Function at 0x18000e630
Capabilities:
Access peb ldr_data
Get ntdll base address
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x80
xor ecx, ecx
mov qword [rax - 0x10], rbx
mov qword [rax - 0x18], rbp
mov r10d, ecx
mov qword [rax - 0x20], rsi
mov ebp, ecx
mov qword [rax - 0x28], r12
mov edi, 0xffff
mov qword [rax - 0x30], r13
mov r12d, ecx
mov qword [rax - 0x38], r14
mov r13, rdx
mov qword [rax - 0x40], r15
mov r15d, ecx
mov rax, qword gs:[0x60]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x28], rcx
mov r9, qword [rax + 0x18]
mov r14, qword [r9 + 0x20]
mov qword [rsp + 0x30], r14
test r14, r14
je 0x18000e8d0
mov r13d, ecx
jmp 0x18000e6b2
xor ecx, ecx
mov r8, qword [r14 + 0x50]
mov rdx, rcx
movzx r9d, word [r14 + 0x48]
nop
movzx ecx, byte [r8]
lea r8, [r8 + 1]
ror edx, 0xd
mov eax, edx
add rax, rcx
cmp cl, 0x61
lea rdx, [rax - 0x20]
cmovb rdx, rax
add r9w, di
jne 0x18000e6c0
cmp edx, 0x6a4abc5b
jne 0x18000e7d7
mov r9, qword [r14 + 0x20]
mov r11d, 4
movsxd rax, dword [r9 + 0x3c]
mov esi, dword [rax + r9 + 0x88]
add rsi, r9
mov ebx, dword [rsi + 0x20]
mov edi, dword [rsi + 0x24]
add rbx, r9
mov r10d, dword [rsi + 0x18]
add rdi, r9
test r10d, r10d
je 0x18000e894
mov ecx, dword [rbx]
add rcx, r9
xor r8d, r8d
movzx eax, byte [rcx]
nop word [rax + rax]
ror r8d, 0xd
lea rcx, [rcx + 1]
movsx eax, al
add r8d, eax
movzx eax, byte [rcx]
test al, al
jne 0x18000e730
cmp r8d, 0xec0e4e8e
je 0x18000e769
cmp r8d, 0x7c0dfcaa
je 0x18000e769
cmp r8d, 0x91afca54
je 0x18000e769
cmp r8d, 0x60e0ceef
jne 0x18000e7be
mov ecx, dword [rsi + 0x1c]
movzx edx, word [rdi]
add rcx, r9
cmp r8d, 0xec0e4e8e
jne 0x18000e784
mov r12d, dword [rcx + rdx*4]
add r12, r9
jmp 0x18000e7bb
cmp r8d, 0x7c0dfcaa
jne 0x18000e796
mov r15d, dword [rcx + rdx*4]
add r15, r9
jmp 0x18000e7bb
cmp r8d, 0x91afca54
jne 0x18000e7a7
mov ebp, dword [rcx + rdx*4]
add rbp, r9
jmp 0x18000e7bb
cmp r8d, 0x60e0ceef
jne 0x18000e7bb
mov eax, dword [rcx + rdx*4]
add rax, r9
mov qword [rsp + 0x20], rax
dec r11d
add rbx, 4
add rdi, 2
dec r10d
test r11d, r11d
jne 0x18000e716
jmp 0x18000e894
cmp edx, 0x3cfa685d
jne 0x18000e89e
mov r9, qword [r14 + 0x20]
mov r11d, 2
movsxd rax, dword [r9 + 0x3c]
mov esi, dword [rax + r9 + 0x88]
add rsi, r9
mov ebx, dword [rsi + 0x20]
mov edi, dword [rsi + 0x24]
add rbx, r9
mov r10d, dword [rsi + 0x18]
add rdi, r9
nop dword [rax]
test r10d, r10d
je 0x18000e88a
mov ecx, dword [rbx]
add rcx, r9
xor r8d, r8d
movzx eax, byte [rcx]
ror r8d, 0xd
lea rcx, [rcx + 1]
movsx eax, al
add r8d, eax
movzx eax, byte [rcx]
test al, al
jne 0x18000e820
cmp r8d, 0x534c0ab8
je 0x18000e847
cmp r8d, 0xff7f061a
jne 0x18000e87a
mov ecx, dword [rsi + 0x1c]
movzx edx, word [rdi]
add rcx, r9
cmp r8d, 0x534c0ab8
jne 0x18000e862
mov r13d, dword [rcx + rdx*4]
add r13, r9
jmp 0x18000e877
cmp r8d, 0xff7f061a
jne 0x18000e877
mov r14d, dword [rcx + rdx*4]
add r14, r9
mov qword [rsp + 0x38], r14
dec r11d
add rbx, 4
add rdi, 2
dec r10d
test r11d, r11d
jne 0x18000e810
mov r14, qword [rsp + 0x30]
mov qword [rsp + 0x28], r13
mov r10, qword [rsp + 0x20]
mov edi, 0xffff
test r12, r12
je 0x18000e8b7
test r15, r15
je 0x18000e8b7
test rbp, rbp
je 0x18000e8b7
test r10, r10
je 0x18000e8b7
test r13, r13
jne 0x18000e8c8
mov r14, qword [r14]
mov qword [rsp + 0x30], r14
test r14, r14
jne 0x18000e6b0
mov r13, qword [rsp + 0x98]
movsxd rbx, dword [r13 + 0x3c]
xor ecx, ecx
add rbx, r13
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
mov edx, dword [rbx + 0x50]
call rbp
mov edx, dword [rbx + 0x54]
mov r14, rax
mov rax, r13
test edx, edx
je 0x18000e910
mov r8, r14
sub r8, r13
nop dword [rax + rax]
movzx ecx, byte [rax]
mov byte [r8 + rax], cl
lea rax, [rax + 1]
add edx, 0xffffffff
jne 0x18000e900
movzx r9d, word [rbx + 0x14]
movzx r10d, word [rbx + 6]
add r9, 0x2c
test r10w, r10w
je 0x18000e96c
add r9, rbx
nop word [rax + rax]
mov ecx, dword [r9 - 8]
add r10w, di
mov edx, dword [r9]
add rcx, r14
mov r8d, dword [r9 - 4]
add rdx, r13
test r8d, r8d
je 0x18000e962
nop word [rax + rax]
movzx eax, byte [rdx]
inc rdx
mov byte [rcx], al
lea rcx, [rcx + 1]
add r8d, 0xffffffff
jne 0x18000e950
add r9, 0x28
test r10w, r10w
jne 0x18000e930
mov ebp, dword [rbx + 0x90]
mov r13, qword [rsp + 0x58]
add rbp, r14
mov eax, dword [rbp + 0xc]
test eax, eax
je 0x18000e9fd
mov ecx, eax
add rcx, r14
call r12
mov edi, dword [rbp + 0x10]
mov rsi, rax
mov ebx, dword [rbp]
add rdi, r14
add rbx, r14
cmp qword [rdi], 0
je 0x18000e9f2
nop
test rbx, rbx
je 0x18000e9d1
mov rdx, qword [rbx]
test rdx, rdx
jns 0x18000e9d1
movsxd rax, dword [rsi + 0x3c]
movzx edx, dx
mov ecx, dword [rax + rsi + 0x88]
mov eax, dword [rcx + rsi + 0x10]
mov ecx, dword [rcx + rsi + 0x1c]
sub rdx, rax
add rcx, rsi
mov eax, dword [rcx + rdx*4]
add rax, rsi
jmp 0x18000e9e1
mov rdx, qword [rbx]
mov rcx, rsi
add rdx, 2
add rdx, r14
call r15
mov qword [rdi], rax
add rbx, 8
add rdi, 8
cmp qword [rdi], 0
jne 0x18000e9a0
mov eax, dword [rbp + 0x20]
add rbp, 0x14
test eax, eax
jne 0x18000e981
movsxd rdi, dword [r14 + 0x3c]
mov r9, r14
mov r15, qword [rsp + 0x48]
add rdi, r14
mov r12, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
sub r9, qword [rdi + 0x30]
cmp dword [rdi + 0xb4], 0
je 0x18000eae1
mov ebx, dword [rdi + 0xb0]
add rbx, r14
mov eax, dword [rbx + 4]
test eax, eax
je 0x18000eae1
nop dword [rax + rax]
mov r8d, dword [rbx]
lea r11, [rbx + 8]
mov r10d, eax
add r8, r14
sub r10, 8
shr r10, 1
je 0x18000ead3
nop word [rax + rax]
movzx edx, word [r11]
dec r10
movzx ecx, dx
movzx eax, dx
shr cx, 0xc
cmp cx, 0xa
jne 0x18000ea8b
and edx, 0xfff
mov rax, qword [rdx + r8]
lea rcx, [r9 + rax]
mov qword [rdx + r8], rcx
jmp 0x18000eac7
cmp cx, 3
jne 0x18000ea9c
and eax, 0xfff
add dword [rax + r8], r9d
jmp 0x18000eac7
cmp cx, 1
jne 0x18000eab7
and eax, 0xfff
lea rcx, [rax + r8]
mov rax, r9
shr rax, 0x10
add word [rcx], ax
jmp 0x18000eac7
cmp cx, 2
jne 0x18000eac7
and eax, 0xfff
add word [rax + r8], r9w
add r11, 2
test r10, r10
jne 0x18000ea60
mov eax, dword [rbx + 4]
add rbx, rax
mov eax, dword [rbx + 4]
test eax, eax
jne 0x18000ea40
mov ebx, dword [rdi + 0x28]
xor edx, edx
xor r8d, r8d
add rbx, r14
lea rcx, [rdx - 1]
call qword [rsp + 0x28]
mov r8, qword [rsp + 0x90]
mov edi, 1
mov edx, edi
mov rcx, r14
call rbx
movsxd rax, dword [r14 + 0x3c]
cmp dword [rax + r14 + 0x8c], 0
je 0x18000ebb0
mov r11d, dword [rax + r14 + 0x88]
add r11, r14
mov r10d, dword [r11 + 0x18]
test r10d, r10d
je 0x18000ebb0
cmp dword [r11 + 0x14], 0
je 0x18000ebb0
mov r8d, dword [r11 + 0x20]
mov r9d, dword [r11 + 0x24]
add r8, r14
mov ebx, dword [rsp + 0xa0]
add r9, r14
xor esi, esi
mov edx, dword [r8]
mov ecx, esi
add rdx, r14
movzx eax, byte [rdx]
nop dword [rax]
ror ecx, 0xd
lea rdx, [rdx + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [rdx]
test al, al
jne 0x18000eb60
cmp ecx, ebx
je 0x18000eb87
add r8, 4
add r9, 2
add r10d, 0xffffffff
jne 0x18000eb51
jmp 0x18000ebb0
movzx ecx, word [r9]
mov eax, dword [r11 + 0x1c]
mov edx, dword [rsp + 0xb0]
add rax, r14
mov r8d, dword [rax + rcx*4]
mov rcx, qword [rsp + 0xa8]
add r8, r14
call r8
test eax, eax
cmovne edi, esi
mov rax, qword [rsp + 0x38]
mov ecx, edi
mov r14, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x78]
test rax, rax
je 0x18000ebd6
add rsp, 0x80
pop rdi
jmp rax
mov rax, qword [rsp + 0x20]
add rsp, 0x80
pop rdi
jmp rax