Function at 0x180001870
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov ecx, dword [0x18008d8f8]
lea edx, [rcx + 1]
imul edx, ecx
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
setne cl
cmp dword [0x18008d8fc], 0xa
setge dl
mov r8d, edx
xor r8b, cl
or dl, cl
xor dl, 1
or dl, r8b
mov edx, 0xc206c9c
mov ecx, 0x7930a67c
cmove edx, ecx
mov dword [rsp + 0x2c], edx
mov rax, qword [rax + 0x18]
mov ebp, 0x64e148e0
cmove ebp, ecx
mov r14d, 0x62023088
mov ecx, 0x97c58e1a
cmove r14d, ecx
mov r15, qword [rax + 0x10]
mov r12d, 0xb7c68b8f
cmove r12d, ecx
mov r13d, 0x948a703
mov eax, 0x7194eaf8
cmove r13d, eax
mov esi, 0x464d7950
cmove esi, eax
mov edx, 0x1049bbe3
xor eax, eax
jmp 0x180001930
mov r15, qword [r15]
mov edx, 0x64e148e0
mov rcx, rdi
nop word cs:[rax + rax]
mov r8d, edx
mov rdi, rcx
cmp edx, 0x1d035615
jle 0x1800019a0
cmp r8d, 0x64e148df
jle 0x180001a00
cmp r8d, 0x76d7c4fd
jle 0x180001a97
cmp r8d, 0x76d7c4fe
je 0x180001b5f
cmp r8d, 0x7930a67c
je 0x18000191b
mov rcx, rdi
mov edx, r8d
cmp r8d, 0x7ad85dc6
jne 0x180001930
mov rcx, qword [r15 + 0x30]
mov rdx, qword [rsp + 0x30]
call fcn.180001380
test rax, rax
mov edx, 0xc3818362
mov ecx, 0x14a153a
cmove edx, ecx
mov rcx, rdi
jmp 0x180001930
cmp r8d, 0x5c242af
jg 0x180001a50
cmp r8d, 0xc3818361
jg 0x180001ac4
cmp r8d, 0x97c58e1a
je 0x180001b79
mov rcx, rax
mov edx, r14d
cmp r8d, 0xb7c68b8f
je 0x180001930
mov rcx, rdi
mov edx, r8d
cmp r8d, 0xa43558cd
jne 0x180001930
jmp 0x180001baf
mov rcx, rdi
cmp r8d, 0x464d794f
jg 0x180001af7
mov edx, ebp
cmp r8d, 0x1d035616
je 0x180001930
mov rcx, rdi
mov edx, r8d
cmp r8d, 0x2c84197c
jne 0x180001930
mov ecx, ebx
and cl, 1
mov byte [rsp + 0x2b], cl
mov rcx, rdi
mov edx, esi
jmp 0x180001930
cmp r8d, 0xc206c9b
jg 0x180001b27
cmp r8d, 0x5c242b0
je 0x180001b86
mov rcx, rdi
mov edx, r8d
cmp r8d, 0x948a703
jne 0x180001930
cmp byte [rsp + 0x2b], 0
mov edx, 0x5c242b0
mov ecx, 0x7ad85dc6
cmovne edx, ecx
mov rcx, rdi
jmp 0x180001930
cmp r8d, 0x64e148e0
je 0x180001b93
mov rcx, rdi
mov edx, r8d
cmp r8d, 0x7194eaf8
jne 0x180001930
mov edx, 0x464d7950
mov rcx, rdi
jmp 0x180001930
mov rcx, rdi
mov edx, r12d
cmp r8d, 0xc3818362
je 0x180001930
mov rcx, rdi
mov edx, r8d
cmp r8d, 0x14a153a
jne 0x180001930
mov edx, 0x1d035616
mov rcx, rdi
jmp 0x180001930
mov edx, r13d
cmp r8d, 0x464d7950
je 0x180001930
mov rcx, rdi
mov edx, r8d
cmp r8d, 0x62023088
jne 0x180001930
mov edx, 0xa43558cd
mov rcx, rdi
jmp 0x180001930
cmp r8d, 0xc206c9c
je 0x180001ba2
mov rcx, rdi
mov edx, r8d
cmp r8d, 0x1049bbe3
jne 0x180001930
cmp qword [r15 + 0x30], 0
mov edx, 0x76d7c4fe
mov ecx, 0x2c84197c
cmove edx, ecx
xor ebx, ebx
mov rcx, rdi
jmp 0x180001930
test rax, rax
sete byte [rsp + 0x2a]
mov edx, 0x2c84197c
movzx ebx, byte [rsp + 0x2a]
mov rcx, rdi
jmp 0x180001930
mov edx, 0xb7c68b8f
mov rcx, rax
jmp 0x180001930
mov edx, 0xa43558cd
mov rcx, rax
jmp 0x180001930
mov r15, qword [r15]
mov rcx, rdi
mov edx, dword [rsp + 0x2c]
jmp 0x180001930
mov rcx, rdi
mov edx, 0x1049bbe3
jmp 0x180001930
mov rax, rdi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret