Function at 0x18000c800
Capabilities:
Access peb ldr_data
Check os version

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov r13d, r9d
mov r11, r8
mov rsi, rcx
xor r12d, r12d
mov dword [rax + 0x38], r12d
mov dword [rsp + 0x48], r12d
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x40], r12
mov rax, qword gs:[0x30]
mov r10, qword [rax + 0x860]
test r10, r10
je 0x18000c866
test byte [r10], 4
jne 0x18000cf52
mov r15d, r12d
mov dword [rsp + 0x4c], r15d
mov qword [rsp + 0x70], 0x48
mov dword [rsp + 0x78], 1
xor eax, eax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
mov ebx, r12d
mov dword [rsp + 0x50], ebx
test r15d, r15d
jne 0x18000cf5d
mov rbx, qword gs:[0x30]
test r8, r8
je 0x18000cdf6
cmp r8, qword [rbx + 0x840]
jne 0x18000cdf6
mov rbx, qword [rbx + 0x848]
mov rax, qword gs:[0x30]
mov ecx, dword [rax + 0x8e8]
test ecx, ecx
jne 0x18000cf11
mov edi, dword [0x1800a98b4]
test rbx, rbx
je 0x18000c91f
mov eax, dword [rbx + 0x120]
cmp edi, eax
jne 0x18000cf18
test ecx, ecx
jne 0x18000c927
bts edi, 0x1f
mov dword [rsp + 0x54], edi
mov rdx, rsi
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntdll.dll_RtlActivateActivationContextUnsafeFast]
lock inc dword [0x1800aa458]
cmp qword [0x1800aa1b0], r12
je 0x18000cef7
cmp dword [0x1800aa1ac], r12d
je 0x18000cef7
mov ebx, 1
lea r14d, [rbx + 2]
test ebx, ebx
je 0x18000cf05
lea rcx, [0x1800aa388]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
mov esi, r12d
cmp qword [0x1800aa198], rsi
jne 0x18000ce9a
lea rcx, [0x1800aa388]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
test esi, esi
cmovne ebx, r14d
mov dword [rsp + 0x50], ebx
mov r11, qword [rsp + 0x190]
mov esi, ebx
and esi, 2
mov r8d, dword [rsp + 0x1b8]
jne 0x18000cd0b
mov r14d, r12d
and ebx, 1
je 0x18000ca01
test r8d, r8d
je 0x18000ca01
mov r8d, r13d
shr r8d, 3
mov r9, qword [0x1800a9090]
test r9, r9
je 0x18000ca01
cmp r8d, dword [0x1800a9098]
jae 0x18000ca01
mov ecx, r13d
and ecx, 7
mov edx, 1
shl edx, cl
movzx ecx, byte [r8 + r9]
and edx, ecx
mov dword [rsp + 0x6c], edx
jne 0x18000ca96
cmp dword [0x1800a98f0], 5
je 0x18000cb2c
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0x110], rax
test r14d, r14d
jne 0x18000cbdf
test r12d, r12d
jne 0x18000caa1
mov eax, dword [rsp + 0x48]
test eax, eax
jne 0x18000ca81
cmp dword [rsp + 0x1b0], eax
jne 0x18000ca81
mov r9, qword [rsp + 0x1a8]
mov r8, qword [rsp + 0x1a0]
mov edx, r13d
mov rcx, qword [rsp + 0x190]
mov rax, qword [rsp + 0x188]
call qword [case.0x18001f7d3.0]
mov qword [rsp + 0x40], rax
test r12d, r12d
mov r12, qword [rsp + 0x1a0]
jne 0x18000caf0
test r14d, r14d
jne 0x18000cc55
mov r14, qword [rsp + 0x190]
mov r12, qword [rsp + 0x1a8]
jmp 0x18000cd61
mov r12d, 1
jmp 0x18000ca01
cmp dword [rsp + 0x1b0], 0
jne 0x18000ca2c
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x1a8]
mov r8, qword [rsp + 0x1a0]
mov edx, r13d
mov rcx, qword [rsp + 0x190]
mov rax, qword [sym.USER32.dll_DwmGetDxRgn]
call qword [case.0x18001f7d3.0]
mov dword [rsp + 0x48], eax
jmp 0x18000ca30
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x1a8]
mov r8, r12
mov edx, r13d
mov rcx, qword [rsp + 0x190]
mov rax, qword [sym.USER32.dll_DwmGetDxRgn]
call qword [case.0x18001f7d3.0]
jmp 0x18000ca78
cmp r13d, 2
je 0x18000ccc4
cmp dword [0x1800a98f0], 5
jne 0x18000ca0e
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x8f8]
test rcx, rcx
je 0x18000ca0e
cmp qword [rcx], 0
je 0x18000ca0e
mov rcx, qword gs:[0x30]
mov rax, qword [rcx + 0x8e0]
bt rax, 8
jae 0x18000ca0e
btr rax, 8
mov qword [rcx + 0x8e0], rax
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0xd8], rax
mov dword [rsp + 0xd0], r13d
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0x1a8]
mov qword [rsp + 0xc0], rax
lea r9, [rsp + 0xc0]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 4]
call fcn.18000dfd0
jmp 0x18000ca0e
xor edx, edx
lea r8d, [rdx + 0x30]
lea rcx, [rsp + 0x118]
call sub.ntdll.dll_memset
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x118], rax
mov dword [rsp + 0x120], r13d
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x1a8]
mov qword [rsp + 0x130], rax
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x118]
mov rax, qword [sym.USER32.dll_DwmGetDxRgn]
call qword [case.0x18001f7d3.0]
mov dword [rsp + 0x1b0], eax
jmp 0x18000ca27
xor edx, edx
lea r8d, [rdx + 0x30]
lea rcx, [rsp + 0xe0]
call sub.ntdll.dll_memset
mov r14, qword [rsp + 0x190]
mov qword [rsp + 0xe0], r14
mov dword [rsp + 0xe8], r13d
mov qword [rsp + 0xf0], r12
mov r12, qword [rsp + 0x1a8]
mov qword [rsp + 0xf8], r12
lea r9, [rsp + 0x60]
lea r8, [rsp + 0xe0]
lea rdx, [rsp + 0xe0]
mov rcx, qword [rsp + 0x40]
mov rax, qword [sym.USER32.dll_CheckBannedOneCoreTransformApi]
call qword [case.0x18001f7d3.0]
jmp 0x18000cd61
mov rcx, r11
call fcn.18000b1b8
movsxd rdx, dword [rax + 0xc8]
mov rax, qword [rax + 0x128]
add rdx, rax
mov eax, dword [rdx - 0x18]
test al, 1
je 0x18000cb36
and eax, 0xfffffffe
mov dword [rdx - 0x18], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x272
mov rcx, qword [rsp + 0x190]
call sym.USER32.dll_SendMessageW
jmp 0x18000cb36
test r8d, r8d
je 0x18000c9ba
mov r9d, r13d
shr r9d, 3
mov r10, qword [0x1800a9018]
test r10, r10
je 0x18000c9ba
cmp r9d, dword [0x1800a9020]
jae 0x18000c9ba
mov ecx, r13d
and ecx, 7
mov edx, 1
shl edx, cl
movzx ecx, byte [r9 + r10]
and edx, ecx
mov dword [rsp + 0x68], edx
je 0x18000c9ba
mov r14d, 1
jmp 0x18000c9bd
test r15d, r15d
jne 0x18000cdc0
test ebx, ebx
je 0x18000cd80
mov eax, 0xffffffff
lock xadd dword [0x1800aa458], eax
cmp eax, 1
je 0x18000ce88
test esi, esi
jne 0x18000ceb7
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntdll.dll_RtlDeactivateActivationContextUnsafeFast]
mov rax, qword gs:[0x30]
cmp dword [rax + 0x8e8], edi
je 0x18000cdc0
mov dword [rax + 0x8ec], 1
test edi, edi
jns 0x18000cfa8
mov dword [rax + 0x8e8], 0
cmp r13d, 0x7e
je 0x18000cf66
cmp r13d, 0x1a
je 0x18000cf66
mov rax, qword [rsp + 0x40]
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rbx, r12
mov rax, qword gs:[0x30]
lea rdi, [rax + 0x800]
movzx edx, r8w
mov rax, qword [0x1800aa168]
cmp rdx, qword [rax + 8]
jae 0x18000ce68
imul edx, dword [0x1800a9f40]
mov ecx, edx
add rcx, qword [0x1800a9f38]
mov rax, r8
shr rax, 0x10
cmp ax, word [rcx + 0x1a]
jne 0x18003c43a
test byte [rcx + 0x19], 1
jne 0x18000ce68
cmp byte [rcx + 0x18], 1
jne 0x18000ce68
mov rax, qword [rdi + 0x20]
test rax, rax
je 0x18003c44d
mov rax, qword [rax]
cmp qword [rcx + 0x10], rax
jne 0x18003c44d
mov rbx, qword [rdi + 0x28]
add rbx, qword [rcx]
test rdi, rdi
je 0x18000ce7a
test dword [rdi + 0x1c], 0x20000000
jne 0x18000cf89
test rbx, rbx
jne 0x18000c8ef
jmp 0x18003c46b
cmp dword [0x1800aa1a8], 0
jne 0x18000cd80
jmp 0x18003c47e
cmp dword [0x1800aa26c], 1
jne 0x18000c988
inc dword [0x1800aa190]
mov esi, 1
jmp 0x18000c988
xor ebx, ebx
lea rcx, [0x1800aa388]
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
sub dword [0x1800aa190], 1
jne 0x18000cedc
cmp dword [0x1800aa26c], 2
je 0x18003c4ee
lea rcx, [0x1800aa388]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
test rbx, rbx
je 0x18000cd88
jmp 0x18003c542
mov ebx, r12d
mov r14d, 2
jmp 0x18000c963
lock dec dword [0x1800aa458]
jmp 0x18000c96b
mov edi, ecx
jmp 0x18000c90c
mov rcx, qword gs:[0x30]
mov edi, dword [rcx + 0x8e8]
cmp edi, eax
je 0x18000cf3f
mov dword [rcx + 0x8ec], 1
test eax, eax
js 0x18000cfb3
mov dword [rcx + 0x8e8], eax
test edi, edi
jne 0x18000c927
mov edi, dword [0x1800a98b4]
jmp 0x18000c923
mov r15d, 1
jmp 0x18000c869
mov edi, dword [rsp + 0x54]
jmp 0x18000c9a7
mov dword [rsp + 0x20], 0
mov r9, r12
mov r8, qword [rsp + 0x1a0]
mov edx, r13d
mov rcx, r14
call fcn.18000ef20
jmp 0x18000cdd4
test rbx, rbx
je 0x18003c46b
mov rcx, r11
call qword [sym.imp.win32u.dll_NtUserValidateHandleSecure]
test eax, eax
jne 0x18000ce7a
jmp 0x18003c46b
mov dword [rax + 0x8e8], edi
jmp 0x18000cdc0
mov dword [rcx + 0x8e8], r12d
jmp 0x18000cf3f
mov edx, 0xffff
cmp ax, dx
jne 0x18000ce68
jmp 0x18000ce3b
mov edx, 0x3a
mov rcx, r8
call qword [sym.imp.win32u.dll_NtUserCallOneParam]
mov rbx, rax
mov r11, qword [rsp + 0x190]
jmp 0x18000ce68
mov ecx, 0x578
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
mov rbx, r12
jmp 0x18000c8ef
xor ebx, ebx
xor r15d, r15d
lea rcx, [0x1800aa430]
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
cmp dword [0x1800aa1a8], ebx
jne 0x18003c4b6
mov rbx, qword [0x1800aa1b0]
mov r15, qword [0x1800aa1a0]
xor eax, eax
mov qword [0x1800aa1b0], rax
mov qword [0x1800aa1a0], rax
lea rcx, [0x1800aa430]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
test r15, r15
je 0x18003c4d6
xor edx, edx
lea ecx, [rdx + 1]
mov rax, r15
call qword [case.0x18001f7d3.0]
test rbx, rbx
je 0x18000cd80
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop
jmp 0x18000cd80
mov dword [section..data], 0x28
lea rax, [sym.USER32.dll_DwmGetDxRgn]
mov qword [sym.USER32.dll_DwmGetDxRgn], rax
lea rax, [sym.USER32.dll_CheckBannedOneCoreTransformApi]
mov qword [sym.USER32.dll_CheckBannedOneCoreTransformApi], rax
mov qword [0x1800a9018], rbx
mov dword [0x1800a9020], ebx
mov rbx, qword [0x1800aa198]
mov qword [0x1800aa198], 0
mov dword [0x1800aa26c], 0
jmp 0x18000cedc
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop
jmp 0x18000cd88