Function at 0x14000b8f4
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x790]
sub rsp, 0x890
mov r14d, ecx
lea rdi, [rsp + 0x50]
mov r12d, edx
xor eax, eax
mov edx, 0x208
xor ebx, ebx
mov ecx, edx
mov dword [rbp + 0x7e0], ebx
rep stosb byte [rdi], al
mov ecx, edx
mov qword [rsp + 0x20], rbx
lea rdi, [rbp + 0x160]
xor r9d, r9d
rep stosb byte [rdi], al
lea rcx, str._list
xor r8d, r8d
xor edx, edx
mov r15d, ebx
call fcn.14000feb0
test eax, eax
je 0x14000b96f
call fcn.14000c230
mov ebx, 1
jmp 0x14000bd46
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea rcx, str._diag
xor edx, edx
call fcn.14000feb0
test eax, eax
je 0x14000b993
call fcn.1400146b4
jmp 0x14000b965
mov r13d, 0x104
mov qword [rsp + 0x20], rbx
mov esi, 1
lea r8, [rsp + 0x50]
mov r9d, r13d
lea rcx, str._prv
mov edx, esi
call fcn.14000feb0
test eax, eax
je 0x14000b9d0
lea rcx, [rsp + 0x50]
call fcn.14000214c
cmp eax, 0x1f
sbb r15d, r15d
and r15d, eax
mov r9d, r13d
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x50]
mov edx, esi
lea rcx, str._dse
call fcn.14000feb0
test eax, eax
je 0x14000ba52
lea rcx, [rsp + 0x50]
call fcn.14000214c
xor r9d, r9d
mov dword [rsp + 0x20], 2
mov r8d, r12d
mov edx, r14d
mov ecx, r15d
mov r13d, eax
call fcn.14000c7a8
mov rsi, rax
test rax, rax
je 0x14000bd46
mov rcx, qword [rax + 0x40]
cmp qword [rcx + 0x40], rbx
je 0x14000ba4a
mov ecx, r12d
call fcn.14000551c
test rax, rax
je 0x14000ba4a
mov rdi, qword [rsi + 0x40]
mov r8, rax
mov edx, r13d
mov rcx, rsi
call qword [rdi + 0x40]
mov ebx, eax
mov rcx, rsi
jmp 0x14000bd41
lea rax, [rbp + 0x7e0]
mov r9d, r13d
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov edx, esi
lea rcx, str._map
call fcn.14000feb0
test eax, eax
je 0x14000bc72
cmp dword [rbp + 0x7e0], ebx
je 0x14000bd46
mov r9d, r13d
mov qword [rsp + 0x20], rbx
lea r8, [rbp + 0x160]
mov edx, esi
lea rcx, str._scv
mov r14d, esi
call fcn.14000feb0
test eax, eax
je 0x14000bac5
lea rcx, [rbp + 0x160]
call fcn.14000214c
mov r14d, eax
lea ecx, [rax - 1]
cmp ecx, 3
cmova r14d, esi
xor eax, eax
mov dword [rbp + 0x7e0], ebx
lea rdi, [rbp + 0x370]
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rbp + 0x7e0]
mov r9d, r13d
lea rcx, str._drvn
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x370]
mov edx, esi
call fcn.14000feb0
mov eax, dword [rbp + 0x7e0]
lea rdi, [rbp + 0x580]
neg eax
mov dword [rbp + 0x7e0], ebx
lea rax, [rbp + 0x370]
mov ecx, 0x208
sbb r13, r13
lea r8, [rbp + 0x580]
and r13, rax
mov r9d, 0x104
xor eax, eax
mov edx, esi
rep stosb byte [rdi], al
lea rax, [rbp + 0x7e0]
lea rcx, str._drvr
mov qword [rsp + 0x20], rax
call fcn.14000feb0
mov eax, dword [rbp + 0x7e0]
lea rcx, [rbp + 0x580]
neg eax
sbb rax, rax
and rax, rcx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rax
call qword [sym.imp.ntdll.dll_RtlDoesFileExists_U]
test al, al
je 0x14000bd46
cmp r14d, 3
jne 0x14000bb8d
test r13, r13
je 0x14000bd46
lea rdx, [rsp + 0x50]
mov dword [rbp + 0x7e0], 2
lea rcx, [rsp + 0x38]
mov qword [rbp + 0x7e8], rbx
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea r9, [rbp + 0x7e8]
xor ecx, ecx
lea r8, [rsp + 0x38]
lea rdx, [rbp + 0x7e0]
call qword [sym.imp.ntdll.dll_LdrLoadDll]
test eax, eax
js 0x14000bd46
mov rcx, qword [rbp + 0x7e8]
test rcx, rcx
je 0x14000bd46
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x14000bd46
mov rsi, qword [rbp + 0x7e8]
test rsi, rsi
je 0x14000bd46
mov edx, dword [rbp + 0x7d0]
mov r9d, r14d
mov r8d, r12d
mov dword [rsp + 0x20], ebx
mov ecx, r15d
call fcn.14000c7a8
mov rdi, rax
test rax, rax
je 0x14000bc64
cmp r14d, 3
jne 0x14000bc4d
test r13, r13
je 0x14000bc37
lea rcx, [rax + 0x54]
mov rdx, r13
call fcn.14000e690
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x14000bc4d
lea rcx, [rdi + 0x260]
call fcn.14000e690
mov rax, qword [rdi + 0x40]
mov rdx, rsi
mov rcx, rdi
call qword [rax + 0x38]
mov rcx, rdi
mov ebx, eax
call fcn.14000ccec
mov rcx, rsi
call qword [sym.imp.ntdll.dll_LdrUnloadDll]
jmp 0x14000bd46
mov r9d, r13d
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x50]
mov edx, esi
lea rcx, [0x14004da60]
call fcn.14000feb0
lea r8, [rsp + 0x50]
test eax, eax
je 0x14000bcf8
movzx edx, word [rsp + 0x50]
mov rdi, rbx
jmp 0x14000bcc0
lea eax, [rdx - 0x30]
cmp ax, 9
ja 0x14000bcc5
movzx eax, dx
lea rdi, [rdi + rdi*4]
add r8, 2
lea rdi, [rdi - 0x18]
lea rdi, [rax + rdi*2]
movzx edx, word [r8]
test dx, dx
jne 0x14000bca0
xor r9d, r9d
mov dword [rsp + 0x20], esi
mov r8d, r12d
mov edx, r14d
mov ecx, r15d
call fcn.14000c7a8
mov rsi, rax
test rax, rax
je 0x14000bd46
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.14000d10c
mov rcx, rsi
jmp 0x14000bd3f
mov r9d, r13d
mov qword [rsp + 0x20], rbx
mov edx, esi
lea rcx, str._pse
call fcn.14000feb0
test eax, eax
je 0x14000bd46
xor r9d, r9d
mov dword [rsp + 0x20], esi
mov r8d, r12d
mov edx, r14d
mov ecx, r15d
call fcn.14000c7a8
mov rdi, rax
test rax, rax
je 0x14000bd46
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.14000cfc0
mov rcx, rdi
mov ebx, eax
call fcn.14000ccec
mov eax, ebx
mov rbx, qword [rsp + 0x8d8]
add rsp, 0x890
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret