Function at 0x180006390
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x20
mov qword [rsp + 0x30], 0xffffffffffffd8f0
mov ebx, 1
xor eax, eax
lock cmpxchg dword [0x18002c88c], ebx
jne 0x18000f470
cmp byte [0x18002c880], 0
mov qword [rsp + 0x38], rdi
je 0x1800063e0
lock dec dword [0x18002c88c]
movzx eax, byte [0x18002c880]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
lea r8d, [rdx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
xor ebx, ebx
test rax, rax
je 0x18000f4d0
mov rcx, qword [0x18002c868]
lea rdi, sym.ulib.dll_const_DSTRING::vftable
mov qword [rax], rdi
lea r8d, [rbx + 0x30]
mov qword [rax + 8], rcx
xor edx, edx
mov qword [rax + 0x10], rbx
mov dword [rax + 0x18], ebx
mov qword [rax + 0x20], rbx
mov dword [rax + 0x28], ebx
mov qword [0x18002c7d0], rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
test rax, rax
je 0x18000f4c4
mov rcx, qword [0x18002c868]
lea r8d, [rbx + 0x30]
mov qword [rax + 8], rcx
xor edx, edx
mov qword [rax + 0x10], rbx
mov dword [rax + 0x18], ebx
mov qword [rax], rdi
mov qword [rax + 0x20], rbx
mov dword [rax + 0x28], ebx
mov qword [0x18002c7a8], rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
test rax, rax
je 0x18000f4b8
mov rcx, qword [0x18002c868]
lea r8d, [rbx + 0x30]
mov qword [rax + 8], rcx
xor edx, edx
mov qword [rax + 0x10], rbx
mov dword [rax + 0x18], ebx
mov qword [rax], rdi
mov qword [rax + 0x20], rbx
mov dword [rax + 0x28], ebx
mov qword [0x18002c7b0], rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
test rax, rax
je 0x18000f4ac
mov rcx, qword [0x18002c868]
lea r8d, [rbx + 0x30]
mov qword [rax + 8], rcx
xor edx, edx
mov qword [rax + 0x10], rbx
mov dword [rax + 0x18], ebx
mov qword [rax], rdi
mov qword [rax + 0x20], rbx
mov dword [rax + 0x28], ebx
mov qword [0x18002c7b8], rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
test rax, rax
je 0x18000f4a0
mov rcx, qword [0x18002c868]
lea r8d, [rbx + 0x30]
mov qword [rax + 8], rcx
xor edx, edx
mov qword [rax + 0x10], rbx
mov dword [rax + 0x18], ebx
mov qword [rax], rdi
mov qword [rax + 0x20], rbx
mov dword [rax + 0x28], ebx
mov qword [0x18002c7c0], rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
test rax, rax
je 0x18000f494
mov rcx, qword [0x18002c868]
lea rdx, [0x180022170]
mov qword [rax + 8], rcx
mov r8d, 0xffffffff
mov rcx, qword [0x18002c7d0]
mov qword [rax + 0x10], rbx
mov dword [rax + 0x18], ebx
mov qword [rax], rdi
mov qword [rax + 0x20], rbx
mov dword [rax + 0x28], ebx
mov qword [0x18002c7c8], rax
call sym.ulib.dll_public:_unsigned_char___cdecl_WSTRING::Initialize_char_const____ptr64__unsigned_long_int____ptr64
test al, al
je 0x1800063c6
mov rcx, qword [0x18002c7a8]
lea rdx, [0x180022184]
mov r8d, 0xffffffff
call sym.ulib.dll_public:_unsigned_char___cdecl_WSTRING::Initialize_char_const____ptr64__unsigned_long_int____ptr64
test al, al
je 0x1800063c6
mov rcx, qword [0x18002c7b0]
lea rdx, [0x180022180]
mov r8d, 0xffffffff
call sym.ulib.dll_public:_unsigned_char___cdecl_WSTRING::Initialize_char_const____ptr64__unsigned_long_int____ptr64
test al, al
je 0x1800063c6
mov rcx, qword [0x18002c7b8]
lea rdx, [0x18002217c]
mov r8d, 0xffffffff
call sym.ulib.dll_public:_unsigned_char___cdecl_WSTRING::Initialize_char_const____ptr64__unsigned_long_int____ptr64
test al, al
je 0x1800063c6
mov rcx, qword [0x18002c7c0]
lea rdx, [0x180022178]
mov r8d, 0xffffffff
call sym.ulib.dll_public:_unsigned_char___cdecl_WSTRING::Initialize_char_const____ptr64__unsigned_long_int____ptr64
test al, al
je 0x1800063c6
mov rcx, qword [0x18002c7c8]
lea rdx, [0x180022174]
mov r8d, 0xffffffff
call sym.ulib.dll_public:_unsigned_char___cdecl_WSTRING::Initialize_char_const____ptr64__unsigned_long_int____ptr64
test al, al
je 0x1800063c6
lock dec dword [0x18002c88c]
mov al, 1
mov rdi, qword [rsp + 0x38]
mov byte [0x18002c880], 1
add rsp, 0x20
pop rbx
ret
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_NtDelayExecution]
nop dword [rax + rax]
xor eax, eax
lock cmpxchg dword [0x18002c88c], ebx
jne 0x18000f470
jmp 0x1800063b8
mov qword [0x18002c7c8], rbx
jmp 0x1800063c6
mov qword [0x18002c7c0], rbx
jmp 0x1800063c6
mov qword [0x18002c7b8], rbx
jmp 0x1800063c6
mov qword [0x18002c7b0], rbx
jmp 0x1800063c6
mov qword [0x18002c7a8], rbx
jmp 0x1800063c6
mov qword [0x18002c7d0], rbx
jmp 0x1800063c6