Function at 0x170031930
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x628
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x590], xmm6
and rsp, 0xfffffffffffffff0
mov r14, rcx
lea rsi, [rsp + 0x140]
mov r8d, 0x4d0
mov rcx, rsi
xor edx, edx
call sym.ntdll.dll_memset
lea rax, [r14 + 0x80]
test r14, r14
cmovne rsi, r14
mov qword [rsp + 0x48], rsi
lea r15, [rsp + 0x1c0]
cmovne r15, rax
cmp byte [0x17008f4f0], 1
jne 0x1700319a7
mov rcx, 0xfffffffffffffffe
xor edx, edx
call sym.ntdll.dll_NtTerminateThread
lea rsi, [0x17008d430]
mov rcx, rsi
call sym.ntdll.dll_RtlEnterCriticalSection
cmp byte [0x17008f50c], 0
je 0x170031a25
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x10]
mov r13, qword [0x17008f570]
test r13, r13
je 0x1700319e6
cmp qword [r13 + 0x30], rax
je 0x170031f91
mov rdx, qword [rcx + 0x18]
add rdx, 0x20
xor r13d, r13d
mov rcx, rdx
nop word cs:[rax + rax]
nop
mov rcx, qword [rcx]
cmp rcx, rdx
je 0x170031f91
cmp qword [rcx + 0x20], rax
jne 0x170031a00
add rcx, 0xfffffffffffffff0
mov qword [0x17008f570], rcx
mov r13, rcx
jmp 0x170031f91
mov r12, qword gs:[0x30]
mov rbx, qword [r12 + 0x60]
lea rax, [0x17008d478]
mov qword [rbx + 0x18], rax
lea rax, [0x17008d4d0]
mov qword [rbx + 0x38], rax
lea rdi, [0x17008f510]
mov qword [rbx + 0x78], rdi
lea r13, [0x17008f520]
mov qword [rbx + 0x238], r13
mov qword [rbx + 0x110], rsi
xorps xmm6, xmm6
movups xmmword [rsp + 0x20], xmm6
mov ecx, 2
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sym.ntdll.dll_RtlCreateHeap
mov qword [rbx + 0x30], rax
lea rdx, [rbx + 0x80]
mov rcx, rdi
mov r8d, 0x40
call sym.ntdll.dll_RtlInitializeBitMap
lea rdx, [rbx + 0x240]
mov rcx, r13
mov r8d, 0x400
call sym.ntdll.dll_RtlInitializeBitMap
mov rcx, qword [rbx + 0x78]
xor edx, edx
mov r8d, 1
call sym.ntdll.dll_RtlSetBits
call fcn.170022450
lea rdx, str.WINEBOOTSTRAPMODE
lea rsi, [rsp + 0xa0]
mov rcx, rsi
call sym.ntdll.dll_RtlInitUnicodeString
mov word [rsp + 0x132], 0
lea r8, [rsp + 0x130]
xor ecx, ecx
mov rdx, rsi
call sym.ntdll.dll_RtlQueryEnvironmentVariable_U
xor ecx, ecx
cmp eax, 0xc0000100
setne cl
mov dword [0x17008f58c], ecx
mov dword [rsp + 0x70], 0x30
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], rsi
mov dword [rsp + 0x88], 0x40
movups xmmword [rsp + 0x90], xmm6
lea rdx, str.RegistryMachineSystemCurrentControlSetControlSession_Manager
mov rcx, rsi
call sym.ntdll.dll_RtlInitUnicodeString
lea rcx, [rsp + 0x50]
lea r8, [rsp + 0x70]
mov edx, 1
call sym.ntdll.dll_NtOpenKey
test eax, eax
jne 0x170031c84
mov rsi, qword [rsp + 0x50]
lea rdx, str.SafeProcessSearchMode
lea rdi, [rsp + 0x60]
mov rcx, rdi
call sym.ntdll.dll_RtlInitUnicodeString
mov dword [rsp + 0x44], 0x7e
lea rbx, [rsp + 0x44]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x7e
lea r9, [rsp + 0xb0]
mov rcx, rsi
mov rdx, rdi
mov r8d, 2
call sym.ntdll.dll_NtQueryValueKey
test eax, eax
jne 0x170031bf0
cmp dword [rsp + 0xb4], 4
jne 0x170031bc4
mov eax, dword [rsp + 0xbc]
jmp 0x170031bea
mov eax, dword [rsp + 0x44]
and eax, 0xfffffffe
mov word [rsp + rax + 0xb0], 0
lea rcx, [rsp + 0xbc]
xor edx, edx
mov r8d, 0x10
call sym.ntdll.dll_wcstoul
mov dword [0x17008f56c], eax
mov rsi, qword [rsp + 0x50]
lea rdx, str.SafeDllSearchMode
lea rdi, [rsp + 0x60]
mov rcx, rdi
call sym.ntdll.dll_RtlInitUnicodeString
mov dword [rsp + 0x44], 0x7e
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x7e
lea r9, [rsp + 0xb0]
mov rcx, rsi
mov rdx, rdi
mov r8d, 2
call sym.ntdll.dll_NtQueryValueKey
test eax, eax
jne 0x170031c7a
cmp dword [rsp + 0xb4], 4
jne 0x170031c4e
mov eax, dword [rsp + 0xbc]
jmp 0x170031c74
mov eax, dword [rsp + 0x44]
and eax, 0xfffffffe
mov word [rsp + rax + 0xb0], 0
lea rcx, [rsp + 0xbc]
xor edx, edx
mov r8d, 0x10
call sym.ntdll.dll_wcstoul
mov dword [0x17008d538], eax
mov rcx, qword [rsp + 0x50]
call sym.ntdll.dll_NtClose
mov dword [rsp + 0xb0], 2
mov rax, qword [r12 + 0x60]
mov rcx, qword [rax + 0x30]
lea r8, [rsp + 0xb0]
mov r9d, 4
xor edx, edx
call sym.ntdll.dll_RtlSetHeapInformation
call fcn.170067f10
lea rcx, str.WINESYSTEMDLLPATH
lea r8, [0x17008f530]
xor edx, edx
call fcn.170032320
mov rax, qword [r12 + 0x60]
mov rbx, qword [rax + 0x20]
mov rdi, qword [rax + 0x10]
mov qword [rsp + 0xa0], rdi
mov rax, qword [rbx + 0x58]
mov qword [0x17008f580], rax
test rax, rax
jne 0x170031d05
mov rcx, qword [rbx + 0x68]
mov r8d, dword [0x17008d538]
lea r9, [0x17008f580]
xor edx, edx
call fcn.170034360
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0xb0]
mov rcx, 0xffffffffffffffff
mov edx, 0x25
mov r9d, 0x40
call sym.ntdll.dll_NtQueryInformationProcess
test byte [rsp + 0xdd], 0x20
je 0x170031d60
lea rcx, [rbx + 0x60]
call fcn.170040430
lea rcx, str.wine:__s_is_a_dll__not_an_executable_n
mov rdx, rax
call fcn.1700327b0
mov rcx, 0xffffffffffffffff
mov edx, 0xc000007b
call sym.ntdll.dll_NtTerminateProcess
lea rdx, [rsp + 0xb0]
mov rcx, rdi
call fcn.170036300
test eax, eax
je 0x170031de5
mov rcx, qword [rbx + 0x68]
lea rdx, [rsp + 0x70]
xor r8d, r8d
xor r9d, r9d
call sym.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus
mov edi, eax
test eax, eax
jne 0x170031dea
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea rsi, [rsp + 0x70]
lea r8, [rsp + 0xa0]
lea r9, [rsp + 0xb0]
xor ecx, ecx
mov rdx, rsi
call fcn.1700358d0
mov edi, eax
mov rcx, rsi
call sym.ntdll.dll_RtlFreeUnicodeString
test edi, edi
jne 0x170031dea
mov r13, qword [rsp + 0x60]
jmp 0x170031e19
mov edi, 0xc000007b
add rbx, 0x60
mov rcx, rbx
call fcn.170040430
lea rcx, str.wine:_failed_to_create_main_module_for__s__status__x_n
mov rdx, rax
mov r8d, edi
call fcn.1700327b0
mov rcx, 0xffffffffffffffff
mov edx, edi
call sym.ntdll.dll_NtTerminateProcess
xor r13d, r13d
mov word [r13 + 0x6c], 0xffff
call fcn.170032410
cmp dword [r12 + 0x180c], 0
je 0x170031e3a
mov rcx, qword [rsp + 0x48]
call fcn.1700324d0
mov dword [rsp + 0x20], 0
lea rdx, [0x1700729ac]
lea r9, [rsp + 0x70]
xor ecx, ecx
xor r8d, r8d
call fcn.17002e930
test eax, eax
je 0x170031e7a
mov esi, eax
lea rcx, str.wine:_could_not_load_kernel32.dll__status__x_n
mov edx, eax
call fcn.1700327b0
mov rcx, 0xffffffffffffffff
mov edx, esi
call sym.ntdll.dll_NtTerminateProcess
mov rdi, qword [rsp + 0x70]
mov rax, qword [rdi + 0x98]
mov qword [0x17008f540], rax
lea rdx, str.BaseThreadInitThunk
lea rsi, [rsp + 0xb0]
mov rcx, rsi
call sym.ntdll.dll_RtlInitAnsiString
mov rcx, qword [rdi + 0x30]
lea r9, [0x17008dcd0]
mov rdx, rsi
xor r8d, r8d
call sym.ntdll.dll_LdrGetProcedureAddress
test eax, eax
je 0x170031edc
mov esi, eax
lea rcx, str.wine:_could_not_find_BaseThreadInitThunk_in_kernel32.dll__status__x_n
mov edx, eax
call fcn.1700327b0
mov rcx, 0xffffffffffffffff
mov edx, esi
call sym.ntdll.dll_NtTerminateProcess
lea rdx, str.CtrlRoutine
lea rsi, [rsp + 0xb0]
mov rcx, rsi
call sym.ntdll.dll_RtlInitAnsiString
mov rcx, qword [rdi + 0x30]
lea r9, [0x17008f4e8]
mov rdx, rsi
xor r8d, r8d
call sym.ntdll.dll_LdrGetProcedureAddress
call fcn.17000ed40
call fcn.170036e10
test byte [r13 + 0x6b], 1
jne 0x170031f26
mov rcx, r13
xor edx, edx
call fcn.170032ac0
jmp 0x170031f33
mov rcx, r13
xor edx, edx
mov r8, r15
call fcn.170032820
mov edi, eax
test eax, eax
je 0x170031f8a
test byte [0x17008d458], 2
je 0x170031f7c
mov rax, qword [r12 + 0x60]
mov rax, qword [rax + 0x20]
mov rcx, qword [rax + 0x68]
call fcn.170030560
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
lea rdx, [0x17008d458]
lea r8, [0x170072a59]
lea r9, str.Importing_dlls_for__s_failed__status__x_n
mov ecx, 1
call fcn.17002dd80
mov rcx, 0xffffffffffffffff
mov edx, edi
call sym.ntdll.dll_NtTerminateProcess
mov byte [0x17008f50c], 1
mov r15, qword gs:[0x30]
cmp dword [r15 + 0x180c], 0
je 0x170031fae
mov rcx, qword [rsp + 0x48]
call fcn.1700324d0
call sym.ntdll.dll_RtlAcquirePebLock
lea rax, [0x17008d418]
mov rcx, qword [0x17008d418]
mov rdx, r15
add rdx, 0x1680
mov qword [r15 + 0x1680], rcx
mov qword [r15 + 0x1688], rax
mov qword [rcx + 8], rdx
mov qword [0x17008d418], rdx
call sym.ntdll.dll_RtlReleasePebLock
call fcn.170061450
mov qword [r15 + 0x17c8], rax
cmp byte [0x17008f508], 0
je 0x17003206b
call fcn.1700337d0
test eax, eax
je 0x170032015
mov rcx, 0xfffffffffffffffe
mov edx, eax
call sym.ntdll.dll_NtTerminateThread
mov rax, qword [r15 + 0x60]
mov rsi, qword [rax + 0x18]
mov rdi, qword [rsi + 0x30]
add rsi, 0x30
cmp rdi, rsi
je 0x170032219
mov ebx, 0xc0000
jmp 0x17003204c
mov rdi, qword [rdi]
cmp rdi, rsi
je 0x170032219
mov eax, dword [rdi + 0x48]
and eax, ebx
cmp eax, 0x80000
jne 0x170032040
lea rcx, [rdi - 0x20]
mov edx, 2
xor r8d, r8d
call fcn.170031240
jmp 0x170032040
mov byte [0x17008f508], 1
call fcn.1700337d0
test eax, eax
je 0x1700320cd
mov edi, eax
test byte [0x17008d458], 2
je 0x1700320bf
mov rax, qword [r15 + 0x60]
mov rax, qword [rax + 0x20]
mov rcx, qword [rax + 0x68]
call fcn.170030560
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
lea rdx, [0x17008d458]
lea r8, [0x170072a59]
lea r9, str.TLS_init__failed_when_loading__s__status__x_n
mov ecx, 1
call fcn.17002dd80
mov rcx, 0xffffffffffffffff
mov edx, edi
call sym.ntdll.dll_NtTerminateProcess
or byte [r13 + 0x6a], 8
mov rdx, qword [r13 + 0x88]
test rdx, rdx
je 0x1700320ed
lea r8, [rsp + 0xb0]
xor ecx, ecx
call sym.ntdll.dll_RtlActivateActivationContext
mov qword [rsp + 0x58], r14
mov rcx, qword [0x17008f548]
mov rdx, qword [rsp + 0x48]
call fcn.17002f070
mov edi, eax
test eax, eax
jne 0x170032120
mov rcx, qword [0x17008f540]
mov rdx, qword [rsp + 0x48]
call fcn.17002f070
mov edi, eax
test eax, eax
je 0x170032170
test byte [0x17008d458], 2
je 0x170032162
mov rax, qword [r15 + 0x60]
mov rax, qword [rax + 0x20]
mov rcx, qword [rax + 0x68]
call fcn.170030560
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
lea rdx, [0x17008d458]
lea r8, [0x170072a59]
lea r9, str.Initializing_system_dll_for__s_failed__status__x_n
mov ecx, 1
call fcn.17002dd80
mov rcx, 0xffffffffffffffff
mov edx, edi
call sym.ntdll.dll_NtTerminateProcess
mov r14, qword [r13 + 0x98]
mov r12, qword [r14 + 0x28]
test r12, r12
je 0x1700321c9
lea rsi, str.dep__dependency_from__node
lea rbx, str._data_rock3_wine_builds_wine_7_dlls_ntdll_loader.c
nop
mov r12, qword [r12]
cmp qword [r12 + 0x18], r14
je 0x1700321ac
mov rcx, rsi
mov rdx, rbx
mov r8d, 0x34a
call fcn.1700240e0
mov rcx, qword [r12 + 8]
mov rdx, qword [rsp + 0x48]
call fcn.17002f070
test eax, eax
jne 0x17003225f
cmp r12, qword [r14 + 0x28]
jne 0x170032190
cmp word [r13 + 0x6e], 0xffff
je 0x1700321df
mov rcx, qword [r13 + 0x30]
mov edx, 1
call fcn.170031540
cmp dword [r13 + 0x68], 0
mov r14, qword [rsp + 0x58]
jns 0x1700321f9
mov rax, qword [0x17008d4f8]
mov rcx, qword [r13 + 0x30]
call qword [rax + 8]
cmp qword [r13 + 0x88], 0
je 0x170032212
mov rdx, qword [rsp + 0xb0]
xor ecx, ecx
call sym.ntdll.dll_RtlDeactivateActivationContext
call fcn.170033990
jmp 0x17003222f
cmp word [r13 + 0x6e], 0xffff
je 0x17003222f
mov rcx, qword [r13 + 0x30]
mov edx, 2
call fcn.170031540
lea rcx, [0x17008d430]
call sym.ntdll.dll_RtlLeaveCriticalSection
test r14, r14
jne 0x170032308
movaps xmm6, xmmword [rbp + 0x590]
lea rsp, [rbp + 0x5a8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov edi, eax
mov rax, qword [0x17008f550]
test rax, rax
je 0x1700322a7
test byte [0x17008d458], 2
je 0x1700322a7
mov rcx, qword [rax + 0x60]
call fcn.170030560
add rax, 1
mov qword [rsp + 0x20], rax
lea rdx, [0x17008d458]
lea r8, [0x170072a59]
lea r9, str._s_failed_to_initialize__aborting_n
mov ecx, 1
call fcn.17002dd80
test byte [0x17008d458], 2
je 0x1700322e9
mov rax, qword [r15 + 0x60]
mov rax, qword [rax + 0x20]
mov rcx, qword [rax + 0x68]
call fcn.170030560
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
lea rdx, [0x17008d458]
lea r8, [0x170072a59]
lea r9, str.Initializing_dlls_for__s_failed__status__x_n
mov ecx, 1
call fcn.17002dd80
mov rcx, 0xffffffffffffffff
mov edx, edi
call sym.ntdll.dll_NtTerminateProcess
cmp word [r13 + 0x6e], 0xffff
jne 0x1700321d1
jmp 0x1700321df
mov rcx, qword [rsp + 0x48]
call fcn.170057de0
int3