Function at 0x18002baa4
Capabilities:
Access peb ldr_data
Get kernel32 base address
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword gs:[0x30]
xor r14d, r14d
mov rbx, rcx
mov rdx, qword [rax + 0x60]
mov rbp, 0xfffffffffffff000
mov rsi, r14
mov rax, qword [rdx + 0x18]
mov qword [rsp + 0xf8], r14
mov r15, r14
mov rdx, qword [rax + 0x10]
mov r12d, r14d
lea r13d, [r14 + 1]
mov rax, qword [rdx]
mov rcx, qword [rax + 0x30]
and rcx, rbp
movsxd rax, dword [rcx + 0x3c]
mov edx, dword [rax + rcx + 0x88]
cmp edx, r14d
je 0x18002bba9
lea rax, [rcx + rdx]
mov r12d, r13d
mov r11d, dword [rax + 0x1c]
mov r10d, dword [rax + 0x20]
mov r9d, dword [rax + 0x24]
mov edi, dword [rax + 0x18]
add r11, rcx
add r10, rcx
add r9, rcx
mov eax, dword [r10]
mov edx, r14d
lea r8, [rax + rcx + 2]
cmp byte [r8], r14b
je 0x18002bb48
add edx, r13d
cmp byte [rdx + r8], r14b
jne 0x18002bb3f
cmp rsi, r14
jne 0x18002bb70
cmp edx, 8
jne 0x18002bb75
cmp dword [r8], 0x616f4c72
jne 0x18002bb75
movzx eax, word [r9]
mov esi, dword [r11 + rax*4]
add rsi, rcx
mov qword [rsp + 0xf8], rsi
jmp 0x18002bb75
cmp r15, r14
jne 0x18002bba6
cmp r15, r14
jne 0x18002bb93
cmp edx, 0x14
jne 0x18002bb93
cmp dword [r8], 0x74654772
jne 0x18002bb93
movzx eax, word [r9]
mov r15d, dword [r11 + rax*4]
add r15, rcx
add r10, 4
add r9, 2
add edi, 0xffffffff
je 0x18002bdab
jmp 0x18002bb2f
mov r12d, r14d
and rbx, rbp
movsxd rsi, dword [rbx + 0x3c]
add rsi, rbx
mov eax, dword [rsi + 0x90]
cmp eax, r14d
je 0x18002bd12
lea rbp, [rbx + rax]
cmp dword [rbp + 0xc], r14d
je 0x18002bd03
mov eax, dword [rbp]
mov r13d, dword [rbp + 0x10]
cmp eax, r14d
jne 0x18002bbe8
mov eax, r13d
cmp r13d, r14d
je 0x18002bceb
mov ecx, dword [rbp + 0xc]
mov r14d, eax
xor edx, edx
add rcx, rbx
lea rdi, [r14 + rbx]
mov al, byte [rcx]
test al, al
je 0x18002bc15
xor r8d, r8d
inc edx
movsx eax, al
mov word [rsp + r8*2 + 0x30], ax
mov al, byte [rdx + rcx]
mov r8d, edx
test al, al
jne 0x18002bc00
add dx, dx
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x100]
mov word [rsp + 0x22], dx
mov word [rsp + 0x20], dx
lea r8, [rsp + 0x20]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rax
call qword [rsp + 0xf8]
test eax, eax
js 0x18002bcfa
mov rcx, qword [rdi]
test rcx, rcx
je 0x18002bce8
sub r13, r14
xor r14d, r14d
bt qword [rdi], 0x3f
movzx r8d, r14w
mov rdx, r14
jb 0x18002bc73
mov edx, dword [rdi]
add rdx, rbx
jmp 0x18002bc8c
cmp rcx, rbx
jb 0x18002bc88
mov eax, dword [rsi + 0x50]
add rax, rbx
cmp rcx, rax
jae 0x18002bc88
mov rdx, rcx
jmp 0x18002bc8c
mov r8w, word [rdi]
cmp rdx, r14
je 0x18002bcb9
add rdx, 2
mov ecx, r14d
cmp byte [rdx], r14b
je 0x18002bca5
inc ecx
cmp byte [rcx + rdx], r14b
jne 0x18002bc9d
mov qword [rsp + 0x28], rdx
mov word [rsp + 0x22], cx
mov word [rsp + 0x20], cx
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x100]
lea r9, [r13 + rdi]
movzx r8d, r8w
call r15
cmp eax, r14d
jl 0x18002bce0
add rdi, 8
mov rcx, qword [rdi]
cmp rcx, r14
jne 0x18002bc5e
jmp 0x18002bceb
mov r12d, 0x7f
jmp 0x18002bceb
xor r14d, r14d
add rbp, 0x14
cmp r12d, r14d
je 0x18002bbc6
jmp 0x18002bd03
mov r12d, 0x7e
xor r14d, r14d
cmp r12d, r14d
jne 0x18002bdab
mov r13d, 1
mov r10d, dword [rsi + 0x28]
mov eax, dword [rsi + 0xb0]
add r10, rbx
cmp eax, r14d
je 0x18002bd97
mov r8d, dword [rsi + 0xb4]
mov rdi, rbx
lea rcx, [rbx + rax]
sub rdi, qword [rsi + 0x30]
mov qword [rsi + 0x30], rbx
jmp 0x18002bd91
mov eax, dword [rcx + 4]
mov r11d, dword [rcx]
lea rdx, [rax - 8]
add r11, rbx
shr rdx, 1
cmp r8d, eax
jl 0x18002bd88
cmp edx, r14d
jbe 0x18002bd88
lea r9, [rcx + 8]
mov edx, edx
movzx eax, word [r9]
mov ebp, 0xf000
and ax, bp
mov ebp, 0xa000
cmp ax, bp
jne 0x18002bd7f
movzx eax, word [r9]
and eax, 0xfff
add qword [rax + r11], rdi
add r9, 2
sub rdx, r13
jne 0x18002bd5c
mov eax, dword [rcx + 4]
sub r8d, eax
add rcx, rax
cmp r8d, 8
ja 0x18002bd3c
mov r8, qword [rsi + 0xc]
mov edx, r13d
mov rcx, rbx
call r10
cmp eax, r14d
cmove r12d, r13d
mov eax, r12d
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret