Function at 0x18001d900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x180043040]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov r8, rcx
mov qword [rsp + 0x38], rcx
mov r12, rdx
mov r9d, 0xc0000225
mov dword [rsp + 0x68], 0x1e001c
lea rax, [0x18003d510]
mov qword [r11 - 0x58], rax
mov dword [rsp + 0x78], 0x140012
lea rax, [0x18003d530]
mov qword [r11 - 0x48], rax
test rdx, rdx
je 0x18001dbe9
test rcx, rcx
je 0x18001dbe9
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx + 0x84], 2
ja 0x18001d994
mov eax, r9d
jmp 0x18001dbf6
mov edx, dword [rax + r8 + 0x98]
add rdx, r8
mov qword [rsp + 0x30], rdx
cmp dword [rax + r8 + 0x9c], 0
jne 0x18001d9b7
mov eax, r9d
jmp 0x18001dbf6
movzx ecx, word [rdx + 0xe]
movzx eax, word [rdx + 0xc]
add ecx, eax
mov eax, ecx
inc rax
lea rax, [rdx + rax*8]
mov r15, 0xffffffffffffffff
mov dword [rsp + 0x24], ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
test ecx, ecx
je 0x18001dbe1
cmp word [rax], 0x10
jne 0x18001dbd6
mov eax, dword [rax + 4]
btr eax, 0x1f
mov ecx, dword [rax + rdx + 0x14]
btr ecx, 0x1f
mov eax, dword [rcx + rdx + 0x14]
mov ecx, dword [rax + rdx]
add rcx, r8
mov rax, r15
nop dword [rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2 + 6], 0
jne 0x18001da10
lea rax, [rax*2 + 0xb]
and rax, 0xfffffffffffffffc
movzx r13d, word [rcx + 2]
add r13, 3
and r13, 0xfffffffffffffffc
add rax, rcx
add r13, rax
movzx eax, word [rcx]
add rax, rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], r13
cmp r13, rax
jae 0x18001dbc3
cmp word [r13], 8
jb 0x18001dbc3
lea rdx, [r13 + 6]
lea rcx, [rsp + 0x88]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov r8b, 1
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntdll.dll_RtlEqualUnicodeString]
test al, al
je 0x18001dba9
mov rax, r15
lea rax, [rax + 1]
cmp word [r13 + rax*2 + 6], 0
jne 0x18001da93
lea rax, [rax*2 + 0xb]
and rax, 0xfffffffffffffffc
movzx edi, word [r13 + 2]
add rdi, 3
and rdi, 0xfffffffffffffffc
add rax, r13
add rdi, rax
movzx eax, word [r13]
add rax, r13
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rdi
cmp rdi, rax
jae 0x18001dba9
movzx ecx, word [rdi]
cmp ecx, 8
jb 0x18001dba9
mov rax, r15
nop dword [rax]
lea rax, [rax + 1]
cmp word [rdi + rax*2 + 6], 0
jne 0x18001daf0
lea rax, [rax*2 + 0xb]
and rax, 0xfffffffffffffffc
movzx ebx, word [rdi + 2]
add rbx, 3
and rbx, 0xfffffffffffffffc
add rax, rdi
lea r14, [rdi + rcx]
add rbx, rax
mov qword [rsp + 0x40], rbx
cmp rbx, r14
jae 0x18001db91
cmp word [rbx], 8
jb 0x18001db91
lea rdx, [rbx + 6]
lea rcx, [rsp + 0x88]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov r8b, 1
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntdll.dll_RtlEqualUnicodeString]
test al, al
je 0x18001db84
nop word [rax + rax]
lea r15, [r15 + 1]
cmp word [rbx + r15*2 + 6], 0
jne 0x18001db60
lea rax, [r15*2 + 0xb]
and rax, 0xfffffffffffffffc
add rax, rbx
mov qword [r12], rax
xor eax, eax
jmp 0x18001dbf6
movzx eax, word [rbx]
add rax, 3
and rax, 0xfffffffffffffffc
jmp 0x18001db1b
movzx eax, word [rdi]
add rax, 3
and rax, 0xfffffffffffffffc
add rdi, rax
mov rax, qword [rsp + 0x50]
jmp 0x18001dacc
movzx eax, word [r13]
add rax, 3
and rax, 0xfffffffffffffffc
add r13, rax
mov rax, qword [rsp + 0x60]
jmp 0x18001da46
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x20]
dec ecx
sub rax, 8
jmp 0x18001d9d1
mov r9d, 0xc0000225
jmp 0x18001dbf3
mov eax, 0xc000000d
jmp 0x18001dbf6
mov eax, r9d
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.18001e5f0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret