Function at 0x1800da640
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
and qword [rbp - 0x28], 0
or r13, 0xffffffffffffffff
and qword [rbp + 0x48], 0
mov r15, rdx
and qword [rbp - 0x18], 0
mov qword [rbp - 0x30], r13
lea edi, [r13 + 2]
cmp r8d, edi
je 0x1800da689
mov ebx, 0xc0000058
jmp 0x1800da78d
mov qword [rsp + 0x30], rcx
mov ebx, 2
mov dword [rsp + 0x28], 0x8000000
lea rcx, [rbp - 0x30]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
mov edx, 0xf0005
call sym.ntdll.dll_NtCreateSection
mov rcx, qword [rbp - 0x30]
cmp rcx, r13
je 0x1800da888
test eax, eax
js 0x1800da888
and dword [rbp - 0x20], 0
lea rax, [rbp - 0x10]
and dword [rbp - 0x1c], 0
lea r8, [rbp + 0x48]
and qword [rbp - 0x10], 0
xor r9d, r9d
mov dword [rsp + 0x48], ebx
mov rdx, r13
and dword [rsp + 0x40], 0
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
call sym.ntdll.dll_NtMapViewOfSection
mov rcx, qword [rbp - 0x30]
mov ebx, eax
call sym.ntdll.dll_NtClose
mov rax, qword [rbp + 0x48]
test rax, rax
je 0x1800da87e
test ebx, ebx
js 0x1800da87e
lea rcx, [rbp - 0x18]
mov r8d, edi
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x40]
mov rcx, rax
xor edx, edx
call fcn.18001014c
test eax, eax
jns 0x1800da7ab
cmp eax, 0xc0000002
jne 0x1800da752
xor edi, edi
jmp 0x1800da7af
mov ebx, 0xc0000089
mov rax, qword [rbp + 0x48]
test rax, rax
je 0x1800da78d
mov rdx, rax
mov rcx, r13
call sym.ntdll.dll_NtUnmapViewOfSection
cmp eax, 0xc0000045
jne 0x1800da78d
mov rcx, qword [rbp + 0x48]
xor edx, edx
call sym.ntdll.dll_RtlFlushSecureMemoryCache
test al, al
je 0x1800da78d
mov rdx, qword [rbp + 0x48]
mov rcx, r13
call sym.ntdll.dll_NtUnmapViewOfSection
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
mov rdi, qword [rbp - 0x18]
mov rcx, qword [rbp + 0x48]
call sym.ntdll.dll_RtlImageNtHeader
mov rsi, rax
test rdi, rdi
je 0x1800da860
mov r8d, dword [rdi + 0xc]
test r8d, r8d
je 0x1800da860
cmp dword [rdi + 0x10], 0
je 0x1800da860
mov rdx, qword [rbp + 0x48]
mov rcx, rsi
call sym.ntdll.dll_RtlAddressInSectionTable
mov r14, rax
test rax, rax
je 0x1800da877
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
lea r8d, [rdx + 0x18]
call sym.ntdll.dll_RtlAllocateHeap
mov rbx, rax
test rax, rax
je 0x1800da870
and qword [rax + 0x10], 0
lea rdx, [rbp - 0x28]
and qword [rax], 0
mov rcx, rax
mov qword [rax + 8], r14
call fcn.1800da5b4
mov rdx, qword [rbp + 0x48]
mov eax, 0x10b
mov r9, rdi
mov r8, rsi
mov rcx, rbx
cmp word [rsi + 0x18], ax
jne 0x1800da84b
call fcn.1800da358
jmp 0x1800da850
call fcn.1800da414
mov ebx, eax
test eax, eax
js 0x1800da88d
add rdi, 0x14
jne 0x1800da7c4
mov rcx, qword [rbp - 0x28]
mov rdx, r15
call fcn.1800da4d0
mov ebx, eax
jmp 0x1800da88d
mov ebx, 0xc0000017
jmp 0x1800da88d
mov ebx, 0xc000008b
jmp 0x1800da88d
mov ebx, 0xc0000019
jmp 0x1800da75b
mov ebx, 0xc0000008
mov rdi, qword [rbp - 0x28]
test rdi, rdi
je 0x1800da757
mov rsi, qword [rdi]
mov r8, qword [rdi + 0x10]
test r8, r8
je 0x1800da8ca
mov r14, qword [r8]
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlFreeHeap
mov r8, r14
test r14, r14
je 0x1800da8ca
mov r14, qword [r14]
jmp 0x1800da8a9
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlFreeHeap
mov rdi, rsi
test rsi, rsi
je 0x1800da757
mov rsi, qword [rsi]
jmp 0x1800da89d