Function at 0x18005aa80
Capabilities:
Access peb ldr_data

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x240
mov rax, qword [0x1801724e0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov qword [rsp + 0x88], r9
mov qword [rsp + 0x68], r8
mov r12, rdx
mov r15d, ecx
mov r13, qword [rsp + 0x2a0]
mov qword [rsp + 0x48], r13
mov qword [rsp + 0xc8], rdx
mov qword [rsp + 0xd0], r13
mov rsi, qword [rsp + 0x2a8]
mov rax, qword gs:[0x60]
mov eax, dword [rax + 0xbc]
mov dword [rsp + 0x50], eax
xor ebx, ebx
mov dword [rsp + 0x70], ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x58], rbx
cmp dword [0x1801563e8], ebx
jne 0x1800b7c70
and r15d, 0xf1ffffff
mov rdi, rbx
bt r15d, 8
jb 0x1800b7cd1
mov r14d, 1
test byte [0x18015d028], r14b
jne 0x18005b4c0
test rdi, rdi
jne 0x18005b5d0
mov edi, 0x10000000
test edi, r15d
jne 0x18005ab61
cmp dword [0x18015d450], 2
jge 0x1800b7d7c
test r15d, 0xfff80c00
jne 0x1800b7de3
xor edx, edx
lea r8d, [rdx + 0x60]
lea rcx, [rsp + 0x140]
call sym.ntdll.dll_memset
test rsi, rsi
jne 0x18005b431
mov r8d, dword [rsp + 0x50]
mov eax, r8d
mov ecx, r15d
or ecx, 0x20
and al, 0x10
cmove ecx, r15d
mov eax, r8d
mov edx, ecx
or edx, 0x40
and al, 0x20
cmove edx, ecx
mov eax, r8d
mov ecx, edx
mov r9d, 0x80
or ecx, r9d
and eax, 0x200000
cmove ecx, edx
mov eax, r8d
mov edx, ecx
bts edx, 0x1e
and al, 0x40
cmove edx, ecx
mov eax, r8d
mov ecx, edx
bts ecx, 0x1d
and al, r9b
cmove ecx, edx
mov r10d, 0x1000
mov esi, ecx
bts esi, 0x1b
and r8d, r10d
cmove esi, ecx
mov rcx, qword gs:[0x60]
cmp qword [rsp + 0x148], rbx
jne 0x18005ac05
mov rax, qword [rcx + 0xc8]
mov qword [rsp + 0x148], rax
cmp qword [rsp + 0x150], rbx
jne 0x18005ac1e
mov rax, qword [rcx + 0xd0]
mov qword [rsp + 0x150], rax
cmp qword [rsp + 0x158], rbx
jne 0x18005ac37
mov rax, qword [rcx + 0xe0]
mov qword [rsp + 0x158], rax
cmp qword [rsp + 0x160], rbx
jne 0x18005ac50
mov rax, qword [rcx + 0xd8]
mov qword [rsp + 0x160], rax
mov rax, qword [0x18015d018]
test rax, rax
je 0x18005b753
cmp qword [rsp + 0x168], rbx
jne 0x18005ac7c
sub rax, qword [0x18015d020]
sub rax, r10
mov qword [rsp + 0x168], rax
mov rcx, qword [rsp + 0x170]
lea rax, [rcx - 1]
mov edx, 0xff000
cmp rax, 0xfefff
cmova rcx, rdx
mov qword [rsp + 0x170], rcx
mov r11, qword [rsp + 0x88]
test r11, r11
je 0x18005b4a7
lea r9, [r11 + 0x1fff]
and r9, 0xffffffffffffe000
mov qword [rsp + 0x78], r9
mov r8, qword [rsp + 0x68]
test r8, r8
jne 0x18005b41e
lea r8, [r9 + 0xffff]
and r8, 0xffffffffffff0000
mov qword [rsp + 0x60], r8
mov rcx, r9
cmp r9, r8
ja 0x1800b7def
mov eax, esi
and eax, 2
je 0x18005b378
test r12, r12
jne 0x18005b378
mov qword [rsp + 0x88], r10
mov dword [rsp + 0x70], 2
lea rax, [r8 - 0x1000]
cmp rax, rcx
jb 0x18005b792
test rcx, rcx
je 0x18005b7aa
test r8, r8
je 0x18005b7aa
test esi, 0x61000000
jne 0x1800b7dff
mov dword [rsp + 0x50], 0x2a0
mov edi, esi
mov rdx, qword [rsp + 0x48]
test r14b, sil
jne 0x18005b4b2
mov rax, r13
neg rax
sbb r13, r13
and r13, rdx
mov qword [rsp + 0x58], r13
bts edi, 0x1f
test rdx, rdx
cmove edi, esi
mov rax, rdx
neg rax
sbb eax, eax
and eax, 0xffffffd8
add eax, 0x2c8
mov dword [rsp + 0x50], eax
test r12, r12
jne 0x18005b385
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x90], rbx
cmp qword [rsp + 0x188], rbx
jne 0x1800b7e29
call fcn.18005c774
and eax, 0x1f
shl rax, 0x10
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0x60]
add rax, rcx
mov qword [rsp + 0xa0], rax
cmp rax, rcx
jb 0x1800b7e57
mov esi, edi
and esi, 0x40000
mov eax, esi
neg eax
sbb ecx, ecx
and ecx, 0x3c
add ecx, 4
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], 0x2000
lea r9, [rsp + 0xa0]
xor r8d, r8d
lea rdx, [rsp + 0x98]
or r13, 0xffffffffffffffff
mov rcx, r13
call sym.ntdll.dll_NtAllocateVirtualMemory
test eax, eax
js 0x1800b7e36
mov rdx, qword [rsp + 0x98]
mov qword [rsp + 0x40], rdx
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x90], rbx
je 0x18005ae8d
mov r9d, 0x8000
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x98]
call fcn.18005cd8c
mov rdx, qword [rsp + 0x98]
add rdx, qword [rsp + 0x90]
mov qword [rsp + 0x40], rdx
mov rax, qword [rsp + 0xa0]
sub rax, qword [rsp + 0x90]
mov qword [rsp + 0x60], rax
mov r8, rdx
mov qword [rsp + 0x80], rdx
mov r15, rdx
cmp r8, r15
jne 0x18005b49d
neg esi
sbb eax, eax
and eax, 0x3c
add eax, 4
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0x1000
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rdx, [rsp + 0x80]
mov rcx, r13
call sym.ntdll.dll_NtAllocateVirtualMemory
test eax, eax
js 0x1800b7e36
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
mov esi, 0x7ffe0380
test eax, eax
jne 0x1800b7e6c
mov ecx, esi
cmp byte [rcx], bl
jne 0x1800b7e88
add r15, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x40]
lea rcx, [rdx + 0x2a0]
mov qword [rsp + 0x68], rcx
mov r13, rcx
mov rax, qword gs:[0x60]
test dword [rax + 0xbc], 0x800
jne 0x1800b7ebe
mov eax, dword [rsp + 0x50]
add eax, 0xf
and eax, 0xfffffff0
mov dword [rsp + 0x50], eax
mov ecx, eax
shr ecx, 4
mov rax, qword [rsp + 0x40]
mov word [rax + 8], cx
mov rax, qword [rsp + 0x40]
mov byte [rax + 0xa], r14b
mov rax, qword [rsp + 0x40]
mov byte [rax + 0xf], r14b
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x98], 0xeeffeeff
mov ecx, edi
btr ecx, 0x1c
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x70], ecx
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x90], ebx
mov rcx, qword [rsp + 0x40]
add rcx, 0x218
xor edx, edx
lea r8d, [rdx + 0x78]
call sym.ntdll.dll_memset
mov rcx, qword [rsp + 0x40]
call fcn.18005c6e0
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x268], r14d
mov r10, qword [rsp + 0x40]
test dword [r10 + 0x70], 0x8000000
jne 0x1800b7ef1
mov eax, edi
and eax, 0x6001007d
mov dword [r10 + 0x74], eax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x68]
sub cx, ax
mov word [rax + 0xd2], cx
mov rax, qword [rsp + 0x40]
mov qword [rax + 0xd8], rbx
mov rax, qword [rsp + 0x40]
add rax, 0x150
mov qword [rax + 8], rax
mov qword [rax], rax
mov rax, qword [rsp + 0x40]
add rax, 0x110
mov qword [rax + 8], rax
mov qword [rax], rax
mov rax, qword [rsp + 0x40]
add rax, 0x120
mov qword [rax + 8], rax
mov qword [rax], rax
mov rax, qword [rsp + 0x40]
add rax, 0xf0
mov qword [rax + 8], rax
mov qword [rax], rax
cmp qword [rsp + 0x58], rbx
jne 0x18005b05e
test r14b, dil
jne 0x18005b05e
xor edx, edx
mov r8d, 0x10000000
mov rcx, r13
call sym.ntdll.dll_RtlInitializeCriticalSectionEx
test eax, eax
js 0x18005b7aa
mov qword [rsp + 0x58], r13
add r13, 0x28
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x160], rcx
mov rax, qword [rsp + 0x40]
bts dword [rax + 0x78], 0x1f
mov rdx, qword [rsp + 0x80]
mov rcx, rdx
sub rcx, qword [rsp + 0x88]
add rcx, qword [rsp + 0x60]
mov r8d, dword [rsp + 0x50]
add r8d, 0x450
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rdx
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
call fcn.18005c4d8
test al, al
je 0x1800b7e36
mov r15d, 0x80
test r12, r12
jne 0x18005b40c
mov dword [r13 + 8], r15d
lea rcx, [r13 + 0x38]
mov qword [r13 + 0x28], rcx
mov rax, qword [rsp + 0x40]
add rax, 0x150
mov qword [r13 + 0x20], rax
lea rax, [rcx + 0x10]
mov qword [r13 + 0x30], rax
mov rdx, r13
mov rcx, qword [rsp + 0x40]
call fcn.18005b7b4
mov rax, qword [rsp + 0x40]
mov word [rax + 0xd0], bx
mov rcx, qword [rsp + 0x148]
mov rax, qword [rsp + 0x40]
mov qword [rax + 0xa0], rcx
mov rcx, qword [rsp + 0x150]
mov rax, qword [rsp + 0x40]
mov qword [rax + 0xa8], rcx
mov rcx, qword [rsp + 0x158]
shr rcx, 4
mov rax, qword [rsp + 0x40]
mov qword [rax + 0xb0], rcx
mov rcx, qword [rsp + 0x160]
shr rcx, 4
mov rax, qword [rsp + 0x40]
mov qword [rax + 0xb8], rcx
mov rcx, qword [rsp + 0x168]
mov rax, qword [rsp + 0x40]
mov qword [rax + 0xc8], rcx
mov rcx, qword [rsp + 0x170]
add rcx, 0xf
shr rcx, 4
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x94], ecx
mov rcx, qword [rsp + 0x188]
xor rcx, qword [0x18015d758]
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x168], rcx
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x290], 4
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x298], 0x1fe000
test byte [0x18015d42c], r14b
jne 0x1800b7f1a
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x100], 0x1f
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x108], 0xfffffffffffffff0
mov rax, qword [rsp + 0x40]
test byte [rax + 0x70], 0x20
jne 0x1800b7f28
mov qword [rax + 0x178], rbx
mov rax, qword [rsp + 0x40]
mov word [rax + 0x180], bx
mov rax, qword [rsp + 0x40]
mov byte [rax + 0x182], bl
mov rax, qword [rsp + 0x40]
mov byte [rax + 0x183], bl
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x140], rbx
mov eax, edi
and al, 3
cmp al, 2
sete cl
test byte [0x18015d42c], r14b
sete al
test al, cl
je 0x18005b2a4
mov edx, 0x80000a
mov r8d, 0x100
mov rcx, qword [rsp + 0x40]
call sym.ntdll.dll_RtlAllocateHeap
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x188], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x188]
test rcx, rcx
je 0x1800b7e36
mov byte [rcx - 1], r14b
mov rax, qword [rsp + 0x40]
mov word [rax + 0x190], r15w
xor r9d, r9d
mov r8d, r14d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call fcn.18002a46c
mov rax, qword [rsp + 0x40]
cmp word [rax + 0xd0], bx
je 0x1800b7e36
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
jne 0x1800b7f3a
mov rcx, rsi
cmp byte [rcx], bl
jne 0x1800b7f56
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
mov esi, 0x7ffe038a
test eax, eax
jne 0x1800b7fb0
mov ecx, esi
cmp byte [rcx], bl
jne 0x1800b7fcc
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
jne 0x1800b8010
mov ecx, 0x7ffe0388
cmp byte [rcx], bl
jne 0x1800b802c
mov rax, qword [rsp + 0x40]
btr dword [rax + 0x78], 0x1f
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x170], rbx
mov rdi, qword [rsp + 0x40]
mov qword [rsp + 0x40], rbx
mov rdx, qword [rsp + 0x48]
mov rcx, rbx
test rcx, rcx
jne 0x1800b8044
cmp qword [rsp + 0x40], rbx
jne 0x1800b8058
mov rax, rdi
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.18008b0e0
add rsp, 0x240
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 0x88], rbx
jmp 0x18005ad24
cmp qword [rsp + 0x188], rbx
je 0x18005b4f0
mov rcx, qword [rsp + 0x178]
test rcx, rcx
je 0x1800b7e29
mov rax, qword [rsp + 0x180]
test rax, rax
je 0x1800b7e29
cmp rcx, rax
ja 0x1800b7e29
test dil, 2
jne 0x1800b7e29
mov qword [rsp + 0x80], r12
lea r15, [r12 + rcx]
mov qword [rsp + 0x60], rax
mov r8, r10
xor edx, edx
mov rcx, r12
call sym.ntdll.dll_memset
mov r8, qword [rsp + 0x80]
or r13, 0xffffffffffffffff
or dword [rsp + 0x70], r14d
mov rdx, r12
mov qword [rsp + 0x40], rdx
mov esi, edi
and esi, 0x40000
jmp 0x18005ae9b
mov r8, r15
xor edx, edx
mov rcx, r13
call sym.ntdll.dll_memset
jmp 0x18005b0d8
add r8, 0x1fff
and r8, 0xffffffffffffe000
jmp 0x18005acdf
cmp dword [rsi], 0x60
jne 0x18005b47d
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x140], xmm0
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x150], xmm1
movups xmm0, xmmword [rsi + 0x20]
movaps xmmword [rsp + 0x160], xmm0
movups xmm1, xmmword [rsi + 0x30]
movaps xmmword [rsp + 0x170], xmm1
movups xmm0, xmmword [rsi + 0x40]
movaps xmmword [rsp + 0x180], xmm0
movups xmm1, xmmword [rsi + 0x50]
movaps xmmword [rsp + 0x190], xmm1
jmp 0x18005ab7d
mov esi, 0x7ffe0380
jmp 0x18005af00
mov r9d, 0x2000
jmp 0x18005acbe
test r13, r13
je 0x18005ad89
jmp 0x1800b7cc9
test r15b, 2
je 0x18005ab34
test r12, r12
jne 0x18005ab34
test rsi, rsi
jne 0x1800b7d28
lea rdi, [rsp + 0x1a0]
test r13, r13
cmovne rdi, rbx
jmp 0x18005ab34
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0x30
lea r9, [rsp + 0xd8]
xor r8d, r8d
mov rdx, r12
or r13, 0xffffffffffffffff
mov rcx, r13
call sym.ntdll.dll_NtQueryVirtualMemory
test eax, eax
js 0x1800b7e36
mov r15, qword [rsp + 0xd8]
cmp r15, r12
jne 0x1800b7e36
cmp dword [rsp + 0xf8], 0x10000
je 0x1800b7e36
mov r8, r15
mov qword [rsp + 0x80], r15
mov eax, 0x1000
cmp dword [rsp + 0xf8], eax
jne 0x18005b723
bt edi, 0x12
jb 0x1800b7e48
mov r8, rax
xor edx, edx
mov rcx, r15
call sym.ntdll.dll_memset
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0x20
lea r9, [rsp + 0x120]
mov r8d, 3
mov rdx, r12
mov rcx, r13
call sym.ntdll.dll_NtQueryVirtualMemory
test eax, eax
js 0x1800b7e36
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x78], rax
mov r8, qword [rsp + 0x80]
lea r15, [rax + r8]
jmp 0x18005b3f2
lea rax, [rsp + 0x1a0]
cmp rdi, rax
jne 0x1800b7d52
xor edx, edx
lea r8d, [rdx + 0x50]
mov rcx, rdi
call sym.ntdll.dll_memset
mov dword [rdi], 0x500001
mov dword [rdi + 0xc], r14d
or dword [rdi + 0x10], 0xffffffff
mov eax, r14d
or ecx, 0xffffffff
movups xmm0, xmmword [0x18015a790]
movdqu xmmword [rsp + 0xb0], xmm0
bsr eax, eax
mov byte [rsp + 0xb1], al
mov eax, dword [rdi + 0x10]
cmp ecx, 0xffffffff
jne 0x1800b7d5d
mov rax, qword [rdi + 0x18]
mov qword [rsp + 0xb8], rax
mov r11, qword [rsp + 0x88]
mov r10, r11
mov r8, qword [rsp + 0x68]
test r8, r8
cmovne r10, r8
mov ecx, r15d
and ecx, r14d
mov eax, r15d
mov edx, ecx
bts edx, 0x1f
and al, 4
cmove edx, ecx
mov eax, r15d
mov r8d, edx
or r8d, 2
and al, 8
cmove r8d, edx
bt r15d, 0x1b
setae cl
mov edx, dword [rsp + 0x50]
bt edx, 0xc
setae al
mov r9d, r8d
bts r9d, 0x1d
and cl, al
cmovne r9d, r8d
test r15b, 0x20
sete cl
test dl, 0x10
sete al
mov edx, r9d
bts edx, 0x1c
and cl, al
cmovne edx, r9d
mov eax, r15d
mov r9d, edx
bts r9d, 0x1e
and eax, 0x40000
cmove r9d, edx
movaps xmm0, xmmword [rsp + 0xb0]
movdqa xmmword [rsp + 0x110], xmm0
mov r8, r10
cmp r11, r10
cmovbe r8, r11
mov ecx, r9d
bts ecx, 0x19
and r15b, 0x10
cmove ecx, r9d
lea r9, [rsp + 0x110]
mov rdx, r10
call fcn.18005d87c
mov rdi, rax
test rax, rax
je 0x18005b71b
xor r9d, r9d
mov r8d, r14d
xor edx, edx
mov rcx, rax
call fcn.18002a46c
cmp word [rdi + 0x3c], bx
je 0x1800b7d6c
mov rdx, r13
jmp 0x18005b33b
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x78]
cmp rcx, rax
cmova rcx, rax
mov qword [rsp + 0x78], rcx
cmp rcx, 0x2000
jae 0x18005b3f2
jmp 0x1800b7e36
mov qword [0x18015d020], 0x10000
xor r9d, r9d
lea r8d, [r9 + 0x40]
lea rdx, [rsp + 0x1f0]
xor ecx, ecx
call sym.ntdll.dll_NtQuerySystemInformation
test eax, eax
js 0x18005b7aa
mov rax, qword [rsp + 0x218]
mov qword [0x18015d018], rax
mov r10d, 0x1000
jmp 0x18005ac60
add r8, 0x10fff
and r8, 0xffffffffffff0000
mov qword [rsp + 0x60], r8
jmp 0x18005ad24
mov rdx, qword [rsp + 0x48]
jmp 0x1800b7cc9
test r12, r12
jne 0x18005ab0c
test r13, r13
jne 0x18005ab0c
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
xor edx, edx
mov rax, qword [0x180156418]
mov r10, qword [section..00cfg]
call r10
mov rdi, rax
test rax, rax
jne 0x18005b71b
cmp rsi, 0xffffffffffffffff
jne 0x1800b7cc6
mov rsi, rbx
mov r9, qword [rsp + 0x88]
mov r8, qword [rsp + 0x68]
jmp 0x18005ab0c
mov rdx, r13
mov rdi, rbx
jmp 0x18005b33b
test r15b, 2
je 0x18005b71b
test r12, r12
jne 0x18005b71b
test r8, r8
jne 0x18005b71b
test r9, r9
jne 0x18005b71b
test r13, r13
jne 0x18005b71b
test rsi, rsi
je 0x1800b7d15
mov rdi, rsi
mov rcx, rsi
call fcn.1801020bc
test eax, eax
jne 0x1800b7d1d
jmp 0x1800b7cc6
lea rdi, [rsp + 0x1a0]
mov r14d, 1
jmp 0x18005ab34
cmp qword [rsi + 8], rbx
jne 0x1800b7d43
cmp qword [rsi + 0x10], rbx
jne 0x1800b7d43
cmp qword [rsi + 0x30], rbx
jne 0x1800b7d43
cmp qword [rsi + 0x48], rbx
mov eax, r14d
je 0x1800b7d45
mov eax, ebx
test eax, eax
je 0x18005ab34
jmp 0x18005b4dc
mov eax, dword [rdi + 0xc]
mov ecx, dword [rdi + 0x10]
jmp 0x18005b603
add al, r14b
mov byte [rsp + 0xb2], al
jmp 0x18005b629
mov rcx, rdi
call fcn.18005f8d0
mov rdi, rbx
jmp 0x18005b71b
test r15d, 0xfff80c00
je 0x18005ab61
mov rax, qword gs:[0x60]
cmp qword [rax + 0x18], rbx
je 0x1800b7dbb
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
add rdx, 0x58
lea rcx, str.HEAP__wZ_:
call sym.ntdll.dll_DbgPrint
jmp 0x1800b7dc7
lea rcx, str.HEAP:
call sym.ntdll.dll_DbgPrint
lea rcx, [0x18012ecb0]
call sym.ntdll.dll_DbgPrint
mov ecx, 2
call fcn.1800fc294
nop
jmp 0x18005ab54
and r15d, 0x7f3ff
jmp 0x18005ab61
mov r9, r8
mov qword [rsp + 0x78], r8
mov rcx, r8
jmp 0x18005acf0
test edi, esi
jne 0x18005ad42
lea rax, [rsp + 0x140]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
mov rdx, r12
mov ecx, esi
call fcn.1800ff9cc
nop
jmp 0x18005b355
mov rdi, rbx
mov rcx, qword [rsp + 0x58]
jmp 0x18005b33e
mov rdi, rbx
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x48]
jmp 0x18005b33e
test byte [rsp + 0xfc], 0x40
je 0x1800b7e36
jmp 0x18005b569
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0x90], rbx
jmp 0x18005addd
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x226
jmp 0x18005aeee
mov rax, qword gs:[0x60]
test byte [rax + 0x378], r14b
je 0x18005aef6
mov r9d, r14d
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x40]
call fcn.1800fdf54
nop
jmp 0x18005aef6
add rcx, 7
and rcx, 0xfffffffffffffff8
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x148], rcx
mov eax, dword [rsp + 0x50]
add eax, 0x810
lea r13, [rcx + 0x810]
bts edi, 0x1a
mov word [rsp + 0x68], r13w
jmp 0x18005af2c
lea rcx, [0x1800fefb0]
call fcn.1800fc1fc
movzx ecx, ax
mov dword [r10 + 0x90], ecx
mov rax, qword [rsp + 0x40]
and dword [rax + 0x70], 0xffffffbf
mov r10, qword [rsp + 0x40]
jmp 0x18005afbe
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x78], r14d
jmp 0x18005b1e2
add qword [rax + 0x100], 0x10
mov rax, qword [rsp + 0x40]
jmp 0x18005b211
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x226
jmp 0x18005b2d8
mov rax, qword gs:[0x60]
test byte [rax + 0x378], r14b
je 0x18005b2e0
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x1800b7f8c
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x90]
add rsi, 0x226
movzx eax, byte [rsi]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0x60]
mov edx, edi
mov rcx, qword [rsp + 0x40]
call fcn.1800fe0ac
nop
jmp 0x18005b2e0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x230
jmp 0x18005b2f4
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x1800b7fec
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x90]
add rsi, 0x230
movzx eax, byte [rsi]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0x60]
mov edx, edi
mov rcx, qword [rsp + 0x40]
call fcn.1800fe0ac
nop
jmp 0x18005b2fc
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x22e
jmp 0x18005b30e
mov r8d, edi
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
call fcn.1800fc2ac
nop
jmp 0x18005b316
cmp rcx, rdx
je 0x18005b347
call sym.ntdll.dll_RtlDeleteCriticalSection
nop
jmp 0x18005b347
test r12, r12
jne 0x18005b352
mov qword [rsp + 0x60], rbx
mov r9d, 0x8000
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
call fcn.18005cd8c
nop
jmp 0x18005b352