Function at 0x18000df80
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rbx, qword [rcx + 0x10]
call fcn.18000d960
test al, al
je 0x18000e12c
lea rax, str.Found_TNameEntryArray_GNames_at_offset_0x:X_n
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 0x30
mov eax, dword [0x180087130]
mov dword [rbp - 0x48], eax
movabs rax, 0x1000000000000000
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x40], 1
lea rax, [rbp - 0x50]
mov qword [rbp - 0x38], rax
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm0
movaps xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x30], xmm1
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x20]
call fcn.18000cf10
nop
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
call fcn.180013c70
mov rcx, rax
call fcn.180011fc0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x18000e077
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000e072
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000e37c
call fcn.180022de0
movsxd rax, dword [0x180087130]
mov rsi, qword [rax + rbx]
mov byte [0x180087134], 0
xor ebx, ebx
mov edi, ebx
test rsi, rsi
je 0x18000e0e3
mov rcx, rsi
call fcn.18000b0c0
test al, al
jne 0x18000e0e3
mov r8d, ebx
mov ecx, ebx
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rcx + rsi]
mov rdx, rax
shr rdx, 0x20
test rax, rax
jne 0x18000e0c4
inc edi
jmp 0x18000e0d2
test edi, edi
jne 0x18000e0cc
inc ebx
jmp 0x18000e0d2
jle 0x18000e0d2
cmp edx, ebx
je 0x18000e0ef
add r8d, 8
add rcx, 8
cmp rcx, 0x800
jl 0x18000e0b0
lea rdx, str.The_address_that_was_found_couldnt_be_used_by_the_generator__this_might_be_due_to_GNames_encryption._n
jmp 0x18000e342
mov dword [0x18008723c], r8d
lea eax, [r8 + 4]
mov dword [0x180087238], eax
lea rax, [0x18000d790]
mov qword [0x180087140], rax
mov qword [0x180087048], rsi
mov byte [0x180087134], 0
xor edx, edx
xor ecx, ecx
call fcn.18000d110
mov al, 1
jmp 0x18000e358
call fcn.18000db40
test al, al
je 0x18000e33b
lea rax, str.Found_FNamePool_GNames_at_offset_0x:X_n
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 0x2a
mov eax, dword [0x180087130]
mov dword [rbp - 0x28], eax
movabs rax, 0x1000000000000000
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x40], 1
lea rax, [rbp - 0x30]
mov qword [rbp - 0x38], rax
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm0
movaps xmm1, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x50], xmm1
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.18000cf10
nop
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
call fcn.180013c70
mov rcx, rax
call fcn.180011fc0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x18000e1f2
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000e1ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000e376
call fcn.180022de0
movsxd r15, dword [0x180087130]
add r15, rbx
mov byte [0x180087134], 1
xor ebx, ebx
mov dword [0x180087238], ebx
mov r12d, 4
mov dword [0x180087244], r12d
mov r11d, 0x10
mov dword [0x180087240], r11d
mov edi, ebx
mov rsi, r15
nop word [rax + rax]
mov r14d, dword [rsi]
lea eax, [r14 - 1]
cmp eax, 0xffff
ja 0x18000e299
mov r9d, ebx
xor r10b, r10b
mov edx, ebx
mov eax, edi
and eax, 0x80000007
jge 0x18000e256
dec eax
or eax, 0xfffffff8
inc eax
lea ecx, [rax + rdi]
movsxd rax, ecx
lea r8, [r15 + 8]
add r8, rax
add ecx, 8
cmp qword [r8], rbx
je 0x18000e27a
inc r9d
test r10b, r10b
jne 0x18000e27a
mov r10b, 1
lea r11d, [rdx + rcx]
add edx, 8
add r8, 8
cmp edx, 0x10000
jl 0x18000e266
mov dword [0x180087240], r11d
lea eax, [r9 - 1]
cmp r14d, eax
je 0x18000e2aa
add edi, r12d
add rsi, r12
cmp edi, 0x20
jge 0x18000e0e3
jmp 0x18000e230
mov dword [0x180087238], edi
lea eax, [rdi + 4]
mov dword [0x180087244], eax
movsxd r8, r11d
add r8, r15
mov ecx, ebx
mov rax, qword [r8]
movabs rdx, 0x6a624f5565726f43
nop
cmp dword [rax], 0x656e6f4e
jne 0x18000e2e2
test rbx, rbx
jne 0x18000e2e2
movsxd rbx, ecx
jmp 0x18000e2e7
cmp qword [rax], rdx
je 0x18000e2fd
inc ecx
inc rax
cmp ecx, 0x1000
jl 0x18000e2d0
lea rdx, str.The_address_that_was_found_couldnt_be_used_by_the_generator__this_might_be_due_to_GNames_encryption._n
jmp 0x18000e342
mov eax, 2
cmp rbx, rax
cmove r12, rax
mov qword [0x180087128], r12
lea rax, [0x18000d800]
mov qword [0x180087140], rax
mov rdx, rbx
mov rcx, r8
call fcn.18000d110
mov qword [0x180087048], r15
mov byte [0x180087134], 1
mov al, 1
jmp 0x18000e358
lea rdx, str.Could_not_find_GNames__n
lea rcx, [0x1800859a0]
call fcn.180011d50
mov rcx, rax
call fcn.180011fc0
xor al, al
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1800306b0
int3
call fcn.1800306b0
int3