Function at 0x180009350
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process filename

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x58], rcx
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x48]
add rax, 0x20
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x24], 0x2c0e824f
mov eax, dword [rsp + 0x24]
mov ecx, eax
sub ecx, 0x9557f690
mov dword [rsp + 0x20], eax
je 0x180009697
jmp 0x1800093c8
mov eax, dword [rsp + 0x20]
sub eax, 0xb2226a42
je 0x180009680
jmp 0x1800093dc
mov eax, dword [rsp + 0x20]
sub eax, 0xc625abc6
je 0x18000951d
jmp 0x1800093f0
mov eax, dword [rsp + 0x20]
sub eax, 0xc9fd5904
je 0x1800094dd
jmp 0x180009404
mov eax, dword [rsp + 0x20]
sub eax, 0xd1b6acaa
je 0x18000957a
jmp 0x180009418
mov eax, dword [rsp + 0x20]
sub eax, 0xe23bbf82
je 0x18000960b
jmp 0x18000942c
mov eax, dword [rsp + 0x20]
sub eax, 0x11aa8991
je 0x18000968a
jmp 0x180009440
mov eax, dword [rsp + 0x20]
sub eax, 0x183ca999
je 0x1800095c9
jmp 0x180009454
mov eax, dword [rsp + 0x20]
sub eax, 0x1e6f1c99
je 0x18000965d
jmp 0x180009468
mov eax, dword [rsp + 0x20]
sub eax, 0x26162e6b
je 0x180009538
jmp 0x18000947c
mov eax, dword [rsp + 0x20]
sub eax, 0x2c0e824f
je 0x1800094bd
jmp 0x180009490
mov eax, dword [rsp + 0x20]
sub eax, 0x39b7e3d5
je 0x1800095bc
jmp 0x1800094a4
mov eax, dword [rsp + 0x20]
sub eax, 0x465c57e1
je 0x18000966a
jmp 0x1800094b8
jmp 0x1800096ac
mov rax, qword [rsp + 0x30]
cmp rax, qword [rsp + 0x40]
mov ecx, 0xc9fd5904
mov edx, 0x465c57e1
cmovne edx, ecx
mov dword [rsp + 0x24], edx
jmp 0x1800096ac
mov rax, qword [rsp + 0x30]
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, 0
mov eax, 0xc625abc6
mov r8d, 0x26162e6b
cmove r8d, eax
mov dword [rsp + 0x24], r8d
jmp 0x1800096ac
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x24], 0xb2226a42
jmp 0x1800096ac
mov eax, dword [0x18003794c]
mov ecx, dword [0x180037948]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete r8b
cmp ecx, 0xa
setl r9b
or r8b, r9b
test r8b, 1
mov eax, 0xd1b6acaa
mov ecx, 0x11aa8991
cmovne ecx, eax
mov dword [rsp + 0x24], ecx
jmp 0x1800096ac
mov eax, dword [0x18003794c]
mov ecx, dword [0x180037948]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete r8b
cmp ecx, 0xa
setl r9b
or r8b, r9b
test r8b, 1
mov eax, 0x39b7e3d5
mov ecx, 0x11aa8991
cmovne ecx, eax
mov dword [rsp + 0x24], ecx
jmp 0x1800096ac
mov dword [rsp + 0x24], 0x183ca999
jmp 0x1800096ac
mov eax, dword [0x18003794c]
mov ecx, dword [0x180037948]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete r8b
cmp ecx, 0xa
setl r9b
or r8b, r9b
test r8b, 1
mov eax, 0xe23bbf82
mov ecx, 0x9557f690
cmovne ecx, eax
mov dword [rsp + 0x24], ecx
jmp 0x1800096ac
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov ecx, dword [0x18003794c]
mov edx, dword [0x180037948]
mov r8d, ecx
sub r8d, 1
imul ecx, r8d
and ecx, 1
cmp ecx, 0
sete r9b
cmp edx, 0xa
setl r10b
or r9b, r10b
test r9b, 1
mov ecx, 0x1e6f1c99
mov edx, 0x9557f690
cmovne edx, ecx
mov dword [rsp + 0x24], edx
jmp 0x1800096ac
mov dword [rsp + 0x24], 0x2c0e824f
jmp 0x1800096ac
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x24], 0xb2226a42
jmp 0x1800096ac
mov rax, qword [rsp + 0x60]
add rsp, 0x68
ret
mov dword [rsp + 0x24], 0xd1b6acaa
jmp 0x1800096ac
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x24], 0xe23bbf82
jmp 0x1800093ad