Function at 0x14000c300
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rax, qword gs:[0x30]
cmp qword [rax + 0x58], 0
je 0x14000c50d
mov rax, qword [0x1400f24f0]
mov rcx, qword [rax + 0x60]
add rcx, 0x28
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x1400f24f0]
mov r9, qword [rax + 0x60]
mov rdx, qword [r9 + 0x50]
lea r8, [r9 + 0x50]
cmp rdx, r8
je 0x14000c37f
nop word [rax + rax]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x48]
cmp qword [rdx + 0x10], rcx
je 0x14000c503
mov rdx, qword [rdx]
cmp rdx, r8
jne 0x14000c360
mov rax, qword gs:[0x30]
xor edx, edx
mov rcx, qword [rax + 0x60]
lea r8d, [rdx + 0x28]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x14000c5b3
mov rcx, qword gs:[0x30]
mov r8d, 0x818
mov rdx, qword [rcx + 0x58]
mov qword [rax + 0x18], rdx
mov edx, 8
mov rcx, qword gs:[0x30]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rbx + 0x20], rax
mov rcx, qword gs:[0x30]
mov rdx, qword [rcx + 0x48]
mov qword [rbx + 0x10], rdx
test rax, rax
je 0x14000c578
mov rdx, qword [rbx + 0x18]
lea rcx, [rax + 0x10]
mov qword [rbx + 0x20], rcx
mov rax, qword gs:[0x30]
mov r8d, dword [rdx - 0x10]
cmp r8, qword [rax + 0x48]
je 0x14000c425
lea r8, [r8*8]
call fcn.14009ade0
mov rcx, qword gs:[0x30]
mov rax, qword [rbx + 0x20]
mov qword [rcx + 0x58], rax
mov rax, qword [0x1400f24f0]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x58]
add rcx, 0x50
mov qword [rbx], rcx
mov qword [rbx + 8], rax
mov qword [rax], rbx
mov qword [rcx + 8], rbx
mov rax, qword [0x1400f24f0]
mov rcx, qword [rax + 0x60]
add rcx, 0x28
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [0x1400f24f0]
mov rcx, qword [rax + 0x60]
add rcx, 0x20
call qword [sym.imp.ntdll.dll_RtlAcquireSRWLockShared]
mov rax, qword gs:[0x30]
mov rcx, qword [0x1400f24f0]
mov r14, qword [rax + 0x58]
mov rax, qword [rcx + 0x60]
mov rbx, qword [rax]
cmp rbx, rax
je 0x14000c55d
mov rdi, qword [rbx + 0x18]
sub rdi, qword [rbx + 0x10]
je 0x14000c525
mov rax, qword gs:[0x30]
mov r8, rdi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
test rax, rax
je 0x14000c525
mov rdx, qword [rbx + 0x10]
mov r8, rdi
mov rcx, rax
call fcn.14009ade0
mov ecx, dword [rbx + 0x34]
mov qword [r14 + rcx*8], rsi
mov rcx, qword [0x1400f24f0]
mov rbx, qword [rbx]
cmp rbx, qword [rcx + 0x60]
jne 0x14000c4a5
mov rcx, qword [rcx + 0x60]
add rcx, 0x20
jmp 0x14000c561
lea rcx, [r9 + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov rax, qword gs:[0x30]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword [0x1400f24f0]
mov rcx, qword [rax + 0x60]
add rcx, 0x20
call qword [sym.imp.ntdll.dll_RtlReleaseSRWLockShared]
mov eax, 8
jmp 0x14000c50f
lea rcx, [rax + 0x20]
call qword [sym.imp.ntdll.dll_RtlReleaseSRWLockShared]
mov rax, qword [0x1400f24f0]
mov rcx, qword [rax + 0x60]
lock inc dword [rcx + 0x60]
jmp 0x14000c50d
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword [0x1400f24f0]
mov rcx, qword [rax + 0x60]
add rcx, 0x28
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 8
jmp 0x14000c50f
mov rcx, qword [0x1400f24f0]
mov rcx, qword [rcx + 0x60]
add rcx, 0x28
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 8
jmp 0x14000c50f