Function at 0x18005d440
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov rax, qword [0x1801724e0]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor r12d, r12d
mov rdi, rcx
test rcx, rcx
je 0x1800b8d00
cmp dword [rcx + 0x10], 0xddeeddee
je 0x18005d5e6
test dword [rcx + 0x74], 0x1000000
jne 0x1800b8d83
mov ecx, dword [rcx + 0x90]
test ecx, ecx
jne 0x1800b8d96
mov rcx, rdi
call fcn.18005d6f8
test dword [rdi + 0x70], 0x61000000
jne 0x1800b8db2
mov rax, qword gs:[0x60]
cmp rdi, qword [rax + 0x30]
je 0x18005d65b
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 1]
call fcn.18002a46c
lea r14, [rdi + 0x110]
mov esi, 0x7ffe0388
mov rbx, qword [r14]
cmp r14, rbx
jne 0x1800b8dd4
cmp byte [rdi + 0x182], 2
je 0x18005d62f
mov rax, r12
test rax, rax
jne 0x18005d63b
lea rbx, [rdi + 0xe8]
cmp qword [rbx], r12
jne 0x1800b8e3f
test byte [rdi + 0x70], 1
je 0x18005d5c8
mov rbx, qword [rdi + 0x128]
sub rbx, 0x18
mov rcx, rbx
call fcn.18005d664
cmp rbx, rdi
jne 0x18005d529
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
mov ebx, 0x7ffe0380
mov r14d, 0x226
test eax, eax
jne 0x1800b8e5d
mov ecx, ebx
cmp byte [rcx], r12b
jne 0x1800b8e75
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
mov ebx, 0x7ffe038a
mov r14d, 0x230
test eax, eax
jne 0x1800b8ed1
mov ecx, ebx
cmp byte [rcx], r12b
jne 0x1800b8ee9
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
jne 0x1800b8f2f
cmp byte [rsi], r12b
jne 0x1800b8f4b
xor eax, eax
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.18008b0e0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rbp
ret
cmp dword [rdi + 0x70], r12d
jl 0x18005d5da
mov rcx, qword [rdi + 0x160]
call sym.ntdll.dll_RtlDeleteCriticalSection
mov qword [rdi + 0x160], r12
jmp 0x18005d529
mov rcx, qword gs:[0x60]
cmp rdi, qword [rcx + 0x30]
je 0x18005d65b
mov ecx, dword [rdi + 0x38]
test ecx, ecx
jne 0x1800b8d67
mov rcx, rdi
call fcn.18005d6f8
mov rcx, rdi
call fcn.180061ed0
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 1]
call fcn.18002a46c
mov rcx, rdi
call fcn.18005f8d0
jmp 0x18005d59d
mov rax, qword [rdi + 0x178]
jmp 0x18005d506
mov r9d, 0x8000
mov qword [rbp - 0x21], rax
lea r8, [rbp - 0x29]
mov qword [rbp - 0x29], r12
lea rdx, [rbp - 0x21]
call fcn.18005cd8c
jmp 0x18005d50f
mov rax, rdi
jmp 0x18005d59f
cmp dword [0x18015d450], 2
jl 0x18005d59d
mov rax, qword gs:[0x60]
cmp qword [rax + 0x18], r12
je 0x1800b8d3f
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
lea rcx, str.HEAP__wZ_:
add rdx, 0x58
call sym.ntdll.dll_DbgPrint
jmp 0x1800b8d4b
lea rcx, str.HEAP:
call sym.ntdll.dll_DbgPrint
lea rcx, str._HeapHandle___NULL_
call sym.ntdll.dll_DbgPrint
mov ecx, 2
call fcn.1800fc294
nop
jmp 0x18005d59d
mov r9d, 8
mov qword [rsp + 0x20], r12
xor r8d, r8d
mov rdx, rdi
call fcn.1800ebde8
nop
jmp 0x18005d600
mov rax, qword [0x180156420]
call qword [section..00cfg]
nop
jmp 0x18005d59f
mov r9d, 8
mov qword [rsp + 0x20], r12
xor r8d, r8d
mov rdx, rdi
call fcn.1800ebde8
nop
jmp 0x18005d4a4
test dword [rdi + 0x70], 0x10000000
jne 0x18005d4b9
mov rcx, rdi
call fcn.1800ffdf4
test al, al
je 0x18005d65b
jmp 0x18005d4b9
mov rax, rbx
lea r8, [rbp - 0x39]
mov rbx, qword [rbx]
lea rdx, [rbp - 0x31]
and rax, 0xffffffffffff0000
mov qword [rbp - 0x39], r12
mov r9d, 0x8000
mov qword [rbp - 0x31], rax
call fcn.18005cd8c
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x1800b8e1d
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x22e
jmp 0x1800b8e20
mov rcx, rsi
cmp byte [rcx], r12b
je 0x18005d4ed
mov r8, qword [rbp - 0x39]
mov rcx, rdi
mov rdx, qword [rbp - 0x31]
call fcn.1800fc3d4
nop
jmp 0x18005d4ed
mov r9d, 0x8000
mov qword [rbp - 0x19], r12
lea r8, [rbp - 0x19]
mov rdx, rbx
call fcn.18005cd8c
mov qword [rbx], r12
jmp 0x18005d51f
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, r14
jmp 0x18005d55b
mov rax, qword gs:[0x60]
test byte [rax + 0x378], 1
je 0x18005d564
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x1800b8ea7
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x90]
add rbx, r14
movzx ecx, byte [rbx]
lea r9, [rbp - 0x11]
mov eax, 0x1023
mov qword [rbp + 0xf], rdi
mov edx, 0x402
mov word [rbp - 0xb], ax
mov r8d, 8
call sym.ntdll.dll_NtTraceEvent
nop
jmp 0x18005d564
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, r14
jmp 0x18005d57e
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x1800b8f05
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x90]
add rbx, r14
movzx ecx, byte [rbx]
lea r9, [rbp + 0x17]
mov eax, 0x1023
mov qword [rbp + 0x37], rdi
mov edx, 0x402
mov word [rbp + 0x1d], ax
mov r8d, 8
call sym.ntdll.dll_NtTraceEvent
nop
jmp 0x18005d587
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x90]
add rsi, 0x22e
jmp 0x18005d594
mov rcx, rdi
call fcn.1800fc348
nop
jmp 0x18005d59d