Function at 0x180032db4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov dword [rsp + 0x20], r9d
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
mov rax, qword [0x1801724e0]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov esi, r9d
mov r12d, r8d
mov rdi, rdx
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x80], rdx
xor ebx, ebx
mov byte [rsp + 0x34], bl
mov dword [rsp + 0x50], ebx
lea ecx, [rbx + 3]
cmp r8d, ecx
jb 0x1800338ed
cmp r12d, 4
ja 0x1800338e6
mov eax, esi
and eax, 0x41
jne 0x1800338d8
cmp r12d, 4
je 0x1800338de
mov r13d, r12d
cmp r12d, 4
cmove r13d, ecx
mov dword [rsp + 0x4c], r13d
mov r15d, esi
not r15d
test r15b, 0x10
je 0x180032f63
lea eax, [r13 - 1]
cmp eax, 2
ja 0x180032f63
cmp r13d, ecx
jne 0x180033749
movzx r14d, word [rdx + 0x10]
mov word [rsp + 0x3c], r14w
mov rcx, qword [rdx]
lea rax, [rcx - 0x10]
test rax, 0xfffffffffffffff7
je 0x180033724
test rcx, 0xffffffffffff0000
jne 0x180033733
mov r9d, esi
mov rdx, rdi
mov r15, qword [rsp + 0x58]
mov rcx, r15
call fcn.180033ae0
or esi, eax
mov dword [rsp + 0x158], esi
bt esi, 0x12
jae 0x180032f68
mov eax, 0xc000008a
mov dword [rsp + 0x38], eax
bt esi, 0x11
jb 0x180032f28
mov rax, qword [rdi]
mov qword [rsp + 0xd0], rax
cmp r13d, 2
jb 0x180033751
mov rax, qword [rdi + 8]
mov qword [rsp + 0xd8], rax
cmp r13d, 3
jne 0x180032ef6
mov rbx, qword [rdi + 0x10]
mov qword [rsp + 0xe0], rbx
cmp r12d, 4
je 0x180032f2d
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, esi
mov r8d, r12d
lea rdx, [rsp + 0xd0]
mov rcx, r15
call fcn.180033eb8
mov dword [rsp + 0x38], eax
jmp 0x1800338b5
mov rax, qword [rdi + 0x18]
mov qword [rsp + 0xe8], rax
jmp 0x180032f04
mov eax, 0xf3ff
test ax, r14w
jne 0x180032e96
mov eax, 0xc00
cmp r14w, ax
je 0x180032e96
or esi, 0x10
mov dword [rsp + 0x158], esi
mov r15, qword [rsp + 0x58]
mov r8d, 2
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa0]
mov dl, 1
mov rcx, r15
call fcn.18001014c
mov rcx, qword [rsp + 0x90]
test eax, eax
cmovs rcx, rbx
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rcx
test rcx, rcx
je 0x1800335ab
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x40], 0xeeee
mov dword [rsp + 0x48], ebx
mov rdx, rbx
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x68], rbx
mov word [rsp + 0x30], bx
mov word [rsp + 0x3c], bx
mov dword [rsp + 0x64], ebx
mov r14d, 0xc000000d
mov r10d, 0x3ff
mov r9d, 0xc000008a
test rcx, rcx
je 0x1800330cc
mov eax, dword [rsp + 0x4c]
mov r8d, eax
dec r8d
mov dword [rsp + 0x4c], r8d
test eax, eax
je 0x1800330cc
test r8d, r8d
je 0x18003315d
cmp qword [rsp + 0x68], rbx
jne 0x180033174
movzx eax, word [rcx + 0xc]
lea r8, [rcx + 0x10]
mov qword [rsp + 0xb0], r8
test qword [rdi], 0xffffffffffff0000
jne 0x180033053
movzx eax, ax
lea r8, [r8 + rax*8]
mov qword [rsp + 0xb0], r8
movzx eax, word [rcx + 0xe]
test ax, ax
je 0x180033488
cmp qword [rsp + 0x68], rbx
jne 0x1800330a5
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
mov r9, qword [rdi]
mov rdx, qword [rsp + 0x98]
movzx ecx, ax
call fcn.1800338fc
add rdi, 8
mov qword [rsp + 0xb8], rdi
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x78]
jmp 0x180032fe7
test sil, 0x20
je 0x180033063
mov rcx, rbx
mov qword [rsp + 0x58], rbx
mov eax, dword [r8]
mov qword [rsp + 0x40], rax
mov edx, dword [r8 + 4]
add rdx, qword [rsp + 0x98]
mov qword [rsp + 0x78], rdx
mov eax, esi
and eax, 2
test rdx, rdx
je 0x18003332a
test eax, eax
jne 0x18003332a
mov rax, qword [rsp + 0x70]
mov qword [rax], rdx
mov rax, qword gs:[0x30]
cmp qword [rax + 0x1810], rbx
je 0x18003344b
mov rax, qword gs:[0x30]
cmp qword [rax + 0x1810], rbx
je 0x180033152
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x1810]
mov qword [rax], r15
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x1810]
mov rax, qword [rsp + 0x78]
mov qword [rcx + 8], rax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x1810]
mov qword [rax + 0x10], r15
mov edi, ebx
mov dword [rsp + 0x38], ebx
jmp 0x1800338ab
mov rax, qword [rsp + 0x68]
cmp r13d, 3
cmove rax, rcx
mov qword [rsp + 0x68], rax
jmp 0x18003301c
mov r8, qword [rsp + 0x80]
movzx eax, word [r8 + 0x10]
mov word [rsp + 0x3c], ax
test r10w, ax
sete byte [rsp + 0x34]
mov eax, dword [rsp + 0x48]
inc dword [rsp + 0x48]
cmp eax, 6
je 0x180033387
ja 0x180033563
test eax, eax
jne 0x180033222
cmp bx, word [rsp + 0x3c]
je 0x18003325a
bt esi, 0x13
movzx eax, word [rsp + 0x40]
cmovb ax, word [rsp + 0x3c]
mov word [rsp + 0x30], ax
mov eax, esi
not eax
test al, 0x20
jne 0x180033203
movzx eax, word [rsp + 0x30]
mov qword [rsp + 0x40], rax
lea rdi, [rsp + 0x40]
mov qword [rsp + 0xb8], rdi
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rcx
mov r9d, 0xc000008a
mov r10d, 0x3ff
jmp 0x180033027
movzx eax, word [rsp + 0x30]
cmp rax, qword [rsp + 0x40]
jne 0x1800331d1
mov r10d, 0x3ff
mov r8, qword [rsp + 0x80]
jmp 0x18003318f
sub eax, 1
je 0x180033264
sub eax, 1
je 0x180033373
sub eax, 1
je 0x180033413
sub eax, 1
jne 0x18003330d
cmp byte [rsp + 0x34], bl
jne 0x180033320
movzx eax, word [rsp + 0x3c]
and ax, r10w
jmp 0x1800331c4
mov word [rsp + 0x30], bx
jmp 0x1800331c9
mov edx, esi
not edx
bt edx, 0x13
setb cl
bt edx, 0x11
setb al
and cl, al
test dl, 0x10
setne al
test al, cl
je 0x180033320
mov rax, qword [r8]
mov qword [rsp + 0xd0], rax
cmp r13d, 2
jb 0x180033770
mov rax, qword [r8 + 8]
mov qword [rsp + 0xd8], rax
cmp r13d, 3
jne 0x180033778
mov rax, qword [r8 + 0x10]
mov qword [rsp + 0xe0], rax
cmp r12d, 4
je 0x18003359a
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, esi
mov r8d, r12d
lea rdx, [rsp + 0xd0]
mov rcx, r15
call fcn.180033eb8
mov edi, eax
mov dword [rsp + 0x38], eax
test eax, eax
js 0x180033320
mov r9d, r12d
lea r8, [rsp + 0xd0]
xor edx, edx
mov rcx, r15
call fcn.18007a164
mov eax, edi
jmp 0x1800338b5
cmp eax, 1
jne 0x18003378a
cmp byte [rsp + 0x34], bl
je 0x180033609
movzx eax, word [rsp + 0x40]
jmp 0x1800331c4
test rcx, rcx
jne 0x18003370f
mov eax, r13d
sub eax, dword [rsp + 0x4c]
sub eax, 1
je 0x1800334d6
sub eax, 1
je 0x180033558
cmp eax, 1
jne 0x180033759
mov edi, 0xc0000204
mov dword [rsp + 0x38], edi
cmp qword [rsp + 0x68], rbx
je 0x1800334ea
mov qword [rsp + 0x78], rbx
jmp 0x180033215
movzx eax, word [rsp + 0x3c]
cmp byte [rsp + 0x34], bl
cmovne ax, word [rsp + 0x40]
jmp 0x1800331c4
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
test sil, 0x20
jne 0x1800331c9
mov word [rsp + 0x30], bx
call fcn.180034b2c
test al, al
je 0x180033780
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x17e0]
movzx ecx, word [rax + 4]
cmp dword [rsp + 0x50], ecx
jae 0x180033613
mov rdx, qword gs:[0x30]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rdx + 0x17e0]
call fcn.180034d90
mov esi, dword [rsp + 0x158]
cmp word [rsp + 0x30], bx
je 0x180033320
inc dword [rsp + 0x50]
dec dword [rsp + 0x48]
jmp 0x1800331c9
test sil, 4
jne 0x180033766
cmp byte [rsp + 0x34], bl
jne 0x180033320
lea rdx, [rsp + 0x30]
movzx ecx, word [rsp + 0x30]
call fcn.18007ec78
test eax, eax
js 0x18003325a
cmp word [rsp + 0x30], bx
je 0x1800331c9
jmp 0x18003340a
mov rax, qword gs:[0x30]
mov qword [rsp + 0xa8], rax
mov rcx, qword gs:[0x60]
xor edx, edx
lea r8d, [rdx + 0x18]
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlAllocateHeap
mov rcx, qword [rsp + 0xa8]
mov qword [rcx + 0x1810], rax
jmp 0x180033100
mov eax, r13d
sub eax, dword [rsp + 0x4c]
sub eax, 1
jne 0x1800336f5
mov r14d, r9d
mov dword [rsp + 0x38], r9d
lea eax, [r14 + 0x3fffff76]
cmp eax, 1
ja 0x1800334ce
mov edx, esi
not edx
bt edx, 0x13
setb cl
bt edx, 0x11
setb al
and cl, al
test dl, 0x10
setne al
test al, cl
jne 0x18003381b
mov eax, r14d
jmp 0x1800338b5
mov edi, r9d
mov dword [rsp + 0x38], r9d
cmp edi, 0xc0000204
je 0x18003335e
lea eax, [rdi + 0x3fffff76]
cmp eax, 1
ja 0x1800338ab
mov edx, esi
not edx
bt edx, 0x13
setb cl
bt edx, 0x11
setb al
and cl, al
test dl, 0x10
setne al
test al, cl
je 0x1800338ab
cmp r13d, 3
jne 0x1800338ab
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
mov qword [rsp + 0xd0], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0xd8], rax
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0xe0], rax
cmp r12d, 4
jne 0x1800335c1
jmp 0x1800335b5
mov edi, 0xc000008b
mov dword [rsp + 0x38], edi
jmp 0x1800334f9
sub eax, 7
je 0x1800336e2
sub eax, 1
je 0x18003369b
sub eax, 1
je 0x180033670
sub eax, 1
je 0x180033635
sub eax, 1
jne 0x18003361d
mov eax, 0x409
jmp 0x1800331c4
mov rax, qword [r8 + 0x18]
mov qword [rsp + 0xe8], rax
jmp 0x1800332c7
mov eax, 0xc0000089
jmp 0x1800338b5
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, esi
mov r8d, r12d
lea rdx, [rsp + 0xd0]
mov rcx, r15
call fcn.180033eb8
mov edi, eax
mov dword [rsp + 0x38], eax
test eax, eax
js 0x1800338ab
mov r9d, r12d
lea r8, [rsp + 0xd0]
xor edx, edx
mov rcx, r15
call fcn.18007a164
jmp 0x1800338ab
mov eax, 0xc0000204
jmp 0x1800338b5
mov word [rsp + 0x30], bx
jmp 0x1800333f4
cmp eax, 1
jne 0x18003378a
or esi, 0x20
mov dword [rsp + 0x158], esi
jmp 0x1800331c9
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x88]
xor ecx, ecx
call sym.ntdll.dll_NtQueryDefaultLocale
mov dword [rsp + 0x38], eax
test eax, eax
js 0x1800331c9
mov eax, dword [rsp + 0x88]
cmp eax, dword [rsp + 0x64]
je 0x1800331c9
jmp 0x1800331c4
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x64]
mov cl, 1
call sym.ntdll.dll_NtQueryDefaultLocale
mov dword [rsp + 0x38], eax
test eax, eax
js 0x1800331c9
mov eax, dword [rsp + 0x64]
jmp 0x1800331c4
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
mov eax, esi
not eax
bt eax, 0x13
jb 0x180033626
mov rax, qword gs:[0x30]
test rax, rax
je 0x1800336d6
mov rax, qword gs:[0x30]
movzx ecx, word [rax + 0x108]
mov word [rsp + 0x30], cx
mov esi, dword [rsp + 0x158]
jmp 0x1800331c9
mov eax, esi
not eax
bt eax, 0x13
jae 0x180033320
jmp 0x180033794
sub eax, 1
jne 0x1800337fc
mov edi, 0xc000008b
mov r14d, edi
mov dword [rsp + 0x38], edi
jmp 0x1800334ac
test eax, eax
je 0x180033333
mov rax, qword [rsp + 0x70]
mov qword [rax], rcx
jmp 0x180033152
test r15b, 8
je 0x180032e96
jmp 0x180032f3b
lea rdx, [0x180114610]
call sym.ntdll.dll__wcsicmp
test eax, eax
jne 0x180032e96
jmp 0x180033724
mov r14d, ebx
jmp 0x180032e70
mov rax, rbx
jmp 0x180032ee4
mov edi, r14d
mov dword [rsp + 0x38], r14d
jmp 0x1800334de
mov eax, 0xc0000204
jmp 0x1800338b5
mov rax, rbx
jmp 0x18003329f
mov rax, rbx
jmp 0x1800332b5
mov word [rsp + 0x30], bx
jmp 0x1800333fb
mov eax, 0xc0000204
jmp 0x1800338b5
mov r9b, 1
xor r8d, r8d
mov rcx, r15
call fcn.180033b64
test rax, rax
je 0x180033320
cmp dword [rax], 0xfecdfecd
jne 0x180033320
cmp dword [rax + 0x7c], ebx
je 0x180033320
mov edx, dword [rax + 0x7c]
add rdx, rax
lea rcx, [rsp + 0xc0]
call sym.ntdll.dll_RtlInitUnicodeString
lea rdx, [rsp + 0x8c]
lea rcx, [rsp + 0xc0]
call sym.ntdll.dll_RtlCultureNameToLCID
test al, al
je 0x180033320
mov eax, dword [rsp + 0x8c]
jmp 0x1800331c4
cmp eax, 1
je 0x18003380b
mov dword [rsp + 0x38], r14d
jmp 0x1800334a0
mov r14d, 0xc0000204
mov dword [rsp + 0x38], r14d
jmp 0x1800334ce
cmp r13d, 3
jne 0x1800334ce
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
mov qword [rsp + 0xd0], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0xd8], rax
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0xe0], rax
cmp r12d, 4
jne 0x180033862
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, esi
mov r8d, r12d
lea rdx, [rsp + 0xd0]
mov rcx, r15
call fcn.180033eb8
mov r14d, eax
mov dword [rsp + 0x38], eax
test eax, eax
js 0x1800334ce
mov r9d, r12d
lea r8, [rsp + 0xd0]
xor edx, edx
mov rcx, r15
call fcn.18007a164
jmp 0x1800334ce
jmp 0x1800338b3
mov eax, edi
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.18008b0e0
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp r12d, 4
jne 0x1800338e6
test eax, eax
jne 0x180032e35
mov eax, 0xc00000f1
jmp 0x1800338b5
test sil, 2
jne 0x180032e16
jmp 0x1800338e6