Function at 0x18000aa10
Capabilities:
Acquire debug privileges

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rax, qword [0x18003c008]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov rax, r8
mov qword [rsp + 0x48], rax
mov ebp, edx
mov dword [rsp + 0x40], edx
mov r12, rcx
mov qword [rsp + 0x58], rax
xor esi, esi
mov qword [r11 - 0x68], rsi
mov dword [r11 - 0x5c], esi
mov dword [r11 - 0x60], 1
mov dword [r11 - 0x58], esi
xor ecx, ecx
mov qword [r11 - 0x54], rcx
mov dword [r11 - 0x4c], ecx
mov edi, 0x3745168e
mov rdx, qword [r8]
cmp dword [rdx - 0x10], ecx
je 0x18000aad2
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
lea r8d, [rsi + 3]
lea rcx, [rsp + 0x60]
call fcn.1800026a0
mov rcx, qword [rsp + 0x60]
mov rdx, rcx
mov edi, esi
movzx eax, byte [rcx]
nop dword [rax]
ror edi, 0xd
movsx eax, al
add edi, eax
lea rdx, [rdx + 1]
movzx eax, byte [rdx]
test al, al
jne 0x18000aab0
lea rax, [rsp + 0x68]
cmp rcx, rax
je 0x18000aad2
call fcn.180010cf0
test ebp, ebp
jne 0x18000ab05
lea edx, [rbp + 0x45]
lea rcx, [0x1800413b0]
call fcn.180009060
test rax, rax
je 0x18000ab01
lea edx, [rbp + 0x45]
lea rcx, [0x1800413b0]
call fcn.180009060
call rax
mov dword [rsp + 0x40], eax
jmp 0x18000ab05
mov dword [rsp + 0x40], esi
mov ebx, esi
nop word [rax + rax]
mov edx, 7
lea rcx, [0x1800413b0]
call fcn.180009060
or rbp, 0xffffffffffffffff
test rax, rax
je 0x18000ab7e
lea edx, [rbp + 8]
lea rcx, [0x1800413b0]
call fcn.180009060
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, r12
call rax
mov r14, rax
cmp rax, rbp
jne 0x18000ab81
inc ebx
cmp ebx, 5
je 0x18000ae79
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18000ab10
mov r14, rsi
mov edx, 0xe
lea rcx, [0x1800413b0]
call fcn.180009060
test rax, rax
je 0x18000ae79
mov edx, 0xe
lea rcx, [0x1800413b0]
call fcn.180009060
xor edx, edx
mov rcx, r14
call rax
mov r13d, eax
lea ecx, [r13 - 1]
cmp ecx, 0xfffffffd
ja 0x18000ae79
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, r13d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
test rax, rax
je 0x18000ae79
mov edx, 8
lea rcx, [0x1800413b0]
call fcn.180009060
test rax, rax
je 0x18000ae34
mov edx, 8
lea rcx, [0x1800413b0]
call fcn.180009060
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0xfc]
mov r8d, r13d
mov rdx, r15
mov rcx, r14
call rax
test eax, eax
je 0x18000ae34
mov edx, 0x15
lea rcx, [0x1800413b0]
call fcn.180009060
test rax, rax
je 0x18000ac5a
mov edx, 0x15
lea rcx, [0x1800413b0]
call fcn.180009060
mov rcx, r14
call rax
mov edx, 0x89
lea rcx, [0x1800413b0]
call fcn.180009060
test rax, rax
je 0x18000ad9d
mov edx, 0x44
lea rcx, [0x1800413b0]
call fcn.180009060
test rax, rax
je 0x18000aca2
mov edx, 0x44
lea rcx, [0x1800413b0]
call fcn.180009060
call rax
mov rbx, rax
jmp 0x18000aca5
mov rbx, rsi
mov edx, 0x89
lea rcx, [0x1800413b0]
call fcn.180009060
lea r8, [rsp + 0xf0]
mov edx, 0x28
mov rcx, rbx
call rax
test eax, eax
je 0x18000ad9d
mov dword [rsp + 0x100], 1
mov dword [rsp + 0x10c], 2
mov edx, 0x8c
lea rcx, [0x1800413b0]
call fcn.180009060
test rax, rax
je 0x18000ad6c
mov edx, 0x8c
lea rcx, [0x1800413b0]
call fcn.180009060
lea r8, [rsp + 0x104]
lea rdx, [0x18002f5b8]
xor ecx, ecx
call rax
test eax, eax
je 0x18000ad6c
mov edx, 0x8d
lea rcx, [0x1800413b0]
call fcn.180009060
test rax, rax
je 0x18000ad6c
mov edx, 0x8d
lea rcx, [0x1800413b0]
call fcn.180009060
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rsp + 0x100]
xor edx, edx
mov rcx, qword [rsp + 0xf0]
call rax
mov edx, 0x15
lea rcx, [0x1800413b0]
call fcn.180009060
test rax, rax
je 0x18000ad9d
mov edx, 0x15
lea rcx, [0x1800413b0]
call fcn.180009060
mov rcx, qword [rsp + 0xf0]
call rax
mov edx, 0x46
lea rcx, [0x1800413b0]
call fcn.180009060
test rax, rax
je 0x18000ae34
mov edx, 0x46
lea rcx, [0x1800413b0]
call fcn.180009060
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov ecx, 0x43a
call rax
mov rsi, rax
test rax, rax
je 0x18000ae34
mov rcx, rbp
lea rcx, [rcx + 1]
cmp word [r12 + rcx*2], 0
jne 0x18000ade1
lea eax, [rcx*2 + 2]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], edi
mov r8d, r13d
mov rdx, r15
mov rcx, rsi
call fcn.18000b660
mov rbx, rax
test rax, rax
je 0x18000ae34
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0xf8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rsi, rsi
je 0x18000ae79
mov edx, 0x15
lea rcx, [0x1800413b0]
call fcn.180009060
test rax, rax
je 0x18000ae79
mov edx, 0x15
lea rcx, [0x1800413b0]
call fcn.180009060
mov rcx, rsi
call rax
mov ebx, dword [rsp + 0xf8]
mov rdx, qword [rsp + 0x48]
mov rdx, qword [rdx]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x18000ae9d
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, ebx
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.180010cd0
mov rbx, qword [rsp + 0x178]
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret