Function at 0x180049950
Capabilities:
Access peb ldr_data
Get ntdll base address
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword gs:[0x60]
xor r10d, r10d
mov rbp, rdx
mov qword [rsp + 0x28], r10
mov r13d, r10d
mov qword [rsp + 0x30], r10
mov r12d, r10d
mov qword [rsp + 0x20], r10
mov rcx, qword [rax + 0x18]
mov esi, r10d
mov r15d, r10d
mov r9d, r10d
mov r14, qword [rcx + 0x20]
test r14, r14
je 0x180049bb6
mov ebp, 0xffff
lea ebx, [r10 + 4]
nop word [rax + rax]
mov rdx, qword [r14 + 0x50]
mov rax, r10
movzx r8d, word [r14 + 0x48]
nop dword [rax]
movzx ecx, byte [rdx]
ror eax, 0xd
cmp cl, 0x61
jb 0x1800499df
add rax, 0xffffffffffffffe0
add rax, rcx
inc rdx
add r8w, bp
jne 0x1800499d0
cmp eax, 0x6a4abc5b
jne 0x180049ac7
mov r9, qword [r14 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov edi, dword [rax + r9 + 0x88]
mov r10d, dword [rdi + r9 + 0x20]
mov r11d, dword [rdi + r9 + 0x24]
add r10, r9
add r11, r9
nop word [rax + rax]
mov edx, dword [r10]
add rdx, r9
xor eax, eax
movzx ecx, byte [rdx]
nop dword [rax + rax]
ror eax, 0xd
lea rdx, [rdx + 1]
movsx ecx, cl
add eax, ecx
movzx ecx, byte [rdx]
test cl, cl
jne 0x180049a30
cmp eax, 0xec0e4e8e
je 0x180049a5f
cmp eax, 0x7c0dfcaa
je 0x180049a5f
cmp eax, 0x91afca54
je 0x180049a5f
cmp eax, 0x60e0ceef
jne 0x180049aac
mov edx, dword [rdi + r9 + 0x1c]
movzx r8d, word [r11]
add rdx, r9
cmp eax, 0xec0e4e8e
jne 0x180049a7b
mov r13d, dword [rdx + r8*4]
add r13, r9
jmp 0x180049aa9
cmp eax, 0x7c0dfcaa
jne 0x180049a8b
mov r12d, dword [rdx + r8*4]
add r12, r9
jmp 0x180049aa9
cmp eax, 0x91afca54
jne 0x180049a9b
mov esi, dword [rdx + r8*4]
add rsi, r9
jmp 0x180049aa9
cmp eax, 0x60e0ceef
jne 0x180049aa9
mov r15d, dword [rdx + r8*4]
add r15, r9
add bx, bp
add r10, 4
add r11, 2
test bx, bx
jne 0x180049a20
mov qword [rsp + 0x28], r15
jmp 0x180049b7d
cmp eax, 0x3cfa685d
jne 0x180049b89
mov r8, qword [r14 + 0x20]
mov ebx, 2
movsxd rax, dword [r8 + 0x3c]
mov edi, dword [rax + r8 + 0x88]
add rdi, r8
mov r11d, dword [rdi + 0x20]
mov r9d, dword [rdi + 0x24]
add r11, r8
mov r10d, dword [rdi + 0x18]
add r9, r8
nop dword [rax]
test r10d, r10d
je 0x180049b78
mov edx, dword [r11]
add rdx, r8
xor ecx, ecx
movzx eax, byte [rdx]
ror ecx, 0xd
lea rdx, [rdx + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [rdx]
test al, al
jne 0x180049b10
cmp ecx, 0x534c0ab8
je 0x180049b4f
cmp ecx, 0xff7f061a
jne 0x180049b68
mov ecx, dword [rdi + 0x1c]
movzx edx, word [r9]
add rcx, r8
mov ebp, dword [rcx + rdx*4]
add rbp, r8
mov qword [rsp + 0x30], rbp
mov ebp, 0xffff
jmp 0x180049b65
mov ecx, dword [rdi + 0x1c]
movzx edx, word [r9]
add rcx, r8
mov r15d, dword [rcx + rdx*4]
add r15, r8
mov qword [rsp + 0x20], r15
add bx, bp
add r11, 4
add r9, 2
dec r10d
test bx, bx
jne 0x180049b00
mov r15, qword [rsp + 0x28]
mov r9, qword [rsp + 0x20]
xor r10d, r10d
lea ebx, [r10 + 4]
test r13, r13
je 0x180049ba2
test r12, r12
je 0x180049ba2
test rsi, rsi
je 0x180049ba2
test r15, r15
je 0x180049ba2
test r9, r9
jne 0x180049bae
mov r14, qword [r14]
test r14, r14
jne 0x1800499c0
mov rbp, qword [rsp + 0x88]
movsxd r15, dword [rbp + 0x3c]
xor ecx, ecx
add r15, rbp
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
mov edx, dword [r15 + 0x50]
call rsi
mov r14, rax
mov r8, rax
mov eax, dword [r15 + 0x54]
mov rdx, rbp
test rax, rax
je 0x180049bf4
movzx ecx, byte [rdx]
inc rdx
mov byte [r8], cl
lea r8, [r8 + 1]
sub rax, 1
jne 0x180049be1
movzx r10d, word [r15 + 6]
movzx eax, word [r15 + 0x14]
test r10, r10
je 0x180049c4a
lea r9, [r15 + 0x2c]
add r9, rax
nop word [rax + rax]
mov ecx, dword [r9 - 8]
dec r10
mov edx, dword [r9]
add rcx, r14
mov r8d, dword [r9 - 4]
add rdx, rbp
test r8, r8
je 0x180049c41
nop dword [rax]
movzx eax, byte [rdx]
inc rdx
mov byte [rcx], al
inc rcx
sub r8, 1
jne 0x180049c30
add r9, 0x28
test r10, r10
jne 0x180049c10
mov ebp, dword [r15 + 0x90]
add rbp, r14
cmp dword [rbp + 0xc], 0
je 0x180049cf4
nop
mov ecx, dword [rbp + 0xc]
add rcx, r14
call r13
mov esi, dword [rbp + 0x10]
mov rbx, rax
mov edi, dword [rbp]
add rsi, r14
add rdi, r14
mov rdx, qword [rsi]
test rdx, rdx
je 0x180049ce6
lea rax, [r14 + 2]
test rdi, rdi
je 0x180049c97
mov r8, qword [rdi]
test r8, r8
jns 0x180049c97
movzx edx, r8w
jmp 0x180049c9f
test rdx, rdx
jns 0x180049cc0
movzx edx, dx
movsxd rax, dword [rbx + 0x3c]
mov ecx, dword [rax + rbx + 0x88]
mov eax, dword [rcx + rbx + 0x10]
mov ecx, dword [rcx + rbx + 0x1c]
sub rdx, rax
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
jmp 0x180049cc9
add rdx, rax
mov rcx, rbx
call r12
mov qword [rsi], rax
add rsi, 8
test rdi, rdi
lea rax, [rdi + 8]
cmove rax, rdi
mov rdx, qword [rsi]
mov rdi, rax
test rdx, rdx
jne 0x180049c80
add rbp, 0x14
cmp dword [rbp + 0xc], 0
jne 0x180049c60
mov r9, r14
sub r9, qword [r15 + 0x30]
cmp dword [r15 + 0xb4], 0
je 0x180049dba
mov ebx, dword [r15 + 0xb0]
add rbx, r14
mov eax, dword [rbx + 4]
test eax, eax
je 0x180049dba
nop
mov r8d, dword [rbx]
lea r11, [rbx + 8]
mov r10d, eax
add r8, r14
sub r10, 8
shr r10, 1
je 0x180049da9
nop word [rax + rax]
movzx edx, word [r11]
dec r10
movzx eax, dx
movzx ecx, dx
shr ax, 0xc
cmp ax, 0xa
jne 0x180049d63
and edx, 0xfff
add qword [rdx + r8], r9
jmp 0x180049da0
cmp ax, 3
jne 0x180049d75
and ecx, 0xfff
add dword [rcx + r8], r9d
jmp 0x180049da0
cmp ax, 1
jne 0x180049d8f
and ecx, 0xfff
mov rax, r9
shr rax, 0x10
add word [rcx + r8], ax
jmp 0x180049da0
cmp ax, 2
jne 0x180049da0
and ecx, 0xfff
add word [rcx + r8], r9w
add r11, 2
test r10, r10
jne 0x180049d40
mov eax, dword [rbx + 4]
add rbx, rax
mov eax, dword [rbx + 4]
test eax, eax
jne 0x180049d20
mov ebx, dword [r15 + 0x28]
xor edx, edx
xor r8d, r8d
add rbx, r14
lea rcx, [rdx - 1]
call qword [rsp + reloc.WLDAP32.dll_Ordinal_32]
mov edi, 1
xor r8d, r8d
mov edx, edi
mov rcx, r14
call rbx
cmp dword [r15 + 0x8c], 0
je 0x180049e90
mov r11d, dword [r15 + 0x88]
add r11, r14
mov ebx, dword [r11 + 0x18]
test ebx, ebx
je 0x180049e90
cmp dword [r11 + 0x14], 0
je 0x180049e90
mov r8d, dword [r11 + 0x20]
xor ebp, ebp
mov r10d, dword [r11 + 0x24]
add r8, r14
add r10, r14
mov r9d, ebp
test ebx, ebx
je 0x180049e90
mov esi, dword [rsp + 0x90]
nop word [rax + rax]
mov edx, dword [r8]
mov ecx, ebp
add rdx, r14
movzx eax, byte [rdx]
nop dword [rax + rax]
ror ecx, 0xd
lea rdx, [rdx + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [rdx]
test al, al
jne 0x180049e40
cmp ecx, esi
je 0x180049e69
inc r9d
add r8, 4
add r10, 2
cmp r9d, ebx
jb 0x180049e30
jmp 0x180049e90
movzx edx, word [r10]
mov ecx, dword [r11 + 0x1c]
add rcx, r14
mov eax, dword [rcx + rdx*4]
mov edx, dword [rsp + 0xa0]
add rax, r14
mov rcx, qword [rsp + 0x98]
call rax
test eax, eax
cmovne edi, ebp
mov rax, qword [rsp + 0x30]
mov ecx, edi
test rax, rax
je 0x180049ea0
call rax
jmp 0x180049ea4
call qword [rsp + Ordinal_41]
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret