Function at 0x18005bdb4
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
movzx eax, word [rsp + 0x98]
xor r13d, r13d
mov byte [r8 + 0xf], r13b
mov rbx, r8
mov byte [r8 + 0xa], r9b
mov rsi, rcx
xor ax, word [rcx + 0x8c]
mov word [r8 + 0xc], ax
cmp qword [rdx + 0x28], rdx
je 0x18005bf77
mov rdi, rbx
sub rdi, rdx
shr rdi, 0x10
inc rdi
cmp rdi, 0xfe
jae 0x1800b83a4
mov r15, qword [rsp + 0xa0]
mov byte [rbx + 0xe], dil
movzx r12d, r15w
mov rdi, r15
mov byte [rbx + 0xb], r13b
shl rdi, 4
add rdi, rbx
mov word [rbx + 8], r15w
mov eax, dword [rsi + 0x7c]
shr eax, 0x14
and al, byte [rsi + 0x8a]
xor al, byte [rdi + 0xa]
test al, 1
je 0x18005bf7f
movzx eax, r12w
movzx ebp, r12w
xor ax, word [rsi + 0x8c]
cmp byte [rsp + 0x90], 0
mov word [rdi + 0xc], ax
mov byte [rbx + 0xf], 0
jne 0x1800b8687
mov byte [rbx + 0xa], 0
lea rdi, [rsi + 0x150]
cmp qword [rsi + 0x138], 0
je 0x1800b8646
mov edx, ebp
mov rcx, rsi
call fcn.18005c238
mov r8, rax
cmp rdi, r8
je 0x18005bed8
mov ecx, dword [rsi + 0x7c]
test ecx, ecx
je 0x1800b864e
mov eax, dword [r8 - 8]
mov ecx, dword [rsi + 0x7c]
mov dword [rsp + 0x38], eax
test eax, ecx
je 0x18005bec7
xor eax, dword [rsi + 0x88]
mov dword [rsp + 0x38], eax
movzx eax, word [rsp + 0x38]
movzx eax, ax
cmp rbp, rax
ja 0x1800b8658
mov rax, qword [r8 + 8]
lea rdi, [rbx + 0x10]
mov rcx, qword [rax]
cmp rcx, r8
jne 0x1800b8669
mov qword [rdi], r8
mov qword [rdi + 8], rax
mov qword [rax], rdi
mov qword [r8 + 8], rdi
movzx eax, word [rbx + 8]
add qword [rsi + 0xc0], rax
mov rdx, qword [rsi + 0x138]
test rdx, rdx
je 0x18005bf3c
movzx ecx, word [rbx + 8]
mov eax, dword [rdx + 8]
cmp rcx, rax
jae 0x18005c006
mov r8, rcx
mov qword [rsp + 0x28], rcx
mov r9, rdi
mov dword [rsp + 0x20], r8d
mov rcx, rsi
mov r8b, 1
call fcn.18005c190
cmp dword [rsi + 0x7c], 0
je 0x18005bf57
mov al, byte [rbx + 0xa]
xor al, byte [rbx + 9]
xor al, byte [rbx + 8]
mov byte [rbx + 0xb], al
mov eax, dword [rsi + 0x88]
xor dword [rbx + 8], eax
mov al, 1
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor dil, dil
jmp 0x18005be19
cmp dword [rsi + 0x7c], 0
je 0x18005bfaa
mov edx, dword [rsi + 0x88]
xor edx, dword [rdi + 8]
mov ecx, edx
mov dword [rdi + 8], edx
shr ecx, 0x10
mov eax, edx
shr eax, 8
xor cl, al
xor cl, dl
shr edx, 0x18
cmp dl, cl
jne 0x1800b83c5
mov r14, qword [rdi + 0x18]
lea r8, [rdi + 0x10]
mov rbp, qword [r8]
mov rax, qword [r14]
mov r9, qword [rbp + 8]
cmp rax, r9
jne 0x1800b83eb
cmp rax, r8
jne 0x1800b83eb
movzx eax, word [rdi + 8]
sub qword [rsi + 0xc0], rax
mov rdx, qword [rsi + 0x138]
test rdx, rdx
je 0x18005c037
movzx r9d, word [rdi + 8]
mov eax, dword [rdx + 8]
cmp r9, rax
jb 0x18005c01d
mov rax, qword [rdx]
test rax, rax
je 0x18005c16b
mov rdx, rax
mov eax, dword [rax + 8]
jmp 0x18005bfed
mov rax, qword [rdx]
test rax, rax
je 0x18005c156
mov rdx, rax
mov eax, dword [rax + 8]
jmp 0x18005bf18
mov rcx, r9
mov qword [rsp + 0x28], r9
mov r9, r8
mov dword [rsp + 0x20], ecx
mov r8b, 1
mov rcx, rsi
call fcn.18005c30c
mov qword [r14], rbp
mov qword [rbp + 8], r14
test byte [rdi + 0xa], 8
jne 0x18005c177
mov r13b, byte [rsp + 0x90]
mov r14d, 0xfeeefeee
test r13b, r13b
jne 0x1800b8417
mov al, byte [rdi + 0xa]
mov byte [rbx + 0xa], al
movzx eax, word [rdi + 8]
add r15, rax
cmp r15, 0xff00
ja 0x1800b862b
movzx ebp, r15w
add r15, r15
mov word [rbx + 8], bp
movzx eax, bp
xor ax, word [rsi + 0x8c]
mov word [rbx + r15*8 + 0xc], ax
mov byte [rbx + 0xf], 0
test r13b, r13b
jne 0x1800b84f8
mov byte [rbx + 0xa], r13b
lea rdi, [rsi + 0x150]
cmp qword [rsi + 0x138], 0
je 0x1800b84b7
mov edx, ebp
mov rcx, rsi
call fcn.18005c238
mov r8, rax
cmp rdi, r8
je 0x18005c101
mov ecx, dword [rsi + 0x7c]
test ecx, ecx
je 0x1800b84bf
mov eax, dword [r8 - 8]
mov ecx, dword [rsi + 0x7c]
mov dword [rsp + 0x38], eax
test eax, ecx
je 0x18005c0f0
xor eax, dword [rsi + 0x88]
mov dword [rsp + 0x38], eax
movzx eax, word [rsp + 0x38]
movzx eax, ax
cmp rbp, rax
ja 0x1800b84c9
mov rax, qword [r8 + 8]
lea rdi, [rbx + 0x10]
mov rcx, qword [rax]
cmp rcx, r8
jne 0x1800b84da
mov qword [rdi], r8
mov qword [rdi + 8], rax
mov qword [rax], rdi
mov qword [r8 + 8], rdi
movzx eax, word [rbx + 8]
add qword [rsi + 0xc0], rax
mov rdx, qword [rsi + 0x138]
test rdx, rdx
je 0x18005bf3c
movzx ecx, word [rbx + 8]
mov eax, dword [rdx + 8]
cmp rcx, rax
jb 0x18005bf21
mov rax, qword [rdx]
test rax, rax
jne 0x18005c163
mov eax, dword [rdx + 8]
dec eax
mov r8d, eax
jmp 0x18005bf24
mov rdx, rax
mov eax, dword [rax + 8]
jmp 0x18005c145
mov eax, dword [rdx + 8]
dec eax
mov ecx, eax
jmp 0x18005c020
mov rdx, rdi
mov rcx, rsi
call fcn.18005ca3c
test al, al
jne 0x18005c048
jmp 0x1800b83d6
and qword [rsp + 0x28], r13
mov r9, rdx
and qword [rsp + 0x20], r13
mov ecx, 3
mov rdx, qword [rdx + 0x28]
call fcn.18009a4c0
nop
jmp 0x18005be19
mov rdx, rdi
mov rcx, rsi
call fcn.1800fbec0
nop
jmp 0x18005bfaa
movzx r8d, word [rdi + 8]
mov r9b, 1
mov rdx, rdi
mov rcx, rsi
call fcn.1800128f0
jmp 0x1800b8403
and qword [rsp + 0x28], 0
mov rdx, rsi
mov ecx, 0xd
mov qword [rsp + 0x20], rax
call fcn.18009a4c0
test r13d, r13d
jne 0x1800b863f
mov r13d, 1
jmp 0x18005be3c
mov al, byte [rdi + 0xa]
test al, 4
je 0x18005c05f
movzx ebp, word [rdi + 8]
shl rbp, 4
sub rbp, 0x20
test al, 2
je 0x1800b843c
cmp rbp, 4
jbe 0x1800b843c
sub rbp, 4
lea rcx, [rdi + 0x20]
mov r8d, r14d
mov rdx, rbp
call sym.ntdll.dll_RtlCompareMemoryUlong
mov r12, rax
cmp rax, rbp
je 0x18005c05f
mov rcx, qword gs:[0x60]
cmp qword [rcx + 0x18], 0
je 0x1800b848a
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
lea rcx, str.HEAP__wZ_:
mov rdx, qword [rdx + 0x10]
add rdx, 0x58
call sym.ntdll.dll_DbgPrint
jmp 0x1800b8496
lea rcx, str.HEAP:
call sym.ntdll.dll_DbgPrint
lea r8, [rdi + 0x20]
mov rdx, rdi
add r8, r12
lea rcx, str.HEAP:_Free_Heap_block__p_modified_at__p_after_it_was_freed_n
call sym.ntdll.dll_DbgPrint
call fcn.18010109c
nop
jmp 0x18005c05f
mov r8, qword [rdi]
jmp 0x18005c0c7
movzx eax, word [r8 - 8]
jmp 0x18005c0f5
mov r8, qword [r8]
cmp rdi, r8
jne 0x18005c0cf
jmp 0x18005c101
and qword [rsp + 0x28], 0
xor edx, edx
mov qword [rsp + 0x20], rcx
xor r9d, r9d
lea ecx, [rdx + 0xd]
call fcn.18009a4c0
nop
jmp 0x18005c123
and byte [rbx + 0xa], 0xf0
test byte [rsi + 0x70], 0x40
je 0x1800b854e
mov rdx, rbp
lea r8, [rbx + 0x20]
shl rdx, 4
sub rdx, 0x20
shr rdx, 2
test rdx, rdx
je 0x1800b854a
test r8b, 4
je 0x1800b852a
dec rdx
mov dword [r8], r14d
add r8, 4
mov rcx, rdx
movabs rax, 0xfeeefeeefeeefeee
shr rcx, 1
mov rdi, r8
rep stosq qword [rdi], rax
test dl, 1
je 0x1800b854a
mov dword [r8 + rdx*4 - 4], r14d
or byte [rbx + 0xa], 4
cmp qword [rsi + 0x138], 0
lea rdi, [rsi + 0x150]
je 0x1800b856f
mov rdx, rbp
mov rcx, rsi
call fcn.18005c238
mov r8, rax
jmp 0x1800b8572
mov r8, qword [rdi]
cmp rdi, r8
je 0x1800b85b3
mov ecx, dword [rsi + 0x7c]
test ecx, ecx
je 0x1800b859e
mov eax, dword [r8 - 8]
mov ecx, dword [rsi + 0x7c]
mov dword [rsp + 0x38], eax
test eax, ecx
je 0x1800b8597
xor eax, dword [rsi + 0x88]
mov dword [rsp + 0x38], eax
movzx eax, word [rsp + 0x38]
jmp 0x1800b85a3
movzx eax, word [r8 - 8]
movzx eax, ax
cmp rbp, rax
jbe 0x1800b85b3
mov r8, qword [r8]
cmp rdi, r8
jne 0x1800b857a
mov rax, qword [r8 + 8]
lea rdi, [rbx + 0x10]
mov rcx, qword [rax]
cmp rcx, r8
jne 0x1800b85d3
mov qword [rdi], r8
mov qword [rdi + 8], rax
mov qword [rax], rdi
mov qword [r8 + 8], rdi
jmp 0x1800b85eb
and qword [rsp + 0x28], 0
xor edx, edx
mov qword [rsp + 0x20], rcx
xor r9d, r9d
lea ecx, [rdx + 0xd]
call fcn.18009a4c0
movzx eax, word [rbx + 8]
add qword [rsi + 0xc0], rax
mov rdx, qword [rsi + 0x138]
test rdx, rdx
je 0x18005bf3c
movzx ecx, word [rbx + 8]
mov eax, dword [rdx + 8]
jmp 0x1800b8621
mov rax, qword [rdx]
test rax, rax
je 0x18005c156
mov rdx, rax
mov eax, dword [rax + 8]
cmp rcx, rax
jae 0x1800b860f
jmp 0x18005bf21
mov r8, r15
mov rdx, rbx
mov rcx, rsi
call fcn.180012f50
nop
jmp 0x18005bf57
xor al, al
jmp 0x18005bf59
mov r8, qword [rdi]
jmp 0x18005be9e
movzx eax, word [r8 - 8]
jmp 0x18005becc
mov r8, qword [r8]
cmp rdi, r8
jne 0x18005bea6
jmp 0x18005bed8
and qword [rsp + 0x28], 0
xor edx, edx
mov qword [rsp + 0x20], rcx
xor r9d, r9d
lea ecx, [rdx + 0xd]
call fcn.18009a4c0
nop
jmp 0x18005befa
and byte [rbx + 0xa], 0xf0
test byte [rsi + 0x70], 0x40
je 0x1800b86e3
mov rdx, rbp
lea r8, [rbx + 0x20]
shl rdx, 4
sub rdx, 0x20
shr rdx, 2
test rdx, rdx
je 0x1800b86df
mov r14d, 0xfeeefeee
test r8b, 4
je 0x1800b86bf
dec rdx
mov dword [r8], r14d
add r8, 4
mov rcx, rdx
movabs rax, 0xfeeefeeefeeefeee
shr rcx, 1
mov rdi, r8
rep stosq qword [rdi], rax
test dl, 1
je 0x1800b86df
mov dword [r8 + rdx*4 - 4], r14d
or byte [rbx + 0xa], 4
cmp qword [rsi + 0x138], 0
lea rdi, [rsi + 0x150]
je 0x1800b8704
mov rdx, rbp
mov rcx, rsi
call fcn.18005c238
mov r8, rax
jmp 0x1800b8707
mov r8, qword [rdi]
cmp rdi, r8
je 0x1800b8748
mov ecx, dword [rsi + 0x7c]
test ecx, ecx
je 0x1800b8733
mov eax, dword [r8 - 8]
mov ecx, dword [rsi + 0x7c]
mov dword [rsp + 0x38], eax
test eax, ecx
je 0x1800b872c
xor eax, dword [rsi + 0x88]
mov dword [rsp + 0x38], eax
movzx eax, word [rsp + 0x38]
jmp 0x1800b8738
movzx eax, word [r8 - 8]
movzx eax, ax
cmp rbp, rax
jbe 0x1800b8748
mov r8, qword [r8]
cmp rdi, r8
jne 0x1800b870f
mov rax, qword [r8 + 8]
lea rdi, [rbx + 0x10]
mov rcx, qword [rax]
cmp rcx, r8
jne 0x1800b8768
mov qword [rdi], r8
mov qword [rdi + 8], rax
mov qword [rax], rdi
mov qword [r8 + 8], rdi
jmp 0x1800b8780
and qword [rsp + 0x28], 0
xor edx, edx
mov qword [rsp + 0x20], rcx
xor r9d, r9d
lea ecx, [rdx + 0xd]
call fcn.18009a4c0
movzx eax, word [rbx + 8]
add qword [rsi + 0xc0], rax
mov rdx, qword [rsi + 0x138]
test rdx, rdx
je 0x1800b87d8
movzx ecx, word [rbx + 8]
mov eax, dword [rdx + 8]
jmp 0x1800b87ae
mov rax, qword [rdx]
test rax, rax
je 0x1800b87b8
mov rdx, rax
mov eax, dword [rax + 8]
cmp rcx, rax
jae 0x1800b87a0
mov r8, rcx
jmp 0x1800b87c0
mov eax, dword [rdx + 8]
dec eax
mov r8d, eax
mov qword [rsp + 0x28], rcx
mov r9, rdi
mov dword [rsp + 0x20], r8d
mov rcx, rsi
mov r8b, 1
call fcn.18005c190
cmp dword [rsi + 0x7c], 0
je 0x18005bf57
mov cl, byte [rbx + 0xa]
xor cl, byte [rbx + 9]
xor cl, byte [rbx + 8]
mov byte [rbx + 0xb], cl
mov ecx, dword [rsi + 0x88]
xor dword [rbx + 8], ecx
jmp 0x18005bf57