Function at 0x1408ac9b6
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
cmc
cmp r11b, 0xbd
mov qword [rax + 8], rcx
cmp r9b, 0x26
cmp bp, di
test r14b, r11b
push rbp
adc bpl, 0x64
clc
rcl bp, 0xd1
push rbx
bsf bp, si
xchg bpl, bpl
add bp, 0x872
push rsi
adc rbp, rdi
push rdi
push r12
ror rbp, cl
adc bp, 0x3b86
push r13
btc bp, 0x8f
movsx rbp, r14w
btr bp, r14w
push r14
bt bp, 0x3b
movzx bp, r8b
push r15
lea rbp, [rax - 0xae8]
sub rsp, 0xba8
jmp 0x1408aca23
mov qword [rbp - 0x40], 0xfffffffffffffffe
movaps xmmword [rax - 0x58], xmm6
mov rbx, rcx
rcl r8d, 0x68
ror ch, cl
sub edx, edx
movsxd r8, r11d
movzx ecx, ax
mov r8d, 0x248
mov cl, r14b
lea rcx, [rbp + 0x160]
jmp 0x1408aca55
call fcn.1408b999b
xor r14d, r14d
cwd
setne ch
mov qword [rsp + 0x40], r14
xchg cx, dx
cqo
mov rdx, rbx
mov cx, r12w
movsx cx, r10b
cmovae cx, dx
lea rcx, [rbp - 0x50]
jmp 0x1408aca85
call 0x1403f6821
movaps xmm6, xmmword [rbp - 0x50]
movaps xmmword [rsp + 0x50], xmm6
movd edi, xmm6
movzx edx, di
shr dx, 1
lea esi, [r14 + 1]
cmp r9d, 0x24b156a1
test r10b, r12b
sub dx, si
jmp 0x1408acab4
je 0x1408acb4c
mov rcx, qword [rbp - 0x48]
rol ax, cl
not al
movzx eax, dx
cmp word [rcx + rax*2], 0x5c
jmp 0x1408acad0
je 0x1408acb07
cmp word [rcx + rax*2], 0x2f
jmp 0x1408acae0
je 0x1408acb07
mov eax, 0xffff
jmp 0x1408acaf4
add dx, ax
jmp 0x1408acafc
jne 0x1408acac3
jmp 0x1408acb4c
movzx eax, dx
lea rcx, [rcx + rax*2]
add rcx, 2
mov qword [rsp + 0x58], rcx
cmc
test r13b, 0xeb
add dx, dx
sub di, dx
cmc
jmp 0x1408acb2f
sub di, 2
jmp 0x1408acb38
mov word [rsp + 0x52], di
mov word [rsp + 0x50], di
jmp 0x1408acb47
movaps xmm6, xmmword [rsp + 0x50]
cmp qword [0x140074d88], r14
jmp 0x1408acb58
jne 0x1408acbe0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
not r9b
movzx r9, cx
cmovbe dx, r14w
mov qword [rbp + 0xb00], r14
cdq
lea r9, [rbp + 0xb00]
setnp dh
movsx rdx, bp
mov edx, 0x1e64b2a0
jmp 0x1408acb9e
mov rcx, qword [rcx + 0x30]
jmp 0x1408acba7
call fcn.140007fc0
mov rcx, qword [rbp + 0xb00]
btc dx, 0x4f
test eax, eax
setns dl
mov r8w, dx
cmovs rcx, r14
cmp sil, bpl
bsr edx, ebx
btr r8d, 0x65
mov qword [0x140074d88], rcx
bt dx, 0x36
cmovl r8, r8
lea r8, [rsp + 0x40]
cwd
mov rdx, qword [rsp + 0x58]
cmp r14d, r8d
xor ecx, ecx
jmp 0x1408acbf6
call 0x14044641c
test eax, eax
jmp 0x1408acc03
je 0x1408acc18
mov rax, qword [rsp + 0x40]
jmp 0x1408acc13
jmp 0x1408ad6ae
lea rdx, [0x140047c24]
mov ecx, esi
call 0x1402852f2
mov qword [rsp + 0x70], rax
test rax, rax
jmp 0x1408acc34
jne 0x1408acc47
mov rbx, r14
jmp 0x1408acc42
jmp 0x1408ad68f
mov rdx, rbx
lea rcx, [rbp + 0x10]
jmp 0x1408acc53
call fcn.1400020ec
lea rax, [0x1400757e0]
movzx ecx, r8w
mov qword [rbp + 0x170], rax
movsx rcx, r12w
cmovno ecx, r9d
xchg rcx, rax
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x178], rax
bswap ecx
movsx cx, ah
movzx rcx, r14w
lea rcx, [rbp + 0x160]
jmp 0x1408acc95
call 0x14066c25b
mov r13d, r14d
mov dword [rbp + 0xb00], r14d
movzx cx, r11b
movzx ebx, word [rsp + 0x50]
test r14b, spl
shr rbx, 1
cmc
mov qword [rsp + 0x50], rbx
mov r15d, 0x208
lea rdi, [rbp + reloc.COMCTL32.dll_RemoveWindowSubclass]
movsx ecx, ax
test sil, 5
bt cx, 0x2a
sub eax, eax
mov rcx, r15
jmp 0x1408accde
rep stosb byte [rdi], al
bswap cx
movsxd rcx, r10d
mov eax, dword [rbp + 0x40]
movzx cx, dil
not cx
mov dword [rsp + 0x60], eax
movsxd rcx, r9d
movsx rcx, r11w
movzx ecx, r10w
mov ecx, 0x9c40
call 0x14074088f
mov r15, rax
test rax, rax
jmp 0x1408acd16
je 0x1408ad542
rdtsc
cmp bh, ch
shl rdx, 0x20
or rax, rdx
cmova cx, bx
movzx ecx, bx
movzx rcx, r12w
mov rcx, rax
call 0x14046464d
mov rcx, r15
jmp 0x1408acd43
call 0x1408ac80a
mov r12, rax
cmp rsi, r13
clc
jmp 0x1408acd54
test rax, rax
jmp 0x1408acd5c
je 0x1408ad2a5
mov rdi, r12
sub rdi, r14
jmp 0x1408acd6d
call 0x1408718de
cdqe
bsr r13w, r9w
sub edx, edx
adc r13d, ebx
btc r13, rbp
div rdi
rcl ax, 0x4b
not r13w
rcr r13, 0x76
add rdx, r14
shr r13b, 0x59
mov r13, qword [r15 + rdx*8]
bsf ax, r10w
bts ax, bp
mov rax, qword [r15 + r14*8]
mov qword [r15 + rdx*8], rax
cmp cl, dil
mov qword [r15 + r14*8], r13
or rsi, 0xffffffffffffffff
sub edi, edi
inc rsi
test r14b, 0x9b
clc
cmp word [r13 + rsi*2], di
jne 0x1408acdba
cmp rsi, rbx
jmp 0x1408acdd7
jbe 0x1408ad252
mov rcx, r13
jmp 0x1408acde5
call 0x14021f1ba
test rax, rax
jmp 0x1408acdf3
jne 0x1408ad252
mov qword [rsp + 0x68], rdi
mov r9b, r10b
mov r8b, 0x10
movzx r9, r9w
lea r9, [rbp + 0xb08]
movsx r8, r14w
not r8w
movsx r8d, r12w
lea r8, [rsp + 0x68]
jmp 0x1408ace25
call fcn.14000af9c
cmp dword [rbp + 0xb08], edi
jge 0x1408ace3e
mov al, dil
jmp 0x1408acef8
mov rdx, r13
not ecx
cmovge rcx, rbp
movsxd rcx, r11d
lea rcx, [rbp - 0x38]
jmp 0x1408ace53
call 0x14009c35d
mov dword [rbp - 0x28], 0x30
mov al, r10b
mov rax, qword [rsp + 0x68]
mov qword [rbp - 0x20], rax
movsx ax, cl
movzx eax, r11w
movsx rax, r8w
mov dword [rbp - 0x10], 0x40
lea rax, [rbp - 0x38]
jmp 0x1408ace88
mov qword [rbp - 0x18], rax
jmp 0x1408ace91
xorps xmm0, xmm0
movdqu xmmword [rbp - 8], xmm0
lea r8, [rbp - 0x28]
mov edx, 5
mov ch, 0xc2
lea rcx, [rsp + 0x78]
jmp 0x1408aceaf
call fcn.140341723
mov edi, eax
movzx cx, r8b
xchg ecx, ecx
mov dword [rbp + 0xb08], eax
mov rcx, qword [rsp + 0x78]
jmp 0x1408acecd
call fcn.140853c76
mov rcx, qword [rsp + 0x68]
jmp 0x1408acedc
call fcn.14013a83f
sub eax, eax
cmc
test edi, edi
setns al
jmp 0x1408acef2
sub edi, edi
test r15b, 0xc4
test al, al
jmp 0x1408aceff
jne 0x1408ad252
mov ebx, 0x104
mov edx, ebx
xchg cx, cx
lea rcx, [rbp + 0x880]
jmp 0x1408acf1b
call 0x14055412b
lea r8, [0x14005bf70]
jmp 0x1408acf2f
mov edx, ebx
lea rcx, [rbp + 0x880]
jmp 0x1408acf3d
call 0x1404b4a48
mov r8, r13
mov edx, ebx
setg cl
bswap rcx
lea rcx, [rbp + 0x880]
call 0x140336c55
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
neg r8b
mov dword [rsp + 0x20], 3
sub r9d, r9d
mov r8w, 0x7c0b
cwd
mov edx, 0x80000000
setge ch
lea r8d, [r9 + 1]
lea rcx, [rbp + 0x880]
jmp 0x1408acf95
call 0x1403ebe83
mov rbx, rax
cmp rax, 0xffffffffffffffff
jmp 0x1408acfa7
je 0x1408ad244
sub r9d, r9d
movzx ecx, r13w
xchg ch, cl
btr rcx, rsi
xor r8d, r8d
xor cl, r8b
mov ch, 1
sub edx, edx
mov cl, r8b
cmovp ecx, eax
mov rcx, rax
call 0x14074cb4a
cmp eax, 0xffffffff
jmp 0x1408acfdc
je 0x1408ad1fd
mov qword [rsp + 0x20], rdi
setp r8b
lea r9, [rbp + 0xaf8]
movsx r8w, r13b
cqo
movsx r8d, r10w
mov r8d, 0x40
setg cl
jmp 0x1408ad012
lea rdx, [rbp + 0x50]
movsx ecx, r13w
mov rcx, rbx
call 0x14058a691
test eax, eax
jmp 0x1408ad02a
je 0x1408ad1fd
cmp dword [rbp + 0xaf8], 0x40
jmp 0x1408ad03c
jne 0x1408ad1fd
mov eax, 0x5a4d
clc
cmc
cmp word [rbp + 0x50], ax
jmp 0x1408ad052
jne 0x1408ad1fd
mov edx, dword [rbp + 0x8c]
cmc
test edx, edx
jmp 0x1408ad066
je 0x1408ad1fd
xor r9d, r9d
sub r8d, r8d
not cl
bswap cx
mov rcx, rbx
jmp 0x1408ad07f
call 0x1404c068b
cmp eax, 0xffffffff
jmp 0x1408ad08d
je 0x1408ad1fd
mov qword [rsp + 0x20], rdi
cdq
movzx r9, r8w
jmp 0x1408ad0a2
lea r9, [rbp + 0xaf8]
cdq
bswap rdx
mov r8d, 0x108
lea rdx, [rbp + 0x50]
xchg cx, cx
mov rcx, rbx
mov rcx, rbx
jmp 0x1408ad0c5
call 0x14085ae0c
test eax, eax
je 0x1408ad1fd
cmp dword [rbp + 0xaf8], 0x108
jne 0x1408ad1fd
cmp dword [rbp + 0x50], 0x4550
jmp 0x1408ad0ef
jne 0x1408ad1fd
mov eax, 0x8664
cmp word [rbp + 0x54], ax
jmp 0x1408ad103
jne 0x1408ad1fd
movzx eax, word [rbp + 0x66]
bts rcx, r14
sar ecx, 0x94
mov ecx, 0x2022
jmp 0x1408ad11e
and ax, cx
cmp ax, cx
jmp 0x1408ad129
jne 0x1408ad1fd
mov eax, 0x20b
cmp r13d, r8d
clc
cmp word [rbp + 0x68], ax
jne 0x1408ad1fd
movzx eax, word [rbp + 0xac]
sets ch
rol cx, 0x64
sar cl, 0xdf
sub ax, 2
mov ecx, 1
jmp 0x1408ad161
cmp ax, cx
jmp 0x1408ad169
ja 0x1408ad1fd
test byte [rbp + 0xae], 0x40
jmp 0x1408ad17b
je 0x1408ad1fd
cmp dword [rbp + 0x78], edi
jmp 0x1408ad189
je 0x1408ad1fd
cmp dword [rbp + 0xd4], 0x10
jmp 0x1408ad19b
jb 0x1408ad1fd
cmp dword [rbp + 0x148], edi
jmp 0x1408ad1ac
jne 0x1408ad1fd
cmp dword [rbp + 0x14c], edi
jmp 0x1408ad1bd
jne 0x1408ad1fd
cmp dword [rbp + 0xf0], edi
jmp 0x1408ad1ce
je 0x1408ad1fd
cmp dword [rbp + 0xf4], edi
jmp 0x1408ad1df
je 0x1408ad1fd
mov eax, dword [rsp + 0x60]
cmp r15b, spl
cmp dword [rbp + 0xa0], eax
jmp 0x1408ad1f7
jae 0x1408ad20a
mov edi, 1
movzx cx, bh
movzx ecx, r11w
mov rcx, rbx
jmp 0x1408ad212
call fcn.14070c6c3
test dil, dil
jmp 0x1408ad21f
jne 0x1408ad244
lea eax, [rsi + 1]
test r11d, 0x3a3b6926
jmp 0x1408ad234
cmp eax, 0x104
jmp 0x1408ad23e
jb 0x1408ad26f
mov rbx, qword [rsp + 0x50]
btr si, r9w
sete sil
mov esi, 1
clc
add r14, rsi
clc
cmp r14, r12
jmp 0x1408ad264
jae 0x1408ad297
jmp 0x1408acd62
mov r8, r13
cwd
bswap ecx
mov edx, 0x104
lea rcx, [rbp + reloc.COMCTL32.dll_RemoveWindowSubclass]
call 0x140297f14
mov esi, 1
movzx edi, r15w
mov dil, 0xec
btr r13d, r13d
mov r13d, dword [rbp + 0xb00]
xor dil, dl
bts di, ax
sub r14d, r14d
mov edi, r14d
cmp r10d, ecx
jmp 0x1408ad2b4
test r12, r12
jmp 0x1408ad2bc
je 0x1408ad2e6
mov rcx, qword [r15 + rdi*8]
jmp 0x1408ad2cb
call 0x14029f1e6
add rdi, rsi
cmp r14, rax
cmc
cmp rdi, r12
jmp 0x1408ad2e0
jb 0x1408ad2c2
mov rcx, r15
call 0x14053a99b
lea rax, [rbp + reloc.COMCTL32.dll_RemoveWindowSubclass]
or rdx, 0xffffffffffffffff
jmp 0x1408ad2ff
inc rdx
stc
cmc
cmp word [rax + rdx*2], r14w
jmp 0x1408ad30e
jne 0x1408ad2ff
mov r15d, 0x208
test edx, edx
jmp 0x1408ad321
je 0x1408ad554
lea rdi, [rbp - 0x80]
sub eax, eax
lea ecx, [rax + 0x30]
rep stosb byte [rdi], al
jmp 0x1408ad337
movdqu xmmword [rbp - 0x60], xmm6
lea rax, [rbp + reloc.COMCTL32.dll_RemoveWindowSubclass]
bsf di, r14w
mov qword [rbp - 0x78], rax
cmp r14b, sil
mov rdi, r15
add dx, dx
neg cx
ror dil, 0xa6
mov word [rbp - 0x80], dx
rcl cx, 0x76
or rdi, rax
mov word [rbp - 0x7e], r15w
movzx cx, dil
shl dil, cl
adc dl, bl
lea rdi, [rbp + 0x3b0]
adc cx, r11w
btc ecx, edi
sub eax, eax
mov ecx, 0x4d0
cwd
movsx edx, r15w
jmp 0x1408ad396
rep stosb byte [rdi], al
cdq
mov dword [rbp + 0x3e0], 0x100010
mov rax, qword [0x140074d88]
mov qword [rbp + 0x410], rax
mov qword [rbp + 0x420], 0x440
cqo
movsxd rcx, r14d
lea rdx, [rbp + 0x3b0]
movsx cx, bl
movsx rcx, r8w
jmp 0x1408ad3d5
mov rcx, 0xfffffffffffffffe
call fcn.140215146
test eax, eax
js 0x1408ad554
lea r8, [rbp - 0x80]
clc
movsx rdx, r12w
movsxd rdx, ebx
lea rdx, [0x140048638]
sub ecx, ecx
jmp 0x1408ad403
call 0x1404a2a90
mov rbx, qword gs:[0x30]
mov rdi, qword [rbx + 0x28]
btr r8w, di
ror r9b, cl
mov qword [rbx + 0x28], r14
dec r8w
bt r9w, r12w
bsr r9w, r10w
lea r9, [rsp + 0x40]
mov r8d, 0x774235cf
ror r8b, 0x26
lea r8, [rbp - 0x80]
cmp r13b, al
xor edx, edx
sub ecx, ecx
jmp 0x1408ad44f
call 0x140345615
mov esi, eax
mov qword [rbx + 0x28], rdi
shrd r8d, r10d, 0xa2
mov dword [rbp - 0x6c], eax
rdtsc
mov eax, 1
test r10b, 0x9b
mov dword [rbp - 0x70], eax
adc r8b, r11b
lea r8, [rbp - 0x80]
lea rdx, [0x140048638]
sub ecx, ecx
call 0x1407a7f87
lea rdi, [rbp + 0x3b0]
xor eax, eax
bswap edx
cqo
mov dh, 0x81
mov ecx, 0x4d0
movsx dx, bl
cmovae dx, ax
setb dh
rep stosb byte [rdi], al
setnp cl
movsxd rdx, r8d
movsx cx, r15b
mov dword [rbp + 0x3e0], 0x100010
mov qword [rbp + 0x410], r14
mov qword [rbp + 0x420], 0x400
cdq
cqo
lea rdx, [rbp + 0x3b0]
movsx cx, r14b
not ch
lea rcx, [rax - 2]
jmp 0x1408ad4ea
call fcn.1407c28ca
test esi, esi
js 0x1408ad554
mov rbx, qword [rsp + 0x40]
jmp 0x1408ad502
cmp dword [rbp + 0x198], r14d
jmp 0x1408ad50e
jne 0x1408ad595
test rbx, rbx
jmp 0x1408ad51c
je 0x1408ad564
mov rcx, rbx
call 0x140770926
mov rbx, r14
jmp 0x1408ad533
mov qword [rsp + 0x40], rbx
jmp 0x1408ad53d
jmp 0x1408ad564
mov r15d, 0x208
dec si
and esi, 0x58244e31
ror sil, cl
mov rbx, qword [rsp + 0x40]
sub sil, 0x3f
and rsi, 0x492575e8
mov esi, 1
cmp r11d, ebp
add r13d, esi
clc
mov dword [rbp + 0xb00], r13d
cmp r13d, 3
jmp 0x1408ad580
jae 0x1408ad595
mov rbx, qword [rsp + 0x50]
jmp 0x1408ad590
jmp 0x1408accc0
lea rdi, [rbp + reloc.COMCTL32.dll_RemoveWindowSubclass]
or ecx, edx
sub eax, eax
movzx ecx, r15w
not cx
bswap ecx
mov rcx, r15
rep stosb byte [rdi], al
sar dil, cl
mov rdi, qword [rbp + 0x10]
test r8b, al
test rdi, rdi
jmp 0x1408ad5c0
je 0x1408ad5dc
mov rcx, qword [rbp + 0x18]
clc
test rcx, rcx
je 0x1408ad5dc
rep stosb byte [rdi], al
mov rbx, qword [rsp + 0x40]
cmc
test rbx, rbx
jmp 0x1408ad5e4
jne 0x1408ad616
xor edx, edx
mov r8d, 0x800
mov rcx, qword [rbp + 0xaf0]
jmp 0x1408ad5fe
call 0x14008327a
mov rbx, rax
not cl
jmp 0x1408ad611
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x160]
jmp 0x1408ad622
call 0x140213809
mov rdx, qword [rbp + 0x10]
cmp r13b, r12b
test r12b, 0x27
cmp r10b, 0xb6
test rdx, rdx
jmp 0x1408ad63f
je 0x1408ad682
mov rcx, qword [rdx - 8]
test rcx, rcx
je 0x1408ad667
mov rdi, rdx
jmp 0x1408ad65a
xor eax, eax
jmp 0x1408ad661
rep stosb byte [rdi], al
mov cx, 0x110a
mov rcx, qword [rdx - 0x10]
call 0x14046507a
mov qword [rbp + 0x10], r14
mov ax, 0x17c7
mov al, dil
mov qword [rbp + 0x18], r14
sbb ax, bp
mov rax, qword [rsp + 0x70]
jmp 0x1408ad68f
test rax, rax
je 0x1408ad6a5
mov rcx, rax
jmp 0x1408ad6a0
call 0x1406e8ae7
mov rax, rbx
jmp 0x1408ad6ae
movaps xmm6, xmmword [rsp + 0xb90]
add rsp, 0xba8
xchg edi, r13d
pop r15
bswap esi
not di
setne r14b
pop r14
pop r13
pop r12
bswap ebx
xchg bpl, sil
pop rdi
pop rsi
setns bpl
movsx ebp, bx
not bpl
pop rbx
pop rbp
jmp 0x1408ad6e9
ret