Function at 0x180001c98
Capabilities:
Access peb ldr_data
Inspect section memory permissions
Parse pe header
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
xor ebp, ebp
mov r12d, ebp
mov r13d, ebp
mov r14d, ebp
mov qword [rsp + 0x28], rbp
mov edi, ebp
mov qword [rsp + 0x90], rbp
mov r15d, ebp
call fcn.180001c8c
lea r9d, [rbp + 1]
mov rbx, rax
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x180001cfa
movsxd rdx, dword [rbx + 0x3c]
lea rcx, [rdx - 0x40]
cmp rcx, 0x3bf
ja 0x180001cfa
cmp dword [rdx + rbx], 0x4550
je 0x180001cff
sub rbx, r9
jmp 0x180001cd6
mov rax, qword gs:[0x60]
mov qword [rsp + 0x20], rbx
mov r11d, 4
mov rcx, qword [rax + 0x18]
mov rsi, qword [rcx + 0x20]
mov qword [rsp + 0x98], rsi
test rsi, rsi
je 0x180001f3f
mov r10d, 0xffff
mov rdx, qword [rsi + 0x50]
movzx r8d, word [rsi + 0x48]
mov rcx, rbp
ror ecx, 0xd
cmp byte [rdx], 0x61
jb 0x180001d50
movzx eax, byte [rdx]
sub eax, 0x20
cdqe
jmp 0x180001d53
movzx eax, byte [rdx]
add rcx, rax
add rdx, r9
add r8w, r10w
jne 0x180001d3e
cmp ecx, 0x6a4abc5b
jne 0x180001e62
mov rdx, qword [rsi + 0x20]
mov edi, 5
mov esi, 0xffff
movsxd rax, dword [rdx + 0x3c]
mov ebp, dword [rax + rdx + 0x88]
mov r10d, dword [rbp + rdx + 0x20]
mov r11d, dword [rbp + rdx + 0x24]
add r10, rdx
add r11, rdx
xor ebx, ebx
mov r8d, dword [r10]
mov ecx, ebx
add r8, rdx
mov al, byte [r8]
ror ecx, 0xd
movsx eax, al
add r8, r9
add ecx, eax
mov al, byte [r8]
test al, al
jne 0x180001da1
cmp ecx, 0xec0e4e8e
je 0x180001ddb
cmp ecx, 0x7c0dfcaa
je 0x180001ddb
cmp ecx, 0x91afca54
je 0x180001ddb
cmp ecx, 0x7946c61b
je 0x180001ddb
cmp ecx, 0xef632f2
jne 0x180001e4a
mov eax, dword [rbp + rdx + 0x1c]
movzx r8d, word [r11]
lea r9, [rdx + rax]
cmp ecx, 0xec0e4e8e
jne 0x180001df8
mov r12d, dword [r9 + r8*4]
add r12, rdx
jmp 0x180001e41
cmp ecx, 0x7c0dfcaa
jne 0x180001e09
mov r13d, dword [r9 + r8*4]
add r13, rdx
jmp 0x180001e41
cmp ecx, 0x91afca54
jne 0x180001e1a
mov r14d, dword [r9 + r8*4]
add r14, rdx
jmp 0x180001e41
cmp ecx, 0x7946c61b
jne 0x180001e32
mov ebx, dword [r9 + r8*4]
add rbx, rdx
mov qword [rsp + 0x28], rbx
xor ebx, ebx
jmp 0x180001e41
cmp ecx, 0xef632f2
jne 0x180001e41
mov r15d, dword [r9 + r8*4]
add r15, rdx
add di, si
mov r9d, 1
add r10, 4
add r11, 2
test di, di
jne 0x180001d96
xor ebp, ebp
jmp 0x180001eeb
cmp ecx, 0x3cfa685d
jne 0x180001f01
mov r8, qword [rsi + 0x20]
mov ebx, 1
mov esi, 0xffff
movsxd rax, dword [r8 + 0x3c]
movzx edi, bx
mov r11d, dword [rax + r8 + 0x88]
mov r9d, dword [r11 + r8 + 0x20]
mov r10d, dword [r11 + r8 + 0x24]
add r9, r8
add r10, r8
mov ecx, dword [r9]
mov edx, ebp
add rcx, r8
mov al, byte [rcx]
ror edx, 0xd
movsx eax, al
add rcx, rbx
add edx, eax
mov al, byte [rcx]
test al, al
jne 0x180001ea5
cmp edx, 0x534c0ab8
jne 0x180001ede
mov eax, dword [r11 + r8 + 0x1c]
movzx edx, word [r10]
add di, si
lea rcx, [r8 + rax]
mov ebp, dword [rcx + rdx*4]
add rbp, r8
mov qword [rsp + 0x90], rbp
xor ebp, ebp
add r9, 4
add r10, 2
test di, di
jne 0x180001e9b
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x98]
mov r10d, 0xffff
test r12, r12
je 0x180001f1a
test r13, r13
je 0x180001f1a
test r14, r14
je 0x180001f1a
test r15, r15
je 0x180001f1a
test rdi, rdi
jne 0x180001f34
mov rsi, qword [rsi]
mov r9d, 1
mov qword [rsp + 0x98], rsi
test rsi, rsi
jne 0x180001d32
mov rbx, qword [rsp + 0x20]
mov r11d, 4
movsxd rdi, dword [rbx + 0x3c]
mov r9d, r11d
xor ecx, ecx
add rdi, rbx
mov r8d, 0x3000
mov edx, dword [rdi + 0x50]
mov qword [rsp + 0x98], rdi
call r14
mov edx, dword [rdi + 0x50]
mov rcx, rax
mov rbp, rax
call r15
mov r8d, dword [rdi + 0x54]
xor r15d, r15d
mov rcx, rbx
lea r11d, [r15 + 1]
test r8, r8
je 0x180001f91
mov rdx, rbp
sub rdx, rbx
mov al, byte [rcx]
mov byte [rdx + rcx], al
add rcx, r11
sub r8, r11
jne 0x180001f84
movzx r9d, word [rdi + 6]
movzx eax, word [rdi + 0x14]
test r9, r9
je 0x180001fd7
lea rcx, [rdi + 0x2c]
add rcx, rax
mov edx, dword [rcx - 8]
mov r8d, dword [rcx]
mov r10d, dword [rcx - 4]
add rdx, rbp
add r8, rbx
sub r9, r11
test r10, r10
je 0x180001fce
mov al, byte [r8]
add r8, r11
mov byte [rdx], al
add rdx, r11
sub r10, r11
jne 0x180001fbe
add rcx, 0x28
test r9, r9
jne 0x180001fa6
mov ebx, dword [rdi + 0x90]
mov ecx, 8
add rbx, rbp
cmp dword [rbx], r15d
je 0x180002089
mov ecx, dword [rbx + 0xc]
add rcx, rbp
call r12
mov r15, rax
xor eax, eax
test r15, r15
je 0x180002075
mov r14d, dword [rbx]
mov esi, dword [rbx + 0x10]
add r14, rbp
add rsi, rbp
jmp 0x180002070
test r14, r14
je 0x18000204b
movabs rax, 0x8000000000000000
test qword [r14], rax
je 0x18000204b
movsxd rax, dword [r15 + 0x3c]
movzx edx, word [r14]
mov ecx, dword [rax + r15 + 0x88]
mov eax, dword [rcx + r15 + 0x10]
mov ecx, dword [rcx + r15 + 0x1c]
add rcx, r15
sub rdx, rax
mov eax, dword [rcx + rdx*4]
add rax, r15
jmp 0x18000205b
mov rdx, qword [rsi]
mov rcx, r15
add rdx, 2
add rdx, rbp
call r13
mov qword [rsi], rax
mov ecx, 8
xor eax, eax
add rsi, rcx
test r14, r14
je 0x180002070
add r14, rcx
cmp qword [rsi], rax
jne 0x18000200f
add rbx, 0x14
xor r15d, r15d
cmp dword [rbx], r15d
jne 0x180001fee
lea ecx, [r15 + 8]
mov eax, dword [rdi + 0xb4]
mov r10, rbp
sub r10, qword [rdi + 0x30]
test eax, eax
je 0x180002155
mov r8d, dword [rdi + 0xb0]
mov r11d, eax
add r8, rbp
test eax, eax
je 0x180002155
mov esi, 0xfff
mov edi, 2
cmp dword [r8 + 4], r15d
je 0x18000214d
mov r9d, dword [r8 + 4]
mov edx, dword [r8]
lea rbx, [r8 + 8]
sub r9, rcx
add rdx, rbp
shr r9, 1
je 0x18000213d
mov r14d, 1
movzx ecx, word [rbx]
sub r9, r14
movzx eax, cx
shr ax, 0xc
cmp ax, 0xa
jne 0x1800020ff
and rcx, rsi
add qword [rcx + rdx], r10
jmp 0x180002131
cmp ax, 3
jne 0x18000210e
and rcx, rsi
add dword [rcx + rdx], r10d
jmp 0x180002131
cmp ax, r14w
jne 0x180002124
mov rax, r10
and rcx, rsi
shr rax, 0x10
add word [rcx + rdx], ax
jmp 0x180002131
cmp ax, di
jne 0x180002131
and rcx, rsi
add word [rcx + rdx], r10w
add rbx, rdi
test r9, r9
jne 0x1800020e3
lea ecx, [r9 + 8]
mov eax, dword [r8 + 4]
add r8, rax
sub r11, rax
jne 0x1800020bd
mov rdi, qword [rsp + 0x98]
movzx esi, word [rdi + 6]
movzx eax, word [rdi + 0x14]
test rsi, rsi
je 0x180002265
mov r14, qword [rsp + 0x28]
lea rbx, [rdi + 0x3c]
mov edx, 0x80000000
mov r13d, 0x40000000
mov r12d, 0x20000000
mov edi, 8
add rbx, rax
mov ecx, dword [rbx - 0x18]
mov dword [rsp + 0x88], r15d
dec rsi
add rcx, rbp
test dword [rbx], edx
mov r8d, r15d
cmovne r8d, edi
mov eax, 2
mov dword [rsp + 0x88], r8d
test dword [rbx], r13d
cmovne r8d, eax
mov dword [rsp + 0x88], r8d
test dword [rbx], edx
je 0x1800021d6
test dword [rbx], r13d
mov eax, 4
cmovne r8d, eax
mov dword [rsp + 0x88], r8d
test dword [rbx], r12d
mov eax, 0x10
cmovne r8d, eax
mov dword [rsp + 0x88], r8d
test dword [rbx], r12d
je 0x180002238
test dword [rbx], edx
mov eax, 0x80
cmovne r8d, eax
mov dword [rsp + 0x88], r8d
test dword [rbx], r12d
je 0x180002238
test dword [rbx], r13d
mov eax, 0x20
cmovne r8d, eax
mov dword [rsp + 0x88], r8d
test dword [rbx], r12d
je 0x180002238
test dword [rbx], edx
je 0x180002238
test dword [rbx], r13d
mov eax, 0x40
cmovne r8d, eax
mov dword [rsp + 0x88], r8d
mov edx, dword [rbx - 0x14]
test rdx, rdx
je 0x18000224b
lea r9, [rsp + 0x88]
call r14
add rbx, 0x28
mov edx, 0x80000000
test rsi, rsi
jne 0x180002188
mov rdi, qword [rsp + 0x98]
mov ebx, dword [rdi + 0x28]
xor r8d, r8d
xor edx, edx
or rcx, 0xffffffffffffffff
add rbx, rbp
call qword [rsp + 0x90]
mov r8, qword [rsp + 0x80]
mov edx, 1
mov rcx, rbp
call rbx
mov rax, rbx
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret