Function at 0x180038a30
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov rbx, qword gs:[0x30]
mov r13, qword gs:[0x60]
mov rsi, qword [rbx + 0x17c8]
xor r12d, r12d
test rsi, rsi
je 0x180038a73
mov rcx, rsi
call sym.ntdll.dll_RtlProcessFlsData
mov rax, qword gs:[0x30]
test byte [rax + 0x17ee], 8
je 0x180038a9b
mov rax, qword gs:[0x30]
test byte [rax + 0x17ee], 0x20
je 0x180038c3d
mov eax, 0x2000
test word [rbx + 0x17ee], ax
jne 0x180038c3d
mov rax, qword gs:[0x30]
mov ecx, 0x1000
test word [rax + 0x17ee], cx
je 0x180038ad1
mov r14b, 1
mov byte [rsp + 0x100], r14b
jmp 0x180038ae3
mov r14b, r12b
mov byte [rsp + 0x100], r12b
xor ecx, ecx
call fcn.1800435b4
call fcn.180046fbc
nop
mov r15, qword [0x18015c398]
xor edx, edx
lea rax, [0x18015c390]
cmp r15, rax
je 0x180038bb1
lea rdi, [r15 - 0x20]
mov qword [rsp + 0x20], rdi
mov r15, qword [r15 + 8]
mov ecx, dword [rdi + 0x68]
mov rax, qword [rdi + 0x30]
cmp qword [r13 + 0x10], rax
je 0x180038bac
bt ecx, 0x12
jb 0x180038bac
mov r12, qword [rdi + 0x38]
test r12, r12
je 0x180038bac
and ecx, 0x80004
cmp ecx, 0x80004
jne 0x180038bac
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x30], 0x48
mov dword [rsp + 0x38], 1
xor edx, edx
lea r8d, [rdx + 0x38]
lea rcx, [rsp + 0x40]
call sym.ntdll.dll_memset
mov rdx, qword [rdi + 0x88]
lea rcx, [rsp + 0x30]
call sym.ntdll.dll_RtlActivateActivationContextUnsafeFast
nop
xor eax, eax
cmp word [rdi + 0x6e], ax
je 0x180038b8c
mov rdx, rdi
lea ecx, [rax + 3]
call fcn.18003b5f8
xor r9d, r9d
lea r8d, [r9 + 3]
mov rdx, qword [rdi + 0x30]
mov rcx, r12
call fcn.18003b518
nop
lea rcx, [rsp + 0x30]
call sym.ntdll.dll_RtlDeactivateActivationContextUnsafeFast
xor edx, edx
jmp 0x180038af2
mov rdi, qword [0x18015bf88]
xor r12d, r12d
cmp word [rdi + 0x6e], r12w
je 0x180038c22
mov qword [rsp + 0x80], 0x48
mov dword [rsp + 0x88], 1
xor edx, edx
lea r8d, [r12 + 0x38]
lea rcx, [rsp + 0x90]
call sym.ntdll.dll_memset
mov rdx, qword [rdi + 0x88]
lea rcx, [rsp + 0x80]
call sym.ntdll.dll_RtlActivateActivationContextUnsafeFast
nop
mov rdx, qword [0x18015bf88]
lea ecx, [r12 + 3]
call fcn.18003b5f8
nop
lea rcx, [rsp + 0x80]
call sym.ntdll.dll_RtlDeactivateActivationContextUnsafeFast
nop
xor r8d, r8d
lea edx, [r8 + 0x13]
call fcn.180046f60
test r14b, r14b
jne 0x180038c38
call fcn.180047b2c
call fcn.180072114
test rsi, rsi
je 0x180038c60
mov qword [rbx + 0x17c8], r12
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlFreeHeap
mov rdi, qword [rbx + 0x1780]
test rdi, rdi
je 0x180038ca2
mov qword [rbx + 0x1780], r12
lea rcx, [0x18015be80]
call sym.ntdll.dll_RtlEnterCriticalSection
lea rcx, [0x18015be80]
call sym.ntdll.dll_RtlLeaveCriticalSection
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlFreeHeap
test byte [rbx + 0x17ee], 4
je 0x180038cc7
mov r8, qword [rbx + 0x20]
mov qword [rbx + 0x20], r12
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlFreeHeap
call sym.ntdll.dll_RtlFreeThreadActivationContextStack
mov eax, 0x400
test word [rbx + 0x17ee], ax
je 0x180038ce8
cmp dword [0x18015cfb8], 3
jne 0x180038ce8
call sym.ntdll.dll_TpTrimPools
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret