Function at 0x18000a770
Capabilities:
Access peb ldr_data
Get ntdll base address
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov rax, qword gs:[0x60]
xor esi, esi
mov rbx, rdx
mov qword [rsp + 0x30], rsi
mov r13d, esi
mov qword [rsp + 0x20], rsi
mov r12d, esi
mov qword [rsp + 0x40], rsi
mov r9, qword [rax + 0x18]
mov ebp, esi
mov r10d, esi
mov qword [rsp + 0x38], rsi
mov r15d, esi
mov r14, qword [r9 + 0x20]
mov qword [rsp + 0x28], r14
test r14, r14
je 0x18000aa33
lea ebx, [rsi + 4]
mov r9d, 0xffff
lea edi, [rsi + 2]
jmp 0x18000a7f2
xor esi, esi
mov rdx, qword [r14 + 0x50]
mov rcx, rsi
movzx r8d, word [r14 + 0x48]
nop
movzx eax, byte [rdx]
ror ecx, 0xd
cmp al, 0x61
jb 0x18000a814
movzx eax, al
sub eax, 0x20
cdqe
jmp 0x18000a817
movzx eax, al
add rcx, rax
inc rdx
add r8w, r9w
jne 0x18000a800
cmp ecx, 0x6a4abc5b
jne 0x18000a920
mov r9, qword [r14 + 0x20]
mov r14d, 0xffff
movsxd rax, dword [r9 + 0x3c]
mov edi, dword [rax + r9 + 0x88]
mov r10d, dword [rdi + r9 + 0x20]
mov r11d, dword [rdi + r9 + 0x24]
add r10, r9
add r11, r9
nop word [rax + rax]
mov ecx, dword [r10]
mov r8d, esi
add rcx, r9
movzx eax, byte [rcx]
nop dword [rax]
ror r8d, 0xd
lea rcx, [rcx + 1]
movsx eax, al
add r8d, eax
movzx eax, byte [rcx]
test al, al
jne 0x18000a870
cmp r8d, 0xec0e4e8e
je 0x18000a8a9
cmp r8d, 0x7c0dfcaa
je 0x18000a8a9
cmp r8d, 0x91afca54
je 0x18000a8a9
cmp r8d, 0x60e0ceef
jne 0x18000a905
mov eax, dword [rdi + r9 + 0x1c]
movzx edx, word [r11]
lea rcx, [r9 + rax]
cmp r8d, 0xec0e4e8e
jne 0x18000a8c8
mov r13d, dword [rcx + rdx*4]
add r13, r9
jmp 0x18000a901
cmp r8d, 0x7c0dfcaa
jne 0x18000a8da
mov r12d, dword [rcx + rdx*4]
add r12, r9
jmp 0x18000a901
cmp r8d, 0x91afca54
jne 0x18000a8eb
mov ebp, dword [rcx + rdx*4]
add rbp, r9
jmp 0x18000a901
cmp r8d, 0x60e0ceef
jne 0x18000a901
mov esi, dword [rcx + rdx*4]
add rsi, r9
mov qword [rsp + 0x20], rsi
xor esi, esi
add bx, r14w
add r10, 4
add r11, 2
test bx, bx
jne 0x18000a860
mov qword [rsp + 0x30], rbp
jmp 0x18000a9e9
cmp ecx, 0x3cfa685d
jne 0x18000aa01
mov r9, qword [r14 + 0x20]
mov ebp, 0xffff
movsxd rax, dword [r9 + 0x3c]
mov esi, dword [rax + r9 + 0x88]
add rsi, r9
mov r11d, dword [rsi + 0x20]
mov ebx, dword [rsi + 0x24]
add r11, r9
mov r10d, dword [rsi + 0x18]
add rbx, r9
test r10d, r10d
je 0x18000a9df
mov ecx, dword [r11]
add rcx, r9
xor r8d, r8d
movzx eax, byte [rcx]
nop word [rax + rax]
ror r8d, 0xd
lea rcx, [rcx + 1]
movsx eax, al
add r8d, eax
movzx eax, byte [rcx]
test al, al
jne 0x18000a970
cmp r8d, 0x534c0ab8
je 0x18000a997
cmp r8d, 0xff7f061a
jne 0x18000a9cb
mov eax, dword [rsi + 0x1c]
movzx edx, word [rbx]
lea rcx, [r9 + rax]
cmp r8d, 0x534c0ab8
jne 0x18000a9b3
mov r15d, dword [rcx + rdx*4]
add r15, r9
jmp 0x18000a9c8
cmp r8d, 0xff7f061a
jne 0x18000a9c8
mov r14d, dword [rcx + rdx*4]
add r14, r9
mov qword [rsp + 0x40], r14
add di, bp
add r11, 4
add rbx, 2
dec r10d
test di, di
jne 0x18000a955
mov rbp, qword [rsp + 0x30]
mov qword [rsp + 0x38], r15
mov r10, qword [rsp + 0x20]
mov edi, 2
mov r14, qword [rsp + 0x28]
mov r9d, 0xffff
lea ebx, [rdi + 2]
test r13, r13
je 0x18000aa1a
test r12, r12
je 0x18000aa1a
test rbp, rbp
je 0x18000aa1a
test r10, r10
je 0x18000aa1a
test r15, r15
jne 0x18000aa2b
mov r14, qword [r14]
mov qword [rsp + 0x28], r14
test r14, r14
jne 0x18000a7f0
mov rbx, qword [rsp + 0xa8]
movsxd r15, dword [rbx + 0x3c]
xor ecx, ecx
add r15, rbx
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
mov edx, dword [r15 + 0x50]
call rbp
mov edx, dword [r15 + 0x54]
mov r14, rax
mov rax, rbx
test rdx, rdx
je 0x18000aa72
mov r8, r14
sub r8, rbx
movzx ecx, byte [rax]
mov byte [r8 + rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x18000aa61
movzx r10d, word [r15 + 6]
movzx eax, word [r15 + 0x14]
test r10, r10
je 0x18000aacb
lea r9, [r15 + 0x2c]
add r9, rax
nop dword [rax + rax]
mov ecx, dword [r9 - 8]
dec r10
mov edx, dword [r9]
add rcx, r14
mov r8d, dword [r9 - 4]
add rdx, rbx
test r8, r8
je 0x18000aac2
nop dword [rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx], al
inc rcx
sub r8, 1
jne 0x18000aab0
add r9, 0x28
test r10, r10
jne 0x18000aa90
mov ebp, dword [r15 + 0x90]
add rbp, r14
mov eax, dword [rbp + 0xc]
test eax, eax
je 0x18000ab6b
mov ecx, eax
add rcx, r14
call r13
mov edi, dword [rbp + 0x10]
mov rsi, rax
mov ebx, dword [rbp]
add rdi, r14
add rbx, r14
cmp qword [rdi], 0
je 0x18000ab5c
nop dword [rax]
test rbx, rbx
je 0x18000ab31
mov rdx, qword [rbx]
test rdx, rdx
jns 0x18000ab31
movsxd rax, dword [rsi + 0x3c]
movzx edx, dx
mov ecx, dword [rax + rsi + 0x88]
mov eax, dword [rcx + rsi + 0x10]
mov ecx, dword [rcx + rsi + 0x1c]
sub rdx, rax
add rcx, rsi
mov eax, dword [rcx + rdx*4]
add rax, rsi
jmp 0x18000ab41
mov rdx, qword [rdi]
mov rcx, rsi
add rdx, 2
add rdx, r14
call r12
mov qword [rdi], rax
add rdi, 8
test rbx, rbx
lea rax, [rbx + 8]
cmove rax, rbx
cmp qword [rdi], 0
mov rbx, rax
jne 0x18000ab00
mov eax, dword [rbp + 0x20]
add rbp, 0x14
test eax, eax
jne 0x18000aae0
mov r8, r14
sub r8, qword [r15 + 0x30]
cmp dword [r15 + 0xb4], 0
je 0x18000ac37
mov r11d, dword [r15 + 0xb0]
add r11, r14
mov eax, dword [r11 + 4]
test eax, eax
je 0x18000ac37
nop word [rax + rax]
mov edx, dword [r11]
lea r10, [r11 + 8]
mov r9d, eax
add rdx, r14
sub r9, 8
shr r9, 1
je 0x18000ac24
nop word [rax + rax]
movzx eax, word [r10]
dec r9
movzx ecx, ax
shr cx, 0xc
cmp cx, 0xa
jne 0x18000abdf
and eax, 0xfff
add qword [rax + rdx], r8
jmp 0x18000ac1b
cmp cx, 3
jne 0x18000abf0
and eax, 0xfff
add dword [rax + rdx], r8d
jmp 0x18000ac1b
cmp cx, 1
jne 0x18000ac0b
and eax, 0xfff
lea rcx, [rax + rdx]
mov rax, r8
shr rax, 0x10
add word [rcx], ax
jmp 0x18000ac1b
cmp cx, 2
jne 0x18000ac1b
and eax, 0xfff
add word [rax + rdx], r8w
add r10, 2
test r9, r9
jne 0x18000abc0
mov eax, dword [r11 + 4]
add r11, rax
mov eax, dword [r11 + 4]
test eax, eax
jne 0x18000aba0
mov ebx, dword [r15 + 0x28]
xor r8d, r8d
xor edx, edx
or rcx, 0xffffffffffffffff
add rbx, r14
call qword [rsp + 0x38]
mov r8, qword [rsp + 0xa0]
mov edi, 1
mov edx, edi
mov rcx, r14
call rbx
cmp dword [r15 + 0x8c], 0
je 0x18000ad20
mov r11d, dword [r15 + 0x88]
add r11, r14
mov ebx, dword [r11 + 0x18]
test ebx, ebx
je 0x18000ad20
cmp dword [r11 + 0x14], 0
je 0x18000ad20
mov r8d, dword [r11 + 0x20]
xor ebp, ebp
mov r10d, dword [r11 + 0x24]
add r8, r14
add r10, r14
mov r9d, ebp
test ebx, ebx
je 0x18000ad20
mov esi, dword [rsp + 0xb0]
nop dword [rax]
mov edx, dword [r8]
mov ecx, ebp
add rdx, r14
movzx eax, byte [rdx]
nop dword [rax + rax]
ror ecx, 0xd
lea rdx, [rdx + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [rdx]
test al, al
jne 0x18000acc0
cmp ecx, esi
je 0x18000ace9
inc r9d
add r8, 4
add r10, 2
cmp r9d, ebx
jb 0x18000acb0
jmp 0x18000ad20
movzx eax, word [r10]
cmp eax, 0xffffffff
je 0x18000ad20
mov edx, dword [r11 + 0x1c]
lea eax, [rax*4]
mov rcx, qword [rsp + 0xb8]
cdqe
add rax, r14
mov r8d, dword [rdx + rax]
mov edx, dword [rsp + 0xc0]
add r8, r14
call r8
test eax, eax
cmovne edi, ebp
mov rax, qword [rsp + 0x40]
mov ecx, edi
test rax, rax
je 0x18000ad30
call rax
jmp 0x18000ad34
call qword [rsp + 0x20]
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret