Function at 0x180034760
Capabilities:
Access peb ldr_data

Disassembly:
test dl, dl
je 0x180034de1
sub rsp, 0x48
mov rax, qword [0x18021c8c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x40], r14
call fcn.180026870
xor esi, esi
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], esi
inc dword [rax + 8]
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], reloc.WLDAP32.dll_Ordinal_27
inc dword [rax + 8]
call fcn.180026870
movabs rbx, 0xfe99b66d079cf6bc
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 1
mov rcx, rbx
inc dword [rax + 8]
call fcn.180026710
call fcn.180026870
call fcn.180026870
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], esi
inc dword [rax + 8]
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 0xed
inc dword [rax + 8]
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 1
mov rcx, rbx
inc dword [rax + 8]
call fcn.180026710
call fcn.180026870
call fcn.180026870
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], esi
inc dword [rax + 8]
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], Ordinal_30
inc dword [rax + 8]
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 1
mov rcx, rbx
inc dword [rax + 8]
call fcn.180026710
call fcn.180026870
call fcn.180026870
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], esi
inc dword [rax + 8]
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 0xbc
inc dword [rax + 8]
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 1
mov rcx, rbx
inc dword [rax + 8]
call fcn.180026710
call fcn.180026870
call fcn.180026870
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], esi
inc dword [rax + 8]
call fcn.180026870
mov r8d, dword [rax + 8]
mov rdx, qword [rax + 0x10]
mov dword [rdx + r8*8], 0xbb
inc dword [rax + 8]
call fcn.180026870
mov rcx, rbx
mov r8d, dword [rax + 8]
mov rdx, qword [rax + 0x10]
mov dword [rdx + r8*8], 1
inc dword [rax + 8]
call fcn.180026710
call fcn.180026870
movss xmm2, dword [0x18025dab4]
lea rdx, [rsp + 0x20]
call fcn.180027c90
lea rdx, [rsp + 0x20]
call fcn.180034470
mov rax, qword gs:[0x58]
mov ecx, dword [0x1802e1e34]
mov r14d, 8
mov rdi, qword [rax + rcx*8]
mov eax, dword [rdi + r14]
cmp dword [0x1802e2790], eax
jle 0x1800349fe
lea rcx, [0x1802e2790]
call fcn.1801727cc
cmp dword [0x1802e2790], 0xffffffff
jne 0x1800349fe
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1800349c6
imul rax, rax, 0x64
jmp 0x1800349e4
cqo
idiv rbx
mov r8, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rdx, r8, 0x3b9aca00
add rax, rdx
lea rcx, [0x1802e2790]
mov qword [0x1802e2798], rax
mov qword [0x1802e27a0], rsi
call fcn.18017276c
mov qword [0x1802e27a0], 0x5f5e100
call fcn.180026870
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], esi
inc dword [rax + 8]
call fcn.180026870
movabs rbp, 0xe2587f8cbbd87b1d
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 0xbc
mov rcx, rbp
inc dword [rax + 8]
call fcn.180026710
call fcn.180026870
mov rcx, qword [rax]
cmp dword [rcx], esi
je 0x180034ac8
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x180034a78
imul rax, rax, 0x64
jmp 0x180034a96
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
mov rcx, rax
sub rcx, qword [0x1802e2798]
cmp rcx, qword [0x1802e27a0]
jl 0x180034ac8
movss xmm0, dword [0x18025dab4]
addss xmm0, dword [0x1801dc6c4]
mov qword [0x1802e2798], rax
movss dword [0x18025dab4], xmm0
mov eax, dword [rdi + r14]
cmp dword [0x1802e27a8], eax
jle 0x180034b3f
lea rcx, [0x1802e27a8]
call fcn.1801727cc
cmp dword [0x1802e27a8], 0xffffffff
jne 0x180034b3f
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x180034b07
imul rax, rax, 0x64
jmp 0x180034b25
cqo
idiv rbx
mov r8, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rdx, r8, 0x3b9aca00
add rax, rdx
lea rcx, [0x1802e27a8]
mov qword [0x1802e27b0], rax
mov qword [0x1802e27b8], rsi
call fcn.18017276c
mov qword [0x1802e27b8], 0x5f5e100
call fcn.180026870
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
mov r8d, dword [rax + 8]
mov rdx, qword [rax + 0x10]
mov dword [rdx + r8*8], esi
inc dword [rax + 8]
call fcn.180026870
mov rcx, rbp
mov r8d, dword [rax + 8]
mov rdx, qword [rax + 0x10]
mov dword [rdx + r8*8], 0xbb
inc dword [rax + 8]
call fcn.180026710
call fcn.180026870
mov rbp, qword [rsp + 0x58]
mov rcx, qword [rax]
cmp dword [rcx], esi
je 0x180034c08
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x180034bb8
imul rax, rax, 0x64
jmp 0x180034bd6
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
mov rcx, rax
sub rcx, qword [0x1802e27b0]
cmp rcx, qword [0x1802e27b8]
jl 0x180034c08
movss xmm0, dword [0x18025dab4]
addss xmm0, dword [0x1801dc838]
mov qword [0x1802e27b0], rax
movss dword [0x18025dab4], xmm0
mov eax, dword [rdi + r14]
cmp dword [0x1802e27c0], eax
mov r14, qword [rsp + 0x40]
jle 0x180034c84
lea rcx, [0x1802e27c0]
call fcn.1801727cc
cmp dword [0x1802e27c0], 0xffffffff
jne 0x180034c84
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x180034c4c
imul rax, rax, 0x64
jmp 0x180034c6a
cqo
idiv rbx
mov r8, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rdx, r8, 0x3b9aca00
add rax, rdx
lea rcx, [0x1802e27c0]
mov qword [0x1802e27c8], rax
mov qword [0x1802e27d0], rsi
call fcn.18017276c
mov qword [0x1802e27d0], 0xbebc200
call fcn.180026870
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
lea rdi, str.HeistLocate
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov qword [rcx + rdx*8], rdi
inc dword [rax + 8]
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], esi
inc dword [rax + 8]
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], esi
movabs rcx, 0x2206bf9a37b7f724
inc dword [rax + 8]
call fcn.180026710
call fcn.180026870
call fcn.180026870
movabs rcx, 0xd80958fc74e988a6
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026710
call fcn.180026870
mov rcx, qword [rax]
mov ebx, dword [rcx]
call fcn.180026870
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], ebx
inc dword [rax + 8]
call fcn.180026870
movss xmm0, dword [rsp + 0x20]
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
movss dword [rcx + rdx*8], xmm0
inc dword [rax + 8]
call fcn.180026870
movss xmm0, dword [rsp + 0x28]
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
movss dword [rcx + rdx*8], xmm0
inc dword [rax + 8]
call fcn.180026870
movss xmm0, dword [rsp + 0x30]
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
movss dword [rcx + rdx*8], xmm0
movabs rcx, 0x9afeff481a85ab2e
inc dword [rax + 8]
call fcn.180026710
call fcn.180026870
call fcn.180026870
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov qword [rcx + rdx*8], rdi
movabs rcx, 0x68e835a1d0dc0e3
inc dword [rax + 8]
call fcn.180026710
call fcn.180026870
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180172080
add rsp, 0x48
ret