Function at 0x18009c550
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rbx, qword [rax + 0x20]
mov edi, dword [rax]
test rbx, rbx
je 0x18009c5b0
nop dword [rax]
mov eax, edi
dec edi
test eax, eax
jle 0x18009c5b0
mov rcx, qword [rbx + 0x20]
lea r8, str.InitializeSRWLock
lea rdx, str.kernel32.dll
call fcn.18009b110
test rax, rax
jne 0x18009c82d
mov rbx, qword [rbx]
test rbx, rbx
jne 0x18009c580
xor esi, esi
mov rax, qword gs:[0x30]
mov qword [rsp + 0xb0], rsi
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rbx, qword [rax + 0x20]
mov edi, dword [rax]
test rbx, rbx
je 0x18009c606
mov eax, edi
dec edi
test eax, eax
jle 0x18009c606
mov rcx, qword [rbx + 0x20]
lea r8, str.RtlInitializeSRWLock
lea rdx, str.ntdll.dll
call fcn.18009b110
test rax, rax
jne 0x18009c835
mov rbx, qword [rbx]
test rbx, rbx
jne 0x18009c5d6
xor edi, edi
xor ebx, ebx
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0x30], rbx
xor ebp, ebp
mov r15d, 0x15ff
mov r14d, 0x2a0
nop word [rax + rax]
mov rax, qword gs:[0x30]
lea rdx, [rbp + 1]
test rbp, rbp
cmove rdx, rbp
mov rcx, qword [rax + 0x60]
mov r9, qword [rcx + 0x10]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x50]
lea r8, [rcx + r9]
test rdx, rdx
je 0x18009c670
cmp rdx, r9
jb 0x18009c9b4
cmp rdx, r8
ja 0x18009c9b4
sub r8, rdx
mov dword [rsp + 0x20], 0
test rdx, rdx
cmove r8, rcx
cmove rdx, r9
xor r9d, r9d
lea rcx, str.48_8D_0D_________E8
call fcn.18009b620
mov rbp, rax
test rax, rax
je 0x18009c9b4
mov rcx, qword gs:[0x30]
movsxd r11, dword [rax + 8]
add r11, 0xc
add r11, rax
mov rdx, qword [rcx + 0x60]
mov qword [rsp + 0xa0], r11
mov r8, qword [rdx + 0x10]
cmp r11, r8
jbe 0x18009c99a
movsxd rax, dword [r8 + 0x3c]
mov ecx, dword [rax + r8 + 0x50]
add rcx, r8
cmp r11, rcx
jae 0x18009c99a
mov r9, r11
mov qword [rsp + 0xa8], r11
neg r9
mov rbx, rbp
mov qword [rsp + 0x40], r9
mov r13, r11
nop dword [rax]
cmp word [r13], r15w
jne 0x18009c93d
mov rax, qword gs:[0x30]
movsxd r8, dword [r13 + 2]
add r8, 6
add r8, r13
mov rcx, qword [rax + 0x60]
mov rdx, qword [rcx + 0x10]
cmp r8, rdx
jbe 0x18009c93d
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x50]
add rcx, rdx
cmp r8, rcx
jae 0x18009c93d
mov rax, qword [r8]
cmp rax, rsi
je 0x18009c755
cmp rax, rdi
jne 0x18009c93d
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rsi, qword [rcx + 0x10]
movsxd rax, dword [rsi + 0x3c]
mov edx, dword [rax + rsi + 0x50]
lea r8, [rsi + rdx]
test r11, r11
je 0x18009c793
cmp r11, rsi
jb 0x18009c85c
cmp r11, r8
ja 0x18009c85c
mov edx, r8d
lea rsi, [r11 + 5]
sub edx, r11d
cmp edx, r14d
cmova edx, r14d
mov ecx, edx
add rcx, r11
cmp rcx, r8
lea eax, [rdx - 0x10]
cmovb eax, edx
mov r13d, eax
test eax, eax
je 0x18009c854
mov r12, rsi
mov rdi, rsi
neg r12
nop dword [rax]
movzx eax, byte [rdi]
sub al, 0x48
test al, 0xfb
jne 0x18009c81f
cmp byte [rdi + 1], 0x8d
jne 0x18009c81f
mov eax, dword [rdi + 3]
add eax, 7
movsxd rdx, eax
mov rax, qword gs:[0x30]
add rdx, r12
add rdx, rdi
add rdx, rsi
mov rcx, qword [rax + 0x60]
mov r8, qword [rcx + 0x10]
cmp rdx, r8
jbe 0x18009c81f
movsxd rax, dword [r8 + 0x3c]
mov ecx, dword [rax + r8 + 0x50]
add rcx, r8
cmp rdx, rcx
jae 0x18009c81f
mov r8d, 0xc
lea rcx, str.ByteProperty
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
je 0x18009c83d
inc rdi
lea rax, [r12 + rdi]
cmp rax, r13
jb 0x18009c7c0
jmp 0x18009c846
mov rsi, qword [rax]
jmp 0x18009c5b2
mov rdi, qword [rax]
jmp 0x18009c608
test rdi, rdi
jne 0x18009c977
mov r11, qword [rsp + 0xa0]
mov r14d, 0x2a0
mov r13, qword [rsp + 0xa8]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rdi, qword [rcx + 0x10]
movsxd rax, dword [rdi + 0x3c]
mov edx, dword [rax + rdi + 0x50]
lea r8, [rdi + rdx]
test r11, r11
je 0x18009c89a
cmp r11, rdi
jb 0x18009c93d
cmp r11, r8
ja 0x18009c93d
mov edx, r8d
lea rdi, [r11 + 5]
sub edx, r11d
cmp edx, r14d
cmova edx, r14d
mov ecx, edx
add rcx, r11
cmp rcx, r8
lea eax, [rdx - 0x10]
cmovb eax, edx
mov r12d, eax
test eax, eax
je 0x18009c93d
mov r15, rdi
mov rsi, rdi
neg r15
movzx eax, byte [rsi]
sub al, 0x48
test al, 0xfb
jne 0x18009c922
cmp byte [rsi + 1], 0x8d
jne 0x18009c922
mov eax, dword [rsi + 3]
add eax, 7
movsxd rdx, eax
mov rax, qword gs:[0x30]
add rdx, rdi
add rdx, r15
add rdx, rsi
mov rcx, qword [rax + 0x60]
mov r8, qword [rcx + 0x10]
cmp rdx, r8
jbe 0x18009c922
movsxd rax, dword [r8 + 0x3c]
mov ecx, dword [rax + r8 + 0x50]
add rcx, r8
cmp rdx, rcx
jae 0x18009c922
mov r8d, 0xc
lea rcx, [0x1800cd728]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x18009c930
inc rsi
lea rax, [r15 + rsi]
cmp rax, r12
jb 0x18009c8c3
jmp 0x18009c935
test rsi, rsi
jne 0x18009c977
mov r11, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x40]
inc r13
add rax, r13
mov qword [rsp + 0xa8], r13
mov r14d, 0x2a0
mov r15d, 0x15ff
cmp rax, 0x50
jge 0x18009c995
mov rsi, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xb8]
jmp 0x18009c700
movsxd rax, dword [rbx + 3]
mov r14d, 0x2a0
add rbx, 7
mov r15d, 0x15ff
add rbx, rax
mov qword [rsp + 0x30], rbx
jmp 0x18009c99a
mov rbx, qword [rsp + 0x30]
test rbx, rbx
jne 0x18009c9b9
mov rsi, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xb8]
jmp 0x18009c630
test rbx, rbx
je 0x18009c9fa
mov rax, qword [0x1800ee2a0]
test rax, rax
jne 0x18009c9dd
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x10]
mov qword [0x1800ee2a0], rax
cmp rbx, rax
jbe 0x18009c9ee
sub ebx, eax
mov al, 1
mov dword [0x1800ee214], ebx
jmp 0x18009c9fc
xor ebx, ebx
mov al, 1
mov dword [0x1800ee214], ebx
jmp 0x18009c9fc
xor al, al
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret