Function at 0x18000cee0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor ebx, ebx
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rdi, qword [rcx + 0x10]
call fcn.18000c870
test al, al
je 0x18000d07c
lea rax, str.Found_TNameEntryArray_GNames_at_offset_0x:X_n
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 0x30
mov eax, dword [0x180081150]
mov dword [rbp - 0x48], eax
movabs rax, 0x1000000000000000
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x40], 1
lea rax, [rbp - 0x50]
mov qword [rbp - 0x38], rax
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm0
movaps xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x30], xmm1
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x20]
call fcn.1800125d0
nop
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
call fcn.1800127a0
mov rcx, rax
call fcn.1800107a0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x18000cfd2
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000cfcd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d2d3
call fcn.180022700
movsxd rax, dword [0x180081150]
mov rsi, qword [rax + rdi]
mov byte [0x180081154], 0
mov edi, ebx
test rsi, rsi
je 0x18000d033
mov rcx, rsi
call fcn.18000a000
test al, al
jne 0x18000d033
mov r8d, ebx
mov rcx, rbx
nop dword [rax]
mov rax, qword [rcx + rsi]
mov rdx, rax
shr rdx, 0x20
test rax, rax
jne 0x18000d014
inc edi
jmp 0x18000d022
test edi, edi
jne 0x18000d01c
inc ebx
jmp 0x18000d022
jle 0x18000d022
cmp edx, ebx
je 0x18000d03f
add r8d, 8
add rcx, 8
cmp rcx, 0x800
jl 0x18000d000
lea rdx, str.The_address_that_was_found_couldnt_be_used_by_the_generator__this_might_be_due_to_GNames_encryption._n
jmp 0x18000d29e
mov dword [0x18008124c], r8d
lea eax, [r8 + 4]
mov dword [0x180081248], eax
lea rax, [0x18000c6a0]
mov qword [0x180081160], rax
mov qword [0x180081058], rsi
mov byte [0x180081154], 0
xor edx, edx
xor ecx, ecx
call fcn.18000c080
mov al, 1
jmp 0x18000d2b4
call fcn.18000ca60
test al, al
je 0x18000d297
lea rax, str.Found_FNamePool_GNames_at_offset_0x:X_n
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 0x2a
mov eax, dword [0x180081150]
mov dword [rbp - 0x28], eax
movabs rax, 0x1000000000000000
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x40], 1
lea rax, [rbp - 0x30]
mov qword [rbp - 0x38], rax
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm0
movaps xmm1, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x50], xmm1
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.1800125d0
nop
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
call fcn.1800127a0
mov rcx, rax
call fcn.1800107a0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x18000d142
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d13d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d2cd
call fcn.180022700
movsxd rsi, dword [0x180081150]
add rsi, rdi
mov byte [0x180081154], 1
mov dword [0x180081248], ebx
mov r12d, 4
mov dword [0x180081254], r12d
mov r11d, 0x10
mov dword [0x180081250], r11d
mov edi, ebx
mov r15, rsi
nop dword [rax + rax]
mov r14d, dword [rsi]
lea eax, [r14 - 1]
cmp eax, 0xffff
ja 0x18000d1ea
mov r9d, ebx
xor r10b, r10b
mov edx, ebx
mov eax, edi
and eax, 0x80000007
jge 0x18000d1a6
dec eax
or eax, 0xfffffff8
inc eax
lea ecx, [rax + rdi]
movsxd r8, ecx
add r8, 8
add r8, r15
add ecx, 8
cmp qword [r8], 0
je 0x18000d1cb
inc r9d
test r10b, r10b
jne 0x18000d1cb
mov r10b, 1
lea r11d, [rcx + rdx]
add edx, 8
add r8, 8
cmp edx, 0x10000
jl 0x18000d1b6
mov dword [0x180081250], r11d
lea eax, [r9 - 1]
cmp r14d, eax
je 0x18000d201
add edi, r12d
add rsi, r12
cmp edi, 0x20
jl 0x18000d180
lea rdx, str.The_address_that_was_found_couldnt_be_used_by_the_generator__this_might_be_due_to_GNames_encryption._n
jmp 0x18000d29e
mov dword [0x180081248], edi
lea eax, [rdi + 4]
mov dword [0x180081254], eax
movsxd r8, r11d
add r8, r15
mov ecx, ebx
mov rax, qword [r8]
movabs rdx, 0x6a624f5565726f43
cmp dword [rax], 0x656e6f4e
jne 0x18000d237
test rbx, rbx
jne 0x18000d237
movsxd rbx, ecx
jmp 0x18000d23c
cmp qword [rax], rdx
je 0x18000d252
inc ecx
inc rax
cmp ecx, 0x1000
jl 0x18000d225
lea rdx, str.The_address_that_was_found_couldnt_be_used_by_the_generator__this_might_be_due_to_GNames_encryption._n
jmp 0x18000d29e
mov eax, 2
cmp rbx, rax
cmove r12, rax
mov qword [0x180081148], r12
lea rax, [0x18000c710]
mov qword [0x180081160], rax
mov byte [0x180081154], 1
mov rdx, rbx
mov rcx, r8
call fcn.18000c080
mov qword [0x180081058], r15
mov byte [0x180081154], 1
mov al, 1
jmp 0x18000d2b4
lea rdx, str.Could_not_find_GNames__n
lea rcx, [0x18007f9e0]
call fcn.1800104f0
mov rcx, rax
call fcn.1800107a0
xor al, al
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.18002f4b4
int3
call fcn.18002f4b4
int3