Function at 0x140037dd4
Capabilities:
Access peb ldr_data

Disassembly:
push rbx
add dword [rax], eax
add byte [rax + rdx*8], dh
mov dword [rsp + 0x158], r9d
mov byte [rsp + 0x80], al
mov qword [rsp + 0x160], 0x44c0fd20
mov al, byte [rsp + 0x153]
add al, 0xb6
mov byte [rsp + 0x81], al
mov al, byte [rsp + 0x153]
xor al, 0xda
mov byte [rsp + 0x82], al
and ebp, 0x7eca5326
mov dword [rsp + 0x158], ebp
mov al, byte [rsp + 0x153]
xor al, 0xd2
mov byte [rsp + 0x83], al
mov al, byte [rsp + 0x153]
add al, 0xae
mov byte [rsp + 0x84], al
mov qword [rsp + 0x160], 0x4e8434fb
mov byte [rsp + 0x157], 0xc2
mov al, byte [rsp + 0x153]
mov dil, 0xec
sub dil, al
mov byte [rsp + 0x85], dil
mov al, byte [rsp + 0x153]
mov word [rsp + 0x154], 0x13de
mov dil, 0x22
sub dil, al
mov al, bl
or al, 0x55
mov byte [rsp + 0x157], al
mov byte [rsp + 0x86], dil
mov word [rsp + 0x154], si
mov al, byte [rsp + 0x153]
mov word [rsp + 0x154], 0
add al, 0xae
mov qword [rsp + 0x160], 0x7effff9f
mov byte [rsp + 0x87], al
mov r14, r8
xor r14, 0xeb1f6dd
mov al, byte [rsp + 0x153]
mov dil, 0x2a
sub dil, al
mov qword [rsp + 0x160], r14
mov byte [rsp + 0x88], dil
mov al, byte [rsp + 0x153]
add al, 0x42
mov byte [rsp + 0x89], al
mov r9d, dword [rsp + 0x58]
and r9d, 0x73f6092b
mov al, byte [rsp + 0x153]
mov dword [rsp + 0x158], r9d
add al, 0x5c
mov byte [rsp + 0x8a], al
movaps xmm0, xmmword [str.ntdll.dlkernel32]
movaps xmmword [rsp + 0xc0], xmm0
mov r15w, word [rsp + 0x15e]
mov r9d, dword [rsp + 0x58]
mov dword [rsp + 0x158], r9d
add r15w, 0x732f
mov word [rsp + 0xd0], r15w
mov byte [rsp + 0x157], bl
mov al, 0x40
sub al, bl
mov r15w, word [rsp + 0x15e]
mov byte [rsp + 0x157], al
add r15w, 0x72c3
mov word [rsp + 0xd2], r15w
mov r14, r8
add r14, 0x643f40ab
mov r15w, word [rsp + 0x15e]
add r15w, 0x72dd
mov qword [rsp + 0x160], r14
mov word [rsp + 0xd4], r15w
mov dword [rsp + 0x158], 0x2caf1f63
mov word [rsp + 0xf6], 0
mov qword [rsp + 0xee], 0
mov qword [rsp + 0xe6], 0
mov qword [rsp + 0xde], 0
mov qword [rsp + 0xd6], 0
mov byte [rsp + 0x157], bl
movsx ebp, byte [rsp + 0x9c]
mov r15w, bp
mov word [rsp + 0xf8], r15w
mov dword [rsp + 0x158], r9d
movsx ebp, byte [rsp + 0x9d]
mov r15w, bp
mov word [rsp + 0xfa], r15w
movsx ebp, byte [rsp + 0x9e]
mov r15w, bp
mov word [rsp + 0xfc], r15w
mov al, bl
or al, 0xa6
mov byte [rsp + 0x157], al
mov al, byte [rsp + 0x9f]
movsx ebp, al
mov r15w, bp
mov word [rsp + 0xfe], r15w
mov ebp, dword [rsp + 0x14c]
xor ebp, 0x1e3c0111
add r9d, 0x63680577
mov dword [rsp + 0x158], r9d
mov r9d, dword [rsp + 0x58]
add r9d, r9d
mov r14, qword gs:[ebp]
mov dword [rsp + 0x158], r9d
mov dil, bl
and dil, 0x82
mov byte [rsp + 0x157], dil
mov r15w, si
or r15w, r15w
mov rax, qword [r14 + 0x60]
mov word [rsp + 0x154], r15w
mov r14, r8
or r14, 0x63ddad90
mov qword [rsp + 0x160], r14
sub dl, bl
mov rax, qword [rax + 0x18]
mov byte [rsp + 0x157], dl
mov r14, rax
add r14, 0x20
mov byte [rsp + 0x157], 0xff
mov rax, qword [rax + 0x20]
mov dword [rsp + 0x158], 0x301b2437
sub rcx, r8
mov qword [rsp + 0x160], rcx
mov qword [rsp + 0x138], 0
cmp rax, r14
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r8
mov byte [rsp + 0x3f], bl
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x28], r11
mov word [rsp + 0x26], si
je 0x140038346
jmp 0x14003845d
mov ax, 0x8d3d
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x160], rcx
mov rdx, qword [rsp + 0xb0]
mov r8w, word [rdx]
sub ax, word [rsp + 0x15e]
mov rdx, qword [rsp + 0xb8]
mov r9d, dword [rsp + 0x58]
mov dword [rsp + 0x158], r9d
mov qword [rsp + 0x138], rdx
cmp r8w, ax
je 0x140038346
jmp 0x14003823c
mov rax, qword [rsp + 0x140]
xor rax, 0xf0db322
mov cx, word [rsp + 0x26]
add cx, 0x3f40
mov dx, word [rsp + 0x5e]
mov word [rsp + 0x154], cx
movzx r8d, dx
mov r9d, r8d
mov qword [rsp + 0x70], r9
mov qword [rsp + 0x108], rax
jmp 0x140038561
lea rax, [rsp + 0xc0]
mov cx, word [rsp + 0x15e]
mov dl, byte [rsp + 0x3f]
xor dl, 0x2b
xor cx, 0x3dbc
mov r8, qword [rsp + 0x68]
mov byte [rsp + 0x157], dl
mov r9w, word [rsp + 0x15e]
mov r10, qword [rsp + 0x40]
and r10, r10
shl r8, 1
add rax, r8
mov qword [rsp + 0x160], r10
add r9w, 0xa0ec
mov qword [rsp + 0xb0], rax
mov word [rsp + 0x7c], cx
mov r11d, dword [rsp + 0x58]
xor r11d, 0xffffffff
mov dword [rsp + 0x158], r11d
cmp r9w, word [rsp + 0x7c]
jne 0x140038135
mov rax, qword [rsp + 0x100]
mov rax, qword [rax]
mov byte [rsp + 0x157], 0x2a
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x138], 0
mov rcx, qword [rsp + 0x48]
cmp rax, rcx
je 0x140038346
mov ax, 0xdbe3
mov byte [rsp + 0x157], 0xbb
mov cx, word [rsp + 0x26]
sub ax, cx
mov rdx, qword [rsp + 0x60]
mov word [rsp + 0x154], ax
mov qword [rsp + 0x100], rdx
mov r8b, byte [rsp + 0x3f]
add r8b, 0x1d
mov rdx, qword [rsp + 0x140]
add rdx, 0x4cd4c33e
mov r9, qword [rsp + 0x128]
mov byte [rsp + 0x157], r8b
mov r10, qword [rsp + 0x100]
mov r10, qword [r10 + 0x20]
mov r11, qword [rsp + 0x40]
mov qword [rsp + 0x160], r11
mov qword [rsp + 0xb8], r10
mov r10, qword [rsp + 0x100]
mov r8b, byte [rsp + 0x3f]
and r8b, 0x10
mov byte [rsp + 0x157], r8b
xor r11, r11
mov qword [rsp + 0x160], r11
mov ax, word [r10 + 0x48]
mov word [rsp + 0x136], ax
imul ax, cx, 0x8f91
mov r10, qword [rsp + 0x100]
mov word [rsp + 0x154], ax
add r10, 0x50
mov qword [rsp + 0x118], r10
mov word [rsp + 0x154], 0xf148
cmp r9, rdx
jbe 0x140038375
jmp 0x14003846c
mov ax, 0x72cb
mov rcx, qword [rsp + 0x138]
mov dx, word [rsp + 0x26]
sub ax, dx
mov word [rsp + 0x154], ax
mov rax, rcx
add rsp, 0x168
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov al, byte [rsp + 0x3f]
or al, 0
mov byte [rsp + 0x157], al
mov rcx, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0xb8]
mov r8, qword [rsp + 0x70]
mov r9, qword [rsp + 0xa0]
mov al, byte [rsp + 0x3f]
mov byte [rsp + 0x157], al
mov qword [rsp + 0x108], r9
mov qword [rsp + 0x138], rdx
mov dword [rsp + 0x158], 0xb96e96c0
cmp rcx, r8
jb 0x140038561
jmp 0x140038346
movzx ecx, word [rsp + 0x126]
call fcn.14003e870
mov dx, word [rsp + 0x26]
or dx, 0x8bc6
mov ecx, dword [rsp + 0x14c]
add ecx, 0x27f7b613
mov r8, qword [rsp + 0x68]
mov word [rsp + 0x154], dx
cmp word [rsp + r8*2 + 0xc0], ax
sete r9b
and r9b, 1
mov byte [rsp + 0x7f], r9b
mov r10d, dword [rsp + 0x58]
imul r11d, r10d, 0x5327ab6f
mov dword [rsp + 0x158], r11d
mov r11d, dword [rsp + 0xac]
mov qword [rsp + 0x60], 0
mov r9b, byte [rsp + 0x3f]
xor r9b, r9b
mov byte [rsp + 0x157], r9b
cmp r11d, ecx
jne 0x1400384f2
jmp 0x14003826e
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x60], rax
jmp 0x14003826e
mov ax, 0x8d3e
mov rcx, qword [rsp + 0x118]
mov rcx, qword [rcx]
mov word [rsp + 0x154], 0x5efe
sub ax, word [rsp + 0x15e]
mov qword [rsp + 0x110], rcx
mov dx, word [rsp + 0x136]
mov r8b, byte [rsp + 0x3f]
and r8b, 0x4d
mov byte [rsp + 0x157], r8b
mov cx, ax
shr dx, cl
mov word [rsp + 0x5e], dx
mov cl, byte [rsp + 0x3f]
add cl, 0x8d
mov byte [rsp + 0x157], cl
mov ax, word [rsp + 0x5e]
mov dx, word [rsp + 0x15e]
xor dx, 0x8d3d
mov cl, byte [rsp + 0x3f]
mov byte [rsp + 0x157], cl
cmp ax, dx
je 0x14003823c
jmp 0x140038186
mov eax, 0xf0db323
mov ecx, eax
mov eax, dword [rsp + 0x58]
add eax, 0x59227997
mov dword [rsp + 0x158], eax
mov eax, dword [rsp + 0x58]
xor eax, 0x61575154
mov rdx, qword [rsp + 0x140]
mov dword [rsp + 0x158], eax
mov r8b, byte [rsp + 0x3f]
add r8b, 0xe1
sub rcx, rdx
mov byte [rsp + 0x157], r8b
add rcx, qword [rsp + 0x68]
mov r9w, word [rsp + 0x26]
mov word [rsp + 0x154], r9w
mov qword [rsp + 0xa0], rcx
test byte [rsp + 0x7f], 1
jne 0x140038375
jmp 0x14003823c
mov ax, word [rsp + 0x15e]
xor ax, 0x8d3d
mov rcx, qword [rsp + 0x108]
mov qword [rsp + 0x68], rcx
mov rcx, qword [rsp + 0x110]
mov rdx, qword [rsp + 0x68]
mov r8w, word [rcx + rdx*2]
mov word [rsp + 0x126], r8w
cmp word [rsp + 0x126], ax
je 0x1400381c4
jmp 0x1400383d3