Function at 0x180002ce0
Capabilities:
Access peb ldr_data
Check os version
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r14, rdx
mov ebp, ecx
test ecx, ecx
je 0x1800030da
mov rdi, qword [0x180005010]
mov r12d, 0x5a4d
test rdi, rdi
jne 0x180002e13
cmp qword [0x180005030], rdi
je 0x180002d36
cmp qword [0x180005038], rdi
je 0x180002d36
cmp qword [0x180005040], rdi
jne 0x180002e13
xor eax, eax
lea rdi, [0x180005010]
mov ecx, 0x38
rep stosb byte [rdi], al
mov rax, qword gs:[0x60]
test rax, rax
je 0x1800030da
cmp dword [rax + 0x118], 0xa
jne 0x1800030da
mov rax, qword [rax + 0x18]
mov rcx, qword [rax + 0x20]
mov rdi, qword [rcx]
sub rdi, 0x10
je 0x1800030da
mov rdi, qword [rdi + 0x30]
mov qword [0x180005010], rdi
mov qword [0x180005018], rdi
cmp word [rdi], r12w
jne 0x1800030da
movsxd rcx, dword [rdi + 0x3c]
add rcx, rdi
mov qword [0x180005020], rcx
cmp dword [rcx], 0x4550
jne 0x1800030da
mov edx, dword [rcx + 0x88]
add rdx, rdi
mov qword [0x180005028], rdx
je 0x1800030da
cmp dword [rdx + 0x10], 0
je 0x1800030da
mov ecx, dword [rdx + 0x1c]
add rcx, rdi
mov qword [0x180005030], rcx
mov r8d, dword [rdx + 0x20]
add r8, rdi
mov qword [0x180005038], r8
mov edx, dword [rdx + 0x24]
add rdx, rdi
mov qword [0x180005040], rdx
test rcx, rcx
je 0x1800030da
test r8, r8
je 0x1800030da
test rdx, rdx
je 0x1800030da
mov rax, qword [0x180005028]
mov qword [rsp + 0x40], rbx
xor ebx, ebx
lea r15d, [rbx + 1]
cmp dword [rax + 0x14], ebx
jbe 0x18000300c
mov qword [rsp + 0x48], rsi
mov rax, qword [0x180005038]
mov ecx, dword [rax + rbx*4]
add rcx, rdi
call fcn.180003d20
cmp eax, ebp
jne 0x180002eac
mov dword [r14], ebp
mov rax, qword [0x180005040]
movzx ecx, word [rax + rbx*2]
mov rax, qword [0x180005030]
mov edx, dword [rax + rcx*4]
add rdx, qword [0x180005010]
mov qword [r14 + 8], rdx
movzx eax, byte [rdx]
cmp al, 0x4c
jne 0x180002e9e
cmp byte [rdx + 1], 0x8b
jne 0x180002ea6
cmp byte [rdx + 2], 0xd1
jne 0x180002ea6
cmp byte [rdx + 3], 0xb8
jne 0x180002ea6
cmp byte [rdx + 6], 0
jne 0x180002eac
cmp byte [rdx + 7], 0
jne 0x180002eac
movzx ecx, byte [rdx + 5]
movzx eax, byte [rdx + 4]
jmp 0x180002ffe
cmp al, 0xe9
je 0x180002f6f
cmp byte [rdx + 3], 0xe9
je 0x180002eca
mov rax, qword [0x180005028]
inc ebx
cmp ebx, dword [rax + 0x14]
jae 0x180003007
mov rdi, qword [0x180005010]
jmp 0x180002e33
movzx ecx, r15w
mov r8d, 0x1f4
nop dword [rax]
nop dword [rax + rax]
movzx edi, cx
mov eax, edi
shl eax, 5
add rax, rdx
cmp byte [rax], 0x4c
jne 0x180002f0e
cmp byte [rax + 1], 0x8b
jne 0x180002f0e
cmp byte [rax + 2], 0xd1
jne 0x180002f0e
cmp byte [rax + 3], 0xb8
jne 0x180002f0e
cmp byte [rax + 6], 0
jne 0x180002f0e
cmp byte [rax + 7], 0
je 0x180002f4b
mov eax, edi
neg eax
shl eax, 5
cdqe
add rax, rdx
cmp byte [rax], 0x4c
jne 0x180002f3d
cmp byte [rax + 1], 0x8b
jne 0x180002f3d
cmp byte [rax + 2], 0xd1
jne 0x180002f3d
cmp byte [rax + 3], 0xb8
jne 0x180002f3d
cmp byte [rax + 6], 0
jne 0x180002f3d
cmp byte [rax + 7], 0
je 0x180002f5d
inc cx
cmp cx, r8w
jbe 0x180002ee0
jmp 0x180003007
movzx ecx, byte [rax + 4]
movzx eax, byte [rax + 5]
sub ecx, edi
shl eax, 8
jmp 0x180003001
movzx ecx, byte [rax + 4]
movzx eax, byte [rax + 5]
add ecx, edi
shl eax, 8
jmp 0x180003001
movzx ecx, r15w
mov r8d, 0x1f4
nop dword [rax]
movzx edi, cx
mov eax, edi
shl eax, 5
add rax, rdx
cmp byte [rax], 0x4c
jne 0x180002fae
cmp byte [rax + 1], 0x8b
jne 0x180002fae
cmp byte [rax + 2], 0xd1
jne 0x180002fae
cmp byte [rax + 3], 0xb8
jne 0x180002fae
cmp byte [rax + 6], 0
jne 0x180002fae
cmp byte [rax + 7], 0
je 0x180002fe8
mov eax, edi
neg eax
shl eax, 5
cdqe
add rax, rdx
cmp byte [rax], 0x4c
jne 0x180002fdd
cmp byte [rax + 1], 0x8b
jne 0x180002fdd
cmp byte [rax + 2], 0xd1
jne 0x180002fdd
cmp byte [rax + 3], 0xb8
jne 0x180002fdd
cmp byte [rax + 6], 0
jne 0x180002fdd
cmp byte [rax + 7], 0
je 0x180002ff4
inc cx
cmp cx, r8w
jbe 0x180002f80
jmp 0x180003007
movzx ecx, byte [rax + 5]
movzx eax, byte [rax + 4]
sub eax, edi
jmp 0x180002ffe
movzx ecx, byte [rax + 5]
movzx eax, byte [rax + 4]
add eax, edi
shl ecx, 8
or ecx, eax
mov dword [r14 + 4], ecx
mov rsi, qword [rsp + 0x48]
cmp qword [r14 + 8], 0
mov rbx, qword [rsp + 0x40]
je 0x1800030da
cmp dword [r14 + 4], 0
je 0x1800030da
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdi, qword [rcx + 0x20]
test rdi, rdi
je 0x1800030b9
nop dword [rax]
cmp word [rdi + 0x48], 0
je 0x1800030b9
mov rcx, qword [rdi + 0x50]
call fcn.180003d20
cmp eax, 0x1caf0b12
je 0x180003067
mov rcx, qword [rdi + 0x50]
call fcn.180003d20
cmp eax, 0x27f12bda
jne 0x1800030b1
mov rcx, qword [rdi + 0x20]
cmp word [rcx], r12w
jne 0x1800030d2
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1800030d2
mov edx, dword [rax + rcx + 0x2c]
mov r8d, dword [rax + rcx + 0x1c]
add rdx, rcx
test r8, r8
je 0x1800030b1
mov rcx, rdx
cmp byte [rcx], 0xf
jne 0x1800030a3
cmp byte [rcx + 1], 5
jne 0x1800030a3
cmp byte [rcx + 2], 0xc3
je 0x1800030c9
inc rcx
mov rax, rcx
sub rax, rdx
cmp rax, r8
jb 0x180003092
mov rdi, qword [rdi]
test rdi, rdi
jne 0x180003040
xor r15d, r15d
cmp qword [r14 + 0x10], r15
setne r15b
mov eax, r15d
jmp 0x1800030dc
mov qword [r14 + 0x10], rcx
mov eax, r15d
jmp 0x1800030dc
xor r15d, r15d
mov eax, r15d
jmp 0x1800030dc
xor eax, eax
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret