0xc000000d
call fcn.14000a820
jmp 0x140001ac0
call fcn.140009e7c
xor ebx, ebx
test sil, sil
je 0x140001aee
cmp byte [0x14004f698], 0
je 0x140001aee
and qword [0x14004f690], 0
mov byte [0x14004f698], 0
mov dword [0x14004f688], 5
mov byte [0x14004f68c], 0
call fcn.140009724
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret