Function at 0x180006ce0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor edi, edi
cmp qword [0x18005f418], rdi
mov qword [0x18005f420], rdi
jne 0x180006d98
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x18]
add rbx, 0x10
mov r11, qword [rbx]
cmp r11, rbx
je 0x180006d98
nop word [rax + rax]
mov r10, qword [r11 + 0x60]
movzx r8d, word [r11 + 0x58]
test r10, r10
je 0x180006d83
movzx ecx, byte [r10]
mov edx, edi
mov r9d, edi
test cl, cl
je 0x180006d83
nop dword [rax + rax]
test r8d, r8d
je 0x180006d5a
cmp r9d, r8d
jae 0x180006d7b
lea eax, [rcx - 0x41]
cmp al, 0x19
ja 0x180006d64
add cl, 0x20
add r10, 2
rol edx, 7
movsx eax, cl
inc r9d
xor edx, eax
movzx ecx, byte [r10]
test cl, cl
jne 0x180006d50
cmp edx, 0x4b1ffe8e
je 0x180006d8d
mov r11, qword [r11]
cmp r11, rbx
jne 0x180006d30
jmp 0x180006d98
mov rax, qword [r11 + 0x30]
mov qword [0x18005f418], rax
call fcn.180007540
mov qword [0x18005f420], rax
mov ecx, 0x10e8
test rax, rax
je 0x180006dbd
nop
mov byte [rax], dil
lea rax, [rax + 1]
sub rcx, 1
jne 0x180006db0
mov rbx, rdi
call fcn.180007660
mov r15d, 0xd
test rax, rax
je 0x180006e22
mov r8d, r15d
mov rcx, rax
call fcn.180007780
mov rbx, rax
mov ecx, r15d
test rax, rax
je 0x180006e22
nop word [rax + rax]
mov byte [rax], dil
lea rax, [rax + 1]
sub rcx, 1
jne 0x180006df0
lea rdx, str.kernel32.dll
mov qword [0x18005f410], rbx
sub rdx, rbx
mov ecx, r15d
movzx eax, byte [rdx + rbx]
mov byte [rbx], al
lea rbx, [rbx + 1]
sub ecx, 1
jne 0x180006e11
jmp 0x180006e29
mov qword [0x18005f410], rbx
mov rbx, rdi
call fcn.180007660
test rax, rax
je 0x180006e82
mov r8, r15
mov rcx, rax
call fcn.180007780
mov rbx, rax
mov rcx, r15
test rax, rax
je 0x180006e82
nop dword [rax]
mov byte [rax], dil
lea rax, [rax + 1]
sub rcx, 1
jne 0x180006e50
lea rdx, str.advapi32.dll
mov qword [0x18005f408], rbx
sub rdx, rbx
mov ecx, r15d
movzx eax, byte [rdx + rbx]
mov byte [rbx], al
lea rbx, [rbx + 1]
sub ecx, 1
jne 0x180006e71
jmp 0x180006e89
mov qword [0x18005f408], rbx
mov rbx, rdi
call fcn.180007660
mov ebp, VariantTimeToDosDateTime
test rax, rax
je 0x180006ee1
mov r8d, ebp
mov rcx, rax
call fcn.180007780
mov rbx, rax
mov ecx, ebp
test rax, rax
je 0x180006ee1
mov byte [rax], dil
lea rax, [rax + 1]
sub rcx, 1
jne 0x180006eb0
lea rdx, str.user32.dll
mov qword [0x18005f400], rbx
sub rdx, rbx
mov ecx, ebp
movzx eax, byte [rdx + rbx]
mov byte [rbx], al
lea rbx, [rbx + 1]
sub ecx, 1
jne 0x180006ed0
jmp 0x180006ee8
mov qword [0x18005f400], rbx
mov rbx, rdi
call fcn.180007660
test rax, rax
je 0x180006f41
mov r8, rbp
mov rcx, rax
call fcn.180007780
mov rbx, rax
mov rcx, rbp
test rax, rax
je 0x180006f41
nop dword [rax + rax]
mov byte [rax], dil
lea rax, [rax + 1]
sub rcx, 1
jne 0x180006f10
lea rdx, str.ws2_32.dll
mov qword [0x18005f3f8], rbx
sub rdx, rbx
mov ecx, ebp
movzx eax, byte [rdx + rbx]
mov byte [rbx], al
lea rbx, [rbx + 1]
sub ecx, 1
jne 0x180006f30
jmp 0x180006f48
mov qword [0x18005f3f8], rbx
mov rbx, rdi
call fcn.180007660
mov r14d, 0xa
test rax, rax
je 0x180006fb1
mov r8d, r14d
mov rcx, rax
call fcn.180007780
mov rbx, rax
mov ecx, r14d
test rax, rax
je 0x180006fb1
mov byte [rax], dil
lea rax, [rax + 1]
sub rcx, 1
jne 0x180006f71
lea rdx, str.ntdll.dll
mov qword [0x18005f3f0], rbx
sub rdx, rbx
mov ecx, r14d
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + rbx]
mov byte [rbx], al
lea rbx, [rbx + 1]
sub ecx, 1
jne 0x180006fa0
jmp 0x180006fb8
mov qword [0x18005f3f0], rbx
mov rbx, rdi
call fcn.180007660
mov esi, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
test rax, rax
je 0x180007011
mov r8d, esi
mov rcx, rax
call fcn.180007780
mov rbx, rax
mov ecx, esi
test rax, rax
je 0x180007011
nop
mov byte [rax], dil
lea rax, [rax + 1]
sub rcx, 1
jne 0x180006fe0
lea rdx, str.shell32.dll
mov qword [0x18005f3e8], rbx
sub rdx, rbx
mov ecx, esi
movzx eax, byte [rdx + rbx]
mov byte [rbx], al
lea rbx, [rbx + 1]
sub ecx, 1
jne 0x180007000
jmp 0x180007018
mov qword [0x18005f3e8], rbx
mov rbx, rdi
call fcn.180007660
test rax, rax
je 0x180007071
mov r8, rsi
mov rcx, rax
call fcn.180007780
mov rbx, rax
mov rcx, rsi
test rax, rax
je 0x180007071
nop dword [rax + rax]
mov byte [rax], dil
lea rax, [rax + 1]
sub rcx, 1
jne 0x180007040
lea rdx, str.crypt32.dll
mov qword [0x18005f3e0], rbx
sub rdx, rbx
mov ecx, esi
movzx eax, byte [rdx + rbx]
mov byte [rbx], al
lea rbx, [rbx + 1]
sub ecx, 1
jne 0x180007060
jmp 0x180007078
mov qword [0x18005f3e0], rbx
mov rbx, rdi
call fcn.180007660
test rax, rax
je 0x1800070d1
mov r8, rsi
mov rcx, rax
call fcn.180007780
mov rbx, rax
mov rcx, rsi
test rax, rax
je 0x1800070d1
nop dword [rax + rax]
mov byte [rax], dil
lea rax, [rax + 1]
sub rcx, 1
jne 0x1800070a0
lea rdx, str.shlwapi.dll
mov qword [0x18005f3d8], rbx
sub rdx, rbx
mov ecx, esi
movzx eax, byte [rdx + rbx]
mov byte [rbx], al
lea rbx, [rbx + 1]
sub ecx, 1
jne 0x1800070c0
jmp 0x1800070d8
mov qword [0x18005f3d8], rbx
mov rbx, rdi
call fcn.180007660
test rax, rax
je 0x180007131
mov r8, rsi
mov rcx, rax
call fcn.180007780
mov rbx, rax
mov rcx, rsi
test rax, rax
je 0x180007131
nop dword [rax + rax]
mov byte [rax], dil
lea rax, [rax + 1]
sub rcx, 1
jne 0x180007100
lea rdx, str.winhttp.dll
mov qword [0x18005f3d0], rbx
sub rdx, rbx
mov ecx, esi
movzx eax, byte [rdx + rbx]
mov byte [rbx], al
lea rbx, [rbx + 1]
sub ecx, 1
jne 0x180007120
jmp 0x180007138
mov qword [0x18005f3d0], rbx
mov rbx, rdi
call fcn.180007660
test rax, rax
je 0x180007192
mov r8, r15
mov rcx, rax
call fcn.180007780
mov rbx, rax
mov rcx, r15
test rax, rax
je 0x180007192
nop dword [rax + rax]
mov byte [rax], dil
lea rax, [rax + 1]
sub rcx, 1
jne 0x180007160
lea rcx, str.netapi32.dll
mov qword [0x18005f3c8], rbx
sub rcx, rbx
nop
movzx eax, byte [rcx + rbx]
mov byte [rbx], al
lea rbx, [rbx + 1]
sub r15d, 1
jne 0x180007180
jmp 0x180007199
mov qword [0x18005f3c8], rbx
mov rbx, rdi
call fcn.180007660
test rax, rax
je 0x1800071f1
mov r8, rbp
mov rcx, rax
call fcn.180007780
mov rbx, rax
mov rcx, rbp
test rax, rax
je 0x1800071f1
nop dword [rax]
mov byte [rax], dil
lea rax, [rax + 1]
sub rcx, 1
jne 0x1800071c0
lea rdx, str.bcrypt.dll
mov qword [0x18005f3c0], rbx
sub rdx, rbx
mov ecx, ebp
movzx eax, byte [rdx + rbx]
mov byte [rbx], al
lea rbx, [rbx + 1]
sub ecx, 1
jne 0x1800071e0
jmp 0x1800071f8
mov qword [0x18005f3c0], rbx
mov rbx, rdi
call fcn.180007660
test rax, rax
je 0x180007251
mov r8, rsi
mov rcx, rax
call fcn.180007780
mov rbx, rax
mov rcx, rsi
test rax, rax
je 0x180007251
nop dword [rax + rax]
mov byte [rax], dil
lea rax, [rax + 1]
sub rcx, 1
jne 0x180007220
lea rcx, str.userenv.dll
mov qword [0x18005f3b8], rbx
sub rcx, rbx
nop
movzx eax, byte [rcx + rbx]
mov byte [rbx], al
lea rbx, [rbx + 1]
sub esi, 1
jne 0x180007240
jmp 0x180007258
mov qword [0x18005f3b8], rbx
mov rbx, rdi
call fcn.180007660
test rax, rax
je 0x1800072b1
mov r8, rbp
mov rcx, rax
call fcn.180007780
mov rbx, rax
mov rcx, rbp
test rax, rax
je 0x1800072b1
nop dword [rax + rax]
mov byte [rax], dil
lea rax, [rax + 1]
sub rcx, 1
jne 0x180007280
lea rcx, str.ktmw32.dll
mov qword [0x18005f3b0], rbx
sub rcx, rbx
nop
movzx eax, byte [rcx + rbx]
mov byte [rbx], al
lea rbx, [rbx + 1]
sub ebp, 1
jne 0x1800072a0
jmp 0x1800072b8
mov qword [0x18005f3b0], rbx
call fcn.180007660
test rax, rax
je 0x180007312
mov r8, r14
mov rcx, rax
call fcn.180007780
mov rdi, rax
mov rcx, r14
test rax, rax
je 0x180007312
nop dword [rax + rax]
mov byte [rax], 0
lea rax, [rax + 1]
sub rcx, 1
jne 0x1800072e0
lea rcx, [0x180051ec8]
mov qword [0x18005f3a8], rdi
sub rcx, rdi
nop
movzx eax, byte [rcx + rdi]
mov byte [rdi], al
lea rdi, [rdi + 1]
sub r14d, 1
jne 0x180007300
jmp 0x180007319
mov qword [0x18005f3a8], rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret