Function at 0x7d2695e0
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x58
mov eax, 1
lock xadd dword [0x7d2ace68], eax
inc eax
cmp eax, 1
jne 0x7d26991e
mov qword [rsp + 0x70], rbx
xor eax, eax
mov qword [rsp + 0x50], rbp
mov ebx, eax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rdi
mov edi, 0x8000
nop dword [rax]
mov ecx, edi
call fcn.7d221988
lea r8, [rsp + 0x60]
mov edx, edi
mov rcx, rax
mov rbp, rax
call qword [sym.imp.ntdll.dll_LdrQueryProcessModuleInformation]
mov esi, eax
test eax, eax
jns 0x7d269663
mov rcx, rbp
call fcn.7d221938
cmp esi, 0xc0000004
jne 0x7d269668
mov edi, dword [rsp + 0x60]
inc ebx
add edi, 0x400
cmp ebx, 6
jb 0x7d269620
jmp 0x7d269668
test rbp, rbp
jne 0x7d269681
mov r8d, esi
lea rdx, str.LoadedModules___08X_
mov ecx, 0x89d
call sym.imfsbDll.dll_SbieApi_Log
jmp 0x7d26990a
mov rdx, qword [0x7d2acf60]
mov qword [rsp + 0x68], rdx
test rdx, rdx
je 0x7d26971e
xor ebx, ebx
cmp dword [rdx], ebx
jbe 0x7d26971e
mov r11d, dword [rbp]
xor r9d, r9d
mov eax, ebx
imul r10, rax, 0x128
add r10, rdx
test r11d, r11d
je 0x7d2696ff
mov rdi, qword [r10 + 0x18]
nop dword [rax]
mov eax, r9d
imul rcx, rax, 0x128
cmp rdi, qword [rcx + rbp + 0x18]
jne 0x7d2696f7
lea r8, [rbp + 0x30]
add r8, rcx
lea rax, [r10 + 0x30]
sub r8, rax
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x7d2696f3
inc rax
test ecx, ecx
jne 0x7d2696e0
test edx, edx
je 0x7d269713
inc r9d
cmp r9d, r11d
jb 0x7d2696c0
movzx eax, word [r10 + 0x2e]
lea rcx, [r10 + 0x30]
add rcx, rax
xor edx, edx
call qword [0x7d2acf28]
mov rdx, qword [rsp + 0x68]
inc ebx
cmp ebx, dword [rdx]
jb 0x7d2696a0
xor esi, esi
cmp dword [rbp], esi
jbe 0x7d2698c3
nop dword [rax]
mov eax, esi
lea rdi, [rbp + 8]
imul rcx, rax, 0x128
add rdi, rcx
test rdx, rdx
je 0x7d2697a8
mov r10d, dword [rdx]
xor r9d, r9d
test r10d, r10d
je 0x7d2697a8
mov r11, qword [rdi + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov eax, r9d
imul rcx, rax, 0x128
cmp qword [rcx + rdx + 0x18], r11
jne 0x7d2697a0
lea rax, [rdx + 0x30]
add rax, rcx
lea r8, [rdi + 0x28]
sub r8, rax
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x7d269793
inc rax
test ecx, ecx
jne 0x7d269780
test edx, edx
je 0x7d2698b3
mov rdx, qword [rsp + 0x68]
inc r9d
cmp r9d, r10d
jb 0x7d269760
cmp dword [0x7d2abfb4], 0x20d0
mov r8, qword [rdi + 0x10]
jb 0x7d2697e3
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov rax, qword [rdx]
cmp rax, rdx
je 0x7d2697e3
cmp qword [rax + 0x30], r8
je 0x7d269893
mov rax, qword [rax]
cmp rax, rdx
jne 0x7d2697d1
xor ebx, ebx
lea rdx, [rdi + 0x28]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitString]
mov r8b, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
mov rcx, qword [rsp + 0x28]
test esi, esi
jne 0x7d269822
cmp word [rcx], si
je 0x7d269822
mov eax, 0x2a
mov word [rcx], ax
mov rcx, qword [rsp + 0x28]
call sub.ntdll.dll__wcslwr
mov rdx, qword [rsp + 0x28]
mov ecx, 0x77b
call sym.imfsbDll.dll_SbieApi_MonitorPut
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
movzx ecx, word [rdi + 0x26]
mov rdx, qword [rdi + 0x10]
add rcx, 0x28
add rcx, rdi
call qword [0x7d2acf28]
test ebx, ebx
je 0x7d2698b3
cmp dword [0x7d2abfb4], 0x20d0
mov r8, qword [rdi + 0x10]
jb 0x7d2698b3
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov rax, qword [rdx]
cmp rax, rdx
je 0x7d2698b3
cmp qword [rax + 0x30], r8
je 0x7d2698a9
mov rax, qword [rax]
cmp rax, rdx
jne 0x7d269883
jmp 0x7d2698b3
mov rax, qword [rax + 0x98]
mov ebx, dword [rax + 0x38]
mov dword [rax + 0x38], 9
jmp 0x7d2697e5
mov rax, qword [rax + 0x98]
mov dword [rax + 0x38], ebx
mov rdx, qword [rsp + 0x68]
inc esi
cmp esi, dword [rbp]
jb 0x7d269730
lea rcx, [0x7d2acf38]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x7d2acf38]
mov qword [0x7d2acf60], rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x7d2698f8
cmp rcx, rbp
je 0x7d2698f8
call fcn.7d221938
xor eax, eax
xchg dword [0x7d2ace68], eax
cmp eax, 1
jle 0x7d26990a
call fcn.7d2695e0
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x40]
add rsp, 0x58
ret