Function at 0x18001c020
Capabilities:
Accept command line arguments
Access peb ldr_data
Check for software breakpoints

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x180043040]
xor rax, rsp
mov qword [rbp + 0x27], rax
cmp dword [0x180048058], 0
je 0x18001c04c
xor eax, eax
jmp 0x18001c8d5
mov rcx, qword [0x180047f38]
lea rdx, [0x180047f40]
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xe8], rsi
mov qword [rsp + 0xc8], r12
mov dword [0x180048058], 1
call fcn.18001e260
call fcn.18001c970
cmp dword [0x180045e14], 0x601
lea rcx, [0x18003cf80]
jae 0x18001c0a0
lea rcx, [0x18003cbf0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x18001c0c5
lea rdx, [0x18003cfa0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180047ff0], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.18001d5c0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xorps xmm0, xmm0
lea rcx, [0x18003cbf0]
mov qword [0x180047f58], rax
movups xmmword [0x180046ee8], xmm0
movups xmmword [0x180046ef8], xmm0
movups xmmword [0x180046f08], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetNativeSystemInfo
call fcn.180004e40
mov qword [0x180048048], rax
test rax, rax
je 0x18001c129
lea rcx, [0x180046ee8]
call rax
xor edx, edx
lea rcx, [0x180046dd4]
mov r8d, 0x110
call fcn.18002f4f0
lea rcx, [0x180046dd0]
mov dword [0x180046dd0], 0x114
call qword [0x180047d10]
mov eax, dword [0x180046dd4]
lea rcx, [0x180038d88]
shl eax, 8
or eax, dword [0x180046dd8]
mov dword [0x180045e14], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtDeviceIoControlFile
call fcn.180004e40
mov rbx, rax
test rax, rax
je 0x18001c1e7
movzx ecx, byte [rax]
cmp cl, 0xe7
jbe 0x18001c19d
add cl, 0x16
cmp cl, 0x14
ja 0x18001c1e7
mov ecx, 0x32
call fcn.180004410
mov qword [0x180047c08], rax
mov rcx, rax
test rax, rax
je 0x18001c1e7
movups xmm0, xmmword [rbx]
mov edx, 0x32
lea r9, [rbp - 0x25]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbx + 0x10]
lea r8d, [rdx - 0x12]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rax + 0x20], xmm0
movzx eax, word [rbx + 0x30]
mov word [rcx + 0x30], ax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [0x180047f38]
lea rdx, [0x1800465d0]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movsxd rcx, dword [0x180047f40]
lea rsi, [0x180000000]
xor r12d, r12d
xor r9d, r9d
mov qword [rsp + 0x30], r12
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
mov rcx, qword [rsi + rcx*8 + 0x3d4f0]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x180048010], rax
cmp rax, 0xffffffffffffffff
jne 0x18001c254
mov qword [0x180048010], r12
movsxd rcx, dword [0x180047f40]
xor r9d, r9d
mov qword [rsp + 0x30], r12
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, qword [rsi + rcx*8 + 0x3b308]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x180047fd0], rax
cmp rax, 0xffffffffffffffff
jne 0x18001c2a0
mov qword [0x180047fd0], r12
mov rax, r12
mov rcx, qword [0x180048010]
mov qword [rsp + 0xf0], rdi
test rcx, rcx
jne 0x18001c2c3
test rax, rax
je 0x18001c64e
mov dword [rbp - 0x29], r12d
jmp 0x18001c2d0
mov dword [rbp - 0x29], r12d
test rax, rax
je 0x18001c3d2
mov r10, qword [0x180047c08]
xor r8d, r8d
test r10, r10
je 0x18001c332
mov dword [rsp + 0x48], r12d
lea rcx, [rbp - 0x19]
mov qword [rsp + 0x40], r12
xor r9d, r9d
mov dword [rsp + 0x38], r12d
xor edx, edx
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x7afd000c
mov qword [rsp + 0x20], rcx
mov rcx, rax
call r10
test eax, eax
js 0x18001c31e
mov eax, dword [rbp - 0x11]
mov dword [rbp - 0x29], eax
jmp 0x18001c44b
and eax, 0xc0000000
cmp eax, 0xc0000000
je 0x18001c363
mov eax, dword [rbp - 0x11]
mov dword [rbp - 0x29], eax
jmp 0x18001c363
mov qword [rsp + 0x38], r12
lea rcx, [rbp - 0x29]
mov qword [rsp + 0x30], rcx
xor r9d, r9d
mov dword [rsp + 0x28], r12d
mov rcx, rax
mov edx, 0x7afd000c
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x18001c44b
mov rcx, qword [0x180048010]
test rcx, rcx
je 0x18001c51c
mov rax, qword [0x180047c08]
xor r8d, r8d
mov dword [rbp - 0x29], r12d
test rax, rax
je 0x18001c425
mov dword [rsp + 0x48], r12d
lea rdx, [rbp - 9]
mov qword [rsp + 0x40], r12
xor r9d, r9d
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x7afd000c
mov qword [rsp + 0x20], rdx
xor edx, edx
call rax
test eax, eax
jns 0x18001c3ca
and eax, 0xc0000000
cmp eax, 0xc0000000
je 0x18001c44b
mov eax, dword [rbp - 1]
mov dword [rbp - 0x29], eax
jmp 0x18001c44b
mov rax, qword [0x180047c08]
xor r8d, r8d
test rax, rax
je 0x18001c425
mov dword [rsp + 0x48], r12d
lea rdx, [rbp + 7]
mov qword [rsp + 0x40], r12
xor r9d, r9d
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x7afd000c
mov qword [rsp + 0x20], rdx
xor edx, edx
call rax
test eax, eax
jns 0x18001c41d
and eax, 0xc0000000
cmp eax, 0xc0000000
je 0x18001c44b
mov eax, dword [rbp + 0xf]
mov dword [rbp - 0x29], eax
jmp 0x18001c44b
mov qword [rsp + 0x38], r12
lea rax, [rbp - 0x29]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], r12d
mov edx, 0x7afd000c
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp qword [0x180048010], r12
je 0x18001c51c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [0x180048010]
mov dword [rbp - 0x1d], eax
mov rax, qword [0x180047c08]
mov dword [rbp - 0x21], r12d
mov dword [rbp - 0x29], r12d
test rax, rax
je 0x18001c4d1
mov dword [rsp + 0x48], 4
lea rdx, [rbp - 0x21]
mov qword [rsp + 0x40], rdx
xor r9d, r9d
mov dword [rsp + 0x38], 4
lea rdx, [rbp - 0x1d]
mov qword [rsp + 0x30], rdx
xor r8d, r8d
lea rdx, [rbp + 0x17]
mov dword [rsp + 0x28], 0xb2d600f8
mov qword [rsp + 0x20], rdx
xor edx, edx
call rax
test eax, eax
jns 0x18001c4c9
and eax, 0xc0000000
cmp eax, 0xc0000000
je 0x18001c505
mov eax, dword [rbp + 0x1f]
mov dword [rbp - 0x29], eax
jmp 0x18001c505
mov qword [rsp + 0x38], r12
lea rax, [rbp - 0x29]
mov qword [rsp + 0x30], rax
lea r8, [rbp - 0x1d]
lea rax, [rbp - 0x21]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
mov edx, 0xb2d600f8
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp dword [rbp - 0x21], r12d
je 0x18001c51c
mov ecx, dword [0x180047fd8]
or ecx, 0x40
mov dword [0x180047fd8], ecx
jmp 0x18001c522
mov ecx, dword [0x180047fd8]
cmp qword [0x180047fd0], r12
je 0x18001c649
lea rdx, [0x180046490]
call fcn.18001dc30
test eax, eax
jne 0x18001c643
mov eax, dword [0x180046494]
mov rbx, qword [0x180047fd0]
neg eax
mov rdi, rbx
sbb ecx, ecx
and ecx, 2
or dword [0x180047fd8], ecx
lea rax, [rbx + 1]
test rax, 0xfffffffffffffffe
jne 0x18001c5c7
lea rdx, [rbp - 0x25]
xor ecx, ecx
call fcn.18001e260
test eax, eax
jne 0x18001c628
movsxd rcx, dword [rbp - 0x25]
xor r9d, r9d
mov qword [rsp + 0x30], r12
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
mov rcx, qword [rsi + rcx*8 + 0x3b308]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x18001c5c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, r12
test eax, eax
jne 0x18001c628
mov qword [rsp + 0x38], r12
lea rax, [rbp - 0x25]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [0x180046f20]
mov dword [rsp + 0x28], 0x800
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x82ac0220
mov dword [rbp - 0x25], r12d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x18001c60b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp rbx, rdi
je 0x18001c628
test rbx, rbx
je 0x18001c628
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x18001c628
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp word [0x180046f20], r12w
je 0x18001c643
mov ecx, dword [0x180047fd8]
or ecx, 4
mov dword [0x180047fd8], ecx
jmp 0x18001c649
mov ecx, dword [0x180047fd8]
test cl, 0x7b
jne 0x18001c658
mov eax, 5
jmp 0x18001c8b5
test cl, 2
je 0x18001c6a3
lea rcx, [0x180045e20]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x180045e48]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x180045d50]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
lea rcx, [0x18001ce30]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov ecx, dword [0x180047fd8]
mov eax, ecx
and al, 0x78
cmp al, 0x40
jne 0x18001c6ca
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
lea rcx, [0x18001d890]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov ecx, dword [0x180047fd8]
cmp dword [0x1800464b4], r12d
jne 0x18001c6d8
test cl, 8
je 0x18001c74b
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
add rax, 0x10
mov rdx, qword [rax]
cmp rdx, rax
je 0x18001c74b
mov rcx, qword [0x180047f38]
nop dword [rax]
cmp qword [rdx + 0x30], rcx
je 0x18001c710
mov rdx, qword [rdx]
cmp rdx, rax
jne 0x18001c700
jmp 0x18001c74b
mov rax, qword [rdx + 0x18]
mov rcx, qword [rdx + 0x10]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov rax, qword [rdx + 8]
mov rcx, qword [rdx]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov rax, qword [rdx + 0x28]
mov rcx, qword [rdx + 0x20]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov rax, qword [rdx + 0x78]
mov rcx, qword [rdx + 0x70]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov rax, qword [0x180047d08]
test rax, rax
je 0x18001c771
lea r9, [0x180048050]
xor r8d, r8d
lea rdx, [0x18000d7b0]
xor ecx, ecx
call rax
jmp 0x18001c8ae
mov eax, dword [0x180045e14]
add eax, 0xfffffaff
cmp eax, 0xfe
ja 0x18001c8ae
mov qword [rsp + 0xb8], r14
lea rcx, [0x180038d88]
mov qword [rsp + 0xb0], r15
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r8, r12
mov r11d, r12d
mov rdi, rax
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
movzx ebx, word [rdx + 0x14]
movzx r14d, word [rdx + 6]
add rbx, rdx
mov r15d, dword [rdx + 0x50]
test r14d, r14d
je 0x18001c89e
mov esi, dword [rbx + 0x3c]
mov qword [rsp + 0xc0], r13
and esi, 0x20
lea r13, [0x18003b2d0]
test esi, esi
je 0x18001c842
mov r9d, dword [rbx + 0x24]
mov r10d, dword [rbx + 0x28]
add r9, rdi
test r10d, r10d
je 0x18001c83f
mov r8, r13
sub r8, r9
nop dword [rax]
mov rax, r9
mov edx, 0x36
nop dword [rax + rax]
movzx ecx, byte [r8 + rax]
cmp byte [rax], cl
je 0x18001c81e
cmp cl, 0xcc
jne 0x18001c833
inc rax
add edx, 0xffffffff
jne 0x18001c810
movsxd rbx, dword [r9 + 3]
add rbx, 7
add rbx, r9
jmp 0x18001c852
inc r9
dec r8
add r10d, 0xffffffff
jne 0x18001c800
mov r8, r12
inc r11d
cmp r11d, r14d
jl 0x18001c7e2
mov rbx, r12
test r8, r8
je 0x18001c896
cmp rbx, rdi
jb 0x18001c896
lea rax, [rdi + r15]
cmp rax, rbx
jb 0x18001c896
mov ecx, 0x20
call fcn.180025480
test rax, rax
je 0x18001c896
lea rcx, [0x18000d7b0]
mov qword [rax + 0x18], r12
mov qword [rax + 0x10], rcx
mov rcx, qword [rbx]
mov qword [rax], rcx
mov qword [rax + 8], rbx
mov qword [rcx + 8], rax
mov qword [rbx], rax
mov qword [0x180048050], rax
mov r13, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xb8]
mov r15, qword [rsp + 0xb0]
call fcn.180004110
xor eax, eax
mov rdi, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0xe8]
mov rbx, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xc8]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.18001e5f0
add rsp, 0xd0
pop rbp
ret