Function at 0x18004a230
Capabilities:
Access peb ldr_data
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov r12d, r8d
mov rbx, rdx
mov r14, rcx
xor r13d, r13d
mov qword [rax - 0x68], r13
mov qword [rax - 0x60], r13
mov dword [rsp + 0x44], r13d
mov eax, dword [rcx + 0x2c]
add rax, rcx
mov qword [rsp + 0x88], rax
lea rdi, [rdx + 0x38]
mov qword [rsp + 0x98], rdi
mov rcx, rdi
call sym.ntdll.dll_RtlAcquireSRWLockExclusive
lea rcx, [rbx + 0x40]
mov qword [rsp + 0x80], rcx
mov r9, qword [rcx]
mov qword [rsp + 0x50], r9
mov r11d, 0x7ffe03b0
cmp r9, rcx
je 0x18004a368
lea rdi, [r9 - 8]
mov r10d, 0x7ffe0008
mov rdx, qword [sym.ntdll.dll_RtlpFreezeTimeBias]
mov rax, qword [r11]
mov rcx, qword [r10]
mov r8, qword [r11]
cmp rax, r8
jne 0x18004a2b5
mov rax, qword [sym.ntdll.dll_RtlpFreezeTimeBias]
cmp rdx, rax
jne 0x18004a2b5
sub rcx, r8
sub rcx, rdx
add rcx, 0x7a120
lock inc dword [rdi + 0x50]
mov esi, dword [rdi + 0x40]
and esi, dword [r14 + 0x18]
cmp dword [rdi + 0x60], r13d
jne 0x18004a328
test esi, esi
je 0x18004a328
mov r15d, esi
and r15d, 1
je 0x18004a31a
cmp dword [rdi + 0x38], r13d
je 0x18004a39c
mov eax, dword [r14 + 0x10]
sub eax, dword [rdi + 0x38]
test eax, eax
jg 0x18004a39c
test esi, 0xfffffffe
jne 0x18004a393
test sil, 0x10
jne 0x18004a39c
mov r9, qword [r9]
mov qword [rsp + 0x50], r9
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.18004a688
mov rax, qword [rsp + 0x70]
test rax, rax
mov r9, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x80]
mov r11d, 0x7ffe03b0
je 0x18004a2a2
jmp 0x1800b4293
mov rcx, qword [rsp + 0x98]
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
neg dword [rsp + 0x44]
sbb eax, eax
and eax, 0xc000022d
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp dword [rdi + 0xa0], r13d
jne 0x18004a322
cmp dword [rdi + 0x78], r13d
jne 0x1800b4220
test r12d, r12d
jne 0x18004a635
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x48], r13d
mov rax, qword [rdi + 0x20]
mov qword [rsp + 0x60], rax
mov rax, qword [rdi + 0x18]
mov rbx, qword [rax + 0x10]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x68], rax
mov r13, qword [rdi + 0x28]
mov r12, qword [rdi + 0x30]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x48]
mov qword [rdi + 0x98], rcx
mov rax, qword [rsp + 0xe8]
add rax, 0x38
mov qword [rsp + 0x58], rax
mov rcx, rax
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
xor edx, edx
mov dword [rsp + 0xf8], edx
and dword [rsp + 0xe0], edx
mov rax, qword [rdi + 0x48]
test rax, rax
je 0x18004a43c
lock bts qword [rax + 0x18], 0
mov ecx, edx
setae cl
mov dword [rsp + 0xe0], ecx
test ecx, ecx
je 0x18004a647
cmp dword [rdi + 0x60], 0
jne 0x1800b4242
mov dword [rsp + 0x48], 1
mov rcx, r12
call sym.ntdll.dll_RtlSetThreadSubProcessTag
mov qword [rsp + 0x90], rax
mov r12, qword [rsp + 0x68]
test r15d, r15d
mov r15, qword [rsp + 0x60]
je 0x18004a4a0
mov ecx, dword [r14 + 0x14]
mov dword [rsp + 0x28], ecx
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9, r13
mov r8, r12
mov edx, dword [r14 + 0x10]
mov rcx, rbx
mov rax, r15
mov r10, qword [section..00cfg]
call r10
mov dword [rsp + 0x40], eax
test sil, 0x10
jne 0x18004a513
test esi, 0xffffffee
jne 0x18004a4f6
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
xor r13d, r13d
test eax, eax
jne 0x18004a559
mov ecx, 0x7ffe038e
cmp byte [rcx], r13b
je 0x18004a575
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9, qword [rsp + 0xe8]
mov r8, rdi
mov edx, dword [r14 + 0x10]
mov rcx, rbx
call fcn.1800d89bc
jmp 0x18004a575
and dword [rsp + 0x40], 0
mov r8d, esi
mov rdx, r13
mov rcx, rbx
mov rax, r15
mov r9, qword [section..00cfg]
call r9
jmp 0x18004a4ae
cmp dword [rdi + 0x60], 0
jne 0x18004a4a6
cmp dword [rsp + 0x40], 0
jl 0x18004a54d
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov r9, r13
mov r8, r12
xor edx, edx
mov rcx, rbx
mov rax, r15
mov r10, qword [section..00cfg]
call r10
and dword [rsp + 0x40], 0
jmp 0x18004a4a6
test byte [rdi + 0x3c], 4
jne 0x18004a4a6
jmp 0x18004a520
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x234
jmp 0x18004a4c3
mov rcx, qword [rsp + 0x90]
call sym.ntdll.dll_RtlSetThreadSubProcessTag
cmp dword [rsp + 0xe0], r13d
jne 0x18004a623
mov rbx, qword [rsp + 0x58]
cmp dword [rsp + 0x48], r13d
je 0x1800b4287
mov rcx, rbx
call sym.ntdll.dll_RtlAcquireSRWLockExclusive
mov eax, 1
mov edx, eax
mov dword [rsp + 0xf8], eax
cmp dword [rsp + 0x40], 0xc000022d
je 0x1800b4269
cmp dword [rsp + 0x40], 0xc0000017
je 0x1800b4269
cmp dword [rdi + 0x38], r13d
je 0x18004a5e3
mov eax, dword [r14 + 0x10]
sub eax, dword [rdi + 0x38]
test eax, eax
jle 0x18004a5ea
mov eax, dword [r14 + 0x10]
mov dword [rdi + 0x38], eax
test byte [rdi + 0x3c], 4
je 0x18004a5fd
cmp dword [rdi + 0x88], r13d
ja 0x1800b424a
mov eax, r13d
mov dword [rdi + 0x90], eax
test edx, edx
je 0x18004a660
mov qword [rdi + 0x98], r13
mov r9, qword [rsp + 0x50]
mov r12d, dword [rsp + 0xf0]
jmp 0x18004a328
mov rcx, qword [rdi + 0x48]
add rcx, 0x18
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
jmp 0x18004a590
cmp dword [rdi + 0x90], r13d
je 0x18004a328
jmp 0x18004a3af
cmp dword [rsp + 0xf0], 1
je 0x18004a66a
mov eax, 1
mov rbx, qword [rsp + 0x58]
xor r13d, r13d
jmp 0x18004a600
mov rcx, rbx
call sym.ntdll.dll_RtlAcquireSRWLockExclusive
jmp 0x18004a60a
mov rcx, qword [rdi + 0x48]
add rcx, 0x18
call sym.ntdll.dll_RtlAcquireSRWLockExclusive
mov dword [rsp + 0xe0], 1
jmp 0x18004a43c
cmp rcx, qword [rdi + 0x80]
jae 0x18004a3a6
mov eax, dword [r14 + 0x10]
cmp dword [rdi + 0x94], eax
jae 0x18004a328
jmp 0x18004a3a6
xor r13d, r13d
jmp 0x18004a582
mov dword [rdi + 0x78], r13d
and qword [rdi + 0x88], 0
mov qword [rdi + 0x80], r13
mov dword [rdi + 0x94], r13d
jmp 0x18004a5fd
test byte [rdi + 0x3c], 4
je 0x18004a5fd
mov dword [rsp + 0x44], eax
mov r8d, dword [r14 + 0x10]
mov edx, dword [rsp + 0x40]
mov rcx, rdi
call fcn.1800d8cc4
mov edx, dword [rsp + 0xf8]
jmp 0x18004a5fd
mov rcx, qword [rsp + 0x78]
mov rdx, qword [section..00cfg]
call rdx
mov r9, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x80]
jmp 0x18004a29c