Function at 0x180017990
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rbx, qword [rcx + 0x10]
call fcn.180017370
test al, al
je 0x180017b3c
lea rax, str.Found_TNameEntryArray_GNames_at_offset_0x:X_n
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 0x30
mov eax, dword [0x1800987b8]
mov dword [rbp - 0x48], eax
movabs rax, 0x1000000000000000
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x40], 1
lea rax, [rbp - 0x50]
mov qword [rbp - 0x38], rax
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm0
movaps xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x30], xmm1
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x20]
call fcn.180016920
nop
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
call fcn.18001d680
mov rcx, rax
call fcn.18001b9d0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x180017a87
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180017a82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180017d8c
call fcn.18002f0e0
movsxd rax, dword [0x1800987b8]
mov rsi, qword [rax + rbx]
mov byte [0x1800987bc], 0
xor ebx, ebx
mov edi, ebx
test rsi, rsi
je 0x180017af3
mov rcx, rsi
call fcn.180014ad0
test al, al
jne 0x180017af3
mov r8d, ebx
mov ecx, ebx
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rcx + rsi]
mov rdx, rax
shr rdx, 0x20
test rax, rax
jne 0x180017ad4
inc edi
jmp 0x180017ae2
test edi, edi
jne 0x180017adc
inc ebx
jmp 0x180017ae2
jle 0x180017ae2
cmp edx, ebx
je 0x180017aff
add r8d, 8
add rcx, 8
cmp rcx, 0x800
jl 0x180017ac0
lea rdx, str.The_address_that_was_found_couldnt_be_used_by_the_generator__this_might_be_due_to_GNames_encryption._n
jmp 0x180017d52
mov dword [0x180098a04], r8d
lea eax, [r8 + 4]
mov dword [0x180098a00], eax
lea rax, [0x1800171a0]
mov qword [0x1800987c8], rax
mov qword [0x1800985c8], rsi
mov byte [0x1800987bc], 0
xor edx, edx
xor ecx, ecx
call fcn.180016b20
mov al, 1
jmp 0x180017d68
call fcn.180017550
test al, al
je 0x180017d4b
lea rax, str.Found_FNamePool_GNames_at_offset_0x:X_n
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 0x2a
mov eax, dword [0x1800987b8]
mov dword [rbp - 0x28], eax
movabs rax, 0x1000000000000000
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x40], 1
lea rax, [rbp - 0x30]
mov qword [rbp - 0x38], rax
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm0
movaps xmm1, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x50], xmm1
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.180016920
nop
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
call fcn.18001d680
mov rcx, rax
call fcn.18001b9d0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x180017c02
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180017bfd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180017d86
call fcn.18002f0e0
movsxd r15, dword [0x1800987b8]
add r15, rbx
mov byte [0x1800987bc], 1
xor ebx, ebx
mov dword [0x180098a00], ebx
mov r12d, 4
mov dword [0x180098a0c], r12d
mov r11d, 0x10
mov dword [0x180098a08], r11d
mov edi, ebx
mov rsi, r15
nop word [rax + rax]
mov r14d, dword [rsi]
lea eax, [r14 - 1]
cmp eax, 0xffff
ja 0x180017ca9
mov r9d, ebx
xor r10b, r10b
mov edx, ebx
mov eax, edi
and eax, 0x80000007
jge 0x180017c66
dec eax
or eax, 0xfffffff8
inc eax
lea ecx, [rax + rdi]
movsxd rax, ecx
lea r8, [r15 + 8]
add r8, rax
add ecx, 8
cmp qword [r8], rbx
je 0x180017c8a
inc r9d
test r10b, r10b
jne 0x180017c8a
mov r10b, 1
lea r11d, [rdx + rcx]
add edx, 8
add r8, 8
cmp edx, 0x10000
jl 0x180017c76
mov dword [0x180098a08], r11d
lea eax, [r9 - 1]
cmp r14d, eax
je 0x180017cba
add edi, r12d
add rsi, r12
cmp edi, 0x20
jge 0x180017af3
jmp 0x180017c40
mov dword [0x180098a00], edi
lea eax, [rdi + 4]
mov dword [0x180098a0c], eax
movsxd r8, r11d
add r8, r15
mov ecx, ebx
mov rax, qword [r8]
movabs rdx, 0x6a624f5565726f43
nop
cmp dword [rax], 0x656e6f4e
jne 0x180017cf2
test rbx, rbx
jne 0x180017cf2
movsxd rbx, ecx
jmp 0x180017cf7
cmp qword [rax], rdx
je 0x180017d0d
inc ecx
inc rax
cmp ecx, 0x1000
jl 0x180017ce0
lea rdx, str.The_address_that_was_found_couldnt_be_used_by_the_generator__this_might_be_due_to_GNames_encryption._n
jmp 0x180017d52
mov eax, 2
cmp rbx, rax
cmove r12, rax
mov qword [0x1800987b0], r12
lea rax, [0x180017210]
mov qword [0x1800987c8], rax
mov rdx, rbx
mov rcx, r8
call fcn.180016b20
mov qword [0x1800985c8], r15
mov byte [0x1800987bc], 1
mov al, 1
jmp 0x180017d68
lea rdx, str._n_nCould_not_find_GNames__n_n
lea rcx, [0x180096db0]
call fcn.18001b760
mov rcx, rax
call fcn.18001b9d0
xor al, al
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.18003be70
int3
call fcn.18003be70
int3