Function at 0x18002a7c8
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, rdx
mov rbx, rcx
mov rdx, qword [rdx]
call fcn.18002acd0
lea r8, [rbx + 0xf0]
mov rbp, rax
cmp rax, r8
je 0x18002aa29
cmp dword [0x18015d450], 1
jge 0x1800ad17e
lea rdi, [rbp - 0x10]
mov al, byte [rdi + 0xe]
test al, al
jne 0x18002a9da
mov rsi, rbx
mov rax, qword [rbp + 0x20]
mov qword [rsp + 0x50], rax
mov rax, qword [rbx + 0x168]
xor rax, qword [0x18015d758]
jne 0x18002aa6f
mov r8, qword [rbp + 0x28]
mov rdx, qword [r14]
mov rcx, r8
mov rax, qword [rbx + 0xb0]
sub rcx, rdx
shl rax, 4
cmp rcx, rax
jbe 0x18002aa2d
lea rax, [rdx + 0xfff]
mov rcx, rbx
and rax, 0xfffffffffffff000
mov edx, 1
mov qword [r14], rax
call fcn.18002ae30
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0x50]
mov r9, r14
mov dword [rsp + 0x20], 0x1000
xor r8d, r8d
or rcx, 0xffffffffffffffff
call sym.ntdll.dll_NtAllocateVirtualMemory
inc dword [rbx + 0x250]
test eax, eax
js 0x1800ad1e6
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
mov r15d, 0x7ffe0380
test eax, eax
jne 0x1800ad1f1
mov ecx, r15d
cmp byte [rcx], 0
jne 0x1800ad20d
cmp dword [rbx + 0x7c], 0
je 0x18002a8f3
mov edx, dword [rbx + 0x88]
xor edx, dword [rdi + 8]
mov ecx, edx
mov dword [rdi + 8], edx
shr ecx, 0x10
mov eax, edx
shr eax, 8
xor cl, al
xor cl, dl
shr edx, 0x18
cmp dl, cl
jne 0x1800ad23f
mov rdx, rbp
mov byte [rdi + 0xa], 0
mov rcx, rbx
mov byte [rdi + 0xf], 0
call fcn.18002ad5c
or ecx, 0xffffffff
add dword [rsi + 0x54], ecx
mov rax, qword [rbp + 0x28]
shr rax, 0xc
sub dword [rsi + 0x50], eax
mov rax, qword [rbp + 0x28]
add qword [rbx + 0x220], rax
inc dword [rbx + 0x240]
add dword [rbx + 0x23c], ecx
mov r9, qword [rbp + 0x28]
cmp r9, 0xff000
jae 0x18002aa19
mov rdx, qword [r14]
cmp r9, rdx
jbe 0x18002aa4b
lea r8, [rdx - 0x30]
mov qword [rsp + 0x28], r14
add r8, qword [rbp + 0x20]
sub r9, rdx
mov rdx, rsi
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call fcn.18002aa88
shl qword [r14], 4
mov byte [rdi + 0xb], 0
mov rdx, qword [rsi + 0x28]
cmp rdx, rsi
jne 0x18002a9fa
xor bpl, bpl
mov byte [rdi + 0xe], bpl
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
jne 0x1800ad272
mov rcx, r15
cmp byte [rcx], 0
jne 0x1800ad28e
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
mov esi, 0x7ffe038a
mov ebp, 0x230
test eax, eax
jne 0x1800ad2ec
mov ecx, esi
cmp byte [rcx], 0
jne 0x1800ad304
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
movzx eax, al
mov rsi, rdi
shl rax, 0x10
and rsi, 0xffffffffffff0000
sub rsi, rax
add rsi, 0x10000
jmp 0x18002a820
mov rbp, rdi
sub rbp, rsi
shr rbp, 0x10
inc rbp
cmp rbp, 0xfe
jb 0x18002a97f
jmp 0x1800ad250
sub qword [rbx + 0x228], r9
mov r9, qword [rbp + 0x28]
jmp 0x18002a93f
xor eax, eax
jmp 0x18002a9c1
mov eax, dword [rbx + 0x94]
shl rax, 4
cmp r8, rax
jae 0x18002a85e
mov qword [r14], r8
mov rdx, r8
jmp 0x18002a85e
mov rcx, qword [rbp + 0x20]
add rcx, r9
cmp rcx, qword [rsi + 0x48]
je 0x18002a94b
movzx eax, word [rdi + 8]
shl rax, 4
add rax, rdx
mov qword [r14], rax
jmp 0x18002a96f
mov r8, r14
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [section..00cfg]
jmp 0x18002a8a1
mov rcx, qword [r14]
cmp qword [rax + 0x28], rcx
jae 0x18002a80e
mov rax, qword gs:[0x60]
cmp qword [rax + 0x18], 0
je 0x1800ad1be
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
lea rcx, str.HEAP__wZ_:
add rdx, 0x58
call sym.ntdll.dll_DbgPrint
jmp 0x1800ad1ca
lea rcx, str.HEAP:
call sym.ntdll.dll_DbgPrint
lea rcx, str._UCRBlock__Size___Size_
call sym.ntdll.dll_DbgPrint
mov ecx, 1
call fcn.1800fc294
nop
jmp 0x18002a80e
inc dword [rbx + 0x258]
jmp 0x18002aa29
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x226
jmp 0x18002a8bf
mov rax, qword gs:[0x60]
test byte [rax + 0x378], 1
je 0x18002a8c8
mov r8, qword [r14]
mov r9d, 2
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.1800fdf54
nop
jmp 0x18002a8c8
mov rdx, rdi
mov rcx, rbx
call fcn.1800fbec0
nop
jmp 0x18002a8f3
and qword [rsp + 0x28], 0
mov r9, rsi
and qword [rsp + 0x20], 0
mov r8, rdi
mov ecx, 3
call fcn.18009a4c0
nop
jmp 0x18002a97f
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x226
jmp 0x18002a993
mov rax, qword gs:[0x60]
test byte [rax + 0x378], 1
je 0x18002a99c
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x1800ad2c4
mov rax, qword gs:[0x60]
mov r15, qword [rax + 0x90]
add r15, 0x226
mov r9, qword [rbx + 0xc0]
mov rdx, rdi
movzx eax, byte [r15]
mov rcx, rbx
mov r8, qword [r14]
shl r9, 4
mov qword [rsp + 0x20], rax
call fcn.1800fe1c8
nop
jmp 0x18002a99c
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, rbp
jmp 0x18002a9b5
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x1800ad320
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x90]
add rsi, rbp
movzx ecx, byte [rsi]
mov rdx, rdi
mov r9, qword [rbx + 0xc0]
mov r8, qword [r14]
mov qword [rsp + 0x20], rcx
mov rcx, rbx
shl r9, 4
call fcn.1800fe1c8
nop
jmp 0x18002a9be