Function at 0x1800010c0
Capabilities:
Access peb ldr_data

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbp
push r13
lea rbp, [r11 - 0x438]
sub rsp, 0x538
xor eax, eax
mov r13d, 1
lock cmpxchg dword [0x180015194], r13d
jne 0x1800015c7
mov qword [r11 + 0x18], rbx
lea rax, [0x180000fc0]
mov qword [0x180015078], rax
lea rax, [fcn.180000a80]
mov qword [0x180015080], rax
lea rax, [0x18000cac0]
mov qword [0x180015098], rax
lea rax, [0x180000750]
mov qword [0x180015088], rax
lea rax, [0x180000860]
mov qword [r11 - 0x30], r14
mov qword [0x180015090], rax
mov qword [r11 - 0x38], r15
call fcn.18000b090
mov rax, qword gs:[0x30]
xor r15d, r15d
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov rbx, qword [r14]
cmp rbx, r14
je 0x1800012cb
mov qword [rsp + 0x530], rsi
mov qword [rsp + 0x528], rdi
mov qword [rsp + 0x520], r12
mov r12d, 0x2000
nop dword [rax + rax]
mov eax, dword [rbx + 0x58]
mov rsi, qword [rbx + 0x20]
and eax, 0x60000000
mov rdi, qword [rbx + 0x40]
cmp eax, 0x20000000
je 0x1800012a7
movsxd rax, dword [rsi + 0x3c]
test word [rax + rsi + 0x16], r12w
je 0x1800012a7
xor edx, edx
lea rcx, [rbp + 0x50]
mov r8d, 0x208
call sub.msvcrt.dll_memset
mov r8, rdi
lea rcx, [rbp + 0x50]
mov edx, 0x104
call qword [sym.imp.msvcrt.dll_wcscpy_s]
lea rcx, [rbp + 0x50]
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rcx + rax*2 + 2], r15w
lea rax, [rax + 1]
jne 0x1800011f0
lea rcx, [rbp + 0x50]
lea rcx, [rcx + rax*2]
lea rax, [rbp + 0x50]
cmp rcx, rax
jb 0x180001262
nop dword [rax]
movzx eax, word [rcx]
cmp ax, 0x5c
je 0x18000122e
cmp ax, 0x2f
je 0x18000122e
sub rcx, 2
lea rax, [rbp + 0x50]
cmp rcx, rax
jae 0x180001210
jmp 0x180001262
lea rax, [rbp + 0x50]
mov word [rcx], r15w
cmp rcx, rax
jb 0x180001262
nop dword [rax + rax]
movzx eax, word [rcx]
cmp ax, 0x5c
je 0x18000125e
cmp ax, 0x2f
je 0x18000125e
sub rcx, 2
lea rax, [rbp + 0x50]
cmp rcx, rax
jae 0x180001240
jmp 0x180001262
add rcx, 2
lea rdx, str.system32
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x1800012a7
mov rdx, rdi
mov rcx, rsi
call fcn.18000a160
mov rdi, rax
test rax, rax
je 0x180001299
mov rdx, rax
mov rcx, rsi
call fcn.18000a470
mov rcx, rdi
call fcn.18000c570
and dword [rbx + 0x58], 0xbfffffff
or dword [rbx + 0x58], 0x20000000
mov rbx, qword [rbx]
cmp rbx, r14
jne 0x180001190
mov r12, qword [rsp + 0x520]
mov rdi, qword [rsp + 0x528]
mov rsi, qword [rsp + 0x530]
mov rcx, qword [section..data]
lea r8, [0x180015170]
mov qword [rsp + 0x50], r15
mov r9d, 0x20
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov rcx, qword [rcx + 0x1a0]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call fcn.18000c360
call fcn.180000400
mov qword [rbp + 0x440], rax
mov rbx, rax
movzx eax, byte [rbp + 0x447]
xor byte [0x180015177], al
xor byte [0x18001517f], al
xor byte [0x180015187], al
xor byte [0x18001518f], al
lea rax, [0x1800004e0]
movzx r11d, byte [rbp + 0x441]
movzx r10d, byte [rbp + 0x442]
movzx r9d, byte [rbp + 0x443]
movzx r8d, byte [rbp + 0x444]
movzx edx, byte [rbp + 0x445]
movzx ecx, byte [rbp + 0x446]
xor byte [0x180015170], bl
xor byte [0x180015171], r11b
xor byte [0x180015172], r10b
xor byte [0x180015173], r9b
xor byte [0x180015174], r8b
xor byte [0x180015175], dl
xor byte [0x180015176], cl
xor byte [0x180015178], bl
xor byte [0x180015179], r11b
xor byte [0x18001517a], r10b
xor byte [0x18001517b], r9b
xor byte [0x18001517c], r8b
xor byte [0x18001517d], dl
xor byte [0x18001517e], cl
xor byte [0x180015180], bl
xor byte [0x180015181], r11b
xor byte [0x180015182], r10b
xor byte [0x180015183], r9b
xor byte [0x180015184], r8b
xor byte [0x180015185], dl
xor byte [0x180015186], cl
xor byte [0x180015188], bl
xor byte [0x180015189], r11b
xor byte [0x18001518a], r10b
xor byte [0x18001518b], r9b
xor byte [0x18001518c], r8b
xor byte [0x18001518d], dl
xor byte [0x18001518e], cl
mov qword [0x180015070], rax
xor eax, eax
mov qword [rbp + 8], rax
mov rax, qword [section..data]
mov qword [rbp - 0x78], 0x202
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x60], r15
mov rcx, qword [rax + 0x1c0]
lea rax, [rbp + 0x260]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], r15
mov qword [rbp], r15
call fcn.18000c040
mov qword [rbp + 0x10], rax
mov rax, qword [0x180015018]
mov r14, qword [rsp + 0x518]
test rax, rax
jne 0x1800014ec
lea rax, [rbp + 0x448]
mov dword [rbp + 0x448], r15d
xor edx, edx
mov qword [rsp + 0x20], rax
mov rax, qword [section..data]
lea r8, [rbp + 0x20]
mov r9d, 0x30
lea rcx, [rdx - 2]
call qword [rax + 0x78]
mov rax, qword [rbp + 0x28]
mov rax, qword [rax + 8]
mov qword [0x180015018], rax
lea rcx, [rbp - 0x80]
mov qword [rbp + 0x18], rax
call fcn.18000f5d0
call fcn.18000c9e0
mov rcx, qword [section..data]
mov r8, rax
mov qword [rsp + 0x50], r15
mov r9d, 8
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov rcx, qword [rcx + 0x20]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 0x30450
call fcn.18000c360
mov rbx, rax
test rax, rax
je 0x1800015b7
xor edx, edx
mov qword [0x180015198], rax
mov r8d, 0x30450
mov rcx, rax
call sub.msvcrt.dll_memset
mov qword [rbx + 0x303b8], rbx
lea rax, [0x180006f80]
mov qword [rbx + 0x303b0], rax
xorps xmm0, xmm0
mov dword [rbx + 0x28], r15d
mov qword [rbx + 0x303a8], r15
mov qword [rbx + 8], r13
movups xmmword [rbx + 0x2c], xmm0
movups xmmword [rbx + 0x3c], xmm0
mov dword [rbx + 0x30410], 0x3a98
movzx eax, byte [rbx + 0x303ce]
cmp byte [rbx + 0x303c0], r15b
jne 0x1800015a8
or al, 8
or al, 0x60
mov qword [rbx + 0x30414], r15
mov byte [rbx + 0x303ce], al
mov rbx, qword [rsp + 0x560]
mov r15, qword [rsp + 0x510]
add rsp, 0x538
pop r13
pop rbp
ret