Function at 0x1800018f0
Capabilities:
Access peb ldr_data
Get process filename
Populate syswhispers2 syscall list
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xc0
cmp dword [0x1800ed050], 0
je 0x18000190e
mov eax, 1
jmp 0x180002383
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x48], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x20], rax
jmp 0x180001b18
lea rcx, str.2529
call fcn.180067c88
mov ebx, eax
lea rcx, str.2529
call fcn.180067c88
add ebx, eax
lea rcx, str.3175
call fcn.180067c88
sub ebx, eax
lea rcx, str.4112
call fcn.180067c88
sub ebx, eax
lea rcx, str.3876
call fcn.180067c88
sub ebx, eax
lea rcx, str.4245
call fcn.180067c88
add ebx, eax
lea rcx, str.2571
call fcn.180067c88
sub ebx, eax
lea rcx, str.2762
call fcn.180067c88
add ebx, eax
lea rcx, str.3925
call fcn.180067c88
sub ebx, eax
lea rcx, str.4463
call fcn.180067c88
add ebx, eax
lea rcx, str.4092
call fcn.180067c88
add ebx, eax
lea rcx, str.3534
call fcn.180067c88
add ebx, eax
lea rcx, str.2772
call fcn.180067c88
add ebx, eax
lea rcx, str.2631
call fcn.180067c88
sub ebx, eax
lea rcx, str.4523
call fcn.180067c88
add ebx, eax
lea rcx, str.3138
call fcn.180067c88
sub ebx, eax
lea rcx, str.4502
call fcn.180067c88
add ebx, eax
lea rcx, str.2906
call fcn.180067c88
sub ebx, eax
lea rcx, str.2374
call fcn.180067c88
add ebx, eax
lea rcx, str.4119
call fcn.180067c88
sub ebx, eax
lea rcx, str.3953
call fcn.180067c88
sub ebx, eax
lea rcx, str.3307
call fcn.180067c88
sub ebx, eax
lea rcx, str.4401
call fcn.180067c88
add ebx, eax
lea rcx, str.2403
call fcn.180067c88
sub ebx, eax
lea rcx, str.2337
call fcn.180067c88
add ebx, eax
lea rcx, str.3209
call fcn.180067c88
add ebx, eax
lea rcx, str.2739
call fcn.180067c88
add ebx, eax
lea rcx, str.2806
call fcn.180067c88
add ebx, eax
lea rcx, str.3929
call fcn.180067c88
add ebx, eax
lea rcx, str.3556
call fcn.180067c88
sub ebx, eax
lea rcx, str.14074
call fcn.180067c88
mov ecx, ebx
sub ecx, eax
xor eax, eax
sub eax, ecx
movsxd rcx, eax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + rcx*8]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp qword [rax + 0x30], 0
je 0x180001bf4
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
movsxd rcx, dword [rax + 0x3c]
mov rax, qword [rsp + 0x48]
add rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
add rax, 0x88
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x90]
mov eax, dword [rax]
mov dword [rsp + 0x80], eax
cmp dword [rsp + 0x80], 0
jne 0x180001b8f
jmp 0x18000194f
mov ecx, dword [rsp + 0x80]
mov rax, qword [rsp + 0x48]
add rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov ecx, dword [rax + 0xc]
mov rax, qword [rsp + 0x48]
add rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax]
or eax, 0x20202020
cmp eax, 0x6c64746e
je 0x180001bd6
jmp 0x18000194f
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
jne 0x180001bef
jmp 0x180001bf4
jmp 0x18000194f
cmp qword [rsp + 0x68], 0
jne 0x180001c03
xor eax, eax
jmp 0x180002383
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x68]
mov ecx, dword [rax + 0x1c]
mov rax, qword [rsp + 0x48]
add rax, rcx
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x68]
mov ecx, dword [rax + 0x20]
mov rax, qword [rsp + 0x48]
add rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x68]
mov ecx, dword [rax + 0x24]
mov rax, qword [rsp + 0x48]
add rax, rcx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0
lea rax, [0x1800ed054]
mov qword [rsp + 0x58], rax
lea rcx, str.2529
call fcn.180067c88
mov ebx, eax
lea rcx, str.2529
call fcn.180067c88
add ebx, eax
lea rcx, str.3175
call fcn.180067c88
sub ebx, eax
lea rcx, str.4112
call fcn.180067c88
sub ebx, eax
lea rcx, str.3876
call fcn.180067c88
sub ebx, eax
lea rcx, str.4245
call fcn.180067c88
add ebx, eax
lea rcx, str.2571
call fcn.180067c88
sub ebx, eax
lea rcx, str.2762
call fcn.180067c88
add ebx, eax
lea rcx, str.3925
call fcn.180067c88
sub ebx, eax
lea rcx, str.4463
call fcn.180067c88
add ebx, eax
lea rcx, str.4092
call fcn.180067c88
add ebx, eax
lea rcx, str.3534
call fcn.180067c88
add ebx, eax
lea rcx, str.2772
call fcn.180067c88
add ebx, eax
lea rcx, str.2631
call fcn.180067c88
sub ebx, eax
lea rcx, str.4523
call fcn.180067c88
add ebx, eax
lea rcx, str.3138
call fcn.180067c88
sub ebx, eax
lea rcx, str.4502
call fcn.180067c88
add ebx, eax
lea rcx, str.2906
call fcn.180067c88
sub ebx, eax
lea rcx, str.2374
call fcn.180067c88
add ebx, eax
lea rcx, str.4119
call fcn.180067c88
sub ebx, eax
lea rcx, str.3953
call fcn.180067c88
sub ebx, eax
lea rcx, str.3307
call fcn.180067c88
sub ebx, eax
lea rcx, str.4401
call fcn.180067c88
add ebx, eax
lea rcx, str.2403
call fcn.180067c88
sub ebx, eax
lea rcx, str.2337
call fcn.180067c88
add ebx, eax
lea rcx, str.3209
call fcn.180067c88
add ebx, eax
lea rcx, str.2739
call fcn.180067c88
add ebx, eax
lea rcx, str.2806
call fcn.180067c88
add ebx, eax
lea rcx, str.3929
call fcn.180067c88
add ebx, eax
lea rcx, str.3556
call fcn.180067c88
sub ebx, eax
lea rcx, str.14074
call fcn.180067c88
mov ecx, ebx
sub ecx, eax
mov eax, dword [rsp + 0x40]
lea eax, [rax + rcx - 1]
mov ecx, eax
mov rax, qword [rsp + 0x60]
mov ecx, dword [rax + rcx*4]
mov rax, qword [rsp + 0x48]
add rax, rcx
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xa0]
movzx eax, word [rax]
cmp eax, 0x775a
jne 0x180001ea7
mov rcx, qword [rsp + 0xa0]
call fcn.1800014f0
mov r11d, eax
mov ecx, dword [rsp + 0x30]
mov rax, qword [rsp + 0x58]
mov dword [rax + rcx*8], r11d
mov eax, dword [rsp + 0x40]
sub eax, 1
mov ecx, eax
mov rax, qword [rsp + 0x38]
movzx r8d, word [rax + rcx*2]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + r8*4]
mov dword [rcx + rdx*8 + 4], eax
mov eax, dword [rsp + 0x30]
add eax, 1
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x1f4
jne 0x180001ea7
jmp 0x180001ebd
mov eax, dword [rsp + 0x40]
sub eax, 1
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x180001c62
mov eax, dword [rsp + 0x30]
mov dword [0x1800ed050], eax
mov dword [rsp + 0x30], 0
jmp 0x180001edc
mov eax, dword [rsp + 0x30]
add eax, 1
mov dword [rsp + 0x30], eax
mov eax, dword [0x1800ed050]
sub eax, 1
cmp dword [rsp + 0x30], eax
jae 0x18000237e
mov dword [rsp + 0xa8], 0
jmp 0x180001f0d
mov eax, dword [rsp + 0xa8]
add eax, 1
mov dword [rsp + 0xa8], eax
mov ecx, dword [rsp + 0x30]
mov eax, dword [0x1800ed050]
sub eax, ecx
sub eax, 1
cmp dword [rsp + 0xa8], eax
jae 0x180002379
mov esi, dword [rsp + 0xa8]
mov edi, dword [rsp + 0xa8]
add edi, 1
lea rcx, str.2529
call fcn.180067c88
mov ebx, eax
lea rcx, str.2529
call fcn.180067c88
add ebx, eax
lea rcx, str.3175
call fcn.180067c88
sub ebx, eax
lea rcx, str.4112
call fcn.180067c88
sub ebx, eax
lea rcx, str.3876
call fcn.180067c88
sub ebx, eax
lea rcx, str.4245
call fcn.180067c88
add ebx, eax
lea rcx, str.2571
call fcn.180067c88
sub ebx, eax
lea rcx, str.2762
call fcn.180067c88
add ebx, eax
lea rcx, str.3925
call fcn.180067c88
sub ebx, eax
lea rcx, str.4463
call fcn.180067c88
add ebx, eax
lea rcx, str.4092
call fcn.180067c88
add ebx, eax
lea rcx, str.3534
call fcn.180067c88
add ebx, eax
lea rcx, str.2772
call fcn.180067c88
add ebx, eax
lea rcx, str.2631
call fcn.180067c88
sub ebx, eax
lea rcx, str.4523
call fcn.180067c88
add ebx, eax
lea rcx, str.3138
call fcn.180067c88
sub ebx, eax
lea rcx, str.4502
call fcn.180067c88
add ebx, eax
lea rcx, str.2906
call fcn.180067c88
sub ebx, eax
lea rcx, str.2374
call fcn.180067c88
add ebx, eax
lea rcx, str.4119
call fcn.180067c88
sub ebx, eax
lea rcx, str.3953
call fcn.180067c88
sub ebx, eax
lea rcx, str.3307
call fcn.180067c88
sub ebx, eax
lea rcx, str.4401
call fcn.180067c88
add ebx, eax
lea rcx, str.2403
call fcn.180067c88
sub ebx, eax
lea rcx, str.2337
call fcn.180067c88
add ebx, eax
lea rcx, str.3209
call fcn.180067c88
add ebx, eax
lea rcx, str.2739
call fcn.180067c88
add ebx, eax
lea rcx, str.2806
call fcn.180067c88
add ebx, eax
lea rcx, str.3929
call fcn.180067c88
add ebx, eax
lea rcx, str.3556
call fcn.180067c88
sub ebx, eax
lea rcx, str.14074
call fcn.180067c88
mov ecx, ebx
sub ecx, eax
mov eax, edi
sub eax, ecx
mov edx, eax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + rdx*8 + 4]
cmp dword [rcx + rsi*8 + 4], eax
jbe 0x180002374
mov ecx, dword [rsp + 0xa8]
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + rcx*8]
mov dword [rsp + 0xb0], eax
mov ecx, dword [rsp + 0xa8]
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + rcx*8 + 4]
mov dword [rsp + 0xb4], eax
mov eax, dword [rsp + 0xa8]
add eax, 1
mov r8d, eax
mov edx, dword [rsp + 0xa8]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + r8*8]
mov dword [rcx + rdx*8], eax
mov eax, dword [rsp + 0xa8]
add eax, 1
mov r8d, eax
mov edx, dword [rsp + 0xa8]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + r8*8 + 4]
mov dword [rcx + rdx*8 + 4], eax
mov eax, dword [rsp + 0xa8]
add eax, 1
mov edx, eax
mov rcx, qword [rsp + 0x58]
mov eax, dword [rsp + 0xb0]
mov dword [rcx + rdx*8], eax
mov edi, dword [rsp + 0xa8]
add edi, 1
lea rcx, str.2529
call fcn.180067c88
mov ebx, eax
lea rcx, str.2529
call fcn.180067c88
add ebx, eax
lea rcx, str.3175
call fcn.180067c88
sub ebx, eax
lea rcx, str.4112
call fcn.180067c88
sub ebx, eax
lea rcx, str.3876
call fcn.180067c88
sub ebx, eax
lea rcx, str.4245
call fcn.180067c88
add ebx, eax
lea rcx, str.2571
call fcn.180067c88
sub ebx, eax
lea rcx, str.2762
call fcn.180067c88
add ebx, eax
lea rcx, str.3925
call fcn.180067c88
sub ebx, eax
lea rcx, str.4463
call fcn.180067c88
add ebx, eax
lea rcx, str.4092
call fcn.180067c88
add ebx, eax
lea rcx, str.3534
call fcn.180067c88
add ebx, eax
lea rcx, str.2772
call fcn.180067c88
add ebx, eax
lea rcx, str.2631
call fcn.180067c88
sub ebx, eax
lea rcx, str.4523
call fcn.180067c88
add ebx, eax
lea rcx, str.3138
call fcn.180067c88
sub ebx, eax
lea rcx, str.4502
call fcn.180067c88
add ebx, eax
lea rcx, str.2906
call fcn.180067c88
sub ebx, eax
lea rcx, str.2374
call fcn.180067c88
add ebx, eax
lea rcx, str.4119
call fcn.180067c88
sub ebx, eax
lea rcx, str.3953
call fcn.180067c88
sub ebx, eax
lea rcx, str.3307
call fcn.180067c88
sub ebx, eax
lea rcx, str.4401
call fcn.180067c88
add ebx, eax
lea rcx, str.2403
call fcn.180067c88
sub ebx, eax
lea rcx, str.2337
call fcn.180067c88
add ebx, eax
lea rcx, str.3209
call fcn.180067c88
add ebx, eax
lea rcx, str.2739
call fcn.180067c88
add ebx, eax
lea rcx, str.2806
call fcn.180067c88
add ebx, eax
lea rcx, str.3929
call fcn.180067c88
add ebx, eax
lea rcx, str.3556
call fcn.180067c88
sub ebx, eax
lea rcx, str.14074
call fcn.180067c88
mov ecx, ebx
sub ecx, eax
mov eax, edi
sub eax, ecx
mov edx, eax
mov rcx, qword [rsp + 0x58]
mov eax, dword [rsp + 0xb4]
mov dword [rcx + rdx*8 + 4], eax
jmp 0x180001efc
jmp 0x180001ed1
mov eax, 1
add rsp, 0xc0
pop rdi
pop rsi
pop rbx
ret