Function at 0x180001ee0
Capabilities:
Access peb ldr_data
Get process filename

Disassembly:
sub rsp, 0x4d8
mov rax, qword [0x1800a4380]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
mov qword [rsp + 0x60], rcx
mov rax, qword gs:[0x60]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
add rax, 0x20
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x2c], 0x1610e960
mov eax, dword [rsp + 0x2c]
mov dword [rsp + 0x28], eax
sub eax, 0x84874800
je 0x180002ac8
jmp 0x180001f55
mov eax, dword [rsp + 0x28]
sub eax, 0x8fa248f1
je 0x18000252f
jmp 0x180001f69
mov eax, dword [rsp + 0x28]
sub eax, 0x8fc57f56
je 0x1800024b5
jmp 0x180001f7d
mov eax, dword [rsp + 0x28]
sub eax, 0x91bc4c34
je 0x180002495
jmp 0x180001f91
mov eax, dword [rsp + 0x28]
sub eax, 0x93df159d
je 0x180002292
jmp 0x180001fa5
mov eax, dword [rsp + 0x28]
sub eax, 0x9d2b3f7d
je 0x180002755
jmp 0x180001fb9
mov eax, dword [rsp + 0x28]
sub eax, 0xa48c8e7f
je 0x180002994
jmp 0x180001fcd
mov eax, dword [rsp + 0x28]
sub eax, 0xaba8120f
je 0x180002b01
jmp 0x180001fe1
mov eax, dword [rsp + 0x28]
sub eax, 0xace8be80
je 0x180002593
jmp 0x180001ff5
mov eax, dword [rsp + 0x28]
sub eax, 0xae558480
je 0x1800024e5
jmp 0x180002009
mov eax, dword [rsp + 0x28]
sub eax, 0xbcb4bc07
je 0x180002987
jmp 0x18000201d
mov eax, dword [rsp + 0x28]
sub eax, 0xbec72e1f
je 0x1800028a8
jmp 0x180002031
mov eax, dword [rsp + 0x28]
sub eax, 0xbf3f8e98
je 0x180002a9e
jmp 0x180002045
mov eax, dword [rsp + 0x28]
sub eax, 0xc47aa1a7
je 0x18000237e
jmp 0x180002059
mov eax, dword [rsp + 0x28]
sub eax, 0xd1eeb3bf
je 0x1800026d3
jmp 0x18000206d
mov eax, dword [rsp + 0x28]
sub eax, 0xd70b1f13
je 0x180002579
jmp 0x180002081
mov eax, dword [rsp + 0x28]
sub eax, 0xdb22599e
je 0x180002462
jmp 0x180002095
mov eax, dword [rsp + 0x28]
sub eax, 0xe1aa8dc9
je 0x180002888
jmp 0x1800020a9
mov eax, dword [rsp + 0x28]
sub eax, 0xeca08f2e
je 0x180002408
jmp 0x1800020bd
mov eax, dword [rsp + 0x28]
sub eax, 0xf1499db2
je 0x180002676
jmp 0x1800020d1
mov eax, dword [rsp + 0x28]
sub eax, 0xf60a7215
je 0x1800022dd
jmp 0x1800020e5
mov eax, dword [rsp + 0x28]
sub eax, 0xfcfc26bb
je 0x1800029aa
jmp 0x1800020f9
mov eax, dword [rsp + 0x28]
sub eax, 0x5ed24c9
je 0x180002683
jmp 0x18000210d
mov eax, dword [rsp + 0x28]
sub eax, 0xc95fd0a
je 0x180002a27
jmp 0x180002121
mov eax, dword [rsp + 0x28]
sub eax, 0xdb8be41
je 0x180002af4
jmp 0x180002135
mov eax, dword [rsp + 0x28]
sub eax, 0x15bf6c6d
je 0x180002a84
jmp 0x180002149
mov eax, dword [rsp + 0x28]
sub eax, 0x1610e960
je 0x180002266
jmp 0x18000215d
mov eax, dword [rsp + 0x28]
sub eax, 0x1b5b1a04
je 0x180002a77
jmp 0x180002171
mov eax, dword [rsp + 0x28]
sub eax, 0x29518d85
je 0x180002b1f
jmp 0x180002185
mov eax, dword [rsp + 0x28]
sub eax, 0x353ca8bf
je 0x1800025e3
jmp 0x180002199
mov eax, dword [rsp + 0x28]
sub eax, 0x366c3cf6
je 0x180002b53
jmp 0x1800021ad
mov eax, dword [rsp + 0x28]
sub eax, 0x3e3aa406
je 0x180002b2c
jmp 0x1800021c1
mov eax, dword [rsp + 0x28]
sub eax, 0x3ece58d8
je 0x18000287b
jmp 0x1800021d5
mov eax, dword [rsp + 0x28]
sub eax, 0x45b6bff0
je 0x18000276f
jmp 0x1800021e9
mov eax, dword [rsp + 0x28]
sub eax, 0x52b462ee
je 0x180002b39
jmp 0x1800021fd
mov eax, dword [rsp + 0x28]
sub eax, 0x65b01241
je 0x18000238b
jmp 0x180002211
mov eax, dword [rsp + 0x28]
sub eax, 0x6c9bdb6a
je 0x18000246f
jmp 0x180002225
mov eax, dword [rsp + 0x28]
sub eax, 0x75a2ca7e
je 0x1800027f1
jmp 0x180002239
mov eax, dword [rsp + 0x28]
sub eax, 0x7f20b5e5
je 0x180002762
jmp 0x18000224d
mov eax, dword [rsp + 0x28]
sub eax, 0x7f37c3e4
je 0x18000292a
jmp 0x180002261
jmp 0x180002b5b
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x2c0]
xor edx, edx
mov r8d, 0x208
call fcn.18006db50
mov dword [rsp + 0x2c], 0x93df159d
jmp 0x180002b5b
mov eax, dword [0x1800a7494]
mov ecx, dword [0x1800a7490]
xor r8d, r8d
sub r8d, 1
mov edx, eax
add edx, r8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x84874800
mov ecx, 0xf60a7215
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x2c], eax
jmp 0x180002b5b
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8d, 0x208
call fcn.18006db50
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov ecx, dword [0x1800a7494]
mov eax, dword [0x1800a7490]
mov edx, ecx
sub edx, 0x6186876d
sub edx, 1
add edx, 0x6186876d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x84874800
mov ecx, 0xc47aa1a7
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x2c], eax
jmp 0x180002b5b
mov dword [rsp + 0x2c], 0x65b01241
jmp 0x180002b5b
mov ecx, dword [0x1800a7494]
mov eax, dword [0x1800a7490]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdb8be41
mov ecx, 0xeca08f2e
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x2c], eax
jmp 0x180002b5b
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x78], rax
mov eax, dword [0x1800a7494]
mov ecx, dword [0x1800a7490]
mov edx, eax
add edx, 0x79aad3a3
sub edx, 1
sub edx, 0x79aad3a3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdb8be41
mov ecx, 0xdb22599e
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x2c], eax
jmp 0x180002b5b
mov dword [rsp + 0x2c], 0x6c9bdb6a
jmp 0x180002b5b
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x78]
cmp rax, rcx
setne al
and al, 1
mov byte [rsp + 0x87], al
mov dword [rsp + 0x2c], 0x91bc4c34
jmp 0x180002b5b
mov dl, byte [rsp + 0x87]
mov eax, 0xa48c8e7f
mov ecx, 0x8fc57f56
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x2c], eax
jmp 0x180002b5b
mov rax, qword [rsp + 0x38]
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x2c0]
xor edx, edx
mov r8d, 0x208
call fcn.18006db50
mov dword [rsp + 0x2c], 0xae558480
jmp 0x180002b5b
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8d, 0x208
call fcn.18006db50
mov rax, qword [rsp + 0x30]
mov r8, qword [rax + 0x50]
lea rcx, [rsp + 0x2c0]
mov edx, 0x104
call fcn.1800731c8
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x2c], 0x8fa248f1
jmp 0x180002b5b
lea rcx, [rsp + 0xb0]
mov r8, qword [rsp + 0x88]
mov edx, 0x104
call fcn.1800731c8
lea rdx, [rsp + 0x2c0]
lea rcx, [rsp + 0xb0]
call section..text
mov edx, eax
mov eax, 0x7f20b5e5
mov ecx, 0xd70b1f13
cmp edx, 0
cmovne eax, ecx
mov dword [rsp + 0x2c], eax
jmp 0x180002b5b
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x2c], 0xace8be80
jmp 0x180002b5b
mov eax, dword [0x1800a7494]
mov ecx, dword [0x1800a7490]
mov edx, eax
sub edx, 0x92e99789
sub edx, 1
add edx, 0x92e99789
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaba8120f
mov ecx, 0x353ca8bf
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x2c], eax
jmp 0x180002b5b
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x68], rax
mov ecx, dword [0x1800a7494]
mov eax, dword [0x1800a7490]
mov edx, ecx
sub edx, 0xc1acc79c
sub edx, 1
add edx, 0xc1acc79c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xaba8120f
mov ecx, 0xf1499db2
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x2c], eax
jmp 0x180002b5b
mov dword [rsp + 0x2c], 0x5ed24c9
jmp 0x180002b5b
mov eax, dword [0x1800a7494]
mov ecx, dword [0x1800a7490]
mov edx, eax
add edx, 0xf1527fb0
sub edx, 1
sub edx, 0xf1527fb0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x29518d85
mov ecx, 0xd1eeb3bf
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x2c], eax
jmp 0x180002b5b
mov ecx, dword [0x1800a7494]
mov eax, dword [0x1800a7490]
mov edx, ecx
add edx, 0xfdc8e6ea
sub edx, 1
sub edx, 0xfdc8e6ea
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x29518d85
mov ecx, 0x9d2b3f7d
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x2c], eax
jmp 0x180002b5b
mov dword [rsp + 0x2c], 0x15bf6c6d
jmp 0x180002b5b
mov dword [rsp + 0x2c], 0x45b6bff0
jmp 0x180002b5b
mov ecx, dword [0x1800a7494]
mov eax, dword [0x1800a7490]
mov edx, ecx
add edx, 0xab0045c5
sub edx, 1
sub edx, 0xab0045c5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3e3aa406
mov ecx, 0x75a2ca7e
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x2c], eax
jmp 0x180002b5b
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x98], rax
mov ecx, dword [0x1800a7494]
mov eax, dword [0x1800a7490]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3e3aa406
mov ecx, 0x3ece58d8
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x2c], eax
jmp 0x180002b5b
mov dword [rsp + 0x2c], 0xe1aa8dc9
jmp 0x180002b5b
mov rax, qword [rsp + 0x98]
mov rax, qword [rax]
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x2c], 0xbec72e1f
jmp 0x180002b5b
mov ecx, dword [0x1800a7494]
mov eax, dword [0x1800a7490]
mov edx, ecx
sub edx, 0x42a67938
sub edx, 1
add edx, 0x42a67938
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x52b462ee
mov ecx, 0x7f37c3e4
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x2c], eax
jmp 0x180002b5b
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x38], rax
mov eax, dword [0x1800a7494]
mov ecx, dword [0x1800a7490]
mov edx, eax
sub edx, 0xcec47266
sub edx, 1
add edx, 0xcec47266
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x52b462ee
mov ecx, 0xbcb4bc07
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x2c], eax
jmp 0x180002b5b
mov dword [rsp + 0x2c], 0x65b01241
jmp 0x180002b5b
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x2c], 0xfcfc26bb
jmp 0x180002b5b
mov ecx, dword [0x1800a7494]
mov eax, dword [0x1800a7490]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x366c3cf6
mov ecx, 0xc95fd0a
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x2c], eax
jmp 0x180002b5b
mov eax, dword [0x1800a7494]
mov ecx, dword [0x1800a7490]
mov edx, eax
sub edx, 0x95625957
sub edx, 1
add edx, 0x95625957
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x366c3cf6
mov ecx, 0x1b5b1a04
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x2c], eax
jmp 0x180002b5b
mov dword [rsp + 0x2c], 0x15bf6c6d
jmp 0x180002b5b
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0x2c], 0xbf3f8e98
jmp 0x180002b5b
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.18006a000
mov rax, qword [rsp + 0x20]
add rsp, 0x4d8
ret
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8d, 0x208
call fcn.18006db50
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x2c], 0xf60a7215
jmp 0x180002b5b
mov dword [rsp + 0x2c], 0xeca08f2e
jmp 0x180002b5b
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x2c], 0x353ca8bf
jmp 0x180002b5b
mov dword [rsp + 0x2c], 0xd1eeb3bf
jmp 0x180002b5b
mov dword [rsp + 0x2c], 0x75a2ca7e
jmp 0x180002b5b
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x2c], 0x7f37c3e4
jmp 0x180002b5b
mov dword [rsp + 0x2c], 0xc95fd0a
jmp 0x180001f3d