Function at 0x18000ca60
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov rax, qword gs:[0x30]
xor r15d, r15d
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rbx, qword [rax + 0x20]
mov edi, dword [rax]
test rbx, rbx
je 0x18000cac0
mov eax, edi
dec edi
test eax, eax
jle 0x18000cac0
mov rcx, qword [rbx + 0x20]
lea r8, str.InitializeSRWLock
lea rdx, str.kernel32.dll
call fcn.18000a070
test rax, rax
jne 0x18000cd1c
mov rbx, qword [rbx]
test rbx, rbx
jne 0x18000ca90
mov rsi, r15
mov rax, qword gs:[0x30]
mov qword [rsp + 0xa8], rsi
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rbx, qword [rax + 0x20]
mov edi, dword [rax]
test rbx, rbx
je 0x18000cb17
mov eax, edi
dec edi
test eax, eax
jle 0x18000cb17
mov rcx, qword [rbx + 0x20]
lea r8, str.RtlInitializeSRWLock
lea rdx, str.ntdll.dll
call fcn.18000a070
test rax, rax
jne 0x18000cd24
mov rbx, qword [rbx]
test rbx, rbx
jne 0x18000cae7
mov rbx, r15
mov qword [rsp + 0xa0], rbx
mov r12, r15
mov r14d, 0x15ff
mov edi, 0x2a0
mov rax, qword gs:[0x30]
lea rdx, [r12 + 1]
test r12, r12
cmove rdx, r12
mov rcx, qword [rax + 0x60]
mov r9, qword [rcx + 0x10]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x50]
lea r8, [rcx + r9]
test rdx, rdx
je 0x18000cb71
cmp rdx, r9
jb 0x18000cecd
cmp rdx, r8
ja 0x18000cecd
sub r8, rdx
mov dword [rsp + 0x20], r15d
test rdx, rdx
cmove r8, rcx
cmove rdx, r9
xor r9d, r9d
lea rcx, str.48_8D_0D_________E8
call fcn.18000a570
mov r12, rax
test rax, rax
je 0x18000cecd
mov rcx, qword gs:[0x30]
movsxd r13, dword [rax + 8]
add r13, 0xc
add r13, rax
mov rdx, qword [rcx + 0x60]
mov r8, qword [rdx + 0x10]
cmp r13, r8
jbe 0x18000cb30
movsxd rax, dword [r8 + 0x3c]
mov ecx, dword [rax + r8 + 0x50]
add rcx, r8
cmp r13, rcx
jae 0x18000cb30
mov r10, r13
mov qword [rsp + 0x90], r13
neg r10
mov r9, r13
mov qword [rsp + 0x98], r10
mov rbp, r12
cmp word [r9], r14w
jne 0x18000ce31
mov rax, qword gs:[0x30]
movsxd r8, dword [r9 + 2]
add r8, 6
add r8, r9
mov rcx, qword [rax + 0x60]
mov rdx, qword [rcx + 0x10]
cmp r8, rdx
jbe 0x18000ce31
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x50]
add rcx, rdx
cmp r8, rcx
jae 0x18000ce31
mov rax, qword [r8]
cmp rax, rsi
je 0x18000cc49
cmp rax, rbx
jne 0x18000ce31
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rsi, qword [rcx + 0x10]
movsxd rax, dword [rsi + 0x3c]
mov edx, dword [rax + rsi + 0x50]
lea r8, [rsi + rdx]
test r13, r13
je 0x18000cc87
cmp r13, rsi
jb 0x18000cd4a
cmp r13, r8
ja 0x18000cd4a
mov edx, r8d
lea rsi, [r13 + 5]
sub edx, r13d
cmp edx, edi
cmova edx, edi
mov ecx, edx
add rcx, r13
cmp rcx, r8
lea eax, [rdx - 0x10]
cmovb eax, edx
mov r14d, eax
test eax, eax
je 0x18000cd4a
mov rdi, rsi
mov rbx, rsi
neg rdi
nop
movzx eax, byte [rbx]
sub al, 0x48
test al, 0xfb
jne 0x18000cd0e
cmp byte [rbx + 1], 0x8d
jne 0x18000cd0e
mov eax, dword [rbx + 3]
add eax, 7
movsxd rdx, eax
mov rax, qword gs:[0x30]
add rdx, rdi
add rdx, rbx
add rdx, rsi
mov rcx, qword [rax + 0x60]
mov r8, qword [rcx + 0x10]
cmp rdx, r8
jbe 0x18000cd0e
movsxd rax, dword [r8 + 0x3c]
mov ecx, dword [rax + r8 + 0x50]
add rcx, r8
cmp rdx, rcx
jae 0x18000cd0e
mov r8d, 0xc
lea rcx, [0x180074ca8]
call fcn.18003085c
test eax, eax
je 0x18000cd2c
inc rbx
lea rax, [rdi + rbx]
cmp rax, r14
jb 0x18000ccb0
jmp 0x18000cd35
mov rsi, qword [rax]
jmp 0x18000cac3
mov rbx, qword [rax]
jmp 0x18000cb1a
test rbx, rbx
jne 0x18000ce66
mov r10, qword [rsp + 0x98]
mov edi, 0x2a0
mov r9, qword [rsp + 0x90]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rbx, qword [rcx + 0x10]
movsxd rax, dword [rbx + 0x3c]
mov edx, dword [rax + rbx + 0x50]
lea r8, [rbx + rdx]
test r13, r13
je 0x18000cd88
cmp r13, rbx
jb 0x18000ce31
cmp r13, r8
ja 0x18000ce31
mov edx, r8d
lea rbx, [r13 + 5]
sub edx, r13d
cmp edx, edi
cmova edx, edi
mov ecx, edx
add rcx, r13
cmp rcx, r8
lea eax, [rdx - 0x10]
cmovb eax, edx
mov r15d, eax
test eax, eax
je 0x18000ce31
mov r14, rbx
mov rdi, rbx
neg r14
nop
movzx eax, byte [rdi]
sub al, 0x48
test al, 0xfb
jne 0x18000ce0e
cmp byte [rdi + 1], 0x8d
jne 0x18000ce0e
mov eax, dword [rdi + 3]
add eax, 7
movsxd rdx, eax
mov rax, qword gs:[0x30]
add rdx, r14
add rdx, rdi
add rdx, rbx
mov rcx, qword [rax + 0x60]
mov r8, qword [rcx + 0x10]
cmp rdx, r8
jbe 0x18000ce0e
movsxd rax, dword [r8 + 0x3c]
mov ecx, dword [rax + r8 + 0x50]
add rcx, r8
cmp rdx, rcx
jae 0x18000ce0e
mov r8d, 0xc
lea rcx, str.ByteProperty
call fcn.1800306d0
test eax, eax
je 0x18000ce1c
inc rdi
lea rax, [r14 + rdi]
cmp rax, r15
jb 0x18000cdb0
jmp 0x18000ce21
test rdi, rdi
jne 0x18000ce66
mov r10, qword [rsp + 0x98]
mov r9, qword [rsp + 0x90]
inc r9
mov qword [rsp + 0x90], r9
lea rax, [r10 + r9]
cmp rax, 0x50
jge 0x18000ce73
mov rbx, qword [rsp + 0xa0]
mov edi, 0x2a0
mov rsi, qword [rsp + 0xa8]
mov r14d, 0x15ff
jmp 0x18000cbf5
movsxd rax, dword [rbp + 3]
lea rdx, [rbp + 7]
add rdx, rax
jne 0x18000ce8b
mov rbx, qword [rsp + 0xa0]
xor r15d, r15d
mov rsi, qword [rsp + 0xa8]
jmp 0x18000cb25
mov rcx, qword [0x180081140]
test rcx, rcx
jne 0x18000ceaf
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x10]
mov qword [0x180081140], rcx
mov rax, rdx
mov r15d, 0
sub rax, rcx
cmp rdx, rcx
cmova r15, rax
mov al, 1
mov dword [0x180081150], r15d
jmp 0x18000cecf
xor al, al
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret