Function at 0x1800541b0
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
jmp 0x1800541b0
jmp 0x180060220
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
xor r13d, r13d
mov r15d, 0xffe0
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rbp, qword [rax + 0x10]
mov r14, rbp
nop word [rax + rax]
movzx esi, word [r14 + 0x58]
movzx edi, si
shr di, 1
cmp di, 9
jbe 0x180054209
mov r11d, esi
shr r11d, 1
jmp 0x18005420f
mov r11d, 9
mov r10, qword [r14 + 0x60]
lea rbx, str.ntdll.dll
mov r8, r10
sub rbx, r10
mov r9d, r13d
cmp r9d, r11d
jge 0x1800542f3
movzx edx, word [r8]
movzx ecx, word [rbx + r8]
cmp r13w, dx
je 0x180054269
cmp r13w, cx
je 0x180054273
lea eax, [rdx - 0x61]
cmp ax, 0x19
ja 0x18005424e
add dx, r15w
lea eax, [rcx - 0x61]
cmp ax, 0x19
ja 0x18005425b
add cx, r15w
cmp dx, cx
jne 0x180054273
add r8, 2
inc r9d
jmp 0x180054223
cmp r13w, cx
je 0x1800542f3
cmp di, 5
jbe 0x180054281
mov r9d, esi
shr r9d, 1
jmp 0x180054287
mov r9d, 5
lea r11, str.ntdll
mov r8d, r13d
sub r11, r10
cmp r8d, r9d
jge 0x1800542f3
movzx edx, word [r10]
movzx ecx, word [r11 + r10]
cmp r13w, dx
je 0x1800542d6
cmp r13w, cx
je 0x1800542dc
lea eax, [rdx - 0x61]
cmp ax, 0x19
ja 0x1800542bb
add dx, r15w
lea eax, [rcx - 0x61]
cmp ax, 0x19
ja 0x1800542c8
add cx, r15w
cmp dx, cx
jne 0x1800542dc
add r10, 2
inc r8d
jmp 0x180054294
cmp r13w, cx
je 0x1800542f3
mov r14, qword [r14]
cmp qword [r14], rbp
jne 0x1800541f0
mov r14, r13
mov r10, r13
jmp 0x18005447c
mov rcx, qword [r14 + 0x30]
mov r14, r13
mov rsi, rcx
test rcx, rcx
je 0x1800543be
movsxd rax, dword [rcx + 0x3c]
mov ebx, dword [rax + rcx + 0x88]
add rbx, rcx
mov eax, dword [rbx + 0x18]
test eax, eax
je 0x1800543be
mov r10d, dword [rbx + 0x20]
lea rbp, str.LdrLoadDll
add r10, rcx
mov r11, r13
mov edi, eax
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [r10]
add r8, rsi
cmp r8, 0x10000
jb 0x180054392
cmp rbp, 0x10000
jb 0x180054392
mov r9, rbp
sub r9, r8
nop
movzx edx, byte [r8]
movzx ecx, byte [r9 + r8]
test dl, dl
je 0x18005438e
test cl, cl
je 0x1800543ae
lea eax, [rdx - 0x61]
cmp al, 0x19
ja 0x18005437b
add dl, 0xe0
lea eax, [rcx - 0x61]
cmp al, 0x19
ja 0x180054385
add cl, 0xe0
cmp dl, cl
jne 0x1800543ae
inc r8
jmp 0x180054360
test cl, cl
jmp 0x180054395
cmp r8, rbp
jne 0x1800543ae
mov eax, dword [rbx + 0x24]
mov ecx, dword [rbx + 0x1c]
add rax, r11
add rcx, rsi
movzx edx, word [rax + rsi]
mov r14d, dword [rcx + rdx*4]
add r14, rsi
add r10, 4
add r11, 2
sub rdi, 1
jne 0x180054340
jmp 0x1800543ca
mov r10, r13
test rsi, rsi
je 0x18005447c
movsxd rax, dword [rsi + 0x3c]
mov r10, r13
mov edi, dword [rax + rsi + 0x88]
add rdi, rsi
mov eax, dword [rdi + 0x18]
test eax, eax
je 0x18005447c
mov r11d, dword [rdi + 0x20]
lea r15, str.RtlInitUnicodeString
add r11, rsi
mov rbx, r13
mov ebp, eax
nop dword [rax]
mov r8d, dword [r11]
add r8, rsi
cmp r8, 0x10000
jb 0x180054452
cmp r15, 0x10000
jb 0x180054452
mov r9, r15
sub r9, r8
nop
movzx edx, byte [r8]
movzx ecx, byte [r9 + r8]
test dl, dl
je 0x18005444e
test cl, cl
je 0x18005446e
lea eax, [rdx - 0x61]
cmp al, 0x19
ja 0x18005443b
add dl, 0xe0
lea eax, [rcx - 0x61]
cmp al, 0x19
ja 0x180054445
add cl, 0xe0
cmp dl, cl
jne 0x18005446e
inc r8
jmp 0x180054420
test cl, cl
jmp 0x180054455
cmp r8, r15
jne 0x18005446e
mov eax, dword [rdi + 0x24]
mov ecx, dword [rdi + 0x1c]
add rax, rbx
add rcx, rsi
movzx edx, word [rax + rsi]
mov r10d, dword [rcx + rdx*4]
add r10, rsi
add r11, 4
add rbx, 2
sub rbp, 1
jne 0x180054400
lea rdx, str.kernel32.dll
lea rcx, [rsp + 0x20]
call r10
lea r9, [rsp + 0x78]
xor edx, edx
lea r8, [rsp + 0x20]
xor ecx, ecx
call r14
mov rsi, qword [rsp + 0x78]
mov r12, r13
test rsi, rsi
je 0x18005455c
movsxd rax, dword [rsi + 0x3c]
mov ebx, dword [rax + rsi + 0x88]
add rbx, rsi
mov eax, dword [rbx + 0x18]
test eax, eax
je 0x18005455c
mov r10d, dword [rbx + 0x20]
lea rbp, str.LoadLibraryA
add r10, rsi
mov r11, r13
mov edi, eax
nop dword [rax]
mov r8d, dword [r10]
add r8, rsi
cmp r8, 0x10000
jb 0x180054532
cmp rbp, 0x10000
jb 0x180054532
mov r9, rbp
sub r9, r8
nop
movzx edx, byte [r8]
movzx ecx, byte [r9 + r8]
test dl, dl
je 0x18005452e
test cl, cl
je 0x18005454e
lea eax, [rdx - 0x61]
cmp al, 0x19
ja 0x18005451b
add dl, 0xe0
lea eax, [rcx - 0x61]
cmp al, 0x19
ja 0x180054525
add cl, 0xe0
cmp dl, cl
jne 0x18005454e
inc r8
jmp 0x180054500
test cl, cl
jmp 0x180054535
cmp r8, rbp
jne 0x18005454e
mov eax, dword [rbx + 0x24]
mov ecx, dword [rbx + 0x1c]
add rax, r11
add rcx, rsi
movzx edx, word [rax + rsi]
mov r12d, dword [rcx + rdx*4]
add r12, rsi
add r10, 4
add r11, 2
sub rdi, 1
jne 0x1800544e0
mov r15, r13
test rsi, rsi
je 0x1800546cc
movsxd rax, dword [rsi + 0x3c]
mov ebx, dword [rax + rsi + 0x88]
add rbx, rsi
mov eax, dword [rbx + 0x18]
test eax, eax
je 0x18005461c
mov r10d, dword [rbx + 0x20]
lea rbp, str.LoadLibraryW
add r10, rsi
mov r11, r13
mov edi, eax
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [r10]
add r8, rsi
cmp r8, 0x10000
jb 0x1800545f2
cmp rbp, 0x10000
jb 0x1800545f2
mov r9, rbp
sub r9, r8
nop
movzx edx, byte [r8]
movzx ecx, byte [r9 + r8]
test dl, dl
je 0x1800545ee
test cl, cl
je 0x18005460e
lea eax, [rdx - 0x61]
cmp al, 0x19
ja 0x1800545db
add dl, 0xe0
lea eax, [rcx - 0x61]
cmp al, 0x19
ja 0x1800545e5
add cl, 0xe0
cmp dl, cl
jne 0x18005460e
inc r8
jmp 0x1800545c0
test cl, cl
jmp 0x1800545f5
cmp r8, rbp
jne 0x18005460e
mov eax, dword [rbx + 0x24]
mov ecx, dword [rbx + 0x1c]
add rax, r11
add rcx, rsi
movzx edx, word [rax + rsi]
mov r15d, dword [rcx + rdx*4]
add r15, rsi
add r10, 4
add r11, 2
sub rdi, 1
jne 0x1800545a0
test rsi, rsi
je 0x1800546cc
movsxd rax, dword [rsi + 0x3c]
mov ebx, dword [rax + rsi + 0x88]
add rbx, rsi
mov eax, dword [rbx + 0x18]
test eax, eax
je 0x1800546cc
mov r10d, dword [rbx + 0x20]
lea rbp, str.GetProcAddress
add r10, rsi
mov r11, r13
mov edi, eax
mov r8d, dword [r10]
add r8, rsi
cmp r8, 0x10000
jb 0x1800546a2
cmp rbp, 0x10000
jb 0x1800546a2
mov r9, rbp
sub r9, r8
nop
movzx edx, byte [r8]
movzx ecx, byte [r8 + r9]
test dl, dl
je 0x18005469e
test cl, cl
je 0x1800546be
lea eax, [rdx - 0x61]
cmp al, 0x19
ja 0x18005468b
add dl, 0xe0
lea eax, [rcx - 0x61]
cmp al, 0x19
ja 0x180054695
add cl, 0xe0
cmp dl, cl
jne 0x1800546be
inc r8
jmp 0x180054670
test cl, cl
jmp 0x1800546a5
cmp r8, rbp
jne 0x1800546be
mov eax, dword [rbx + 0x24]
mov ecx, dword [rbx + 0x1c]
add rax, r11
add rcx, rsi
movzx edx, word [rax + rsi]
mov r13d, dword [rcx + rdx*4]
add r13, rsi
add r10, 4
add r11, 2
sub rdi, 1
jne 0x180054651
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rbx + 0x20]
movsxd rax, dword [rbp + 0x3c]
mov ecx, dword [rax + rbp + 0x90]
test ecx, ecx
je 0x180054750
mov eax, dword [rcx + rbp + 0xc]
lea r14, [rcx + rbp]
test eax, eax
je 0x180054750
mov ecx, eax
add rcx, rbp
call r12
mov ecx, dword [r14]
mov rsi, rax
mov edx, dword [r14 + 0x10]
test ecx, ecx
lea rdi, [rdx + rbp]
cmovne edx, ecx
mov rcx, qword [rdx + rbp]
lea rbx, [rdx + rbp]
test rcx, rcx
je 0x18005473f
jns 0x18005471f
movzx edx, cx
jmp 0x180054726
lea rdx, [rbp + 2]
add rdx, rcx
mov rcx, rsi
call r13
add rbx, 8
mov qword [rdi], rax
add rdi, 8
mov rcx, qword [rbx]
test rcx, rcx
jne 0x180054718
mov eax, dword [r14 + 0x20]
add r14, 0x14
test eax, eax
jne 0x1800546f0
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rbx + 0x68]
test rcx, rcx
je 0x180054779
call r15
lea rdx, [0x180169f28]
mov qword [rbx + 0x60], rax
mov rcx, rax
call r13
test rax, rax
je 0x180054786
mov rcx, rbx
call rax
jmp 0x180054786
mov rcx, rbx
call sym.deleakersdk64.dll_DeleakerSDK_RemoteAgent_Init
mov eax, 1
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
jmp 0x18000255e