Function at 0x18000da20
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov rax, qword gs:[0x30]
xor r15d, r15d
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rbx, qword [rax + 0x20]
mov edi, dword [rax]
test rbx, rbx
je 0x18000da80
mov eax, edi
dec edi
test eax, eax
jle 0x18000da80
mov rcx, qword [rbx + 0x20]
lea r8, str.InitializeSRWLock
lea rdx, str.kernel32.dll
call fcn.18000b030
test rax, rax
jne 0x18000dcdc
mov rbx, qword [rbx]
test rbx, rbx
jne 0x18000da50
mov rsi, r15
mov rax, qword gs:[0x30]
mov qword [rsp + 0xa8], rsi
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rbx, qword [rax + 0x20]
mov edi, dword [rax]
test rbx, rbx
je 0x18000dad7
mov eax, edi
dec edi
test eax, eax
jle 0x18000dad7
mov rcx, qword [rbx + 0x20]
lea r8, str.RtlInitializeSRWLock
lea rdx, str.ntdll.dll
call fcn.18000b030
test rax, rax
jne 0x18000dce4
mov rbx, qword [rbx]
test rbx, rbx
jne 0x18000daa7
mov rbx, r15
mov qword [rsp + 0xa0], rbx
mov r12, r15
mov r14d, 0x15ff
mov edi, 0x2a0
mov rax, qword gs:[0x30]
lea rdx, [r12 + 1]
test r12, r12
cmove rdx, r12
mov rcx, qword [rax + 0x60]
mov r9, qword [rcx + 0x10]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x50]
lea r8, [rcx + r9]
test rdx, rdx
je 0x18000db31
cmp rdx, r9
jb 0x18000de8d
cmp rdx, r8
ja 0x18000de8d
sub r8, rdx
mov dword [rsp + 0x20], r15d
test rdx, rdx
cmove r8, rcx
cmove rdx, r9
xor r9d, r9d
lea rcx, str.48_8D_0D_________E8
call fcn.18000b530
mov r12, rax
test rax, rax
je 0x18000de8d
mov rcx, qword gs:[0x30]
movsxd r13, dword [rax + 8]
add r13, 0xc
add r13, rax
mov rdx, qword [rcx + 0x60]
mov r8, qword [rdx + 0x10]
cmp r13, r8
jbe 0x18000daf0
movsxd rax, dword [r8 + 0x3c]
mov ecx, dword [rax + r8 + 0x50]
add rcx, r8
cmp r13, rcx
jae 0x18000daf0
mov r10, r13
mov qword [rsp + 0x90], r13
neg r10
mov r9, r13
mov qword [rsp + 0x98], r10
mov rbp, r12
cmp word [r9], r14w
jne 0x18000ddf1
mov rax, qword gs:[0x30]
movsxd r8, dword [r9 + 2]
add r8, 6
add r8, r9
mov rcx, qword [rax + 0x60]
mov rdx, qword [rcx + 0x10]
cmp r8, rdx
jbe 0x18000ddf1
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x50]
add rcx, rdx
cmp r8, rcx
jae 0x18000ddf1
mov rax, qword [r8]
cmp rax, rsi
je 0x18000dc09
cmp rax, rbx
jne 0x18000ddf1
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rsi, qword [rcx + 0x10]
movsxd rax, dword [rsi + 0x3c]
mov edx, dword [rax + rsi + 0x50]
lea r8, [rsi + rdx]
test r13, r13
je 0x18000dc47
cmp r13, rsi
jb 0x18000dd0a
cmp r13, r8
ja 0x18000dd0a
mov edx, r8d
lea rsi, [r13 + 5]
sub edx, r13d
cmp edx, edi
cmova edx, edi
mov ecx, edx
add rcx, r13
cmp rcx, r8
lea eax, [rdx - 0x10]
cmovb eax, edx
mov r14d, eax
test eax, eax
je 0x18000dd0a
mov rdi, rsi
mov rbx, rsi
neg rdi
nop
movzx eax, byte [rbx]
sub al, 0x48
test al, 0xfb
jne 0x18000dcce
cmp byte [rbx + 1], 0x8d
jne 0x18000dcce
mov eax, dword [rbx + 3]
add eax, 7
movsxd rdx, eax
mov rax, qword gs:[0x30]
add rdx, rdi
add rdx, rbx
add rdx, rsi
mov rcx, qword [rax + 0x60]
mov r8, qword [rcx + 0x10]
cmp rdx, r8
jbe 0x18000dcce
movsxd rax, dword [r8 + 0x3c]
mov ecx, dword [rax + r8 + 0x50]
add rcx, r8
cmp rdx, rcx
jae 0x18000dcce
mov r8d, 0xc
lea rcx, [0x180078eb8]
call fcn.180033f8c
test eax, eax
je 0x18000dcec
inc rbx
lea rax, [rdi + rbx]
cmp rax, r14
jb 0x18000dc70
jmp 0x18000dcf5
mov rsi, qword [rax]
jmp 0x18000da83
mov rbx, qword [rax]
jmp 0x18000dada
test rbx, rbx
jne 0x18000de26
mov r10, qword [rsp + 0x98]
mov edi, 0x2a0
mov r9, qword [rsp + 0x90]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rbx, qword [rcx + 0x10]
movsxd rax, dword [rbx + 0x3c]
mov edx, dword [rax + rbx + 0x50]
lea r8, [rbx + rdx]
test r13, r13
je 0x18000dd48
cmp r13, rbx
jb 0x18000ddf1
cmp r13, r8
ja 0x18000ddf1
mov edx, r8d
lea rbx, [r13 + 5]
sub edx, r13d
cmp edx, edi
cmova edx, edi
mov ecx, edx
add rcx, r13
cmp rcx, r8
lea eax, [rdx - 0x10]
cmovb eax, edx
mov r15d, eax
test eax, eax
je 0x18000ddf1
mov r14, rbx
mov rdi, rbx
neg r14
nop
movzx eax, byte [rdi]
sub al, 0x48
test al, 0xfb
jne 0x18000ddce
cmp byte [rdi + 1], 0x8d
jne 0x18000ddce
mov eax, dword [rdi + 3]
add eax, 7
movsxd rdx, eax
mov rax, qword gs:[0x30]
add rdx, r14
add rdx, rdi
add rdx, rbx
mov rcx, qword [rax + 0x60]
mov r8, qword [rcx + 0x10]
cmp rdx, r8
jbe 0x18000ddce
movsxd rax, dword [r8 + 0x3c]
mov ecx, dword [rax + r8 + 0x50]
add rcx, r8
cmp rdx, rcx
jae 0x18000ddce
mov r8d, 0xc
lea rcx, str.ByteProperty
call fcn.180033e00
test eax, eax
je 0x18000dddc
inc rdi
lea rax, [r14 + rdi]
cmp rax, r15
jb 0x18000dd70
jmp 0x18000dde1
test rdi, rdi
jne 0x18000de26
mov r10, qword [rsp + 0x98]
mov r9, qword [rsp + 0x90]
inc r9
mov qword [rsp + 0x90], r9
lea rax, [r10 + r9]
cmp rax, 0x50
jge 0x18000de33
mov rbx, qword [rsp + 0xa0]
mov edi, 0x2a0
mov rsi, qword [rsp + 0xa8]
mov r14d, 0x15ff
jmp 0x18000dbb5
movsxd rax, dword [rbp + 3]
lea rdx, [rbp + 7]
add rdx, rax
jne 0x18000de4b
mov rbx, qword [rsp + 0xa0]
xor r15d, r15d
mov rsi, qword [rsp + 0xa8]
jmp 0x18000dae5
mov rcx, qword [0x180085190]
test rcx, rcx
jne 0x18000de6f
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x10]
mov qword [0x180085190], rcx
mov rax, rdx
mov r15d, 0
sub rax, rcx
cmp rdx, rcx
cmova r15, rax
mov al, 1
mov dword [0x1800851a0], r15d
jmp 0x18000de8f
xor al, al
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret