Function at 0x180004170
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x58
cmp byte [0x180055ac0], 0
jne 0x180004484
mov qword [rsp + 0x60], rbx
mov eax, 0x5a4d
mov qword [rsp + 0x68], rbp
lea rbx, [0x180002950]
mov qword [rsp + 0x70], rsi
and rbx, 0xffffffffffff0000
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r14
mov byte [0x180055ac0], 1
cmp word [rbx], ax
je 0x1800041cc
nop
sub rbx, 0x1000
cmp word [rbx], ax
jne 0x1800041c0
mov rax, qword gs:[0x30]
movabs rsi, 0x4e00520045004b
movabs rdi, 0x6e00720065006b
mov rcx, qword [rax + 0x60]
mov r8, qword [rcx + 0x18]
mov rcx, qword [r8 + 0x20]
add r8, 0x20
cmp rcx, r8
je 0x180004228
nop
cmp word [rcx + 0x48], 0x18
jne 0x180004220
mov rax, qword [rcx + 0x50]
mov rdx, qword [rax]
cmp rdx, rsi
je 0x1800043c6
cmp rdx, rdi
je 0x1800043c6
mov rcx, qword [rcx]
cmp rcx, r8
jne 0x180004200
xor ecx, ecx
lea rdx, str.LoadLibraryA
call fcn.180002890
mov rcx, qword gs:[0x30]
mov rbp, rax
mov qword [rsp + 0x78], rax
mov rdx, qword [rcx + 0x60]
mov r8, qword [rdx + 0x18]
mov rdx, qword [r8 + 0x20]
add r8, 0x20
cmp rdx, r8
je 0x180004288
nop dword [rax]
cmp word [rdx + 0x48], 0x18
jne 0x180004280
mov rcx, qword [rdx + 0x50]
mov rax, qword [rcx]
cmp rax, rsi
je 0x1800043cf
cmp rax, rdi
je 0x1800043cf
mov rdx, qword [rdx]
cmp rdx, r8
jne 0x180004260
xor ecx, ecx
lea rdx, [0x18004e6c8]
mov qword [rsp + 0x30], r15
call fcn.180002890
movsxd rdi, dword [rbx + 0x3c]
mov r13, rax
add rdi, rbx
mov qword [rsp + 0x20], rdi
mov ecx, dword [rdi + 0xb0]
test ecx, ecx
je 0x180004366
cmp dword [rdi + 0xb4], 0
jbe 0x180004366
mov r8d, dword [rbx + rcx + 4]
lea r9, [rbx + rcx]
mov ecx, dword [rbx + rcx]
mov r11, rbx
sub r11, qword [rdi + 0x30]
add ecx, r8d
je 0x180004366
mov esi, 0xa000
mov r14d, 0xf000
mov r15d, 0x3000
nop dword [rax]
nop word [rax + rax]
mov eax, r8d
xor edx, edx
sub rax, 8
shr rax, 1
movsxd r10, eax
test eax, eax
jle 0x180004353
nop dword [rax]
nop word [rax + rax]
movzx r8d, word [r9 + rdx*2 + 8]
movzx eax, r8w
and ax, r14w
cmp ax, r15w
je 0x180004339
cmp ax, si
jne 0x18000434b
mov ecx, dword [r9]
and r8d, 0xfff
lea rax, [rbx + r8]
add qword [rcx + rax], r11
inc rdx
cmp rdx, r10
jl 0x180004320
mov eax, dword [r9 + 4]
add r9, rax
mov ecx, dword [r9]
mov r8d, dword [r9 + 4]
add ecx, r8d
jne 0x180004300
mov r14d, dword [rdi + 0x90]
add r14, rbx
mov qword [rsp + 0x48], r12
mov eax, dword [r14]
test eax, eax
je 0x18000443e
mov ecx, dword [r14 + 0xc]
lea rsi, [rbx + rax]
mov r15d, dword [r14 + 0x10]
add rcx, rbx
add r15, rbx
mov r12, rsi
call rbp
mov rbp, rax
test rax, rax
je 0x180004455
xor edi, edi
cmp qword [rsi], rdi
je 0x180004406
mov rcx, r12
xor esi, esi
nop
mov rax, qword [rcx]
test rax, rax
jns 0x1800043d8
test ax, ax
je 0x180004455
mov rdx, rax
jmp 0x1800043e1
mov rcx, qword [rcx + 0x20]
jmp 0x18000422a
mov rcx, qword [rdx + 0x20]
jmp 0x18000428a
lea rdx, [rbx + 2]
add rdx, rax
je 0x180004455
mov rcx, rbp
call r13
test rax, rax
je 0x180004455
inc rdi
mov qword [rsi + r15], rax
lea rsi, [rdi*8]
cmp qword [rsi + r12], 0
lea rcx, [rsi + r12]
jne 0x1800043b0
mov eax, dword [r14 + 0x14]
add r14, 0x14
test eax, eax
je 0x180004439
mov ecx, dword [r14 + 0xc]
lea rsi, [rbx + rax]
mov r15d, dword [r14 + 0x10]
add rcx, rbx
add r15, rbx
mov r12, rsi
call qword [rsp + 0x78]
mov rbp, rax
test rax, rax
jne 0x1800043a3
jmp 0x180004455
mov rdi, qword [rsp + 0x20]
mov eax, dword [rdi + 0x28]
mov r8, rbx
add rax, rbx
mov qword [rdi + 0x30], rbx
mov edx, 1
mov rcx, rbx
call rax
mov r12, qword [rsp + 0x48]
xor eax, eax
mov r15, qword [rsp + 0x30]
mov r13, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov r14, qword [rsp + 0x38]
add rsp, 0x58
ret
xor eax, eax
add rsp, 0x58
ret