Function at 0x1800160e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb8
xor r14d, r14d
mov eax, r8d
mov r12, rcx
lea rcx, [0x180016998]
and eax, 0x10
mov rbx, rdx
mov r15, r14
mov qword [rsp + 0x40], r14
mov rbp, r14
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x58], eax
mov qword [rsp + 0x70], r14
je 0x180016148
mov rdi, qword [rdx]
lea rax, [0x180022060]
mov qword [rsp + 0x68], rax
jmp 0x18001614c
mov rdi, qword [rdx + 8]
cmp rdi, r14
jne 0x18001615b
mov ebx, 2
jmp 0x180016675
movsxd rax, dword [rdi + 0x3c]
xor edx, edx
mov r13d, 0x8664
mov ecx, dword [rax + rdi + 0x50]
lea r8d, [rdx + 0x28]
mov qword [rsp + 0x50], r14
lea esi, [rcx + 0xfff]
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x48], r14
and esi, 0xfffff000
mov dword [rsp + 0x5c], esi
call sub.ntdll.dll_memset
mov eax, dword [rbx + 0x14]
add eax, dword [rbx + 0x10]
xor r11d, r11d
mov qword [rsp + 0x30], r14
lea eax, [rax + rsi + 0xc58]
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x78]
mov dword [rsp + 0x60], eax
lea eax, [r11 + 0x40]
lea rcx, [rsp + 0x50]
mov edx, 0xf001f
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x64], r11d
mov dword [rsp + 0x90], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x78], 0x30
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], r14
call qword [sym.imp.ntdll.dll_NtCreateSection]
cmp eax, r14d
jl 0x18001624e
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x48]
or rdx, 0xffffffffffffffff
call fcn.180016cb4
mov esi, eax
cmp eax, r14d
jne 0x180016258
mov r8d, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call sub.ntdll.dll_memset
mov rbp, qword [rsp + 0x50]
mov r15, qword [rsp + 0x48]
mov qword [rsp + 0x70], rbp
jmp 0x180016258
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov esi, eax
mov ebx, esi
cmp esi, r14d
jne 0x18001664b
mov rdx, qword [r12]
lea r8, [rsp + 0x40]
mov rcx, rbp
call fcn.180016cb4
mov ebx, eax
cmp eax, r14d
jne 0x18001664b
movsxd rbx, dword [rdi + 0x3c]
mov r14, qword [rsp + 0x40]
mov eax, 0x8664
add rbx, rdi
mov rdx, rdi
mov rcx, r15
cmp word [rbx + 4], r13w
cmp word [rbx + 4], ax
mov eax, dword [rbx + 0x54]
movzx esi, word [rbx + 0x14]
movzx r12d, word [rbx + 6]
mov r13d, dword [rbx + 0x3c]
mov r8d, eax
call sub.ntdll.dll_memcpy
test r12d, r12d
je 0x1800162f0
lea ebp, [r13 - 1]
lea rsi, [rsi + rbx + 0x2c]
not ebp
mov eax, dword [rsi - 4]
lea ecx, [rax + r13 - 1]
and ecx, ebp
je 0x1800162e6
mov edx, dword [rsi]
mov r8d, ecx
mov ecx, dword [rsi - 8]
add rcx, r15
add rdx, rdi
call sub.ntdll.dll_memcpy
add rsi, 0x28
sub r12, 1
jne 0x1800162c7
test r14, r14
mov edx, 0x8664
lea rax, [rbx + 0xb0]
cmove r14, r15
cmp word [rbx + 4], dx
lea rcx, [rbx + 0xa0]
cmove rcx, rax
mov ebp, 8
cmp dword [rcx], 0
je 0x1800163bc
mov r10d, dword [rcx + 4]
test r10d, r10d
je 0x1800163bc
cmp word [rbx + 4], dx
jne 0x180016339
mov rax, qword [rbx + 0x30]
jmp 0x18001633c
mov eax, dword [rbx + 0x34]
mov r8d, dword [rcx]
mov rdi, r14
sub r14, qword [rbx + 0x30]
add r8, r15
sub rdi, rax
cmp r10d, ebp
jbe 0x1800163bc
mov ebx, 2
mov esi, 0xfff
mov eax, dword [r8 + 4]
mov r9d, dword [r8]
mov rcx, rax
add r9, r15
sub rcx, rbp
shr rcx, 1
cmp r10d, eax
jl 0x1800163ad
test ecx, ecx
je 0x1800163ad
lea rdx, [r8 + 8]
mov r11d, ecx
movzx eax, word [rdx]
shr eax, 0xc
cmp eax, 3
je 0x18001639a
cmp eax, 0xa
jne 0x1800163a4
movzx eax, word [rdx]
and rax, rsi
add qword [rax + r9], r14
jmp 0x1800163a4
movzx eax, word [rdx]
and rax, rsi
add dword [rax + r9], edi
add rdx, rbx
sub r11, 1
jne 0x18001637e
mov eax, dword [r8 + 4]
sub r10d, eax
add r8, rax
cmp r10d, ebp
ja 0x18001635b
mov rbx, qword [rsp + 0x108]
mov r12d, dword [rsp + 0x5c]
mov r8d, dword [rbx + 0x10]
mov rdx, qword [rbx]
lea rsi, [r12 + r15]
lea rcx, [rsi + 0xc58]
call sub.ntdll.dll_memcpy
mov eax, dword [rbx + 0x10]
mov r8d, dword [rbx + 0x14]
mov rdx, qword [rbx + 8]
add rax, r12
lea rcx, [rax + r15 + 0xc58]
call sub.ntdll.dll_memcpy
mov rax, qword [rsp + 0x40]
xor r14d, r14d
mov qword [rsi + 0x30], rax
mov rax, qword [rsp + 0x40]
lea rcx, [r12 + rax + 0xc58]
mov qword [rsi + 0x18], rcx
mov ecx, dword [rbx + 0x10]
mov rax, qword [rsp + 0x40]
add rcx, r12
lea rcx, [rcx + rax + 0xc58]
mov qword [rsi + 0x20], rcx
mov eax, dword [rbx + 0x10]
mov dword [rsi + 0x28], eax
mov eax, dword [rbx + 0x14]
mov ebx, r14d
mov dword [rsi + 0x2c], eax
cmp dword [rsp + 0x58], r14d
je 0x180016504
mov r13, qword [rsp + 0x100]
mov rdi, qword [r13]
cmp qword [0x180023ce8], r14
je 0x180016470
cmp qword [0x180023cf0], r14
je 0x180016470
cmp qword [0x180023cf8], r14
jne 0x1800164ea
lea r8, [0x180025d0a]
lea rdx, [0x1800257ee]
mov rcx, rdi
mov ebx, 0x7f
call fcn.180010c4c
mov qword [0x180023ce8], rax
cmp rax, r14
je 0x1800165aa
lea r8, [0x180025d15]
lea rdx, [0x1800257ee]
mov rcx, rdi
call fcn.180010c4c
mov qword [0x180023cf0], rax
cmp rax, r14
je 0x1800165aa
lea r8, [0x180025cde]
lea rdx, [0x1800257ee]
mov rcx, rdi
call fcn.180010c4c
mov qword [0x180023cf8], rax
cmp rax, r14
je 0x1800165aa
mov ebx, r14d
lea rdx, [0x180023ce8]
mov r8d, 0x18
mov rcx, rsi
call sub.ntdll.dll_memcpy
jmp 0x1800165aa
cmp qword [0x180023cd0], r14
je 0x18001651f
cmp qword [0x180023cd8], r14
je 0x18001651f
cmp qword [0x180023ce0], r14
jne 0x18001658d
lea rcx, [0x1800257ee]
mov ebx, 0x7f
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
cmp rax, r14
je 0x1800165a2
lea rdx, [0x180025d0a]
mov rcx, rax
call fcn.1800106e8
mov qword [0x180023cd0], rax
cmp rax, r14
je 0x1800165a2
lea rdx, [0x180025d15]
mov rcx, rdi
call fcn.1800106e8
mov qword [0x180023cd8], rax
cmp rax, r14
je 0x1800165a2
lea rdx, [0x180025cde]
mov rcx, rdi
call fcn.1800106e8
mov qword [0x180023ce0], rax
cmp rax, r14
je 0x1800165a2
mov ebx, r14d
lea rdx, [0x180023cd0]
mov r8d, 0x18
mov rcx, rsi
call sub.ntdll.dll_memcpy
mov r13, qword [rsp + 0x100]
cmp ebx, r14d
jne 0x18001664b
mov rdx, qword [rsp + 0x68]
lea rcx, [rsi + 0x48]
mov r8d, 0x800
call sub.ntdll.dll_memcpy
mov r11, qword [rsp + 0x40]
mov rcx, qword [0x180023a50]
mov esi, 0x318
xor edx, edx
lea rdi, [r12 + r11]
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
cmp rax, r14
je 0x18001662f
mov r8, rsi
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
mov r8d, dword [rsp + 0x110]
lea r11, [rdi + 0x48]
mov rdx, rbx
mov rcx, r13
mov qword [rbx + 8], r11
mov qword [rbx + 0x10], rdi
call fcn.180010ac8
mov rcx, qword [0x180023a50]
mov r8, rbx
xor edx, edx
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, ebp
cmp ebp, r14d
jne 0x18001664b
mov rdx, qword [rsp + 0x118]
cmp rdx, r14
je 0x18001664b
mov rax, qword [rsp + 0x40]
mov qword [rdx], rax
cmp r15, r14
je 0x180016665
mov rdx, r15
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov rcx, qword [rsp + 0x70]
cmp rcx, r14
je 0x180016675
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret