Function at 0x180013f50
Capabilities:
Access peb ldr_data
Check os version

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov r15, r9
mov r14d, edx
mov rbx, rcx
mov r13, rcx
mov qword [rsp + 0xc0], rcx
xor r12d, r12d
mov qword [rax - 0xc0], r12
mov byte [rsp + 0x40], r12b
mov qword [rax - 0x78], r12
test r8, r8
je 0x1800a9410
mov rsi, r8
add rsi, 0xfffffffffffffff0
prefetchw byte [rsi]
mov r8, rsi
cmp byte [rsi + 0xf], 5
je 0x1800a9438
mov qword [rsp + 0x48], rsi
cmp byte [rcx + 0x182], 2
jne 0x18001411c
cmp qword [rcx + 0x178], r12
je 0x18001411c
lea rdx, [r8 + 0xf]
cmp byte [rdx], r12b
jge 0x18001411c
test r14b, 0x10
jne 0x180014fc2
lea r9, [r8 + 8]
mov rdi, r8
shr rdi, 4
mov eax, dword [r9]
xor eax, ebx
xor eax, edi
xor eax, dword [0x18015d458]
movzx ecx, ax
test ecx, ecx
jne 0x1800a944d
shr eax, 0xc
mov ecx, eax
sub r8, rcx
mov rax, qword [r8]
movzx r8d, word [rax + 0x24]
movzx ecx, byte [rdx]
cmp cl, 5
je 0x1800a9455
test cl, 0x40
jne 0x1800a946d
movzx eax, cl
and al, 0x3f
cmp al, 0x3f
je 0x180014f7c
movzx edx, cl
and edx, 0x3f
movzx edi, r8w
shl rdi, 4
sub rdi, rdx
mov qword [rsp + 0x58], rdi
mov esi, dword [rsp + 0x188]
and esi, 0xc003ffff
mov dword [rsp + 0x188], esi
mov r8, r15
mov edx, esi
mov rcx, rbx
call sym.ntdll.dll_RtlAllocateHeap
mov qword [rsp + 0x68], rax
jmp 0x1800140a7
test rax, rax
je 0x1800140da
cmp r15, rdi
jb 0x180014f74
mov r8, rdi
mov rdx, qword [rsp + 0x190]
mov rcx, rax
call sym.ntdll.dll_RtlCopyMemory
mov r8, qword [rsp + 0x190]
mov edx, esi
mov rcx, rbx
call sym.ntdll.dll_RtlFreeHeap
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
test rcx, rcx
jne 0x1800a94bd
mov ecx, 0x7ffe0380
cmp byte [rcx], 0
jne 0x1800a94e2
mov rdi, qword [rsp + 0x68]
mov rax, rdi
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp r8, rbx
je 0x1800a9531
or r14d, dword [rcx + 0x74]
mov dword [rsp + 0x188], r14d
test r14d, 0x61000000
jne 0x1800a9550
movabs rax, 0x7fffffffffffffff
cmp r15, rax
ja 0x1800a9571
mov rax, r15
mov r9d, 1
test r15, r15
cmove rax, r9
add rax, qword [rcx + 0x100]
and rax, qword [rcx + 0x108]
cmp rax, 0x20
jb 0x1800a9597
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r12
test r14b, 1
jne 0x1800141ba
mov rcx, qword [rcx + 0x160]
call sym.ntdll.dll_RtlTryEnterCriticalSection
test eax, eax
je 0x180014eab
inc dword [rbx + 0x248]
mov r9d, 1
mov byte [rsp + 0x40], 1
xor r14d, 1
mov dword [rsp + 0x188], r14d
prefetchw byte [rsi]
cmp byte [rsi + 0xf], 5
je 0x180014b20
mov qword [rsp + 0x48], rsi
mov r10, rsi
mov qword [rsp + 0x80], rsi
cmp dword [rbx + 0x7c], 0
je 0x180014202
mov edx, dword [rbx + 0x88]
xor edx, dword [rsi + 8]
mov dword [rsi + 8], edx
mov ecx, edx
shr ecx, 0x10
mov eax, edx
shr eax, 8
xor cl, al
xor cl, dl
shr edx, 0x18
cmp dl, cl
jne 0x180014b30
mov qword [rsp + 0xb8], rsi
movzx edx, word [rsi + 8]
mov rcx, qword [rbx + 0x138]
mov eax, dword [rcx + 8]
cmp rdx, rax
jb 0x180014227
mov rcx, qword [rcx]
test rcx, rcx
je 0x180014227
jmp 0x180014215
test r14d, 0x3c000100
jne 0x1800147e9
cmp qword [rbx + 0x148], 0
jne 0x1800147e9
test byte [rsi + 0xa], 2
jne 0x1800147e9
lea r8, [rsi + 0xf]
mov qword [rsp + 0x90], r8
movzx ecx, byte [r8]
test cl, 0x3f
je 0x180014b49
cmp cl, 4
je 0x180014a2f
movzx edi, word [r10 + 8]
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0x60], rdi
cmp cl, 5
je 0x180014ba0
test cl, 0x40
jne 0x180014bb3
movzx eax, cl
and al, 0x3f
cmp al, 0x3f
je 0x180014ab8
movzx ecx, cl
and ecx, 0x3f
mov qword [rsp + 0x78], rcx
mov rax, rdi
shl rax, 4
sub rax, rcx
mov qword [rsp + 0x58], rax
movzx eax, word [rbx + 0x190]
cmp rdi, rax
jae 0x18001431f
mov rax, rdi
shr rax, 3
and dil, 7
movzx edx, byte [rax + rbx + 0x192]
movzx ecx, dil
shl r9d, cl
movzx eax, dl
mov rdi, qword [rsp + 0x60]
test dl, r9b
jne 0x1800144ba
mov rax, qword [rbx + 0x188]
mov qword [rsp + 0x98], rdi
lea rcx, [rax + rdi*2]
movzx eax, word [rcx]
cmp ax, 1
jbe 0x180014312
dec ax
mov word [rcx], ax
mov r14d, dword [rsp + 0x188]
mov rsi, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
shr rcx, 4
mov rdx, rcx
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0x88], rcx
cmp rcx, rdi
jbe 0x18001436d
cmp byte [r8], 4
je 0x1800145b6
mov qword [rsp + 0x20], rcx
mov r9, r15
mov r8, rsi
mov edx, r14d
mov rcx, rbx
call fcn.18005b944
test al, al
je 0x1800145b6
jmp 0x180014e5e
inc rcx
cmp rcx, rdi
je 0x1800147cb
cmp byte [r8], 4
je 0x180014c2f
test byte [rsi + 0xa], 2
jne 0x180014821
mov rax, qword gs:[0x60]
mov ecx, dword [rax + 0xbc]
mov dword [rsp + 0x10c], ecx
bt ecx, 0xb
jb 0x180014c41
mov r14d, dword [rsp + 0x188]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x60]
mov qword [rsp + 0x98], rdi
mov rdx, qword [rsp + 0x88]
mov qword [rsp + 0xa8], rdx
mov r12d, 4
mov rcx, qword [rsp + 0x58]
cmp r15, rcx
ja 0x1800144d4
test byte [rbx + 0x70], 0x20
jne 0x180014ca1
cmp rdx, rdi
je 0x180014486
movzx r9d, byte [rsi + 0xa]
and r9b, 0xfe
mov byte [rsp + 0x71], r9b
cmp byte [r8], 4
je 0x180014cba
movzx ecx, word [rsi + 8]
movzx eax, dx
sub ecx, eax
movsxd rdi, ecx
mov qword [rsp + 0x128], rdi
mov word [rsi + 8], dx
test byte [rbx + 0x70], 0x40
jne 0x180014de0
xor r10b, r10b
movzx eax, byte [rsi + 0xe]
test al, al
jne 0x1800147a3
mov rcx, rbx
mov qword [rsp + 0xe0], rbx
mov r8, rdx
shl r8, 4
add r8, rsi
mov qword [rsp + 0x30], rdi
mov word [rsp + 0x28], dx
mov byte [rsp + 0x20], r10b
mov rdx, rcx
mov rcx, rbx
call fcn.18005bdb4
mov rdx, qword [rsp + 0xa8]
mov r8, qword [rsp + 0x90]
cmp byte [r8], 4
je 0x180014e5e
mov rax, qword [rsp + 0x50]
sub rax, r15
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0x80]
cmp rax, 0x3f
jae 0x180014de8
mov byte [rcx + 0xf], al
jmp 0x180014e5e
mov r14d, dword [rsp + 0x188]
mov rsi, qword [rsp + 0x48]
mov qword [rsp + 0x98], rdi
jmp 0x18001431f
test r14b, 8
jne 0x1800147f4
test byte [rbx + 0x70], 0x40
je 0x1800143eb
mov rax, qword [rsp + 0x58]
and eax, 3
mov qword [rsp + 0x118], rax
je 0x180014508
sub r12, rax
mov rax, r12
mov qword [rsp + 0x118], rax
mov rcx, qword [rsp + 0x58]
lea r10, [rax + rcx]
cmp r15, r10
jbe 0x1800143eb
mov r9, r15
sub r9, rax
sub r9, rcx
and r9, 0xfffffffffffffffc
je 0x1800143eb
mov qword [rsp + 0xe8], r9
add r10, 0x10
add r10, rsi
mov qword [rsp + 0x120], r10
shr r9, 2
mov qword [rsp + 0xe8], r9
test r9, r9
je 0x1800143eb
test r10b, 4
je 0x180014584
mov dword [r10], 0xbaadf00d
sub r9, 1
mov qword [rsp + 0xe8], r9
je 0x1800143eb
add r10, 4
mov qword [rsp + 0x120], r10
mov rcx, r9
shr rcx, 1
movabs rax, 0xbaadf00dbaadf00d
mov rdi, r10
rep stosq qword [rdi], rax
test r9b, 1
je 0x1800145a9
mov dword [r10 + r9*4 - 4], 0xbaadf00d
mov rdi, qword [rsp + 0x98]
jmp 0x1800143eb
test r14b, 0x10
jne 0x180014b13
and r14d, 0xc003ffff
mov dword [rsp + 0x188], r14d
movzx eax, byte [rsi + 0xa]
test al, 2
jne 0x1800149ad
mov rax, qword gs:[0x60]
mov rsi, qword [rsp + 0x48]
mov r14d, dword [rsp + 0x188]
test dword [rax + 0xbc], 0x800
jne 0x180014df5
lea rdi, [r13 + 0x7c]
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0xe0], rdi
cmp dword [rdi], 0
je 0x180014631
movzx eax, byte [rsi + 0xa]
xor al, byte [rsi + 9]
xor al, byte [rsi + 8]
mov byte [rsi + 0xb], al
mov eax, dword [r13 + 0x88]
xor dword [rsi + 8], eax
mov qword [rsp + 0xb8], r12
mov r8, r15
mov edx, r14d
mov rcx, rbx
call sym.ntdll.dll_RtlAllocateHeap
mov r9, rax
mov qword [rsp + 0x68], rax
lea rdx, [r13 + 0x7c]
jmp 0x180014695
test r9, r9
je 0x180014786
lea rdi, [r9 - 0x10]
mov qword [rsp + 0x78], rdi
prefetchw byte [rdi]
cmp byte [rdi + 0xf], 5
je 0x180014e17
mov qword [rsp + 0xf8], rdi
cmp dword [rdx], 0
je 0x1800146ef
mov edx, dword [r13 + 0x88]
xor edx, dword [rdi + 8]
mov dword [rdi + 8], edx
mov ecx, edx
shr ecx, 0x10
mov eax, edx
shr eax, 8
xor cl, al
xor cl, dl
shr edx, 0x18
cmp dl, cl
jne 0x180014e2c
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0xb8], rdi
test byte [rdi + 0xa], 2
jne 0x1800148d6
cmp dword [rdx], 0
je 0x18001471d
movzx eax, byte [rdi + 0xa]
xor al, byte [rdi + 9]
xor al, byte [rdi + 8]
mov byte [rdi + 0xb], al
mov eax, dword [r13 + 0x88]
xor dword [rdi + 8], eax
mov qword [rsp + 0xb8], r12
cmp byte [rsp + 0x40], 0
je 0x18001474e
mov rcx, qword [r13 + 0x160]
call sym.ntdll.dll_RtlLeaveCriticalSection
mov byte [rsp + 0x40], 0
and r14d, 0xfffffffe
mov dword [rsp + 0x188], r14d
mov r9, qword [rsp + 0x68]
cmp r15, qword [rsp + 0x58]
jb 0x180014b0b
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x190]
mov rcx, r9
call sym.ntdll.dll_RtlCopyMemory
mov r8, qword [rsp + 0x190]
mov edx, r14d
mov rcx, rbx
call sym.ntdll.dll_RtlFreeHeap
mov r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x190], r9
jmp 0x180014e5e
movzx eax, al
shl rax, 0x10
mov rcx, rsi
and rcx, 0xffffffffffff0000
sub rcx, rax
add rcx, 0x10000
mov qword [rsp + 0xe0], rcx
jmp 0x180014452
mov rdx, rcx
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0x88], rcx
add qword [rsp + 0x50], 0x10
jmp 0x180014379
add qword [rsp + 0x50], 0x10
jmp 0x18001424c
mov r8, r15
sub r8, rcx
mov rax, qword [rsp + 0x190]
add rcx, rax
xor edx, edx
call sym.ntdll.dll_memset
mov rdx, qword [rsp + 0xa8]
mov r8, qword [rsp + 0x90]
jmp 0x1800143eb
movzx ecx, word [rsi + 8]
shl rcx, 4
add rcx, 0xfffffffffffffff0
add rcx, rsi
mov qword [rsp + 0x138], rcx
shl rdx, 4
lea rax, [rsi - 0x10]
add rax, rdx
mov qword [rsp + 0xc8], rax
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
mov rax, qword gs:[0x60]
mov ecx, dword [rax + 0xbc]
mov dword [rsp + 0x108], ecx
bt ecx, 0xb
jae 0x1800143ad
mov rdi, qword [rsp + 0xc8]
mov r12d, 4
mov dword [rsp + 0x20], r12d
mov r9, qword [rsp + 0x88]
mov qword [rsp + 0xa8], r9
mov r8, qword [rsp + 0x60]
mov qword [rsp + 0x98], r8
movzx edx, word [rdi + 2]
mov rcx, rbx
call fcn.1800ed110
mov word [rdi + 2], ax
mov r14d, dword [rsp + 0x188]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x98]
mov rdx, r9
mov r8, qword [rsp + 0x90]
jmp 0x1800143dd
mov rcx, rdi
call fcn.180063b6c
mov r8, rax
mov qword [rsp + 0xc8], rax
cmp dword [rdx], 0
je 0x18001491b
mov edi, dword [r13 + 0x88]
xor edi, dword [rsi + 8]
mov dword [rsi + 8], edi
mov edx, edi
shr edx, 0x10
mov ecx, edi
shr ecx, 8
xor dl, cl
xor dl, dil
shr edi, 0x18
cmp dil, dl
jne 0x180014e41
mov rdi, qword [rsp + 0x78]
test byte [rsi + 0xa], 2
je 0x180014933
mov rcx, rsi
call fcn.180063b6c
mov rcx, qword [rax + 8]
mov qword [r8 + 8], rcx
jmp 0x18001493c
xor eax, eax
mov qword [r8], rax
mov qword [r8 + 8], rax
jmp 0x180014984
lea rdx, [r13 + 0x7c]
cmp dword [rdx], 0
je 0x18001471d
movzx eax, byte [rsi + 0xa]
xor al, byte [rsi + 9]
xor al, byte [rsi + 8]
mov byte [rsi + 0xb], al
mov eax, dword [r13 + 0x88]
xor dword [rsi + 8], eax
jmp 0x180014701
and r14d, 0xfffff1ff
mov dword [rsp + 0x188], r14d
movzx eax, al
and eax, 0xe0
or eax, 0x10
shl eax, 4
or r14d, eax
mov dword [rsp + 0x188], r14d
mov rcx, rsi
call fcn.180063b6c
movzx ecx, word [rax + 2]
test cx, cx
je 0x1800149f9
js 0x1800149f9
movzx eax, cx
shl eax, 0x12
or r14d, eax
mov dword [rsp + 0x188], r14d
jmp 0x180014601
lea rdi, [rsi - 0x30]
cmp dword [rbx + 0x7c], 0
je 0x180014b8e
mov ecx, dword [r10 + 8]
mov dword [rsp + 0xb0], ecx
test dword [rbx + 0x7c], ecx
jne 0x180014b77
mov word [rsp + 0x72], cx
movzx edx, word [rsi + 8]
mov r14d, dword [rsp + 0x188]
mov rsi, qword [rsp + 0x48]
movzx eax, cx
mov rcx, qword [rdi + 0x20]
sub rcx, rax
mov qword [rsp + 0x58], rcx
movzx edi, dx
add rdi, rcx
shr rdi, 4
mov qword [rsp + 0x60], rdi
add qword [rsp + 0x50], 0x30
mov rcx, qword [rsp + 0x50]
add rcx, 8
mov qword [rsp + 0x50], rcx
lea rax, [rcx + 0xfff]
and rax, 0xfffffffffffff000
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x98], rdi
jmp 0x18001431f
test cl, cl
js 0x180014bc6
cmp dword [rbx + 0x7c], 0
je 0x180014c27
mov ecx, dword [rsi + 8]
mov dword [rsp + 0xa0], ecx
test dword [rbx + 0x7c], ecx
jne 0x180014c10
mov r14d, dword [rsp + 0x188]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x60]
mov qword [rsp + 0x98], rdi
mov word [rsp + 0x74], cx
movzx eax, cx
add rax, rax
mov rcx, qword [rsi + rax*8]
jmp 0x1800142a5
mov r8, r15
jmp 0x18001475e
mov qword [rsp + 0x190], r12
jmp 0x180014e5e
movzx eax, byte [rsi + 0xe]
shl rax, 4
sub rsi, rax
jmp 0x1800141c7
mov rdx, rsi
mov rcx, rbx
call fcn.1800fbec0
mov r9d, 1
mov r10, rsi
jmp 0x180014202
mov rax, qword gs:[0x30]
mov dword [rax + 0x1250], 0xc000000d
mov rdi, qword gs:[0x30]
mov ecx, 0xc000000d
call sym.ntdll.dll_RtlNtStatusToDosError
mov dword [rdi + 0x68], eax
jmp 0x180014e5e
mov eax, dword [rbx + 0x88]
xor eax, ecx
mov dword [rsp + 0xb0], eax
movzx ecx, ax
jmp 0x180014a51
movzx edx, word [r10 + 8]
movzx ecx, dx
mov word [rsp + 0x72], dx
jmp 0x180014a67
movzx ecx, word [rbx + 0x8c]
movzx eax, word [rsi + 0xc]
xor rcx, rax
jmp 0x1800142a5
movzx eax, cl
and eax, 0x3f
add rax, rax
movzx ecx, word [rsi + rax*8 + 0xc]
jmp 0x1800142a5
mov rcx, rsi
shr rcx, 4
xor ecx, dword [rsi + 8]
xor ecx, ebx
xor ecx, dword [0x18015d458]
test cx, cx
je 0x180014be2
mov rax, r12
jmp 0x180014bed
shr ecx, 0xc
mov eax, ecx
sub rsi, rax
mov rax, qword [rsi]
movzx ecx, word [rax + 0x24]
mov r14d, dword [rsp + 0x188]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x60]
mov qword [rsp + 0x98], rdi
jmp 0x180014afc
mov eax, dword [rbx + 0x88]
xor eax, ecx
mov dword [rsp + 0xa0], eax
movzx ecx, ax
jmp 0x180014add
movzx ecx, di
jmp 0x180014af7
movzx eax, word [rsp + 0x50]
sub ax, r15w
mov word [rsi + 8], ax
jmp 0x1800143d7
mov rsi, qword [rsp + 0x48]
movzx eax, byte [rsi + 0xb]
mov byte [rsp + 0x70], al
movzx r8d, word [rsi + 8]
movzx edx, ax
mov r12d, 4
mov dword [rsp + 0x20], r12d
mov r9, qword [rsp + 0x88]
mov qword [rsp + 0xa8], r9
mov rcx, rbx
call fcn.1800ed110
mov byte [rsi + 0xb], al
mov r14d, dword [rsp + 0x188]
mov rdi, qword [rsp + 0x60]
mov qword [rsp + 0x98], rdi
mov rdx, r9
mov r8, qword [rsp + 0x90]
jmp 0x1800143dd
movabs rax, 0xabababababababab
mov qword [rsi + r15 + 0x10], rax
mov qword [rsi + r15 + 0x18], rax
jmp 0x1800143f5
add rsi, 0xffffffffffffffd0
mov rax, qword gs:[0x60]
mov ecx, dword [rax + 0xbc]
mov dword [rsp + 0x110], ecx
mov r9, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x60]
mov qword [rsp + 0xa8], r9
bt ecx, 0xb
jae 0x180014d0a
mov dword [rsp + 0x20], 5
mov r8, rdi
movzx edx, word [rsi + 0x12]
mov rcx, rbx
call fcn.1800ed110
mov word [rsi + 0x12], ax
mov rcx, qword [rsp + 0x50]
lea rax, [rsi + rcx]
mov qword [rsp + 0xf0], rax
shl rdi, 4
sub rdi, rcx
mov qword [rsp + 0xd8], rdi
mov r9d, 0x4000
lea r8, [rsp + 0xd8]
lea rdx, [rsp + 0xf0]
call fcn.18005cd8c
mov dword [rsp + 0xd0], eax
test eax, eax
jns 0x180014dca
mov rax, qword gs:[0x60]
cmp qword [rax + 0x18], 0
je 0x180014d83
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
add rdx, 0x58
lea rcx, str.HEAP__wZ_:
call sym.ntdll.dll_DbgPrint
jmp 0x180014d8f
lea rcx, str.HEAP:
call sym.ntdll.dll_DbgPrint
mov r9d, dword [rsp + 0xd0]
mov r8, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0xf0]
lea rcx, str.Unable_to_release_memory_at__p_for__Ix_bytes___Status___x_n
call sym.ntdll.dll_DbgPrint
call fcn.18010109c
mov rsi, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x88]
jmp 0x18001447e
mov rax, qword [rsp + 0xd8]
sub qword [rsi + 0x20], rax
mov rsi, qword [rsp + 0x48]
jmp 0x180014476
mov r10b, 1
jmp 0x18001443b
add rdx, rdx
mov qword [rsi + rdx*8], rax
mov byte [rcx + 0xf], 0x3f
jmp 0x180014e5e
movzx eax, byte [rsi + 0xb]
test al, al
je 0x180014601
movzx eax, al
shl eax, 0x12
or r14d, eax
mov dword [rsp + 0x188], r14d
jmp 0x180014601
movzx eax, byte [rdi + 0xe]
shl rax, 4
sub rdi, rax
mov qword [rsp + 0x78], rdi
jmp 0x1800146b4
mov rdx, rdi
mov rcx, r13
call fcn.1800fbec0
mov r9, qword [rsp + 0x68]
jmp 0x1800146e7
mov rdx, rsi
mov rcx, r13
call fcn.1800fbec0
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0xc8]
jmp 0x180014916
jmp 0x180014eff
cmp byte [0x18015c3a8], 0
jne 0x180014ed6
mov rcx, qword [rbx + 0x160]
call sym.ntdll.dll_RtlEnterCriticalSection
mov r9d, 1
mov edx, r9d
mov rcx, rbx
call fcn.18007c6f0
jmp 0x1800141a9
mov rax, qword gs:[0x30]
mov dword [rax + 0x1250], 0xc0000194
mov rdi, qword gs:[0x30]
mov ecx, 0xc0000194
call sym.ntdll.dll_RtlNtStatusToDosError
mov dword [rdi + 0x68], eax
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x180014f2a
cmp dword [r13 + 0x7c], 0
je 0x180014f2a
movzx eax, byte [rcx + 0xa]
xor al, byte [rcx + 9]
xor al, byte [rcx + 8]
mov byte [rcx + 0xb], al
mov eax, dword [r13 + 0x88]
xor dword [rcx + 8], eax
cmp byte [rsp + 0x40], 0
je 0x180014f3d
mov rcx, qword [r13 + 0x160]
call sym.ntdll.dll_RtlLeaveCriticalSection
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
test rcx, rcx
jne 0x1800a95a1
mov ecx, 0x7ffe0380
cmp byte [rcx], 0
jne 0x1800a95c6
mov rdi, qword [rsp + 0x190]
mov rax, rdi
jmp 0x180014109
mov rdi, r15
jmp 0x1800140b5
test cl, cl
jns 0x1800a9485
mov ecx, dword [r9]
xor ecx, ebx
xor ecx, edi
xor ecx, dword [0x18015d458]
movzx eax, cx
test eax, eax
jne 0x180014fa8
shr ecx, 0xc
mov eax, ecx
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov r12, qword [rcx]
movzx eax, word [r12 + 0x24]
movzx eax, ax
shl rax, 4
add rax, qword [rsp + 0x48]
mov rdx, qword [rax]
jmp 0x18001404c
xor eax, eax
jmp 0x180014109
mov rax, qword gs:[0x30]
mov dword [rax + 0x1250], r12d
mov rdi, qword gs:[0x30]
xor ecx, ecx
call sym.ntdll.dll_RtlNtStatusToDosError
mov dword [rdi + 0x68], eax
jmp 0x180014fc2
movzx eax, byte [rsi + 0xe]
shl rax, 4
sub r8, rax
mov qword [rsp + 0x48], r8
jmp 0x180013fc0
mov rax, r12
jmp 0x18001401f
movzx edx, word [rbx + 0x8c]
mov rax, qword [rsp + 0x48]
movzx ecx, word [rax + 0xc]
xor rdx, rcx
jmp 0x18001404c
movzx eax, cl
and eax, 0x3f
shl rax, 4
add rax, qword [rsp + 0x48]
movzx edx, word [rax + 0xc]
jmp 0x18001404c
cmp dword [rbx + 0x7c], r12d
je 0x1800a94b4
mov eax, dword [r9]
mov dword [rsp + 0x130], eax
test dword [rbx + 0x7c], eax
je 0x1800a94a7
xor eax, dword [rbx + 0x88]
mov dword [rsp + 0x130], eax
movzx eax, word [rsp + 0x130]
jmp 0x180014fae
movzx eax, word [r9]
jmp 0x180014fae
cmp dword [rcx], 0
je 0x1800140f3
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x226
jmp 0x1800140f8
mov rax, qword gs:[0x60]
test byte [rax + 0x378], 1
je 0x180014101
mov rdi, qword [rsp + 0x68]
test rdi, rdi
je 0x180014106
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], r15
mov r9, qword [rsp + 0x58]
mov r8, qword [rsp + 0x190]
mov rdx, rdi
mov rcx, rbx
call fcn.1800fe360
nop
jmp 0x180014106
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov rdx, rbx
lea ecx, [r9 + 9]
call fcn.18009a4c0
nop
jmp 0x180014fc2
bt r14d, 0x1c
jb 0x18001413e
mov r8, qword [rsp + 0x190]
mov edx, r14d
call fcn.180100494
nop
jmp 0x180014109
mov rax, qword gs:[0x30]
mov dword [rax + 0x1250], 0xc0000017
mov rdi, qword gs:[0x30]
mov ecx, 0xc0000017
jmp 0x1800a942b
mov eax, 0x20
jmp 0x180014179
cmp dword [rcx], 0
je 0x180014f56
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x226
jmp 0x180014f5b
mov rax, qword gs:[0x60]
test byte [rax + 0x378], 1
je 0x180014f64
mov rdi, qword [rsp + 0x190]
test rdi, rdi
je 0x180014f6c
test dword [rsp + 0x188], 0x800000
jne 0x180014f6c
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r15
mov r9, qword [rsp + 0x58]
mov r8, qword [rsp + 0x100]
mov rdx, rdi
mov rcx, rbx
call fcn.1800fe360
nop
jmp 0x180014f6c