Function at 0x1800d1d70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
jmp 0x1800e1068
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f]
sub rsp, 0x90
mov rax, qword gs:[0x60]
xor r15d, r15d
mov r14, rcx
mov qword [rbp - 9], r15
mov rcx, rdx
mov byte [rbp - 0x29], r15b
mov rdi, r9
mov qword [rbp - 1], r15
mov rax, qword [rax + 0x30]
mov rbx, rdx
mov qword [rbp + 7], rax
mov byte [rbp + 0x5f], r15b
call sym.ntdll.dll_RtlValidSecurityDescriptor
xor r10d, r10d
test al, al
jne 0x1800e10d3
mov edi, 0xc0000079
jmp 0x1800e15cb
movzx eax, word [rbx + 2]
mov r11d, 0x8000
movzx ecx, ax
and cx, r11w
je 0x1800e10f5
cmp dword [rbx + 4], r10d
je 0x1800e10c9
mov r13d, dword [rbx + 4]
add r13, rbx
jmp 0x1800e10f9
mov r13, qword [rbx + 8]
mov qword [rbp + 0xf], r13
test r13, r13
je 0x1800e10c9
test cx, cx
je 0x1800e111b
cmp dword [rbx + 8], r10d
jne 0x1800e1113
mov qword [rbp - 0x11], r10
jmp 0x1800e1123
mov edx, dword [rbx + 8]
add rdx, rbx
jmp 0x1800e111f
mov rdx, qword [rbx + 0x10]
mov qword [rbp - 0x11], rdx
mov r9b, 0x10
test r9b, al
je 0x1800e127a
test cx, cx
je 0x1800e1147
cmp dword [rbx + 0xc], r10d
je 0x1800e127a
mov r12d, dword [rbx + 0xc]
add r12, rbx
jmp 0x1800e114b
mov r12, qword [rbx + 0x18]
mov qword [rbp - 0x19], r12
test r12, r12
je 0x1800e127a
mov edx, 0x800
test dx, ax
jne 0x1800e1267
mov r8d, 0x2000
test r8w, ax
jne 0x1800e1267
test r14, r14
je 0x1800e1267
test cx, cx
je 0x1800e1198
cmp dword [rbx + 8], r10d
jne 0x1800e118f
mov r8, r10
jmp 0x1800e119c
mov r8d, dword [rbx + 8]
add r8, rbx
jmp 0x1800e119c
mov r8, qword [rbx + 0x10]
test cx, cx
je 0x1800e11b4
cmp dword [rbx + 4], r10d
jne 0x1800e11ac
mov rax, r10
jmp 0x1800e11b8
mov eax, dword [rbx + 4]
add rax, rbx
jmp 0x1800e11b8
mov rax, qword [rbx + 8]
test cx, cx
je 0x1800e11d0
cmp dword [rbx + 0xc], r10d
jne 0x1800e11c8
mov rdx, r10
jmp 0x1800e11d4
mov edx, dword [rbx + 0xc]
add rdx, rbx
jmp 0x1800e11d4
mov rdx, qword [rbx + 0x18]
test byte [r14 + 2], r9b
jne 0x1800e11df
mov rcx, r10
jmp 0x1800e11f9
cmp word [r14 + 2], r10w
jge 0x1800e11f5
cmp dword [r14 + 0xc], r10d
je 0x1800e11da
mov ecx, dword [r14 + 0xc]
add rcx, r14
jmp 0x1800e11f9
mov rcx, qword [r14 + 0x18]
lea r9, [rbp - 0x21]
mov qword [rsp + 0x40], r9
lea r9, [rbp - 9]
mov qword [rsp + 0x38], r9
mov r9, qword [rbp + 0x7f]
mov qword [rsp + 0x30], r9
mov r9b, byte [rbp + 0x77]
mov qword [rsp + 0x28], r8
mov r8, rdi
mov qword [rsp + 0x20], rax
call fcn.1800e0830
xor r10d, r10d
mov edi, eax
test eax, eax
js 0x1800e15cb
mov eax, dword [rbp - 0x21]
mov r11d, 0x8000
mov r9d, eax
mov byte [rbp - 0x29], 1
and r9d, 8
and eax, 0x1400
or r9d, 4
add r9d, r9d
or r9d, eax
movzx eax, word [rbx + 2]
add r9d, r9d
mov dword [rbp - 0x25], r9d
jmp 0x1800e12cc
mov r9d, eax
and r9d, 0x2010
or r9d, edx
mov dword [rbp - 0x25], r9d
jmp 0x1800e12d4
mov r8d, eax
mov edx, 0x800
and r8d, 0x2010
mov ecx, r8d
or ecx, edx
mov dword [rbp - 0x25], ecx
test r14, r14
je 0x1800e12b8
test byte [r14 + 2], r9b
je 0x1800e12cc
cmp word [r14 + 2], r10w
jge 0x1800e12b2
cmp dword [r14 + 0xc], r10d
je 0x1800e12cc
mov ecx, dword [r14 + 0xc]
add rcx, r14
jmp 0x1800e12bb
mov rcx, qword [r14 + 0x18]
jmp 0x1800e12bb
mov rcx, r10
test rcx, rcx
je 0x1800e12cc
mov ecx, r8d
or ecx, 0x2800
mov dword [rbp - 0x25], ecx
mov r12, qword [rbp - 9]
mov qword [rbp - 0x19], r12
movzx ecx, ax
test al, 4
je 0x1800e140c
test ax, ax
jns 0x1800e12f7
cmp dword [rbx + 0x10], r10d
jne 0x1800e12ef
mov rsi, r10
jmp 0x1800e12fb
mov esi, dword [rbx + 0x10]
add rsi, rbx
jmp 0x1800e12fb
mov rsi, qword [rbx + 0x20]
test rsi, rsi
je 0x1800e140c
mov edx, 0x400
movzx edi, cx
test dx, cx
jne 0x1800e1402
mov eax, 0x1000
test ax, cx
jne 0x1800e1402
test r14, r14
je 0x1800e1402
test cx, cx
jns 0x1800e1345
cmp dword [rbx + 8], r10d
jne 0x1800e133c
mov r9, r10
jmp 0x1800e1349
mov r9d, dword [rbx + 8]
add r9, rbx
jmp 0x1800e1349
mov r9, qword [rbx + 0x10]
movzx eax, cx
and ax, r11w
je 0x1800e1366
cmp dword [rbx + 4], r10d
jne 0x1800e135d
mov r8, r10
jmp 0x1800e136a
mov r8d, dword [rbx + 4]
add r8, rbx
jmp 0x1800e136a
mov r8, qword [rbx + 8]
test cl, 4
jne 0x1800e1374
mov rdx, r10
jmp 0x1800e138b
test ax, ax
je 0x1800e1387
cmp dword [rbx + 0x10], r10d
je 0x1800e136f
mov edx, dword [rbx + 0x10]
add rdx, rbx
jmp 0x1800e138b
mov rdx, qword [rbx + 0x20]
test byte [r14 + 2], 4
jne 0x1800e1397
mov rcx, r10
jmp 0x1800e13b1
cmp word [r14 + 2], r10w
jge 0x1800e13ad
cmp dword [r14 + 0x10], r10d
je 0x1800e1392
mov ecx, dword [r14 + 0x10]
add rcx, r14
jmp 0x1800e13b1
mov rcx, qword [r14 + 0x20]
lea rax, [rbp - 0x21]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 1]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x7f]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r9
mov r9b, byte [rbp + 0x77]
mov qword [rsp + 0x20], r8
mov r8, qword [rbp + 0x6f]
call fcn.1800e0830
xor r10d, r10d
mov edi, eax
test eax, eax
js 0x1800e15b7
mov edi, dword [rbp - 0x21]
and edi, 0x1408
mov byte [rbp + 0x5f], 1
or edi, 4
jmp 0x1800e1417
and edi, 0x1004
or edi, edx
jmp 0x1800e141b
mov edi, ecx
and edi, 4
or edi, 0x1400
mov rsi, qword [rbp - 1]
movzx eax, byte [r13 + 1]
mov edx, 0xfffffffc
lea r13d, [rax*4 + 0xb]
mov rax, qword [rbp - 0x11]
and r13d, edx
test rax, rax
je 0x1800e1448
movzx eax, byte [rax + 1]
lea ecx, [rax*4 + 0xb]
and ecx, edx
jmp 0x1800e144b
mov ecx, r10d
test r12, r12
je 0x1800e145f
movzx r15d, word [r12 + 2]
add r15d, 3
and r15d, edx
jmp 0x1800e1462
mov r15d, r10d
test rsi, rsi
je 0x1800e1475
movzx r14d, word [rsi + 2]
add r14d, 3
and r14d, edx
jmp 0x1800e1478
mov r14d, r10d
mov edx, dword [0x18015c294]
lea r8d, [r14 + r15]
mov rbx, qword [rbp + 7]
add ecx, 0x14
add r8d, ecx
add edx, 0x140000
add r8d, r13d
mov rcx, rbx
call sym.ntdll.dll_RtlAllocateHeap
xor r10d, r10d
mov qword [rbp - 0x21], rax
mov rcx, rax
test rax, rax
jne 0x1800e14b9
mov edi, 0xc0000017
mov r15, rax
jmp 0x1800e15a1
xor eax, eax
lea r12, [rcx + 0x14]
mov qword [rcx], rax
mov edx, 0x8000
mov qword [rcx + 8], rax
mov rbx, r12
mov dword [rcx + 0x10], eax
mov eax, dword [rbp - 0x25]
or ax, dx
mov byte [rcx], 1
or word [rcx + 2], ax
mov rdx, qword [rbp - 0x19]
test rdx, rdx
je 0x1800e1506
movzx r8d, word [rdx + 2]
mov rcx, rbx
call sym.ntdll.dll_RtlCopyMemory
mov rcx, qword [rbp - 0x21]
mov ebx, r15d
add rbx, r12
sub r12d, ecx
xor r10d, r10d
jmp 0x1800e1509
mov r12d, r10d
mov dword [rcx + 0xc], r12d
or word [rcx + 2], di
test rsi, rsi
je 0x1800e1537
movzx r8d, word [rsi + 2]
mov rdx, rsi
mov rcx, rbx
call sym.ntdll.dll_RtlCopyMemory
mov r15, qword [rbp - 0x21]
mov ecx, ebx
sub ecx, r15d
mov eax, r14d
add rbx, rax
jmp 0x1800e153e
mov r15, qword [rbp - 0x21]
mov ecx, r10d
mov rdx, qword [rbp + 0xf]
mov dword [r15 + 0x10], ecx
mov rcx, rbx
movzx eax, byte [rdx + 1]
lea r8d, [rax*4 + 8]
call sym.ntdll.dll_RtlCopyMemory
mov rcx, qword [rbp - 0x11]
mov eax, ebx
sub eax, r15d
xor r10d, r10d
mov dword [r15 + 4], eax
mov eax, r13d
add rbx, rax
test rcx, rcx
je 0x1800e1596
movzx eax, byte [rcx + 1]
mov rdx, rcx
mov rcx, rbx
lea r8d, [rax*4 + 8]
call sym.ntdll.dll_RtlCopyMemory
sub ebx, r15d
mov dword [r15 + 8], ebx
xor r10d, r10d
mov r12, qword [rbp - 0x19]
mov edi, r10d
mov rbx, qword [rbp + 7]
cmp byte [rbp + 0x5f], r10b
je 0x1800e15b7
mov r8, rsi
xor edx, edx
mov rcx, rbx
call sym.ntdll.dll_RtlFreeHeap
xor r10d, r10d
cmp byte [rbp - 0x29], r10b
je 0x1800e15cb
mov rcx, qword [rbp + 7]
mov r8, r12
xor edx, edx
call sym.ntdll.dll_RtlFreeHeap
mov rax, qword [rbp + 0x67]
mov rbx, qword [rsp + 0xd0]
mov qword [rax], r15
mov eax, edi
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret