Function at 0x180011d18
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb8
xor r14d, r14d
mov eax, r8d
mov r12, rcx
lea rcx, [0x1800125c4]
and eax, 0x10
mov rbx, rdx
mov r15, r14
mov qword [rsp + 0x40], r14
mov rbp, r14
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x58], eax
mov qword [rsp + 0x70], r14
je 0x180011d80
mov rdi, qword [rdx]
lea rax, [0x180028090]
mov qword [rsp + 0x68], rax
jmp 0x180011d84
mov rdi, qword [rdx + 8]
cmp rdi, r14
jne 0x180011d93
mov ebx, 2
jmp 0x1800122a2
movsxd rax, dword [rdi + 0x3c]
xor edx, edx
mov r13w, 0x8664
mov ecx, dword [rax + rdi + 0x50]
lea r8d, [rdx + 0x28]
mov qword [rsp + 0x50], r14
lea esi, [rcx + 0xfff]
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x48], r14
and esi, 0xfffff000
mov dword [rsp + 0x5c], esi
call sub.ntdll.dll_memset
mov eax, dword [rbx + 0x14]
add eax, dword [rbx + 0x10]
xor r11d, r11d
mov qword [rsp + 0x30], r14
lea eax, [rax + rsi + 0xc58]
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x78]
mov dword [rsp + 0x60], eax
lea eax, [r11 + 0x40]
lea rcx, [rsp + 0x50]
mov edx, 0xf001f
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x64], r11d
mov dword [rsp + 0x90], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x78], 0x30
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], r14
call qword [sym.imp.ntdll.dll_NtCreateSection]
cmp eax, r14d
jl 0x180011e85
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x48]
or rdx, 0xffffffffffffffff
call fcn.1800128a8
cmp eax, r14d
mov esi, eax
jne 0x180011e8f
mov r8d, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call sub.ntdll.dll_memset
mov rbp, qword [rsp + 0x50]
mov r15, qword [rsp + 0x48]
mov qword [rsp + 0x70], rbp
jmp 0x180011e8f
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov esi, eax
cmp esi, r14d
mov ebx, esi
jne 0x180012278
mov rdx, qword [r12]
lea r8, [rsp + 0x40]
mov rcx, rbp
call fcn.1800128a8
cmp eax, r14d
mov ebx, eax
jne 0x180012278
movsxd rbx, dword [rdi + 0x3c]
mov r14, qword [rsp + 0x40]
mov rdx, rdi
add rbx, rdi
mov rcx, r15
mov eax, dword [rbx + 0x54]
cmp word [rbx + 4], r13w
movzx esi, word [rbx + 0x14]
movzx r12d, word [rbx + 6]
mov r13d, dword [rbx + 0x3c]
mov r8d, eax
call sub.ntdll.dll_memcpy
test r12d, r12d
je 0x180011f1e
lea ebp, [r13 - 1]
lea rsi, [rsi + rbx + 0x2c]
not ebp
mov eax, dword [rsi - 4]
lea ecx, [rax + r13 - 1]
and ecx, ebp
je 0x180011f14
mov edx, dword [rsi]
mov r8d, ecx
mov ecx, dword [rsi - 8]
add rcx, r15
add rdx, rdi
call sub.ntdll.dll_memcpy
add rsi, 0x28
sub r12, 1
jne 0x180011ef5
test r14, r14
mov dx, 0x8664
lea rax, [rbx + 0xb0]
cmove r14, r15
cmp word [rbx + 4], dx
lea rcx, [rbx + 0xa0]
cmove rcx, rax
mov ebp, 8
cmp dword [rcx], 0
je 0x180011fe9
mov r10d, dword [rcx + 4]
test r10d, r10d
je 0x180011fe9
cmp word [rbx + 4], dx
jne 0x180011f66
mov rax, qword [rbx + 0x30]
jmp 0x180011f69
mov eax, dword [rbx + 0x34]
mov r8d, dword [rcx]
mov rdi, r14
sub r14, qword [rbx + 0x30]
add r8, r15
sub rdi, rax
cmp r10d, ebp
jbe 0x180011fe9
mov ebx, 2
mov esi, 0xfff
mov eax, dword [r8 + 4]
mov r9d, dword [r8]
mov rcx, rax
add r9, r15
sub rcx, rbp
shr rcx, 1
cmp r10d, eax
jl 0x180011fda
test ecx, ecx
je 0x180011fda
lea rdx, [r8 + 8]
mov r11d, ecx
movzx eax, word [rdx]
shr eax, 0xc
cmp eax, 3
je 0x180011fc7
cmp eax, 0xa
jne 0x180011fd1
mov ax, word [rdx]
and rax, rsi
add qword [rax + r9], r14
jmp 0x180011fd1
mov ax, word [rdx]
and rax, rsi
add dword [rax + r9], edi
add rdx, rbx
sub r11, 1
jne 0x180011fab
mov eax, dword [r8 + 4]
sub r10d, eax
add r8, rax
cmp r10d, ebp
ja 0x180011f88
mov rbx, qword [rsp + 0x108]
mov r12d, dword [rsp + 0x5c]
mov r8d, dword [rbx + 0x10]
mov rdx, qword [rbx]
lea rsi, [r12 + r15]
lea rcx, [rsi + 0xc58]
call sub.ntdll.dll_memcpy
mov eax, dword [rbx + 0x10]
mov r8d, dword [rbx + 0x14]
mov rdx, qword [rbx + 8]
add rax, r12
lea rcx, [rax + r15 + 0xc58]
call sub.ntdll.dll_memcpy
mov rax, qword [rsp + 0x40]
xor r14d, r14d
mov qword [rsi + 0x30], rax
mov rax, qword [rsp + 0x40]
lea rcx, [r12 + rax + 0xc58]
mov qword [rsi + 0x18], rcx
mov ecx, dword [rbx + 0x10]
mov rax, qword [rsp + 0x40]
add rcx, r12
cmp dword [rsp + 0x58], r14d
lea rcx, [rcx + rax + 0xc58]
mov qword [rsi + 0x20], rcx
mov eax, dword [rbx + 0x10]
mov dword [rsi + 0x28], eax
mov eax, dword [rbx + 0x14]
mov ebx, r14d
mov dword [rsi + 0x2c], eax
je 0x180012131
cmp qword [0x180029848], r14
mov r13, qword [rsp + 0x100]
mov rdi, qword [r13]
je 0x18001209d
cmp qword [0x180029850], r14
je 0x18001209d
cmp qword [0x180029858], r14
jne 0x180012117
lea r8, [0x18002cf69]
lea rdx, [0x18002c84e]
mov rcx, rdi
mov ebx, 0x7f
call fcn.180014ae0
cmp rax, r14
mov qword [0x180029848], rax
je 0x1800121d7
lea r8, [0x18002cf74]
lea rdx, [0x18002c84e]
mov rcx, rdi
call fcn.180014ae0
cmp rax, r14
mov qword [0x180029850], rax
je 0x1800121d7
lea r8, [0x18002cf3d]
lea rdx, [0x18002c84e]
mov rcx, rdi
call fcn.180014ae0
cmp rax, r14
mov qword [0x180029858], rax
je 0x1800121d7
mov ebx, r14d
lea rdx, [0x180029848]
mov r8d, 0x18
mov rcx, rsi
call sub.ntdll.dll_memcpy
jmp 0x1800121d7
cmp qword [0x180029830], r14
je 0x18001214c
cmp qword [0x180029838], r14
je 0x18001214c
cmp qword [0x180029840], r14
jne 0x1800121ba
lea rcx, [0x18002c84e]
mov ebx, 0x7f
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp rax, r14
mov rdi, rax
je 0x1800121cf
lea rdx, [0x18002cf69]
mov rcx, rax
call fcn.18001459c
cmp rax, r14
mov qword [0x180029830], rax
je 0x1800121cf
lea rdx, [0x18002cf74]
mov rcx, rdi
call fcn.18001459c
cmp rax, r14
mov qword [0x180029838], rax
je 0x1800121cf
lea rdx, [0x18002cf3d]
mov rcx, rdi
call fcn.18001459c
cmp rax, r14
mov qword [0x180029840], rax
je 0x1800121cf
mov ebx, r14d
lea rdx, [0x180029830]
mov r8d, 0x18
mov rcx, rsi
call sub.ntdll.dll_memcpy
mov r13, qword [rsp + 0x100]
cmp ebx, r14d
jne 0x180012278
mov rdx, qword [rsp + 0x68]
lea rcx, [rsi + 0x48]
mov r8d, 0x800
call sub.ntdll.dll_memcpy
mov r11, qword [rsp + 0x40]
mov rcx, qword [0x180029648]
mov esi, 0x318
xor edx, edx
lea rdi, [r12 + r11]
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r14
mov rbx, rax
je 0x18001225c
mov r8, rsi
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
mov r8d, dword [rsp + 0x110]
lea r11, [rdi + 0x48]
mov rdx, rbx
mov rcx, r13
mov qword [rbx + 8], r11
mov qword [rbx + 0x10], rdi
call fcn.18001497c
mov rcx, qword [0x180029648]
mov r8, rbx
xor edx, edx
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebp, r14d
mov ebx, ebp
jne 0x180012278
mov rdx, qword [rsp + 0x118]
cmp rdx, r14
je 0x180012278
mov rax, qword [rsp + 0x40]
mov qword [rdx], rax
cmp r15, r14
je 0x180012292
mov rdx, r15
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov rcx, qword [rsp + 0x70]
cmp rcx, r14
je 0x1800122a2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret