Function at 0x180017c00
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rbx, qword [rcx + 0x10]
call fcn.1800175e0
test al, al
je 0x180017dac
lea rax, str.Found_TNameEntryArray_GNames_at_offset_0x:X_n
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 0x30
mov eax, dword [0x18009a7c8]
mov dword [rbp - 0x48], eax
movabs rax, 0x1000000000000000
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x40], 1
lea rax, [rbp - 0x50]
mov qword [rbp - 0x38], rax
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm0
movaps xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x30], xmm1
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x20]
call fcn.180016b90
nop
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
call fcn.18001d8f0
mov rcx, rax
call fcn.18001bc40
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x180017cf7
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180017cf2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180017ffc
call fcn.18002f350
movsxd rax, dword [0x18009a7c8]
mov rsi, qword [rax + rbx]
mov byte [0x18009a7cc], 0
xor ebx, ebx
mov edi, ebx
test rsi, rsi
je 0x180017d63
mov rcx, rsi
call fcn.180014d40
test al, al
jne 0x180017d63
mov r8d, ebx
mov ecx, ebx
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rcx + rsi]
mov rdx, rax
shr rdx, 0x20
test rax, rax
jne 0x180017d44
inc edi
jmp 0x180017d52
test edi, edi
jne 0x180017d4c
inc ebx
jmp 0x180017d52
jle 0x180017d52
cmp edx, ebx
je 0x180017d6f
add r8d, 8
add rcx, 8
cmp rcx, 0x800
jl 0x180017d30
lea rdx, str.The_address_that_was_found_couldnt_be_used_by_the_generator__this_might_be_due_to_GNames_encryption._n
jmp 0x180017fc2
mov dword [0x18009aa14], r8d
lea eax, [r8 + 4]
mov dword [0x18009aa10], eax
lea rax, [0x180017410]
mov qword [0x18009a7d8], rax
mov qword [0x18009a5b8], rsi
mov byte [0x18009a7cc], 0
xor edx, edx
xor ecx, ecx
call fcn.180016d90
mov al, 1
jmp 0x180017fd8
call fcn.1800177c0
test al, al
je 0x180017fbb
lea rax, str.Found_FNamePool_GNames_at_offset_0x:X_n
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 0x2a
mov eax, dword [0x18009a7c8]
mov dword [rbp - 0x28], eax
movabs rax, 0x1000000000000000
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x40], 1
lea rax, [rbp - 0x30]
mov qword [rbp - 0x38], rax
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm0
movaps xmm1, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x50], xmm1
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.180016b90
nop
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
call fcn.18001d8f0
mov rcx, rax
call fcn.18001bc40
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x180017e72
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180017e6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180017ff6
call fcn.18002f350
movsxd r15, dword [0x18009a7c8]
add r15, rbx
mov byte [0x18009a7cc], 1
xor ebx, ebx
mov dword [0x18009aa10], ebx
mov r12d, 4
mov dword [0x18009aa1c], r12d
mov r11d, 0x10
mov dword [0x18009aa18], r11d
mov edi, ebx
mov rsi, r15
nop word [rax + rax]
mov r14d, dword [rsi]
lea eax, [r14 - 1]
cmp eax, 0xffff
ja 0x180017f19
mov r9d, ebx
xor r10b, r10b
mov edx, ebx
mov eax, edi
and eax, 0x80000007
jge 0x180017ed6
dec eax
or eax, 0xfffffff8
inc eax
lea ecx, [rax + rdi]
movsxd rax, ecx
lea r8, [r15 + 8]
add r8, rax
add ecx, 8
cmp qword [r8], rbx
je 0x180017efa
inc r9d
test r10b, r10b
jne 0x180017efa
mov r10b, 1
lea r11d, [rdx + rcx]
add edx, 8
add r8, 8
cmp edx, 0x10000
jl 0x180017ee6
mov dword [0x18009aa18], r11d
lea eax, [r9 - 1]
cmp r14d, eax
je 0x180017f2a
add edi, r12d
add rsi, r12
cmp edi, 0x20
jge 0x180017d63
jmp 0x180017eb0
mov dword [0x18009aa10], edi
lea eax, [rdi + 4]
mov dword [0x18009aa1c], eax
movsxd r8, r11d
add r8, r15
mov ecx, ebx
mov rax, qword [r8]
movabs rdx, 0x6a624f5565726f43
nop
cmp dword [rax], 0x656e6f4e
jne 0x180017f62
test rbx, rbx
jne 0x180017f62
movsxd rbx, ecx
jmp 0x180017f67
cmp qword [rax], rdx
je 0x180017f7d
inc ecx
inc rax
cmp ecx, 0x1000
jl 0x180017f50
lea rdx, str.The_address_that_was_found_couldnt_be_used_by_the_generator__this_might_be_due_to_GNames_encryption._n
jmp 0x180017fc2
mov eax, 2
cmp rbx, rax
cmove r12, rax
mov qword [0x18009a7c0], r12
lea rax, [0x180017480]
mov qword [0x18009a7d8], rax
mov rdx, rbx
mov rcx, r8
call fcn.180016d90
mov qword [0x18009a5b8], r15
mov byte [0x18009a7cc], 1
mov al, 1
jmp 0x180017fd8
lea rdx, str._n_nCould_not_find_GNames__n_n
lea rcx, [0x180098db0]
call fcn.18001b9d0
mov rcx, rax
call fcn.18001bc40
xor al, al
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.18003d010
int3
call fcn.18003d010
int3