Function at 0x18001bdd0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x220
mov rsi, r9
mov r15, r8
mov r14d, edx
mov rbx, rcx
mov dword [rsp + 0x34], 1
mov byte [rsp + 0x30], 0
xor ecx, ecx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x48], ecx
shr rsi, 4
test edx, 0x7d010f60
jne 0x18001e1be
mov eax, 0x80000000
cmp r8, rax
jae 0x18001e1be
mov r12b, 1
mov dword [rsp + 0x60], r12d
mov r13, rsi
mov qword [rsp + 0x58], rsi
cmp rsi, 2
jb 0x18001e188
mov rax, qword [rsp + 0x288]
mov dword [rax], 3
mov edi, r14d
and edi, 0x800000
jne 0x18001e161
test r14b, 1
jne 0x18001bebc
mov rcx, qword [rbx + 0x160]
mov rax, qword gs:[0x30]
lock btr dword [rcx + 8], 0
mov rax, qword [rax + 0x48]
jae 0x18001d073
mov qword [rcx + 0x10], rax
mov dword [rcx + 0xc], 1
inc dword [rbx + 0x248]
mov byte [rsp + 0x30], 1
test dword [rbx + 0x78], 0x30000000
jne 0x18001d200
mov eax, dword [rbx + 0x94]
cmp r13, rax
ja 0x18001ce66
test edi, edi
jne 0x18001bf58
movzx eax, word [rbx + 0x190]
cmp rsi, rax
jae 0x18001c9ae
cmp r15, qword [0x180159758]
ja 0x18001bf58
mov r14, rsi
shr r14, 3
movzx eax, sil
and al, 7
movzx edi, byte [r14 + rbx + 0x192]
movzx r15d, al
mov ecx, r15d
mov edx, 1
shl edx, cl
test dil, dl
jne 0x18001bf58
mov rax, qword [rbx + 0x188]
lea rdi, [rax + rsi*2]
mov qword [rsp + 0x180], rdi
movzx ecx, word [rdi]
add cx, 0x21
mov word [rdi], cx
cmp dword [rsp + 0x48], 0
jne 0x18001ce0b
movzx eax, cl
and al, 0x1f
cmp al, 0x10
ja 0x18001ce0b
mov esi, 0xff00
cmp cx, si
ja 0x18001ce0b
mov rax, qword [rsp + 0x280]
test rax, rax
je 0x18001bf71
mov rdi, qword [rax]
test rdi, rdi
jne 0x18001cb3a
lea rax, [rbx + 0x150]
mov qword [rsp + 0x128], rax
mov r15, qword [rbx + 0x138]
mov eax, dword [r15 + 8]
cmp r13, rax
jae 0x18001c0e4
mov r14, r13
mov qword [rsp + 0xa8], r13
lea r11, [0x180119500]
sub r14d, dword [r15 + 0x18]
xor esi, esi
mov r12, qword [r15 + 0x20]
mov rax, qword [r12 + 8]
cmp r12, rax
je 0x18001d332
lea r8, [rax - 0x10]
mov edx, dword [r8 + 8]
mov dword [rsp + 0x198], edx
cmp dword [rbx + 0x7c], esi
je 0x18001c000
mov edi, dword [rbx + 0x88]
xor edi, edx
mov dword [rsp + 0x198], edi
movzx edx, di
mov ecx, edi
shr ecx, 0x10
mov eax, edi
shr eax, 8
xor cl, al
xor cl, dil
mov eax, edi
shr eax, 0x18
cmp al, cl
jne 0x18001d890
movzx eax, dx
mov ecx, r13d
sub ecx, eax
test ecx, ecx
jg 0x18001cd55
mov r8, qword [r12]
add r8, 0xfffffffffffffff0
mov edx, dword [r8 + 8]
mov dword [rsp + 0x1a8], edx
cmp dword [rbx + 0x7c], esi
je 0x18001c056
mov edi, dword [rbx + 0x88]
xor edi, edx
mov dword [rsp + 0x1a8], edi
movzx edx, di
mov ecx, edi
shr ecx, 0x10
mov eax, edi
shr eax, 8
xor cl, al
xor cl, dil
mov eax, edi
shr eax, 0x18
cmp al, cl
jne 0x18001d8b8
movzx eax, dx
mov ecx, r13d
sub ecx, eax
test ecx, ecx
jle 0x18001cad7
cmp qword [r15], rsi
jne 0x18001c07e
mov eax, dword [r15 + 8]
dec eax
cmp dword [rsp + 0xa8], eax
je 0x18001ca25
mov edi, r14d
shr edi, 5
mov dword [rsp + 0x78], edi
mov r9d, dword [r15 + 8]
sub r9d, dword [r15 + 0x18]
shr r9d, 5
dec r9d
mov rax, qword [r15 + 0x28]
lea r8, [rax + rdi*4]
mov qword [rsp + 0xf0], r8
and r14d, 0x1f
mov edx, 1
movzx ecx, r14b
shl edx, cl
dec edx
not edx
and edx, dword [r8]
nop dword [rax]
test edx, edx
jne 0x18001c0f8
cmp edi, r9d
ja 0x18001cabb
add r8, 4
mov qword [rsp + 0xf0], r8
mov edx, dword [r8]
inc edi
mov dword [rsp + 0x78], edi
jmp 0x18001c0c0
mov rcx, qword [r15]
test rcx, rcx
je 0x18001c9e9
mov r15, rcx
jmp 0x18001bf87
mov ecx, edx
test dx, dx
jne 0x18001c920
test edx, 0xff0000
jne 0x18001cb00
shr rcx, 0x18
movzx ecx, byte [rcx + r11]
add ecx, 0x18
shl edi, 5
add edi, ecx
mov dword [rsp + 0x78], edi
cmp dword [r15 + 0xc], esi
jne 0x18001d909
mov rax, qword [r15 + 0x30]
mov rsi, qword [rax + rdi*8]
test rsi, rsi
je 0x18001cac3
cmp qword [rsp + 0x128], rsi
je 0x18001ccd7
lea r14, [rsi - 0x10]
mov qword [rsp + 0x90], r14
cmp dword [rbx + 0x7c], 0
je 0x18001c186
mov edx, dword [rbx + 0x88]
xor edx, dword [r14 + 8]
mov dword [r14 + 8], edx
mov ecx, edx
shr ecx, 0x10
mov eax, edx
shr eax, 8
xor cl, al
xor cl, dl
shr edx, 0x18
cmp dl, cl
jne 0x18001d910
movzx ecx, word [r14 + 8]
movzx edx, cx
shr dx, 8
cmp rcx, r13
jb 0x18001d98a
mov r13, qword [rsi]
mov r8, qword [r14 + 0x18]
mov qword [rsp + 0x68], r8
mov rax, qword [r8]
mov r9, qword [r13 + 8]
cmp rax, r9
jne 0x18001d967
cmp rax, rsi
jne 0x18001d967
sub qword [rbx + 0xc0], rcx
mov rdi, qword [rbx + 0x138]
test rdi, rdi
je 0x18001c309
movzx r12d, word [r14 + 8]
mov ecx, dword [rdi + 8]
cmp r12, rcx
jb 0x18001c1f5
mov rax, qword [rdi]
test rax, rax
je 0x18001c90f
mov rdi, rax
jmp 0x18001c1dc
mov qword [rsp + 0xf8], r12
mov ecx, r12d
mov qword [rsp + 0xe0], r12
mov r15d, ecx
sub r15d, dword [rdi + 0x18]
cmp dword [rdi + 0xc], 0
jne 0x18001d927
mov eax, r15d
lea r11, [rax*8]
mov qword [rsp + 0x70], r11
mov r10, qword [rdi + 0x30]
mov rdx, qword [r10 + r11]
dec dword [rdi + 0x10]
mov eax, dword [rdi + 8]
lea r9d, [rax - 1]
cmp ecx, r9d
je 0x18001c907
cmp rdx, rsi
jne 0x18001c302
mov dword [rsp + 0x88], eax
cmp qword [rdi], 0
cmove eax, r9d
mov dword [rsp + 0x88], eax
mov r9, qword [rsi]
mov qword [rsp + 0xe0], r9
mov rdx, qword [rdi + 0x20]
cmp ecx, eax
jae 0x18001c998
cmp r9, rdx
je 0x18001c2d6
lea r10, [r9 - 0x10]
mov edx, dword [r10 + 8]
mov dword [rsp + 0x1c8], edx
cmp dword [rbx + 0x7c], 0
je 0x18001c2c2
mov esi, dword [rbx + 0x88]
xor esi, edx
mov dword [rsp + 0x1c8], esi
movzx edx, si
mov ecx, esi
shr ecx, 0x10
mov eax, esi
shr eax, 8
xor cl, al
xor cl, sil
mov eax, esi
shr eax, 0x18
cmp al, cl
jne 0x18001d930
movzx eax, dx
sub r12d, eax
je 0x18001ccc2
mov r14, qword [rsp + 0x90]
mov rax, qword [rdi + 0x30]
mov qword [r11 + rax], 0
mov eax, r15d
shr eax, 5
and r15d, 0x1f
mov edx, 1
movzx ecx, r15b
shl edx, cl
mov ecx, eax
mov rax, qword [rdi + 0x28]
not edx
and dword [rax + rcx*4], edx
lea r11, [0x180119500]
mov qword [r8], r13
mov qword [r13 + 8], r8
lea rdi, [r14 + 0xa]
test byte [rdi], 8
jne 0x18001cd5d
mov r13, qword [rsp + 0x58]
mov r12d, dword [rsp + 0x60]
movzx r15d, byte [rdi]
mov byte [rsp + 0x40], r15b
mov r8d, dword [rsp + 0x34]
test r8d, r8d
je 0x18001d0b0
mov qword [rsp + 0x80], r14
test byte [rdi], 1
jne 0x18001da26
mov byte [rdi], r12b
movzx edi, word [r14 + 8]
sub rdi, r13
mov qword [rsp + 0x188], rdi
mov word [r14 + 8], r13w
mov rcx, qword [rsp + 0x278]
mov r12, qword [rsp + 0x270]
sub rcx, r12
mov qword [rsp + 0x58], rcx
cmp rcx, 0x3f
jae 0x18001da48
mov byte [r14 + 0xf], cl
mov byte [r14 + 0xb], 0
test rdi, rdi
je 0x18001c772
cmp rdi, 1
je 0x18001cdbe
test r8d, r8d
je 0x18001d226
xor r12d, r12d
mov dword [rsp + 0x44], r12d
movzx eax, byte [r14 + 0xe]
test al, al
jne 0x18001c89a
mov r9, rbx
mov qword [rsp + 0x70], rdi
mov rsi, r13
shl rsi, 4
add rsi, r14
mov dword [rsp + 0x48], 0
mov byte [rsi + 0xa], r15b
mov byte [rsi + 0xf], 0
movzx eax, word [rbx + 0x8c]
xor ax, r13w
mov word [rsi + 0xc], ax
mov rdx, qword [r9 + 0x28]
cmp rdx, r9
jne 0x18001c8ba
xor r15b, r15b
mov byte [rsi + 0xe], r15b
mov byte [rsi + 0xb], 0
mov word [rsi + 8], di
mov r15, rdi
shl r15, 4
add r15, rsi
mov ecx, dword [rbx + 0x7c]
mov eax, ecx
shr eax, 0x14
and al, byte [rbx + 0x8a]
xor al, byte [r15 + 0xa]
test al, 1
je 0x18001d3c8
movzx eax, word [rbx + 0x8c]
xor ax, di
mov word [r15 + 0xc], ax
test r12b, r12b
jne 0x18001d231
movzx edx, di
mov qword [rsp + 0x68], rdx
mov byte [rsi + 0xa], r12b
mov byte [rsi + 0xf], r12b
lea rax, [rbx + 0x150]
mov r15, qword [rbx + 0x138]
test r15, r15
je 0x18001db18
mov eax, dword [r15 + 8]
cmp rdx, rax
jae 0x18001c5d9
mov r9, rdx
mov qword [rsp + 0xa0], rdx
sub r9d, dword [r15 + 0x18]
mov qword [rsp + 0x58], r9
xor edi, edi
mov r13, qword [r15 + 0x20]
mov rax, qword [r13 + 8]
cmp r13, rax
je 0x18001cc12
lea r8, [rax - 0x10]
mov edx, dword [r8 + 8]
mov dword [rsp + 0x1d8], edx
cmp dword [rbx + 0x7c], edi
je 0x18001c4f0
mov r12d, dword [rbx + 0x88]
xor r12d, edx
mov dword [rsp + 0x1d8], r12d
movzx edx, r12w
mov ecx, r12d
shr ecx, 0x10
mov eax, r12d
shr eax, 8
xor cl, al
xor cl, r12b
mov eax, r12d
shr eax, 0x18
cmp al, cl
jne 0x18001da74
movzx eax, dx
mov rdx, qword [rsp + 0x68]
mov ecx, edx
sub ecx, eax
test ecx, ecx
jg 0x18001c9e1
mov r10, qword [r13]
mov r8d, dword [r10 - 8]
mov dword [rsp + 0x1e8], r8d
cmp dword [rbx + 0x7c], edi
je 0x18001c54e
mov r12d, dword [rbx + 0x88]
xor r12d, r8d
mov dword [rsp + 0x1e8], r12d
movzx r8d, r12w
mov ecx, r12d
shr ecx, 0x10
mov eax, r12d
shr eax, 8
xor cl, al
xor cl, r12b
mov eax, r12d
shr eax, 0x18
cmp al, cl
jne 0x18001daa2
movzx eax, r8w
mov ecx, edx
sub ecx, eax
test ecx, ecx
jle 0x18001cb31
cmp qword [r15], rdi
jne 0x18001c576
mov eax, dword [r15 + 8]
dec eax
cmp dword [rsp + 0xa0], eax
je 0x18001cc1a
mov edi, r9d
shr edi, 5
mov dword [rsp + 0x7c], edi
mov r10d, dword [r15 + 8]
sub r10d, dword [r15 + 0x18]
shr r10d, 5
dec r10d
mov rax, qword [r15 + 0x28]
lea r8, [rax + rdi*4]
mov qword [rsp + 0x110], r8
and r9d, 0x1f
mov edx, 1
movzx ecx, r9b
shl edx, cl
dec edx
not edx
and edx, dword [r8]
test edx, edx
jne 0x18001c5ed
cmp edi, r10d
ja 0x18001cca1
add r8, 4
mov qword [rsp + 0x110], r8
mov edx, dword [r8]
inc edi
mov dword [rsp + 0x7c], edi
jmp 0x18001c5b5
mov rcx, qword [r15]
test rcx, rcx
je 0x18001ca02
mov r15, rcx
jmp 0x18001c473
mov ecx, edx
test dx, dx
je 0x18001ca9e
test dl, dl
je 0x18001cb1d
movzx eax, cl
movzx ecx, byte [rax + r11]
shl edi, 5
add edi, ecx
mov dword [rsp + 0x7c], edi
cmp dword [r15 + 0xc], 0
jne 0x18001db11
mov rax, qword [r15 + 0x30]
mov rdi, qword [rax + rdi*8]
mov rdx, qword [rsp + 0x68]
test rdi, rdi
je 0x18001cca9
lea rax, [rbx + 0x150]
cmp rax, rdi
je 0x18001c676
cmp dword [rbx + 0x7c], 0
je 0x18001db27
mov ecx, dword [rdi - 8]
mov dword [rsp + 0x178], ecx
test dword [rbx + 0x7c], ecx
je 0x18001db20
mov eax, dword [rbx + 0x88]
xor eax, ecx
mov dword [rsp + 0x178], eax
movzx eax, ax
cmp rdx, rax
ja 0x18001db30
lea r15, [rsi + 0x10]
mov rax, qword [rdi + 8]
mov rcx, qword [rax]
cmp rcx, rdi
jne 0x18001db3f
mov qword [r15], rdi
mov qword [r15 + 8], rax
mov qword [rax], r15
mov qword [rdi + 8], r15
movzx eax, word [rsi + 8]
add qword [rbx + 0xc0], rax
mov rdi, qword [rbx + 0x138]
test rdi, rdi
je 0x18001c749
movzx r13d, word [rsi + 8]
mov eax, dword [rdi + 8]
cmp r13, rax
jae 0x18001c84e
mov qword [rsp + 0x118], r13
mov edx, r13d
mov qword [rsp + 0x180], r13
mov r12d, edx
sub r12d, dword [rdi + 0x18]
cmp dword [rdi + 0xc], 0
jne 0x18001db62
mov eax, r12d
inc dword [rdi + 0x10]
lea r8, [rax*8]
mov qword [rsp + 0x70], r8
mov rax, qword [rdi + 0x30]
mov rcx, qword [r8 + rax]
mov qword [rsp + 0x58], rcx
mov eax, dword [rdi + 8]
dec eax
cmp edx, eax
je 0x18001c9fa
test rcx, rcx
jne 0x18001c935
mov rax, qword [rdi + 0x30]
mov qword [r8 + rax], r15
test rcx, rcx
jne 0x18001c749
mov eax, r12d
shr eax, 5
and r12d, 0x1f
mov edx, 1
movzx ecx, r12b
shl edx, cl
mov ecx, eax
mov rax, qword [rdi + 0x28]
or dword [rax + rcx*4], edx
mov r8d, dword [rsp + 0x34]
cmp dword [rbx + 0x7c], 0
je 0x18001c76a
movzx eax, byte [rsi + 0xa]
xor al, byte [rsi + 9]
xor al, byte [rsi + 8]
mov byte [rsi + 0xb], al
mov eax, dword [rbx + 0x88]
xor dword [rsi + 8], eax
mov r12, qword [rsp + 0x270]
mov r15, qword [rsp + 0x80]
lea rax, [r15 + 0x10]
mov qword [rsp + 0x50], rax
lea rsi, [r15 + 8]
movzx edx, word [rsi]
movzx edi, dx
shr di, 8
mov r13d, edx
shl r13, 4
mov qword [rsp + 0x160], r13
movzx eax, byte [r15 + 0xf]
and al, 0x3f
cmp al, 0x3f
je 0x18001de25
test r8d, r8d
je 0x18001d13f
cmp dword [rbx + 0x7c], 0
je 0x18001c7db
movzx ecx, byte [r14 + 0xa]
xor cl, dil
xor cl, dl
mov rax, qword [rsp + 0x80]
mov byte [rax + 0xb], cl
mov eax, dword [rbx + 0x88]
xor dword [rsi], eax
cmp byte [rsp + 0x30], 0
je 0x18001c827
test dword [rbx + 0x74], 0x1000000
jne 0x18001c816
inc dword [rbx + 0x260]
mov ecx, dword [rbx + 0x268]
cmp dword [rbx + 0x260], ecx
ja 0x18001c862
inc dword [rbx + 0x26c]
mov eax, dword [rbx + 0x26c]
cmp eax, 0x1000
jae 0x18001d365
mov rcx, qword [rbx + 0x160]
call sym.ntdll.dll_RtlLeaveCriticalSection
mov byte [rsp + 0x30], 0
mov r14d, dword [rsp + 0x268]
test r14b, 8
je 0x18001e114
lea r8, [r13 - 8]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call sym.ntdll.dll_memset
jmp 0x18001e114
mov rcx, qword [rdi]
test rcx, rcx
je 0x18001ca13
mov rdi, rcx
jmp 0x18001c6b8
mov dword [rbx + 0x260], 0
mov rax, qword [rbx + 0xc0]
shl rax, 4
mov rdx, qword [rbx + 0x220]
sub rdx, rax
cmp rdx, qword [rbx + 0x280]
ja 0x18001cae0
mov qword [rbx + 0x288], rdx
jmp 0x18001c7ff
movzx eax, al
shl rax, 0x10
mov r9, r14
and r9, 0xffffffffffff0000
sub r9, rax
add r9, 0x10000
jmp 0x18001c3c6
mov r15, rsi
sub r15, r9
shr r15, 0x10
inc r15
mov qword [rsp + 0x188], r15
cmp r15, 0xfe
jb 0x18001c404
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r8, rsi
mov ecx, 3
call fcn.18009a4c0
lea r11, [0x180119500]
jmp 0x18001c404
dec dword [rdi + 0x14]
jmp 0x18001c244
dec ecx
mov eax, ecx
mov qword [rsp + 0xf8], rax
jmp 0x18001c200
test dl, dl
je 0x18001caec
movzx eax, cl
movzx ecx, byte [rax + r11]
jmp 0x18001c11b
lea r10, [rcx - 0x10]
mov r9d, dword [r10 + 8]
mov dword [rsp + 0x208], r9d
cmp dword [rbx + 0x7c], 0
je 0x18001c983
mov edx, dword [rbx + 0x88]
xor edx, r9d
mov dword [rsp + 0x44], edx
mov dword [rsp + 0x208], edx
movzx r9d, dx
mov ecx, edx
shr ecx, 0x10
mov eax, edx
shr eax, 8
xor cl, al
xor cl, dl
mov eax, edx
shr eax, 0x18
cmp al, cl
jne 0x18001db6b
mov rcx, qword [rsp + 0x58]
movzx eax, r9w
sub r13d, eax
test r13d, r13d
jle 0x18001c71e
jmp 0x18001c726
cmp r9, rdx
jne 0x18001cb14
mov qword [r10 + r11], 0
jmp 0x18001c2e2
cmp r15, qword [0x180159758]
ja 0x18001bf58
cmp byte [rbx + 0x182], 2
je 0x18001d7f5
cmp byte [rbx + 0x183], 2
jne 0x18001bf58
or dword [rbx + 0x78], 0x20000000
jmp 0x18001bf58
mov rdi, r13
jmp 0x18001c629
lea r14d, [rax - 1]
mov qword [rsp + 0xa8], r14
jmp 0x18001bf9f
inc dword [rdi + 0x14]
jmp 0x18001c715
lea r9d, [rax - 1]
mov qword [rsp + 0xa0], r9
jmp 0x18001c48b
lea edx, [rax - 1]
mov eax, edx
mov qword [rsp + 0x118], rax
jmp 0x18001c6cf
cmp dword [r15 + 0xc], esi
jne 0x18001d8e0
mov rax, qword [r15 + 0x30]
mov r14, qword [rax + r14*8]
cmp r12, r14
je 0x18001ca92
lea r8, [r14 - 0x10]
mov edx, dword [r8 + 8]
mov dword [rsp + 0x1b8], edx
cmp dword [rbx + 0x7c], esi
je 0x18001ca7e
mov edi, dword [rbx + 0x88]
xor edi, edx
mov dword [rsp + 0x1b8], edi
movzx edx, di
mov ecx, edi
shr ecx, 0x10
mov eax, edi
shr eax, 8
xor cl, al
xor cl, dil
mov eax, edi
shr eax, 0x18
cmp al, cl
jne 0x18001d8e8
movzx eax, dx
mov ecx, r13d
sub ecx, eax
test ecx, ecx
jle 0x18001ca8f
mov r14, qword [r14]
jmp 0x18001ca37
mov rsi, r14
lea r11, [0x180119500]
jmp 0x18001c136
test edx, 0xff0000
jne 0x18001cbfe
shr rcx, 0x18
movzx ecx, byte [rcx + r11]
add ecx, 0x18
jmp 0x18001c608
test edx, edx
jne 0x18001c0f8
mov r15, qword [r15]
mov r14d, dword [r15 + 0x18]
mov qword [rsp + 0xa8], r14
jmp 0x18001bfa6
mov rsi, qword [r12]
jmp 0x18001c136
mov qword [rbx + 0x280], rdx
jmp 0x18001c88e
shr rcx, 8
movzx eax, cl
movzx ecx, byte [rax + r11]
add ecx, 8
jmp 0x18001c11b
shr rcx, 0x10
movzx eax, cl
movzx ecx, byte [rax + r11]
add ecx, 0x10
jmp 0x18001c11b
mov qword [r10 + r11], r9
jmp 0x18001c302
shr rcx, 8
movzx eax, cl
movzx ecx, byte [rax + r11]
add ecx, 8
jmp 0x18001c608
mov rdi, qword [r13]
jmp 0x18001c629
lea r14, [rdi - 0x10]
mov qword [rsp + 0x90], r14
cmp dword [rbx + 0x7c], 0
je 0x18001cb73
mov edx, dword [rbx + 0x88]
xor edx, dword [r14 + 8]
mov dword [r14 + 8], edx
mov ecx, edx
shr ecx, 0x10
mov eax, edx
shr eax, 8
xor cl, al
xor cl, dl
shr edx, 0x18
cmp dl, cl
jne 0x18001d825
mov rsi, qword [rdi]
mov r15, qword [r14 + 0x18]
mov rax, qword [r15]
mov r9, qword [rsi + 8]
cmp rax, r9
jne 0x18001d844
cmp rax, rdi
jne 0x18001d844
movzx eax, word [r14 + 8]
sub qword [rbx + 0xc0], rax
mov rdx, qword [rbx + 0x138]
test rdx, rdx
je 0x18001cbde
movzx ecx, word [r14 + 8]
mov eax, dword [rdx + 8]
cmp rcx, rax
jae 0x18001cdf7
mov rax, rcx
mov qword [rsp + 0xe8], rcx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
mov r9, rdi
mov r8b, 1
mov rcx, rbx
call fcn.18005c30c
mov qword [r15], rsi
mov qword [rsi + 8], r15
lea rdi, [r14 + 0xa]
test byte [rdi], 8
jne 0x18001d33a
lea r11, [0x180119500]
jmp 0x18001c327
shr rcx, 0x10
movzx eax, cl
movzx ecx, byte [rax + r11]
add ecx, 0x10
jmp 0x18001c608
mov rdi, r13
jmp 0x18001c629
cmp dword [r15 + 0xc], edi
jne 0x18001dada
mov ecx, r9d
mov rax, qword [r15 + 0x30]
mov r12, qword [rax + rcx*8]
cmp r13, r12
je 0x18001cc95
mov r9d, dword [r12 - 8]
mov dword [rsp + 0x1f8], r9d
cmp dword [rbx + 0x7c], edi
je 0x18001cc80
mov r8d, dword [rbx + 0x88]
xor r8d, r9d
mov dword [rsp + 0x44], r8d
mov dword [rsp + 0x1f8], r8d
movzx r9d, r8w
mov ecx, r8d
shr ecx, 0x10
mov eax, r8d
shr eax, 8
xor cl, al
xor cl, r8b
mov eax, r8d
shr eax, 0x18
cmp al, cl
jne 0x18001dae2
movzx eax, r9w
mov ecx, edx
sub ecx, eax
test ecx, ecx
jle 0x18001cc92
mov r12, qword [r12]
jmp 0x18001cc2f
mov rdi, r12
lea r11, [0x180119500]
jmp 0x18001c629
test edx, edx
jne 0x18001c5ed
mov r15, qword [r15]
mov r9d, dword [r15 + 0x18]
mov qword [rsp + 0xa0], r9
mov rdx, qword [rsp + 0x68]
jmp 0x18001c48b
mov rax, qword [rdi + 0x30]
mov qword [r11 + rax], r9
mov r14, qword [rsp + 0x90]
jmp 0x18001c302
mov rdx, qword [rsp + 0x278]
mov rcx, rbx
call fcn.18002a508
mov r14, rax
mov qword [rsp + 0x90], rax
test rax, rax
je 0x18001e10b
lea r8, [rax + 0x10]
mov rsi, qword [r8]
mov r15, qword [rax + 0x18]
mov rax, qword [r15]
mov r9, qword [rsi + 8]
cmp rax, r9
jne 0x18001df2f
cmp rax, r8
jne 0x18001df2f
movzx eax, word [r14 + 8]
sub qword [rbx + 0xc0], rax
mov rdx, qword [rbx + 0x138]
test rdx, rdx
je 0x18001cda0
movzx ecx, word [r14 + 8]
mov eax, dword [rdx + 8]
cmp rcx, rax
jb 0x18001cdea
mov rdi, qword [rdx]
test rdi, rdi
je 0x18001cd7f
mov rdx, rdi
jmp 0x18001cd3c
mov rsi, r12
jmp 0x18001c136
mov rdx, r14
mov rcx, rbx
call fcn.18005ca3c
test al, al
je 0x18001d9c3
mov r13, qword [rsp + 0x58]
mov r12d, dword [rsp + 0x60]
jmp 0x18001cbf2
dec eax
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
mov r9, r8
mov r8b, 1
mov rcx, rbx
call fcn.18005c30c
mov qword [r15], rsi
mov qword [rsi + 8], r15
lea rdi, [r14 + 0xa]
test byte [rdi], 8
jne 0x18001d9b0
mov r12d, dword [rsp + 0x60]
jmp 0x18001cbf2
inc word [r14 + 8]
mov rcx, qword [rsp + 0x278]
sub rcx, r12
add rcx, 0x10
mov qword [rsp + 0x60], rcx
cmp rcx, 0x3f
jae 0x18001da5f
mov byte [r14 + 0xf], cl
jmp 0x18001c772
mov rax, rcx
mov qword [rsp + 0x100], rcx
jmp 0x18001cd89
mov r8, qword [rdx]
test r8, r8
je 0x18001d835
mov rdx, r8
jmp 0x18001cbb0
mov rdx, qword [rsp + 0x270]
test rdx, rdx
je 0x18001d808
cmp byte [rbx + 0x182], 2
jne 0x18001d31e
mov rcx, qword [rbx + 0x178]
call fcn.1800747e4
mov ecx, 0xffff
cmp ax, cx
je 0x18001d20d
mov word [rdi], ax
movzx ecx, byte [r14 + rbx + 0x192]
bts ecx, r15d
mov byte [r14 + rbx + 0x192], cl
inc dword [rbx + 0x270]
jmp 0x18001bf58
test byte [rbx + 0x70], 2
je 0x18001e10b
mov rsi, qword [rsp + 0x278]
add rsi, 0x30
mov qword [rsp + 0x278], rsi
lea rax, [rsi + 8]
mov qword [rsp + 0x278], rax
call fcn.18001ebf0
mov edi, eax
and edi, 0xf
shl rdi, 0xc
mov qword [rsp + 0xd0], 0
mov rdx, qword [rsp + 0x278]
add rdx, 0x1000
add rdx, rdi
mov qword [rsp + 0xd8], rdx
mov edx, 1
mov rcx, rbx
call fcn.18002ae30
mov esi, eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0x2000
lea r9, [rsp + 0xd8]
xor r8d, r8d
lea rdx, [rsp + 0xd0]
or rcx, 0xffffffffffffffff
call sym.ntdll.dll_NtAllocateVirtualMemory
test eax, eax
js 0x18001e114
mov rdx, qword [rsp + 0xd0]
add rdx, rdi
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 0x1000
lea r9, [rsp + 0x278]
xor r8d, r8d
lea rdx, [rsp + 0x38]
or rcx, 0xffffffffffffffff
call sym.ntdll.dll_NtAllocateVirtualMemory
test eax, eax
js 0x18001e0fc
movzx ecx, word [rsp + 0x278]
sub cx, r15w
mov rax, qword [rsp + 0x38]
mov word [rax + 0x38], cx
or r12b, 2
mov rax, qword [rsp + 0x38]
mov byte [rax + 0x3a], r12b
mov rcx, qword [rsp + 0x278]
mov rax, qword [rsp + 0x38]
mov qword [rax + 0x20], rcx
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0xd8]
mov qword [rcx + 0x28], rax
mov rax, qword [rsp + 0x38]
mov byte [rax + 0x3f], 4
mov rax, qword [rsp + 0x278]
add qword [rbx + 0x230], rax
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
mov edi, 0x7ffe0380
test eax, eax
jne 0x18001df4f
mov ecx, edi
cmp byte [rcx], 0
jne 0x18001df6b
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
jne 0x18001dfa1
mov rcx, rdi
cmp byte [rcx], 0
jne 0x18001dfbd
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
mov edi, 0x7ffe038a
test eax, eax
jne 0x18001e020
mov ecx, edi
cmp byte [rcx], 0
jne 0x18001e03c
test dword [rbx + 0x70], 0x8000000
jne 0x18001e089
mov rax, qword gs:[0x60]
test dword [rax + 0xbc], 0x800
jne 0x18001e0a1
mov rcx, qword [rsp + 0x38]
cmp dword [rbx + 0x7c], 0
je 0x18001d03b
movzx eax, byte [rcx + 0x3a]
xor al, byte [rcx + 0x39]
xor al, byte [rcx + 0x38]
mov byte [rcx + 0x3b], al
mov eax, dword [rbx + 0x88]
xor dword [rcx + 0x38], eax
mov rcx, qword [rsp + 0x38]
lea r8, [rbx + 0x110]
mov rax, qword [r8 + 8]
mov rdx, qword [rax]
cmp rdx, r8
jne 0x18001e0dc
mov qword [rcx], r8
mov qword [rcx + 8], rax
mov qword [rax], rcx
mov qword [r8 + 8], rcx
mov rax, qword [rsp + 0x38]
add rax, 0x40
mov qword [rsp + 0x50], rax
jmp 0x18001e114
cmp qword [rcx + 0x10], rax
je 0x18001d1e3
cmp byte [0x18015c3a8], 0
jne 0x18001d7c7
mov dword [rsp + 0x48], 1
mov rcx, qword [rbx + 0x160]
call sym.ntdll.dll_RtlEnterCriticalSection
mov edx, 1
mov rcx, rbx
call fcn.18007c6f0
jmp 0x18001beaa
test r15b, 4
je 0x18001c33e
movzx esi, word [r14 + 8]
shl rsi, 4
sub rsi, 0x20
mov qword [rsp + 0x108], rsi
test r15b, 2
je 0x18001d0e7
cmp rsi, 4
jbe 0x18001d0e7
sub rsi, 4
mov qword [rsp + 0x108], rsi
lea rcx, [r14 + 0x20]
mov r8d, 0xfeeefeee
mov rdx, rsi
call sym.ntdll.dll_RtlCompareMemoryUlong
mov r12, rax
cmp rax, rsi
je 0x18001da10
mov rcx, qword gs:[0x60]
cmp qword [rcx + 0x18], 0
je 0x18001d9db
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
mov rdx, qword [rdx + 0x10]
add rdx, 0x58
lea rcx, str.HEAP__wZ_:
call sym.ntdll.dll_DbgPrint
jmp 0x18001d9e7
mov r14d, dword [rsp + 0x268]
test r14b, 8
jne 0x18001d1eb
test byte [rbx + 0x70], 0x40
jne 0x18001de36
test byte [rbx + 0x70], 0x20
jne 0x18001debf
mov r15, qword [rsp + 0x80]
mov byte [r15 + 0xb], 0
test byte [r15 + 0xa], 2
je 0x18001d5ca
mov rcx, r15
call fcn.180063b6c
mov rdi, rax
mov qword [rsp + 0x170], rax
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
test dword [rbx + 0x70], 0x8000000
jne 0x18001dee8
mov rax, qword gs:[0x60]
test dword [rax + 0xbc], 0x800
jne 0x18001defa
cmp dword [rbx + 0x7c], 0
je 0x18001e114
movzx eax, byte [rsi + 2]
xor al, byte [rsi + 1]
xor al, byte [rsi]
mov byte [r15 + 0xb], al
mov eax, dword [rbx + 0x88]
xor dword [rsi], eax
jmp 0x18001e114
inc dword [rcx + 0xc]
jmp 0x18001bea4
lea r8, [r13 - 8]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call sym.ntdll.dll_memset
jmp 0x18001d15b
mov rcx, rbx
call fcn.180059d74
jmp 0x18001bebc
cmp byte [rbx + 0x182], 2
je 0x18001d812
or dword [rbx + 0x78], 0x20000000
jmp 0x18001bf58
mov r12d, 1
jmp 0x18001c3b1
movzx r15d, di
movzx eax, byte [rsi + 0xa]
and al, 0xf0
mov byte [rsi + 0xa], al
mov byte [rsi + 0xf], 0
test byte [rbx + 0x70], 0x40
jne 0x18001db98
lea rdi, [rbx + 0x150]
cmp qword [rbx + 0x138], 0
je 0x18001dc1c
mov rdx, r15
mov rcx, rbx
call fcn.18005c238
mov r8, rax
cmp rdi, r8
je 0x18001d2ad
cmp dword [rbx + 0x7c], 0
je 0x18001dc2b
mov ecx, dword [r8 - 8]
mov dword [rsp + 0x130], ecx
test dword [rbx + 0x7c], ecx
je 0x18001dc24
mov eax, dword [rbx + 0x88]
xor eax, ecx
mov dword [rsp + 0x130], eax
movzx eax, ax
cmp r15, rax
ja 0x18001dc35
lea rdi, [rsi + 0x10]
mov rax, qword [r8 + 8]
mov rcx, qword [rax]
cmp rcx, r8
jne 0x18001dc3d
mov qword [rdi], r8
mov qword [rdi + 8], rax
mov qword [rax], rdi
mov qword [r8 + 8], rdi
movzx eax, word [rsi + 8]
add qword [rbx + 0xc0], rax
mov rdx, qword [rbx + 0x138]
test rdx, rdx
je 0x18001c749
movzx ecx, word [rsi + 8]
mov r8d, dword [rdx + 8]
cmp rcx, r8
jae 0x18001d325
mov rax, rcx
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
mov r9, rdi
mov r8b, 1
mov rcx, rbx
call fcn.18005c190
jmp 0x18001c749
xor ecx, ecx
jmp 0x18001ce30
mov rax, qword [rdx]
test rax, rax
je 0x18001d39d
mov rdx, rax
jmp 0x18001d2ee
mov rsi, r12
jmp 0x18001c136
mov rdx, r14
mov rcx, rbx
call fcn.18005ca3c
test al, al
jne 0x18001cbf2
movzx r8d, word [r14 + 8]
mov r9b, 1
mov rdx, r14
mov rcx, rbx
call fcn.1800128f0
jmp 0x18001d862
cmp byte [rbx + 0x182], 2
jne 0x18001d3ae
cmp dword [rbx + 0x270], 0x10
jbe 0x18001d3ae
mov eax, 0x100
cmp dword [rbx + 0x264], eax
ja 0x18001d3b5
mov dword [rbx + 0x264], 0
mov dword [rbx + 0x26c], 0
jmp 0x18001c816
lea eax, [r8 - 1]
mov qword [rsp + 0xb0], rax
jmp 0x18001d302
mov eax, 0x10
jmp 0x18001d37c
cmp ecx, 0x10000
jae 0x18001d384
lea eax, [rcx + rcx]
mov dword [rbx + 0x268], eax
jmp 0x18001d384
test ecx, ecx
je 0x18001d3f3
mov edx, dword [rbx + 0x88]
xor edx, dword [r15 + 8]
mov dword [r15 + 8], edx
mov ecx, edx
shr ecx, 0x10
mov eax, edx
shr eax, 8
xor cl, al
xor cl, dl
shr edx, 0x18
cmp dl, cl
jne 0x18001dc5d
lea r8, [r15 + 0x10]
mov r13, qword [r8]
mov rcx, qword [r15 + 0x18]
mov qword [rsp + 0xb0], rcx
mov rax, qword [rcx]
mov r9, qword [r13 + 8]
cmp rax, r9
jne 0x18001ddf1
cmp rax, r8
jne 0x18001ddf1
movzx eax, word [r15 + 8]
sub qword [rbx + 0xc0], rax
mov rdx, qword [rbx + 0x138]
test rdx, rdx
je 0x18001d47f
movzx r9d, word [r15 + 8]
mov ecx, dword [rdx + 8]
cmp r9, rcx
jb 0x18001d5c2
mov rax, qword [rdx]
test rax, rax
je 0x18001d455
mov rdx, rax
jmp 0x18001d43c
lea eax, [rcx - 1]
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x28], r9
mov dword [rsp + 0x20], eax
mov r9, r8
mov r8b, 1
mov rcx, rbx
call fcn.18005c30c
mov rcx, qword [rsp + 0xb0]
mov qword [rcx], r13
mov qword [r13 + 8], rcx
test byte [r15 + 0xa], 8
jne 0x18001d610
test r12b, r12b
jne 0x18001d72d
movzx eax, byte [r15 + 0xa]
mov byte [rsi + 0xa], al
movzx r8d, word [r15 + 8]
add r8, rdi
mov qword [rsp + 0x70], r8
cmp r8, 0xff00
ja 0x18001dddc
mov word [rsi + 8], r8w
movzx ecx, word [rbx + 0x8c]
xor cx, r8w
mov rax, r8
shl rax, 4
mov word [rax + rsi + 0xc], cx
movzx r15d, r8w
test r12b, r12b
jne 0x18001d67f
mov byte [rsi + 0xa], r12b
mov byte [rsi + 0xf], r12b
lea rdi, [rbx + 0x150]
cmp qword [rbx + 0x138], 0
je 0x18001dca3
mov edx, r15d
mov rcx, rbx
call fcn.18005c238
mov r8, rax
cmp rdi, r8
jne 0x18001d581
lea rdi, [rsi + 0x10]
mov rax, qword [r8 + 8]
mov rcx, qword [rax]
cmp rcx, r8
jne 0x18001dcbc
mov qword [rdi], r8
mov qword [rdi + 8], rax
mov qword [rax], rdi
mov qword [r8 + 8], rdi
movzx eax, word [rsi + 8]
add qword [rbx + 0xc0], rax
mov rdx, qword [rbx + 0x138]
test rdx, rdx
je 0x18001c749
movzx ecx, word [rsi + 8]
mov r8d, dword [rdx + 8]
cmp rcx, r8
jb 0x18001d66f
mov rax, qword [rdx]
test rax, rax
je 0x18001d570
mov rdx, rax
jmp 0x18001d556
lea eax, [r8 - 1]
mov qword [rsp + 0x148], rax
jmp 0x18001d302
cmp dword [rbx + 0x7c], 0
je 0x18001dcb2
mov ecx, dword [r8 - 8]
mov dword [rsp + 0x98], ecx
test dword [rbx + 0x7c], ecx
je 0x18001dcab
mov eax, dword [rbx + 0x88]
xor eax, ecx
mov dword [rsp + 0x98], eax
movzx eax, ax
cmp r15, rax
jbe 0x18001d515
mov r8, qword [r8]
jmp 0x18001d510
mov rax, r9
jmp 0x18001d458
mov rax, qword gs:[0x60]
test dword [rax + 0xbc], 0x800
je 0x18001d1bf
movzx r9d, word [rsi]
shr r14d, 0x12
mov edx, 0xff
and dx, r14w
mov dword [rsp + 0x20], 0
xor r8d, r8d
mov rcx, rbx
call fcn.1800ed110
mov byte [r15 + 0xb], al
jmp 0x18001d1bf
mov rdx, r15
mov rcx, rbx
call fcn.18005ca3c
test al, al
jne 0x18001d491
movzx r8d, word [r15 + 8]
mov r9b, 1
mov rdx, r15
mov rcx, rbx
call fcn.1800128f0
cmp dword [rsp + 0x48], 0
je 0x18001de11
mov rax, qword gs:[0x30]
mov dword [rax + 0x1250], 0xc000003c
mov rdi, qword gs:[0x30]
mov ecx, 0xc000003c
call sym.ntdll.dll_RtlNtStatusToDosError
mov dword [rdi + 0x68], eax
jmp 0x18001e114
mov rax, rcx
mov qword [rsp + 0x148], rcx
jmp 0x18001d302
movzx eax, byte [rsi + 0xa]
and al, 0xf0
mov byte [rsi + 0xa], al
mov byte [rsi + 0xf], 0
test byte [rbx + 0x70], 0x40
jne 0x18001dcdc
lea rdi, [rbx + 0x150]
cmp qword [rbx + 0x138], 0
je 0x18001dd60
mov rdx, r15
mov rcx, rbx
call fcn.18005c238
mov r8, rax
cmp rdi, r8
jne 0x18001dd68
lea rdi, [rsi + 0x10]
mov rax, qword [r8 + 8]
mov rcx, qword [rax]
cmp rcx, r8
jne 0x18001ddac
mov qword [rdi], r8
mov qword [rdi + 8], rax
mov qword [rax], rdi
mov qword [r8 + 8], rdi
movzx eax, word [rsi + 8]
add qword [rbx + 0xc0], rax
mov rdx, qword [rbx + 0x138]
test rdx, rdx
je 0x18001c749
movzx ecx, word [rsi + 8]
mov r8d, dword [rdx + 8]
cmp rcx, r8
jb 0x18001ddcc
mov rax, qword [rdx]
test rax, rax
jne 0x18001d7bf
lea eax, [r8 - 1]
mov qword [rsp + 0x158], rax
jmp 0x18001d302
movzx eax, byte [r15 + 0xa]
test al, 4
je 0x18001d49a
movzx r13d, word [r15 + 8]
shl r13, 4
sub r13, 0x20
mov qword [rsp + 0x140], r13
test al, 2
je 0x18001d765
cmp r13, 4
jbe 0x18001d765
sub r13, 4
mov qword [rsp + 0x140], r13
lea rcx, [r15 + 0x20]
mov r8d, 0xfeeefeee
mov rdx, r13
call sym.ntdll.dll_RtlCompareMemoryUlong
mov qword [rsp + 0x70], rax
cmp rax, r13
je 0x18001d49a
mov rdx, qword gs:[0x60]
cmp qword [rdx + 0x18], 0
je 0x18001dc6d
mov rdx, qword gs:[0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x10]
add rdx, 0x58
lea rcx, str.HEAP__wZ_:
call sym.ntdll.dll_DbgPrint
jmp 0x18001dc79
mov rdx, rax
jmp 0x18001d703
mov rax, qword gs:[0x30]
mov dword [rax + 0x1250], 0xc0000194
mov rdi, qword gs:[0x30]
mov ecx, 0xc0000194
call sym.ntdll.dll_RtlNtStatusToDosError
mov dword [rdi + 0x68], eax
jmp 0x18001e114
cmp qword [rbx + 0x178], 0
jne 0x18001bf58
jmp 0x18001c9c8
mov edx, 1
jmp 0x18001ce1c
cmp qword [rbx + 0x178], 0
jne 0x18001bf58
jmp 0x18001d21a
mov rdx, r14
mov rcx, rbx
call fcn.1800fbec0
jmp 0x18001cb73
dec eax
mov qword [rsp + 0xe8], rax
jmp 0x18001cbc7
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov r8, rdi
mov rdx, rbx
mov ecx, 0xd
call fcn.18009a4c0
mov rax, qword gs:[0x30]
mov dword [rax + 0x1250], 0xc0000017
mov rdi, qword gs:[0x30]
mov ecx, 0xc0000017
call sym.ntdll.dll_RtlNtStatusToDosError
mov dword [rdi + 0x68], eax
jmp 0x18001e114
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov rdx, rbx
lea ecx, [r9 + 3]
call fcn.18009a4c0
movzx edx, di
lea r11, [0x180119500]
jmp 0x18001c000
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov rdx, rbx
lea ecx, [r9 + 3]
call fcn.18009a4c0
movzx edx, di
lea r11, [0x180119500]
jmp 0x18001c056
add r14d, r14d
jmp 0x18001ca2f
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov rdx, rbx
lea ecx, [r9 + 3]
call fcn.18009a4c0
movzx edx, di
jmp 0x18001ca7e
add edi, edi
jmp 0x18001c12e
mov rdx, r14
mov rcx, rbx
call fcn.1800fbec0
lea r11, [0x180119500]
jmp 0x18001c186
lea eax, [r15 + r15]
jmp 0x18001c21c
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, r10
mov rdx, rbx
lea ecx, [rax + 3]
call fcn.18009a4c0
movzx edx, si
mov r8, qword [rsp + 0x68]
mov r9, qword [rsp + 0xe0]
mov r11, qword [rsp + 0x70]
jmp 0x18001c2c2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov r8, rsi
mov rdx, rbx
mov ecx, 0xd
call fcn.18009a4c0
jmp 0x18001e114
cmp dword [rbx + 0x7c], 0
je 0x18001ccd7
movzx eax, byte [r14 + 0xa]
xor al, dl
xor al, cl
mov byte [r14 + 0xb], al
mov eax, dword [rbx + 0x88]
xor dword [r14 + 8], eax
jmp 0x18001ccd7
mov rdx, r14
mov rcx, rbx
call fcn.18005ca3c
test al, al
jne 0x18001cdb4
movzx r8d, word [r14 + 8]
mov r9b, 1
mov rdx, r14
mov rcx, rbx
call fcn.1800128f0
jmp 0x18001e114
lea rcx, str.HEAP:
call sym.ntdll.dll_DbgPrint
mov r14, qword [rsp + 0x90]
lea r8, [r14 + 0x20]
add r8, r12
mov rdx, r14
lea rcx, str.HEAP:_Free_Heap_block__p_modified_at__p_after_it_was_freed_n
call sym.ntdll.dll_DbgPrint
call fcn.18010109c
movzx r15d, byte [rsp + 0x40]
mov r8d, dword [rsp + 0x34]
lea r11, [0x180119500]
mov r12d, dword [rsp + 0x60]
jmp 0x18001c33e
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, r14
mov rdx, rbx
lea ecx, [rax + 3]
call fcn.18009a4c0
jmp 0x18001e114
mov rax, r13
shl rax, 4
add rax, r14
mov qword [rax], rcx
mov byte [r14 + 0xf], 0x3f
jmp 0x18001c38d
lea rax, [r13 + 1]
add rax, rax
mov qword [r14 + rax*8], rcx
mov byte [r14 + 0xf], 0x3f
jmp 0x18001c772
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov rdx, rbx
lea ecx, [r9 + 3]
call fcn.18009a4c0
movzx edx, r12w
mov r9, qword [rsp + 0x58]
lea r11, [0x180119500]
jmp 0x18001c4f0
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [r10 - 0x10]
mov rdx, rbx
lea ecx, [rax + 3]
call fcn.18009a4c0
movzx r8d, r12w
mov r9, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
lea r11, [0x180119500]
jmp 0x18001c54e
add r9d, r9d
jmp 0x18001cc24
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [r12 - 0x10]
mov rdx, rbx
lea ecx, [rax + 3]
call fcn.18009a4c0
movzx r9d, word [rsp + 0x44]
mov rdx, qword [rsp + 0x68]
jmp 0x18001cc80
add edi, edi
jmp 0x18001c61c
mov rdi, qword [rax]
jmp 0x18001c639
mov eax, ecx
jmp 0x18001c66a
movzx eax, word [rdi - 8]
jmp 0x18001c66a
mov rdi, qword [rdi]
lea rax, [rbx + 0x150]
jmp 0x18001c639
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8, rdi
xor edx, edx
lea ecx, [rdx + 0xd]
call fcn.18009a4c0
jmp 0x18001c698
lea eax, [r12 + r12]
jmp 0x18001c6eb
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, r10
mov rdx, rbx
lea ecx, [rax + 3]
call fcn.18009a4c0
movzx r9d, word [rsp + 0x44]
mov r8, qword [rsp + 0x70]
jmp 0x18001c97e
mov rdx, r15
shl rdx, 4
sub rdx, 0x20
mov qword [rsp + 0xb8], rdx
lea r8, [rsi + 0x20]
mov qword [rsp + 0x120], r8
shr rdx, 2
mov qword [rsp + 0xb8], rdx
test rdx, rdx
je 0x18001dc13
test r8b, 4
je 0x18001dbef
mov dword [r8], 0xfeeefeee
sub rdx, 1
mov qword [rsp + 0xb8], rdx
je 0x18001dc13
add r8, 4
mov qword [rsp + 0x120], r8
mov rcx, rdx
shr rcx, 1
movabs rax, 0xfeeefeeefeeefeee
mov rdi, r8
rep stosq qword [rdi], rax
test dl, 1
je 0x18001dc13
mov dword [r8 + rdx*4 - 4], 0xfeeefeee
or byte [rsi + 0xa], 4
jmp 0x18001d24c
mov r8, qword [rdi]
jmp 0x18001d26f
mov eax, ecx
jmp 0x18001d2a1
movzx eax, word [r8 - 8]
jmp 0x18001d2a1
mov r8, qword [r8]
jmp 0x18001d26f
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor edx, edx
lea ecx, [rdx + 0xd]
call fcn.18009a4c0
jmp 0x18001d2cf
mov rdx, r15
mov rcx, rbx
call fcn.1800fbec0
jmp 0x18001d3f3
lea rcx, str.HEAP:
call sym.ntdll.dll_DbgPrint
mov r8, qword [rsp + 0x70]
add r8, 0x20
add r8, r15
mov rdx, r15
lea rcx, str.HEAP:_Free_Heap_block__p_modified_at__p_after_it_was_freed_n
call sym.ntdll.dll_DbgPrint
call fcn.18010109c
mov r12d, dword [rsp + 0x44]
jmp 0x18001d49a
mov r8, qword [rdi]
jmp 0x18001d510
mov eax, ecx
jmp 0x18001d5ae
movzx eax, word [r8 - 8]
jmp 0x18001d5ae
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor edx, edx
lea ecx, [rdx + 0xd]
call fcn.18009a4c0
jmp 0x18001d537
mov rdx, r15
shl rdx, 4
sub rdx, 0x20
mov qword [rsp + 0xc0], rdx
lea r8, [rsi + 0x20]
mov qword [rsp + 0x150], r8
shr rdx, 2
mov qword [rsp + 0xc0], rdx
test rdx, rdx
je 0x18001dd57
test r8b, 4
je 0x18001dd33
mov dword [r8], 0xfeeefeee
sub rdx, 1
mov qword [rsp + 0xc0], rdx
je 0x18001dd57
add r8, 4
mov qword [rsp + 0x150], r8
mov rcx, rdx
shr rcx, 1
movabs rax, 0xfeeefeeefeeefeee
mov rdi, r8
rep stosq qword [rdi], rax
test dl, 1
je 0x18001dd57
mov dword [r8 + rdx*4 - 4], 0xfeeefeee
or byte [rsi + 0xa], 4
jmp 0x18001d696
mov r8, qword [rdi]
jmp 0x18001d6b9
cmp dword [rbx + 0x7c], 0
je 0x18001dd93
mov ecx, dword [r8 - 8]
mov dword [rsp + 0x218], ecx
test dword [rbx + 0x7c], ecx
je 0x18001dd8f
mov eax, dword [rbx + 0x88]
xor eax, ecx
mov dword [rsp + 0x218], eax
jmp 0x18001dd98
mov eax, ecx
jmp 0x18001dd98
movzx eax, word [r8 - 8]
movzx eax, ax
cmp r15, rax
jbe 0x18001d6c2
mov r8, qword [r8]
jmp 0x18001d6b9
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor edx, edx
lea ecx, [rdx + 0xd]
call fcn.18009a4c0
jmp 0x18001d6e4
mov rax, rcx
mov qword [rsp + 0x158], rcx
jmp 0x18001d302
mov rdx, rsi
mov rcx, rbx
call fcn.180012f50
mov r8d, dword [rsp + 0x34]
jmp 0x18001c76a
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov ecx, 0xd
call fcn.18009a4c0
jmp 0x18001d636
mov dword [rsp + 0x48], 1
lea r11, [0x180119500]
jmp 0x18001c410
sub r13, 8
mov qword [rsp + 0x160], r13
jmp 0x18001c7af
mov rdx, r12
and rdx, 0xfffffffffffffffc
mov qword [rsp + 0xc8], rdx
mov r8, qword [rsp + 0x50]
mov qword [rsp + 0x168], r8
shr rdx, 2
mov qword [rsp + 0xc8], rdx
test rdx, rdx
je 0x18001d15b
test r8b, 4
je 0x18001de92
mov dword [r8], 0xbaadf00d
sub rdx, 1
mov qword [rsp + 0xc8], rdx
je 0x18001d15b
add r8, 4
mov qword [rsp + 0x168], r8
mov rcx, rdx
shr rcx, 1
movabs rax, 0xbaadf00dbaadf00d
mov rdi, r8
rep stosq qword [rdi], rax
test dl, 1
je 0x18001d15b
mov dword [r8 + rdx*4 - 4], 0xbaadf00d
jmp 0x18001d15b
mov rax, qword [rsp + 0x50]
movabs rcx, 0xabababababababab
mov qword [rax + r12], rcx
mov qword [rax + r12 + 8], rcx
mov rax, qword [rsp + 0x80]
or byte [rax + 0xa], 4
jmp 0x18001d165
mov ecx, 1
call fcn.1800244c4
mov word [rdi], ax
jmp 0x18001d1a6
movzx r9d, word [rsi]
shr r14d, 0x12
mov edx, 0xfff
and dx, r14w
mov dword [rsp + 0x20], 0
xor r8d, r8d
mov rcx, rbx
call fcn.1800ed110
mov rcx, qword [rsp + 0x170]
mov word [rcx + 2], ax
jmp 0x18001d1bf
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov ecx, 0xd
call fcn.18009a4c0
jmp 0x18001e114
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x226
jmp 0x18001cfb0
mov rax, qword gs:[0x60]
test byte [rax + 0x378], 1
je 0x18001cfb9
mov r9d, 9
mov r8, qword [rsp + 0x278]
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.1800fdf54
jmp 0x18001cfb9
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x226
jmp 0x18001cfc9
mov rax, qword gs:[0x60]
test byte [rax + 0x378], 1
je 0x18001cfd2
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x18001dff3
mov rax, qword gs:[0x60]
mov rdi, qword [rax + 0x90]
add rdi, 0x226
movzx eax, byte [rdi]
mov r9, qword [rbx + 0xc0]
shl r9, 4
mov qword [rsp + 0x20], rax
mov r8, qword [rsp + 0x278]
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.1800fe1c8
jmp 0x18001cfd2
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x230
jmp 0x18001cfe6
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x18001e05c
mov rax, qword gs:[0x60]
mov rdi, qword [rax + 0x90]
add rdi, 0x230
movzx eax, byte [rdi]
mov r9, qword [rbx + 0xc0]
shl r9, 4
mov qword [rsp + 0x20], rax
mov r8, qword [rsp + 0x278]
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.1800fe1c8
jmp 0x18001cfef
mov ecx, 1
call fcn.1800244c4
mov rcx, qword [rsp + 0x38]
mov word [rcx + 0x10], ax
jmp 0x18001cffc
mov rax, qword [rsp + 0x38]
mov r9, qword [rax + 0x20]
shr r9, 4
shr r14d, 0x12
mov edx, 0xff
and dx, r14w
mov dword [rsp + 0x20], 1
xor r8d, r8d
mov rcx, rbx
call fcn.1800ed110
mov rcx, qword [rsp + 0x38]
mov word [rcx + 0x12], ax
jmp 0x18001d015
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor edx, edx
lea ecx, [rdx + 0xd]
call fcn.18009a4c0
jmp 0x18001d060
mov qword [rsp + 0x38], 0
inc dword [rbx + 0x258]
mov qword [rsp + 0x50], 0
cmp byte [rsp + 0x30], 0
jne 0x18001e1a1
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
test rcx, rcx
jne 0x1800ab58b
mov ecx, 0x7ffe0388
mov rdi, qword [rsp + 0x50]
cmp byte [rcx], 0
jne 0x1800ab5b0
mov rax, rdi
add rsp, 0x220
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rax, qword gs:[0x60]
test dword [rax + 0xbc], 0x800
jne 0x18001be73
or r12b, 8
mov dword [rsp + 0x60], r12d
jmp 0x18001be73
add qword [rsp + 0x278], 0x10
mov r13d, 2
mov qword [rsp + 0x58], r13
jmp 0x18001be56
cmp qword [rsp + 0x38], 0
je 0x18001e26a
mov rcx, qword [rbx + 0x160]
call sym.ntdll.dll_RtlLeaveCriticalSection
jmp 0x18001e11f
mov dword [rsp + 0x34], ecx
mov rax, qword [rsp + 0x288]
mov dword [rax], 4
movabs rax, 0x7fffffffffffffff
cmp r15, rax
ja 0x1800ab556
test r14d, 0x61000000
jne 0x1800ab55d
test r15, r15
je 0x1800ab576
mov rax, r15
mov r13, qword [rbx + 0x100]
add r13, rax
and r13, qword [rbx + 0x108]
cmp r13, 0x20
jb 0x1800ab580
mov qword [rsp + 0x278], r13
mov r12d, r14d
shr r12d, 4
and r12b, 0xe1
or r12b, 1
mov dword [rsp + 0x60], r12d
test r14d, 0x3c000100
je 0x18001e25f
or r12b, 2
mov dword [rsp + 0x60], r12d
add r13, 0x10
mov qword [rsp + 0x278], r13
shr r13, 4
mov qword [rsp + 0x58], r13
jmp 0x18001be64
cmp qword [rbx + 0x148], rcx
je 0x18001e251
jmp 0x18001e23c
cmp qword [rsp + 0x50], 0
je 0x18001e1ad
mov rcx, rbx
call fcn.18008383c
jmp 0x18001e1ad
xor eax, eax
jmp 0x18001e14e
bt r14d, 0x1c
jb 0x18001e1f0
mov rcx, rbx
call fcn.1800ff4c0
nop
jmp 0x18001e14e
mov eax, 1
jmp 0x18001e1fc
mov r13d, 0x20
jmp 0x18001e217
cmp dword [rcx], 0
je 0x18001e138
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x22e
jmp 0x18001e13d
test rdi, rdi
je 0x18001e14b
mov r8, qword [rsp + 0x38]
test r8, r8
je 0x18001e14b
mov rdx, r8
and rdx, 0xffffffffffff0000
mov r8, qword [r8 + 0x28]
mov rcx, rbx
call fcn.1800fc474
nop
jmp 0x18001e14b