Function at 0x7fff25d8e730
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14d, r9d
mov r15, r8
mov esi, edx
mov r12, rcx
and dword [rax - 0x38], 0
mov rdi, qword [0x7fff25fd2548]
mov qword [rsp + 0x28], rdi
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
nop dword [rax + rax]
lea eax, [rsi + r14]
lea eax, [rax*2 + 0x20]
mov r13d, eax
mov rcx, qword gs:[0x60]
mov r8d, eax
mov edx, dword [0x7fff25fd0c80]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x7fff25d8e8b7
mov r8d, r13d
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
mov word [rbx + 0x14], si
mov word [rbx + 0x16], r14w
test r12, r12
je 0x7fff25d8e7e0
mov r8d, esi
add r8, r8
lea rcx, [rbx + 0x18]
mov rdx, r12
call sub.ntdll.dll_memcpy
test r15, r15
jne 0x7fff25d8e852
and dword [rbx + 0x10], 0
xor esi, esi
mov dword [rsp + 0x24], esi
movzx ecx, word [rbx + 0x14]
movzx eax, word [rbx + 0x16]
add ecx, eax
cmp esi, ecx
jae 0x7fff25d8e818
movzx ecx, word [rbx + rsi*2 + 0x18]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
nop dword [rax + rax]
movzx eax, ax
add dword [rbx + 0x10], eax
inc esi
jmp 0x7fff25d8e7eb
lea rax, [rdi + 0x48]
mov rcx, qword [rax + 8]
cmp qword [rcx], rax
jne 0x7fff25d8e8b0
mov qword [rbx], rax
mov qword [rbx + 8], rcx
mov qword [rcx], rbx
mov qword [rax + 8], rbx
mov ecx, dword [rdi + 0x28]
cmp ecx, 0x80
jae 0x7fff25d8e86d
lea eax, [rcx + 1]
mov dword [rdi + 0x28], eax
mov dword [rsp + 0x20], 1
jmp 0x7fff25d8e8b7
mov r8, r14
add r8, r8
lea rax, [rsi + 0xc]
lea rcx, [rbx + rax*2]
mov rdx, r15
call sub.ntdll.dll_memcpy
jmp 0x7fff25d8e7e5
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
cmp qword [rdx + 8], rax
jne 0x7fff25d8e8b0
cmp qword [rcx], rax
jne 0x7fff25d8e8b0
mov qword [rcx], rdx
mov qword [rdx + 8], rcx
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x30]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
jmp 0x7fff25d8e848
mov ecx, 3
int 0x29
cmp dword [rsp + 0x20], 0
je 0x7fff25d8e8f4
inc dword [rdi + 0x34]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
nop dword [rax + rax]
mov eax, dword [rsp + 0x20]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
ret
inc dword [rdi + 0x38]
jmp 0x7fff25d8e8c1
sub rsp, 0x28
mov r10, r8
test r8, r8
je 0x7fff25d8e927
sub ecx, 1
je 0x7fff25d8e92d
sub ecx, 1
je 0x7fff25df09b0
cmp ecx, 1
jne 0x7fff25d8e927
mov rcx, r8
call fcn.7fff25d90c70
add rsp, 0x28
ret
mov ecx, edx
call fcn.7fff25d8e958
test eax, eax
je 0x7fff25d8e927
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [r10 + 0x18]
mov edx, dword [r10 + 0x20]
add rsp, 0x28
jmp 0x7fff25d8e730
mov ecx, edx
call fcn.7fff25d8e958
test eax, eax
je 0x7fff25df09cc
mov r9d, dword [r8 + 0x30]
xor edx, edx
mov r8, qword [r8 + 0x28]
xor ecx, ecx
jmp 0x7fff25d8e946
cmp edx, 0xc0000464
jne 0x7fff25d8e927
mov r9d, dword [r8 + 0x30]
mov r8, qword [r8 + 0x28]
jmp 0x7fff25d8e93e