Function at 0x1800083e0
Capabilities:
Access peb ldr_data
Get process filename
Parse pe header
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push r14
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
xor esi, esi
mov qword [rsp + 0x48], r12
mov edx, 0x5a4d
xor r12d, r12d
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r15
xor ebp, ebp
mov r15, qword [rcx]
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x90], rsi
cmp word [r15], dx
jne 0x180008440
movsxd rcx, dword [r15 + 0x3c]
lea rax, [rcx - 0x40]
cmp rax, 0x3bf
ja 0x180008440
cmp dword [rcx + r15], 0x4550
je 0x180008445
dec r15
jmp 0x180008420
mov rax, qword gs:[0x60]
mov r9d, 1
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x88], r15
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x20]
test r14, r14
je 0x180008628
mov r13d, 0xffff
lea r15d, [r9 + 2]
nop dword [rax]
mov rdx, qword [r14 + 0x50]
xor ecx, ecx
movzx r8d, word [r14 + 0x48]
nop dword [rax + rax]
movzx eax, byte [rdx]
ror ecx, 0xd
cmp al, 0x61
jb 0x1800084a4
movzx eax, al
sub eax, 0x20
cdqe
jmp 0x1800084a7
movzx eax, al
add rcx, rax
inc rdx
add r8w, r13w
jne 0x180008490
cmp ecx, 0x6a4abc5b
jne 0x180008596
mov r9, qword [r14 + 0x20]
movzx ebx, r15w
movsxd rax, dword [r9 + 0x3c]
mov edi, dword [rax + r9 + 0x88]
mov r10d, dword [rdi + r9 + 0x20]
mov r11d, dword [rdi + r9 + 0x24]
add r10, r9
add r11, r9
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r10]
add rcx, r9
xor r8d, r8d
movzx eax, byte [rcx]
nop dword [rax]
ror r8d, 0xd
lea rcx, [rcx + 1]
movsx eax, al
add r8d, eax
movzx eax, byte [rcx]
test al, al
jne 0x180008500
cmp r8d, 0xec0e4e8e
je 0x180008530
cmp r8d, 0x7c0dfcaa
je 0x180008530
cmp r8d, 0x91afca54
jne 0x180008573
mov eax, dword [rdi + r9 + 0x1c]
movzx edx, word [r11]
lea rcx, [r9 + rax]
cmp r8d, 0xec0e4e8e
jne 0x18000854f
mov r12d, dword [rcx + rdx*4]
add r12, r9
jmp 0x18000856f
cmp r8d, 0x7c0dfcaa
jne 0x180008560
mov esi, dword [rcx + rdx*4]
add rsi, r9
jmp 0x18000856f
cmp r8d, 0x91afca54
jne 0x18000856f
mov ebp, dword [rcx + rdx*4]
add rbp, r9
add bx, r13w
add r10, 4
add r11, 2
test bx, bx
jne 0x1800084f0
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x90], rsi
jmp 0x1800085ff
cmp ecx, 0x3cfa685d
jne 0x180008605
mov r10, qword [r14 + 0x20]
movsxd rax, dword [r10 + 0x3c]
mov ecx, dword [rax + r10 + 0x88]
mov r8d, dword [rcx + r10 + 0x20]
add r8, r10
nop word [rax + rax]
mov edx, dword [r8]
add rdx, r10
xor ecx, ecx
movzx eax, byte [rdx]
nop dword [rax + rax]
ror ecx, 0xd
lea rdx, [rdx + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [rdx]
test al, al
jne 0x1800085d0
cmp ecx, 0x534c0ab8
lea eax, [r9 - 1]
cmovne ax, r9w
add r8, 4
movzx r9d, ax
test ax, ax
jne 0x1800085c0
mov r9d, 1
test r12, r12
je 0x180008614
test rsi, rsi
je 0x180008614
test rbp, rbp
jne 0x180008620
mov r14, qword [r14]
test r14, r14
jne 0x180008480
mov r15, qword [rsp + 0x88]
movsxd r13, dword [r15 + 0x3c]
xor ecx, ecx
add r13, r15
mov r8d, 0x3000
mov qword [rsp + 0x88], r13
lea r9d, [rcx + 0x40]
mov edx, dword [r13 + 0x50]
call rbp
mov r14, rax
mov rdx, r15
mov eax, dword [r13 + 0x54]
test rax, rax
je 0x180008671
mov r8, r14
sub r8, r15
nop
movzx ecx, byte [rdx]
mov byte [r8 + rdx], cl
lea rdx, [rdx + 1]
sub rax, 1
jne 0x180008660
call fcn.180002d40
movzx r10d, word [r13 + 6]
mov r12, rax
movzx ecx, word [r13 + 0x14]
mov qword [rsp + 0x20], rax
test r10, r10
je 0x1800086db
lea r9, [r13 + 0x2c]
add r9, rcx
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [r9 - 8]
dec r10
mov edx, dword [r9]
add rcx, r14
mov r8d, dword [r9 - 4]
add rdx, r15
test r8, r8
je 0x1800086d2
nop dword [rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx], al
inc rcx
sub r8, 1
jne 0x1800086c0
add r9, 0x28
test r10, r10
jne 0x1800086a0
lea rbp, [r13 + 0x90]
mov r15d, dword [rbp]
add r15, r14
mov eax, dword [r15 + 0xc]
test eax, eax
je 0x1800087a9
mov r12, qword [rsp + 0x90]
mov r13, qword [rsp + 0x98]
cmp dword [rbp], 0
je 0x18000879c
mov ecx, eax
add rcx, r14
call r13
mov edi, dword [r15 + 0x10]
mov rsi, rax
mov ebx, dword [r15]
add rdi, r14
add rbx, r14
cmp qword [rdi], 0
je 0x18000878c
nop dword [rax]
test rbx, rbx
je 0x180008761
mov rdx, qword [rbx]
test rdx, rdx
jns 0x180008761
movsxd rax, dword [rsi + 0x3c]
movzx edx, dx
mov ecx, dword [rax + rsi + 0x88]
mov eax, dword [rcx + rsi + 0x10]
mov ecx, dword [rcx + rsi + 0x1c]
sub rdx, rax
add rcx, rsi
mov eax, dword [rcx + rdx*4]
add rax, rsi
jmp 0x180008771
mov rbp, qword [rdi]
mov rcx, rsi
add rbp, r14
lea rdx, [rbp + 2]
call r12
mov qword [rdi], rax
add rdi, 8
test rbx, rbx
lea rax, [rbx + 8]
cmove rax, rbx
cmp qword [rdi], 0
mov rbx, rax
jne 0x180008730
mov eax, dword [r15 + 0x20]
add r15, 0x14
test eax, eax
jne 0x180008705
mov r13, qword [rsp + 0x88]
mov r12, qword [rsp + 0x20]
mov r15, qword [rsp + 0x38]
mov r8, r14
sub r8, qword [r13 + 0x30]
cmp dword [r13 + 0xb4], 0
mov rbp, qword [rsp + 0x58]
je 0x180008877
mov r11d, dword [r13 + 0xb0]
add r11, r14
mov eax, dword [r11 + 4]
test eax, eax
je 0x180008877
nop
mov edx, dword [r11]
lea r10, [r11 + 8]
mov r9d, eax
add rdx, r14
sub r9, 8
shr r9, 1
je 0x180008864
nop word [rax + rax]
movzx eax, word [r10]
dec r9
movzx ecx, ax
shr cx, 0xc
cmp cx, 0xa
jne 0x18000881f
and eax, 0xfff
add qword [rax + rdx], r8
jmp 0x18000885b
cmp cx, 3
jne 0x180008830
and eax, 0xfff
add dword [rax + rdx], r8d
jmp 0x18000885b
cmp cx, 1
jne 0x18000884b
and eax, 0xfff
lea rcx, [rax + rdx]
mov rax, r8
shr rax, 0x10
add word [rcx], ax
jmp 0x18000885b
cmp cx, 2
jne 0x18000885b
and eax, 0xfff
add word [rax + rdx], r8w
add r10, 2
test r9, r9
jne 0x180008800
mov eax, dword [r11 + 4]
add r11, rax
mov eax, dword [r11 + 4]
test eax, eax
jne 0x1800087e0
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rcx, r12
call fcn.180003100
mov ebx, dword [r13 + 0x28]
mov rcx, r14
mov rsi, qword [rsp + 0x80]
add rbx, r14
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
cmp byte [rsi + 8], 0
jne 0x180008923
mov rdx, qword [rsi + 0x10]
call fcn.1800082f0
mov rdi, rax
test rax, rax
je 0x18000892c
cmp byte [rsi + 0x3c], 0
je 0x1800088f5
mov r8, qword [rsi + 0x40]
test r8, r8
je 0x1800088f5
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x20]
add rdx, 0x20
cmp rcx, rdx
je 0x1800088f5
cmp qword [rcx + 0x20], r8
je 0x1800088f1
mov rcx, qword [rcx]
cmp rcx, rdx
jne 0x1800088e1
jmp 0x1800088f5
mov qword [rcx + 0x20], r14
xor r8d, r8d
mov rcx, r14
lea edx, [r8 + 1]
call rbx
mov r9d, dword [rsi + 0x38]
mov r8, qword [rsi + 0x30]
mov rdx, qword [rsi + 0x28]
mov rcx, qword [rsi + 0x20]
call rdi
cdqe
mov rdi, qword [rsp + 0x50]
add rsp, 0x60
pop r14
pop rsi
pop rbx
ret
xor r8d, r8d
lea edx, [r8 + 1]
call rbx
mov rax, rbx
mov rdi, qword [rsp + 0x50]
add rsp, 0x60
pop r14
pop rsi
pop rbx
ret