Function at 0x18000dea0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor ebx, ebx
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rdi, qword [rcx + 0x10]
call fcn.18000d830
test al, al
je 0x18000e03c
lea rax, str.Found_TNameEntryArray_GNames_at_offset_0x:X_n
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 0x30
mov eax, dword [0x1800851a0]
mov dword [rbp - 0x48], eax
movabs rax, 0x1000000000000000
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x40], 1
lea rax, [rbp - 0x50]
mov qword [rbp - 0x38], rax
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm0
movaps xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x30], xmm1
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x20]
call fcn.180013590
nop
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
call fcn.180013760
mov rcx, rax
call fcn.180011760
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x18000df92
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000df8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000e293
call fcn.180025e30
movsxd rax, dword [0x1800851a0]
mov rsi, qword [rax + rdi]
mov byte [0x1800851a4], 0
mov edi, ebx
test rsi, rsi
je 0x18000dff3
mov rcx, rsi
call fcn.18000afc0
test al, al
jne 0x18000dff3
mov r8d, ebx
mov rcx, rbx
nop dword [rax]
mov rax, qword [rcx + rsi]
mov rdx, rax
shr rdx, 0x20
test rax, rax
jne 0x18000dfd4
inc edi
jmp 0x18000dfe2
test edi, edi
jne 0x18000dfdc
inc ebx
jmp 0x18000dfe2
jle 0x18000dfe2
cmp edx, ebx
je 0x18000dfff
add r8d, 8
add rcx, 8
cmp rcx, 0x800
jl 0x18000dfc0
lea rdx, str.The_address_that_was_found_couldnt_be_used_by_the_generator__this_might_be_due_to_GNames_encryption._n
jmp 0x18000e25e
mov dword [0x180085304], r8d
lea eax, [r8 + 4]
mov dword [0x180085300], eax
lea rax, [0x18000d660]
mov qword [0x1800851b0], rax
mov qword [0x180085060], rsi
mov byte [0x1800851a4], 0
xor edx, edx
xor ecx, ecx
call fcn.18000d040
mov al, 1
jmp 0x18000e274
call fcn.18000da20
test al, al
je 0x18000e257
lea rax, str.Found_FNamePool_GNames_at_offset_0x:X_n
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 0x2a
mov eax, dword [0x1800851a0]
mov dword [rbp - 0x28], eax
movabs rax, 0x1000000000000000
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x40], 1
lea rax, [rbp - 0x30]
mov qword [rbp - 0x38], rax
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm0
movaps xmm1, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x50], xmm1
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.180013590
nop
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
call fcn.180013760
mov rcx, rax
call fcn.180011760
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x18000e102
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000e0fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000e28d
call fcn.180025e30
movsxd rsi, dword [0x1800851a0]
add rsi, rdi
mov byte [0x1800851a4], 1
mov dword [0x180085300], ebx
mov r12d, 4
mov dword [0x18008530c], r12d
mov r11d, 0x10
mov dword [0x180085308], r11d
mov edi, ebx
mov r15, rsi
nop dword [rax + rax]
mov r14d, dword [rsi]
lea eax, [r14 - 1]
cmp eax, 0xffff
ja 0x18000e1aa
mov r9d, ebx
xor r10b, r10b
mov edx, ebx
mov eax, edi
and eax, 0x80000007
jge 0x18000e166
dec eax
or eax, 0xfffffff8
inc eax
lea ecx, [rax + rdi]
movsxd r8, ecx
add r8, 8
add r8, r15
add ecx, 8
cmp qword [r8], 0
je 0x18000e18b
inc r9d
test r10b, r10b
jne 0x18000e18b
mov r10b, 1
lea r11d, [rcx + rdx]
add edx, 8
add r8, 8
cmp edx, 0x10000
jl 0x18000e176
mov dword [0x180085308], r11d
lea eax, [r9 - 1]
cmp r14d, eax
je 0x18000e1c1
add edi, r12d
add rsi, r12
cmp edi, 0x20
jl 0x18000e140
lea rdx, str.The_address_that_was_found_couldnt_be_used_by_the_generator__this_might_be_due_to_GNames_encryption._n
jmp 0x18000e25e
mov dword [0x180085300], edi
lea eax, [rdi + 4]
mov dword [0x18008530c], eax
movsxd r8, r11d
add r8, r15
mov ecx, ebx
mov rax, qword [r8]
movabs rdx, 0x6a624f5565726f43
cmp dword [rax], 0x656e6f4e
jne 0x18000e1f7
test rbx, rbx
jne 0x18000e1f7
movsxd rbx, ecx
jmp 0x18000e1fc
cmp qword [rax], rdx
je 0x18000e212
inc ecx
inc rax
cmp ecx, 0x1000
jl 0x18000e1e5
lea rdx, str.The_address_that_was_found_couldnt_be_used_by_the_generator__this_might_be_due_to_GNames_encryption._n
jmp 0x18000e25e
mov eax, 2
cmp rbx, rax
cmove r12, rax
mov qword [0x180085198], r12
lea rax, [0x18000d6d0]
mov qword [0x1800851b0], rax
mov byte [0x1800851a4], 1
mov rdx, rbx
mov rcx, r8
call fcn.18000d040
mov qword [0x180085060], r15
mov byte [0x1800851a4], 1
mov al, 1
jmp 0x18000e274
lea rdx, str.Could_not_find_GNames__n
lea rcx, [0x1800839e0]
call fcn.1800114b0
mov rcx, rax
call fcn.180011760
xor al, al
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.180032be4
int3
call fcn.180032be4
int3