Function at 0x18000c270
Capabilities:
Access peb ldr_data
Get ntdll base address
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x90
mov qword [rax - 0x10], rbx
mov qword [rax - 0x18], rbp
mov qword [rax - 0x20], rsi
mov qword [rax - 0x28], r12
mov qword [rax - 0x30], r13
mov qword [rax - 0x38], r14
mov qword [rax - 0x40], r15
mov rax, qword gs:[0x60]
xor r15d, r15d
mov r10, qword [rax + 0x18]
mov rbx, rdx
mov r13d, r15d
mov r14, qword [r10 + 0x20]
mov r12d, r15d
mov qword [rsp + 0x40], r15
mov ebp, r15d
mov qword [rsp + 0x38], r15
mov r11d, r15d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x48], r15
mov r9d, r15d
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x30], r14
test r14, r14
je 0x18000c55d
lea ebx, [r15 + 4]
mov r10d, 0xffff
lea edi, [rbx - 2]
mov rdx, qword [r14 + 0x50]
movzx r8d, word [r14 + 0x48]
mov rcx, r15
nop dword [rax]
ror ecx, 0xd
movzx eax, byte [rdx]
cmp al, 0x61
jb 0x18000c324
movzx eax, al
sub eax, 0x20
cdqe
jmp 0x18000c327
movzx eax, al
add rcx, rax
inc rdx
add r8w, r10w
jne 0x18000c310
cmp ecx, 0x6a4abc5b
jne 0x18000c433
mov r9, qword [r14 + 0x20]
mov r14d, 0xffff
movsxd rax, dword [r9 + 0x3c]
mov edi, dword [rax + r9 + 0x88]
mov r10d, dword [rdi + r9 + 0x20]
mov r11d, dword [rdi + r9 + 0x24]
add r10, r9
add r11, r9
nop word [rax + rax]
mov ecx, dword [r10]
mov r8d, r15d
add rcx, r9
movzx eax, byte [rcx]
nop dword [rax]
ror r8d, 0xd
movsx eax, al
lea rcx, [rcx + 1]
add r8d, eax
movzx eax, byte [rcx]
test al, al
jne 0x18000c380
cmp r8d, 0xec0e4e8e
je 0x18000c3b9
cmp r8d, 0x7c0dfcaa
je 0x18000c3b9
cmp r8d, 0x91afca54
je 0x18000c3b9
cmp r8d, 0x60e0ceef
jne 0x18000c413
mov eax, dword [rdi + r9 + 0x1c]
movzx edx, word [r11]
lea rcx, [r9 + rax]
cmp r8d, 0xec0e4e8e
jne 0x18000c3d8
mov r13d, dword [rcx + rdx*4]
add r13, r9
jmp 0x18000c40f
cmp r8d, 0x7c0dfcaa
jne 0x18000c3ea
mov r12d, dword [rcx + rdx*4]
add r12, r9
jmp 0x18000c40f
cmp r8d, 0x91afca54
jne 0x18000c3fb
mov ebp, dword [rcx + rdx*4]
add rbp, r9
jmp 0x18000c40f
cmp r8d, 0x60e0ceef
jne 0x18000c40f
mov esi, dword [rcx + rdx*4]
add rsi, r9
mov qword [rsp + 0x28], rsi
add bx, r14w
add r10, 4
add r11, 2
test bx, bx
jne 0x18000c370
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], rbp
jmp 0x18000c50e
cmp ecx, 0x3cfa685d
jne 0x18000c52b
mov r9, qword [r14 + 0x20]
mov r12d, 0xffff
movsxd rax, dword [r9 + 0x3c]
mov esi, dword [rax + r9 + 0x88]
add rsi, r9
mov r11d, dword [rsi + 0x20]
mov ebx, dword [rsi + 0x24]
mov r10d, dword [rsi + 0x18]
add r11, r9
add rbx, r9
nop dword [rax]
test r10d, r10d
je 0x18000c504
mov ecx, dword [r11]
mov r8d, r15d
add rcx, r9
movzx eax, byte [rcx]
nop word [rax + rax]
ror r8d, 0xd
movsx eax, al
lea rcx, [rcx + 1]
add r8d, eax
movzx eax, byte [rcx]
test al, al
jne 0x18000c490
cmp r8d, 0x534c0ab8
je 0x18000c4b7
cmp r8d, 0xff7f061a
jne 0x18000c4f0
mov eax, dword [rsi + 0x1c]
movzx edx, word [rbx]
lea rcx, [r9 + rax]
cmp r8d, 0x534c0ab8
jne 0x18000c4d8
mov r14d, dword [rcx + rdx*4]
add r14, r9
mov qword [rsp + 0x20], r14
jmp 0x18000c4ec
cmp r8d, 0xff7f061a
jne 0x18000c4ec
mov ebp, dword [rcx + rdx*4]
add rbp, r9
mov qword [rsp + 0x48], rbp
add di, r12w
add r11, 4
add rbx, 2
dec r10d
test di, di
jne 0x18000c470
mov rbp, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
mov r11, qword [rsp + 0x28]
mov r9, qword [rsp + 0x20]
mov r14, qword [rsp + 0x30]
mov edi, 2
mov r10d, 0xffff
lea ebx, [rdi + 2]
test r13, r13
je 0x18000c544
test r12, r12
je 0x18000c544
test rbp, rbp
je 0x18000c544
test r11, r11
je 0x18000c544
test r9, r9
jne 0x18000c555
mov r14, qword [r14]
mov qword [rsp + 0x30], r14
test r14, r14
jne 0x18000c301
mov rbx, qword [rsp + 0xa8]
movsxd r15, dword [rbx + 0x3c]
xor ecx, ecx
mov r8d, 0x3000
add r15, rbx
lea r9d, [rcx + 0x40]
mov edx, dword [r15 + 0x50]
mov qword [rsp + 0xa8], r15
call rbp
mov rdx, rbx
mov r14, rax
mov eax, dword [r15 + 0x54]
test rax, rax
je 0x18000c5b1
mov r8, r14
sub r8, rbx
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
mov byte [r8 + rdx - 1], cl
dec rax
jne 0x18000c5a0
movzx r10d, word [r15 + 6]
movzx eax, word [r15 + 0x14]
test r10, r10
je 0x18000c60b
lea r9, [r15 + 0x2c]
add r9, rax
nop word [rax + rax]
mov ecx, dword [r9 - 8]
mov edx, dword [r9]
mov r8d, dword [r9 - 4]
add rcx, r14
add rdx, rbx
dec r10
test r8, r8
je 0x18000c602
nop dword [rax]
movzx eax, byte [rdx]
inc rcx
lea rdx, [rdx + 1]
mov byte [rcx - 1], al
dec r8
jne 0x18000c5f0
add r9, 0x28
test r10, r10
jne 0x18000c5d0
mov ebp, dword [r15 + 0x90]
add rbp, r14
mov eax, dword [rbp + 0xc]
test eax, eax
je 0x18000c6be
movabs r15, 0x8000000000000000
nop word [rax + rax]
mov ecx, eax
add rcx, r14
call r13
mov ebx, dword [rbp + 0x10]
mov edi, dword [rbp]
add rbx, r14
add rdi, r14
mov rsi, rax
cmp qword [rbx], 0
je 0x18000c6a7
nop dword [rax]
test rdi, rdi
je 0x18000c681
mov rdx, qword [rdi]
test r15, rdx
je 0x18000c681
movsxd rax, dword [rsi + 0x3c]
movzx edx, dx
mov ecx, dword [rax + rsi + 0x88]
mov eax, dword [rcx + rsi + 0x10]
mov ecx, dword [rcx + rsi + 0x1c]
add rcx, rsi
sub rdx, rax
mov eax, dword [rcx + rdx*4]
add rax, rsi
jmp 0x18000c691
mov rdx, qword [rbx]
mov rcx, rsi
add rdx, 2
add rdx, r14
call r12
mov qword [rbx], rax
add rbx, 8
test rdi, rdi
je 0x18000c6a1
add rdi, 8
cmp qword [rbx], 0
jne 0x18000c650
mov eax, dword [rbp + 0x20]
add rbp, 0x14
test eax, eax
jne 0x18000c630
mov r15, qword [rsp + 0xa8]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
mov r8, r14
sub r8, qword [r15 + 0x30]
cmp dword [r15 + 0xb4], 0
je 0x18000c797
mov r11d, dword [r15 + 0xb0]
add r11, r14
mov eax, dword [r11 + 4]
test eax, eax
je 0x18000c797
nop dword [rax + rax]
mov edx, dword [r11]
mov r9d, eax
lea r10, [r11 + 8]
sub r9, 8
add rdx, r14
shr r9, 1
je 0x18000c784
nop word [rax + rax]
movzx eax, word [r10]
dec r9
movzx ecx, ax
shr cx, 0xc
cmp cx, 0xa
jne 0x18000c73f
and eax, 0xfff
add qword [rax + rdx], r8
jmp 0x18000c77b
cmp cx, 3
jne 0x18000c750
and eax, 0xfff
add dword [rax + rdx], r8d
jmp 0x18000c77b
cmp cx, 1
jne 0x18000c76b
and eax, 0xfff
lea rcx, [rax + rdx]
mov rax, r8
shr rax, 0x10
add word [rcx], ax
jmp 0x18000c77b
cmp cx, 2
jne 0x18000c77b
and eax, 0xfff
add word [rax + rdx], r8w
add r10, 2
test r9, r9
jne 0x18000c720
mov eax, dword [r11 + 4]
add r11, rax
mov eax, dword [r11 + 4]
test eax, eax
jne 0x18000c700
mov ebx, dword [r15 + 0x28]
xor r8d, r8d
xor edx, edx
or rcx, 0xffffffffffffffff
add rbx, r14
call qword [rsp + 0x20]
mov r8, qword [rsp + 0xa0]
mov edx, 1
mov rcx, r14
call rbx
test eax, eax
je 0x18000c894
mov esi, dword [rsp + 0xb0]
test esi, esi
je 0x18000c89b
cmp dword [r15 + 0x8c], 0
je 0x18000c89b
mov r11d, dword [r15 + 0x88]
add r11, r14
mov ebx, dword [r11 + 0x18]
test ebx, ebx
je 0x18000c89b
xor edi, edi
cmp dword [r11 + 0x14], edi
je 0x18000c89d
mov r8d, dword [r11 + 0x20]
mov r10d, dword [r11 + 0x24]
mov r9d, edi
add r8, r14
add r10, r14
test ebx, ebx
je 0x18000c89d
nop dword [rax]
mov edx, dword [r8]
mov ecx, edi
add rdx, r14
movzx eax, byte [rdx]
nop dword [rax + rax]
ror ecx, 0xd
movsx eax, al
lea rdx, [rdx + 1]
add ecx, eax
movzx eax, byte [rdx]
test al, al
jne 0x18000c830
cmp ecx, esi
je 0x18000c859
inc r9d
add r8, 4
add r10, 2
cmp r9d, ebx
jb 0x18000c820
jmp 0x18000c89d
movzx eax, word [r10]
cmp eax, 0xffffffff
je 0x18000c89d
mov edx, dword [r11 + 0x1c]
lea eax, [rax*4]
movsxd rcx, eax
lea rax, [r14 + rdx]
mov edx, dword [rsp + 0xc0]
mov r8d, dword [rcx + rax]
mov rcx, qword [rsp + 0xb8]
add r8, r14
call r8
test eax, eax
cmovne edi, edi
jmp 0x18000c89d
mov edi, 1
jmp 0x18000c89d
xor edi, edi
mov rax, qword [rsp + 0x48]
mov r15, qword [rsp + 0x58]
mov r14, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x88]
mov ecx, edi
test rax, rax
je 0x18000c8cb
add rsp, 0x90
pop rdi
jmp rax
mov rax, qword [rsp + 0x28]
add rsp, 0x90
pop rdi
jmp rax