Function at 0x1800128f0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov byte [rax + 0x20], r9b
mov qword [rax + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
and qword [rbp - 0x11], 0
xor r12b, r12b
mov rax, qword [rcx + 0x168]
mov r15b, r9b
xor rax, qword [0x18015d758]
mov rdi, r8
mov rsi, rdx
mov byte [rbp + 0x67], r12b
mov rbx, rcx
jne 0x180012a42
test r9b, r9b
jne 0x1800a3a14
cmp r8, qword [rcx + 0xb0]
jb 0x180012a42
mov r8, qword [rcx + 0xc0]
add r8, rdi
cmp r8, qword [rcx + 0xb8]
jb 0x180012a39
mov ecx, dword [rcx + 0x290]
mov rdx, qword [rbx + 0x220]
add ecx, 4
shr rdx, cl
cmp r8, rdx
jb 0x180012a39
xor r9d, r9d
lea r8, [rbp + 0x77]
mov rdx, rsi
mov rcx, rbx
call fcn.1800135e0
mov rdi, qword [rbp + 0x77]
mov r14, rax
lea rcx, [rdi - 0x101]
cmp rcx, 0xfdff
ja 0x180012a49
mov r8, rdi
mov rdx, rax
mov rcx, rbx
call fcn.180012f50
mov rcx, qword [rbx + 0x280]
mov rax, qword [rbx + 0xc0]
mov rdi, qword [rbx + 0x220]
shl rax, 4
sub rdi, rax
mov rax, rcx
shr rax, 4
sub rcx, rax
cmp rdi, rcx
jb 0x180012a0b
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rbx + 0x288]
mov rax, rcx
shr rax, 2
sub rcx, rax
cmp rdi, rcx
jbe 0x1800129f0
mov rcx, rbx
call fcn.18005cb44
mov qword [rbx + 0x288], rdi
mov qword [rbx + 0x280], rdi
jmp 0x1800129f0
mov rdx, rsi
mov rcx, rbx
mov r8, rdi
call fcn.180012f50
jmp 0x1800129f0
mov al, byte [rsi + 0xe]
test al, al
je 0x180012f24
and rsi, 0xffffffffffff0000
movzx eax, al
shl rax, 0x10
sub rsi, rax
add rsi, 0x10000
mov r13, rdi
mov r10d, 1
add r13, r13
cmp byte [r14 + r13*8 + 0xf], 3
jne 0x180012c44
lea r15, [r13 + 2]
mov rcx, rbx
lea r15, [r14 + r15*8]
mov rdx, r15
call fcn.18002ad5c
mov rcx, qword [r15 + 0x28]
mov rax, qword [r15 + 0x20]
mov qword [rbp - 0x11], rax
mov qword [rbp - 0x19], rcx
or ecx, 0xffffffff
add dword [rsi + 0x54], ecx
mov rax, qword [r15 + 0x28]
shr rax, 0xc
sub dword [rsi + 0x50], eax
mov rax, qword [r15 + 0x28]
add qword [rbx + 0x220], rax
add dword [rbx + 0x23c], ecx
mov rax, qword [r15 + 0x28]
cmp rax, 0xff000
jb 0x180012ae0
sub qword [rbx + 0x228], rax
mov rax, qword [r15 + 0x28]
mov r15b, byte [rbp + 0x7f]
mov r10d, 1
shr rax, 4
add rdi, 0x40
add rdi, rax
mov byte [rbp + 0x67], r10b
mov qword [rbp + 0x77], rdi
mov r12b, r10b
movzx eax, word [r14 + 0xc]
cmp word [rbx + 0x8c], ax
je 0x180012d0a
lea rcx, [r14 + 0x103f]
mov rdx, 0xfffffffffffff000
and rcx, rdx
lea rax, [r14 + 0x50]
mov qword [rbp - 0x21], rcx
cmp rcx, rax
je 0x180012f34
mov r15, rdi
shl r15, 4
test r12b, r12b
je 0x180012c4e
lea rax, [r15 + r14]
and rax, rdx
mov qword [rbp - 0x29], rax
cmp rax, rcx
jb 0x1800a3f2c
mov rdx, rax
sub rax, rcx
sub rdx, rcx
cmp byte [rbp + 0x7f], 0
mov qword [rbp - 0x29], rdx
jne 0x180012b77
cmp byte [r14 + r13*8 + 0xf], 3
jne 0x180012c5a
mov r12d, 0x7ffe0380
test rax, rax
je 0x180012bbd
add dword [rbx + 0x244], r10d
lea r8, [rbp - 0x29]
mov r9d, 0x4000
lea rdx, [rbp - 0x21]
call fcn.18005cd8c
test eax, eax
js 0x1800a3b3c
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
jne 0x1800a3d82
mov ecx, r12d
cmp byte [rcx], 0
jne 0x1800a3d9e
cmp byte [rbp + 0x67], 0
mov r13d, 1
je 0x180012c75
mov r8, qword [rbp - 0x21]
lea rax, [rbp + 0xf]
mov r9, qword [rbp - 0x29]
add r8, 0xffffffffffffffd0
mov qword [rsp + 0x28], rax
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], r14
call fcn.18002aa88
mov r8, qword [rbp + 0xf]
mov rdx, r14
mov rcx, rbx
call fcn.180012f50
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
xor r14d, r14d
test eax, eax
jne 0x1800a3e7b
mov rcx, r12
cmp byte [rcx], r14b
jne 0x1800a3e97
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
mov edi, 0x7ffe038a
mov esi, 0x230
test eax, eax
jne 0x1800a3f02
mov ecx, edi
cmp byte [rcx], r14b
je 0x1800129f0
jmp 0x1800a3f1a
and qword [rbp - 0x19], 0
jmp 0x180012b00
lea rax, [r14 - 0x20]
add rax, r15
jmp 0x180012b48
test rdx, rdx
je 0x1800a3f93
cmp rdx, qword [rbx + 0xb0]
jae 0x180012b77
jmp 0x1800a3f93
mov rdi, qword [rbp - 0x29]
add rdi, qword [rbp - 0x21]
movzx eax, word [rbx + 0x8c]
mov word [rdi + 0xc], ax
lea rax, [r15 + r14]
mov rcx, qword [rbp - 0x21]
add rcx, qword [rbp - 0x29]
cmp rax, rcx
je 0x1800a3e57
mov byte [rdi + 0xf], 0
mov byte [rdi + 0xa], 0
sub r15, qword [rbp - 0x29]
sub r15, qword [rbp - 0x21]
add r15, r14
shr r15, 4
cmp dword [0x18015d450], r13d
mov word [rdi + 8], r15w
jge 0x1800a3dd2
mov byte [rdi + 0xb], 0
mov rdx, qword [rsi + 0x28]
cmp rdx, rsi
je 0x180012f2c
mov r15, rdi
sub r15, rsi
shr r15, 0x10
inc r15
cmp r15, 0xfe
jae 0x1800a3e35
movzx r8d, word [rdi + 8]
mov rdx, rdi
mov rcx, rbx
mov byte [rdi + 0xe], r15b
call fcn.180012f50
jmp 0x180012bcd
lea r8, [rsi + 0x60]
mov qword [rbp - 0x21], r14
mov rcx, qword [r8]
mov r9, r14
cmp r8, rcx
je 0x1800a3a44
lea rdx, [rcx - 0x10]
mov rax, qword [rdx + 0x28]
add rax, qword [rdx + 0x20]
mov qword [rbp - 9], rdx
cmp rax, r14
jne 0x180012e78
test r15b, r15b
jne 0x1800a3a4f
mov ecx, dword [0x18015d450]
mov r13d, 1
cmp ecx, r13d
jge 0x1800a3a5d
mov r15, rdi
shl r15, 4
test r12b, r12b
je 0x180012e80
lea rax, [r15 + r14]
mov qword [rbp - 1], rax
and rax, 0xfffffffffffff000
sub rax, r9
mov qword [rbp - 0x29], rax
je 0x1800a3acb
mov r9d, 0x4000
lea r8, [rbp - 0x29]
lea rdx, [rbp - 0x21]
call fcn.18005cd8c
test eax, eax
js 0x1800a3b30
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
mov r12d, 0x7ffe0380
mov r14d, 0x226
test eax, eax
jne 0x1800a3b7b
mov ecx, r12d
cmp byte [rcx], 0
jne 0x1800a3b93
add dword [rbx + 0x244], r13d
mov r13d, 0xff000
mov rdi, qword [rbp - 9]
mov rax, qword [rdi + 0x28]
cmp rax, r13
jb 0x180012de4
sub qword [rbx + 0x228], rax
mov rdx, rdi
mov rcx, rbx
call fcn.18002ad5c
mov rax, qword [rbp - 0x29]
mov rdx, rdi
add qword [rdi + 0x28], rax
mov rcx, rbx
call fcn.18002abd8
mov rax, qword [rbp - 0x29]
shr rax, 0xc
add dword [rsi + 0x50], eax
mov rax, qword [rbp - 0x29]
sub qword [rbx + 0x220], rax
mov rax, qword [rdi + 0x28]
cmp rax, r13
jb 0x180012e28
add qword [rbx + 0x228], rax
mov r13b, byte [rbp + 0x67]
xor r8d, r8d
test r13b, r13b
je 0x180012e91
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
jne 0x1800a3c6d
mov rcx, r12
cmp byte [rcx], 0
jne 0x1800a3c85
mov r15, qword [rbp - 0x19]
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
mov edi, 0x7ffe038a
mov esi, 0x230
test eax, eax
jne 0x1800a3cf4
mov ecx, edi
cmp byte [rcx], 0
je 0x1800129f0
jmp 0x1800a3d0c
mov rcx, qword [rcx]
jmp 0x180012d18
lea r8, [r15 + r14]
mov qword [rbp - 1], r8
lea rax, [r8 - 0x20]
jmp 0x180012d70
mov rdi, qword [rbp - 0x29]
add rdi, qword [rbp - 0x21]
movzx eax, word [rbx + 0x8c]
mov word [rdi + 0xc], ax
mov rcx, qword [rbp - 0x21]
add rcx, qword [rbp - 0x29]
cmp qword [rbp - 1], rcx
je 0x1800a3c49
mov byte [rdi + 0xf], r8b
mov r14d, 1
mov byte [rdi + 0xa], r8b
sub r15, qword [rbp - 0x29]
shr r15, 4
cmp dword [0x18015d450], r14d
mov word [rdi + 8], r15w
jge 0x1800a3bc5
mov byte [rdi + 0xb], r8b
mov rdx, qword [rsi + 0x28]
cmp rdx, rsi
je 0x180012f44
mov r14, rdi
sub r14, rsi
shr r14, 0x10
inc r14
cmp r14, 0xfe
jae 0x1800a3c29
movzx r8d, word [rdi + 8]
mov rdx, rdi
mov rcx, rbx
mov byte [rdi + 0xe], r14b
call fcn.180012f50
mov r14d, 0x226
jmp 0x180012e34
mov rsi, rbx
jmp 0x180012a6c
xor r15b, r15b
jmp 0x180012cf1
add rcx, 0x1000
mov qword [rbp - 0x21], rcx
jmp 0x180012b34
mov r14b, r8b
jmp 0x180012f05
test byte [rdx + 0xa], 8
je 0x1800a3a3c
dec dword [rcx + 0x274]
lea r9, [rbp + 7]
lea r8, [rbp + 0x17]
call fcn.18005cd40
test al, al
je 0x1800a3a3c
mov rax, qword [rbp + 7]
sub qword [rbx + 0x278], rax
mov r14, rsi
jmp 0x180012a49
xor edx, edx
mov qword [rbp - 9], rdx
jmp 0x180012d3a
test rdx, rdx
je 0x180012b12
jmp 0x180012d43
test rdx, rdx
jne 0x180012d58
mov rax, qword gs:[0x60]
cmp qword [rax + 0x18], rdx
je 0x1800a3a98
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
lea rcx, str.HEAP__wZ_:
add rdx, 0x58
call sym.ntdll.dll_DbgPrint
jmp 0x1800a3aa4
lea rcx, str.HEAP:
call sym.ntdll.dll_DbgPrint
lea rcx, str._UCRBlock___NULL_
call sym.ntdll.dll_DbgPrint
mov ecx, r13d
call fcn.1800fc294
mov r9, qword [rbp - 0x21]
mov ecx, dword [0x18015d450]
mov rdi, qword [rbp + 0x77]
jmp 0x180012d58
cmp ecx, r13d
jl 0x1800a3f93
test r12b, r12b
je 0x1800a3f93
mov rax, qword gs:[0x60]
cmp qword [rax + 0x18], 0
je 0x1800a3b10
mov rax, qword gs:[0x60]
lea rcx, str.HEAP__wZ_:
mov rdx, qword [rax + 0x18]
mov rdx, qword [rdx + 0x10]
add rdx, 0x58
call sym.ntdll.dll_DbgPrint
jmp 0x1800a3b1c
lea rcx, str.HEAP:
call sym.ntdll.dll_DbgPrint
lea rcx, str.__TrailingUCR_
call sym.ntdll.dll_DbgPrint
mov ecx, r13d
jmp 0x1800a3f8a
add dword [rbx + 0x254], r13d
test r12b, r12b
jmp 0x1800a3b4b
mov ecx, 1
add dword [rbx + 0x254], ecx
cmp byte [rbp + 0x67], 0
je 0x1800a3f93
mov r8, qword [rbp - 0x11]
lea rax, [rbp + 0x77]
mov r9, qword [rbp - 0x19]
add r8, 0xffffffffffffffd0
mov qword [rsp + 0x28], rax
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], r14
call fcn.18002aa88
jmp 0x1800a3f8f
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, r14
jmp 0x180012dba
mov rax, qword gs:[0x60]
test byte [rax + 0x378], r13b
je 0x180012dc3
mov r8, qword [rbp - 0x29]
mov r9d, 5
mov rdx, qword [rbp - 0x21]
mov rcx, rbx
call fcn.1800fe120
nop
jmp 0x180012dc3
cmp r15w, r14w
ja 0x180012ede
mov rax, qword gs:[0x60]
cmp qword [rax + 0x18], r8
je 0x1800a3c01
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
lea rcx, str.HEAP__wZ_:
add rdx, 0x58
call sym.ntdll.dll_DbgPrint
jmp 0x1800a3c0d
lea rcx, str.HEAP:
call sym.ntdll.dll_DbgPrint
lea rcx, str.__LONG_FreeEntry__Size___1_
call sym.ntdll.dll_DbgPrint
mov ecx, r14d
call fcn.1800fc294
xor r8d, r8d
jmp 0x180012ede
mov qword [rsp + 0x28], r8
mov r9, rsi
mov qword [rsp + 0x20], r8
mov ecx, 3
mov r8, rdi
call fcn.18009a4c0
nop
jmp 0x180012f05
cmp dword [rbx + 0x7c], r8d
je 0x180012e34
mov al, byte [rdi + 0xa]
xor al, byte [rdi + 9]
xor al, byte [rdi + 8]
mov byte [rdi + 0xb], al
mov eax, dword [rbx + 0x88]
xor dword [rdi + 8], eax
jmp 0x180012e34
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, r14
jmp 0x180012e44
mov rax, qword gs:[0x60]
mov ecx, 1
test byte [rax + 0x378], cl
je 0x180012e4d
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x1800a3cbb
mov rax, qword gs:[0x60]
mov r12, qword [rax + 0x90]
add r12, r14
movzx eax, byte [r12]
mov rcx, rbx
mov r9, qword [rbx + 0xc0]
mov r15, qword [rbp - 0x19]
mov r8, qword [rbp - 0x29]
mov rdx, qword [rbp - 0x21]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
shl r9, 4
mov byte [rsp + 0x20], r13b
call fcn.1800fdffc
nop
jmp 0x180012e51
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, rsi
jmp 0x180012e6a
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x1800a3d28
mov rax, qword gs:[0x60]
mov rdi, qword [rax + 0x90]
add rdi, rsi
movzx eax, byte [rdi]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov byte [rsp + 0x20], r13b
jmp 0x1800a3d61
mov rax, qword gs:[0x60]
mov rdi, qword [rax + 0x90]
add rdi, rsi
movzx eax, byte [rdi]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
mov byte [rsp + 0x20], r14b
mov r9, qword [rbx + 0xc0]
mov rcx, rbx
mov r8, qword [rbp - 0x29]
mov rdx, qword [rbp - 0x21]
shl r9, 4
call fcn.1800fdffc
nop
jmp 0x1800129f0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x226
jmp 0x180012bb4
mov rax, qword gs:[0x60]
mov ecx, 1
test byte [rax + 0x378], cl
je 0x180012bbd
mov r8, qword [rbp - 0x29]
lea r9d, [rcx + 5]
mov rdx, qword [rbp - 0x21]
mov rcx, rbx
call fcn.1800fe120
nop
jmp 0x180012bbd
cmp r15w, r13w
ja 0x180012cc6
mov rax, qword gs:[0x60]
cmp qword [rax + 0x18], 0
je 0x1800a3e0f
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
lea rcx, str.HEAP__wZ_:
add rdx, 0x58
call sym.ntdll.dll_DbgPrint
jmp 0x1800a3e1b
lea rcx, str.HEAP:
call sym.ntdll.dll_DbgPrint
lea rcx, str._LONG_FreeEntry__Size___1
call sym.ntdll.dll_DbgPrint
mov ecx, r13d
call fcn.1800fc294
nop
jmp 0x180012cc6
and qword [rsp + 0x28], 0
mov r9, rsi
and qword [rsp + 0x20], 0
mov r8, rdi
mov ecx, 3
call fcn.18009a4c0
nop
jmp 0x180012cf1
cmp dword [rbx + 0x7c], 0
je 0x180012bcd
mov al, byte [rdi + 0xa]
xor al, byte [rdi + 9]
xor al, byte [rdi + 8]
mov byte [rdi + 0xb], al
mov eax, dword [rbx + 0x88]
xor dword [rdi + 8], eax
jmp 0x180012bcd
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x226
jmp 0x180012c14
mov rax, qword gs:[0x60]
test byte [rax + 0x378], r13b
je 0x180012c1d
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x1800a3ecd
mov rax, qword gs:[0x60]
mov r12, qword [rax + 0x90]
add r12, 0x226
movzx eax, byte [r12]
mov rcx, rbx
mov r9, qword [rbx + 0xc0]
mov r8, qword [rbp - 0x29]
mov rdx, qword [rbp - 0x21]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
shl r9, 4
mov byte [rsp + 0x20], r14b
call fcn.1800fdffc
nop
jmp 0x180012c1d
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, rsi
jmp 0x180012c36
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x1800a3d4f
jmp 0x1800a3d3c
cmp dword [0x18015d450], r10d
jl 0x1800a3f93
test r12b, r12b
je 0x1800a3f93
mov rax, qword gs:[0x60]
cmp qword [rax + 0x18], 0
je 0x1800a3f6d
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
lea rcx, str.HEAP__wZ_:
add rdx, 0x58
call sym.ntdll.dll_DbgPrint
jmp 0x1800a3f79
lea rcx, str.HEAP:
call sym.ntdll.dll_DbgPrint
lea rcx, str.__TrailingUCR_
call sym.ntdll.dll_DbgPrint
mov ecx, 1
call fcn.1800fc294
mov rdi, qword [rbp + 0x77]
mov rdx, r14
jmp 0x180012a3c