Function at 0x180016df0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push r12
sub rsp, 0x80
mov rbp, r8
mov r12d, edx
mov rdi, rcx
test r8, r8
je 0x180017032
mov qword [rsp + 0x78], rsi
xor esi, esi
test rcx, rcx
je 0x1800a98ce
cmp dword [rdi + 0x10], 0xddeeddee
je 0x180017020
test byte [0x18015d028], 2
jne 0x18001733a
test dword [rdi + 0x74], 0x1000000
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0x68], r14
mov r14, rsi
jne 0x1800171d8
test byte [rdi + 0x78], 1
jne 0x1800a990d
test bpl, 0xf
jne 0x1800a9955
lea r14, [rbp - 0x10]
prefetchw byte [r14]
cmp byte [r14 + 0xf], 5
je 0x1800a9920
test byte [r14 + 0xf], 0x3f
je 0x1800a9931
test r14, r14
je 0x1800a9adc
cmp byte [rbp - 1], 5
je 0x1800a9977
cmp byte [r14 + 0xf], sil
jge 0x1800171d8
mov rdx, qword [0x18015d458]
mov rcx, r14
shr rcx, 4
xor ecx, dword [r14 + 8]
xor ecx, edx
mov qword [rsp + 0x70], r13
xor ecx, edi
mov qword [rsp + 0x60], r15
test cx, cx
jne 0x1800a9bcb
shr rcx, 0xc
mov rax, r14
sub rax, rcx
mov r15, qword [rax]
test r15, r15
je 0x1800a9bcb
prefetchw byte [r15]
mov r9, qword [r15 + 8]
mov eax, dword [r14 + 0xc]
shr eax, 8
movzx r13d, ax
mov rax, qword [r15]
mov qword [rsp + 0x40], r9
mov rcx, qword [rax]
mov eax, dword [r9 + 0x18]
xor eax, r9d
mov rbx, qword [rcx + 0x18]
xor eax, ebx
xor eax, edx
mov r8d, eax
shr eax, 0x10
imul eax, r13d
movzx r8d, r8w
add rax, r9
add r8, rax
cmp r8, r14
jne 0x1800a9b0a
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
jne 0x1800a9b13
mov ecx, 0x7ffe0380
cmp byte [rcx], sil
jne 0x1800a9b2f
cmp word [0x7ffe036a], 1
mov edx, 0x64
jbe 0x1800a9b5e
mov r8d, esi
mov r9d, 0x8000
mov ebx, dword [r15 + 0x20]
mov eax, ebx
shr eax, 0x10
test r9w, ax
jne 0x180017326
mov ecx, ebx
mov eax, ebx
or ecx, 0x80000000
lock cmpxchg dword [r15 + 0x20], ecx
jne 0x180017326
mov byte [r14 + 0xf], 0x80
cmp ebx, 0xffffffff
je 0x18001737a
mov r14, qword [rsp + 0x40]
mov rax, qword [r14 + 0x28]
btr qword [rax], r13
cmp word [r15 + 0x10], si
jne 0x18001738c
mov r8d, esi
inc r8d
shl r13d, 0x10
movzx eax, bx
add eax, r8d
mov r8, qword [r15]
or eax, r13d
cmp ax, word [r15 + 0x28]
je 0x180017043
mov dword [r15 + 0x20], eax
mov eax, dword [r15 + 0x2c]
test al, 2
je 0x1800171fc
mov r15, qword [rsp + 0x60]
mov esi, 1
mov r13, qword [rsp + 0x70]
mov rcx, rdi
call fcn.1800173e0
test eax, eax
jne 0x1800a9bed
mov rbx, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x68]
mov eax, esi
mov rsi, qword [rsp + 0x78]
add rsp, 0x80
pop r12
pop rdi
pop rbp
ret
mov r8d, r12d
mov rdx, rbp
mov rcx, rdi
call fcn.180017430
mov esi, eax
jmp 0x18001700d
mov eax, 1
add rsp, 0x80
pop r12
pop rdi
pop rbp
ret
mov rcx, qword [r8]
mov r9d, dword [r8 + 0xa8]
mov edx, dword [rcx + 0x20]
mov ecx, dword [r8 + 0xa4]
cmp ecx, 1
jne 0x180017070
cmp edx, r9d
jb 0x180017070
mov rcx, qword [r8]
sub edx, r9d
cmp edx, dword [rcx + 0x24]
jb 0x180016fd1
mov r14, qword [r15]
mov rbx, rsi
xchg qword [r14 + 8], rbx
test rbx, rbx
je 0x180017133
prefetchw byte [rbx + 0x2c]
mov eax, dword [rbx + 0x2c]
mov ecx, eax
and ecx, 0xfffffff9
lock cmpxchg dword [rbx + 0x2c], ecx
jne 0x18001708a
cmp eax, 6
je 0x1800173c4
mov rdx, rbx
mov rcx, r14
call fcn.180014fcc
test al, al
je 0x180017133
mov eax, dword [rbx + 0x2c]
test eax, eax
je 0x180017133
test al, 2
jne 0x180017133
mov ecx, eax
or ecx, 2
lock cmpxchg dword [rbx + 0x2c], ecx
jne 0x1800170b2
mov r9, qword [rbx]
mov r8d, esi
movzx eax, word [r9 + 0xae]
add eax, r8d
and eax, 0xf
mov rdx, qword [r9 + rax*8 + 0x10]
lea rcx, [r9 + rax*8]
test rdx, rdx
je 0x180017316
mov eax, dword [rdx + 0x2c]
test al, 1
jne 0x1800172df
mov rax, rdx
lock cmpxchg qword [rcx + 0x10], rbx
jne 0x1800172df
prefetchw byte [rdx + 0x2c]
mov eax, dword [rdx + 0x2c]
mov ecx, eax
and ecx, 0xfffffffd
lock cmpxchg dword [rdx + 0x2c], ecx
jne 0x180017110
cmp eax, 2
jne 0x180017133
mov rax, qword [rdx]
mov rcx, qword [rax]
mov qword [rdx], rsi
add rdx, 0x30
call fcn.18009e460
test byte [r15 + 0x26], 3
mov rax, qword [r14]
mov r14, qword [r15]
mov rbx, qword [rax + 0x18]
jne 0x1800a9b65
mov rax, qword [r15 + 8]
mov rcx, rbx
mov dword [rax + 0x14], esi
mov rdx, qword [r15 + 8]
call fcn.180013ac8
movzx edx, word [r15 + 0x28]
neg edx
mov rax, qword [r14 + 0xa0]
lea ecx, [rax + rdx]
mov dword [rsp + 0xb8], ecx
mov rcx, rax
shr rcx, 0x20
dec ecx
mov dword [rsp + 0xbc], ecx
mov rcx, qword [rsp + 0xb8]
lock cmpxchg qword [r14 + 0xa0], rcx
jne 0x180017162
mov qword [r15 + 8], rsi
lock inc dword [rbx + 0x3c]
mov dword [r15 + 0x20], esi
prefetchw byte [r15 + 0x2c]
mov eax, dword [r15 + 0x2c]
mov ecx, eax
and ecx, 0xfffffffe
lock cmpxchg dword [r15 + 0x2c], ecx
jne 0x1800171ab
cmp eax, 1
jne 0x180016fe1
mov rax, qword [r15]
lea rdx, [r15 + 0x30]
mov rcx, qword [rax]
mov qword [r15], rsi
call fcn.18009e460
jmp 0x180016fe1
mov edx, r12d
mov r9, rbp
or edx, 2
mov r8, r14
mov rcx, rdi
call fcn.1800150a0
movzx esi, al
test al, al
jne 0x180016ff0
jmp 0x180017000
mov rdx, r15
mov rcx, r8
call fcn.180014fcc
test al, al
je 0x180016fe1
mov eax, dword [r15 + 0x2c]
test eax, eax
je 0x180016fe1
test al, 2
jne 0x180016fe1
mov ecx, eax
or ecx, 2
lock cmpxchg dword [r15 + 0x2c], ecx
jne 0x18001720f
mov r9, qword [r15]
mov r8d, esi
movzx eax, word [r9 + 0xae]
add eax, r8d
and eax, 0xf
mov rdx, qword [r9 + rax*8 + 0x10]
lea rcx, [r9 + rax*8]
test rdx, rdx
je 0x180017291
mov eax, dword [rdx + 0x2c]
test al, 1
je 0x1800172a1
inc r8d
cmp r8d, 0x10
jb 0x180017236
mov rax, qword [r15]
lea rdx, [r15 + 0x30]
movzx r8d, word [rax + 0xac]
mov rax, qword [rax]
mov rcx, qword [rax + 0x18]
mov rcx, qword [rcx + r8*8 + 0x4a8]
add rcx, 0x90
call fcn.18009e460
jmp 0x180016fe1
xor eax, eax
lock cmpxchg qword [rcx + 0x10], r15
je 0x180016fe1
jmp 0x180017259
mov rax, rdx
lock cmpxchg qword [rcx + 0x10], r15
jne 0x180017259
prefetchw byte [rdx + 0x2c]
mov eax, dword [rdx + 0x2c]
mov ecx, eax
and ecx, 0xfffffffd
lock cmpxchg dword [rdx + 0x2c], ecx
jne 0x1800172b3
cmp eax, 2
jne 0x180016fe1
mov rax, qword [rdx]
mov rcx, qword [rax]
mov qword [rdx], rsi
add rdx, 0x30
call fcn.18009e460
jmp 0x180016fe1
inc r8d
cmp r8d, 0x10
jb 0x1800170cf
mov rax, qword [rbx]
lea rdx, [rbx + 0x30]
movzx r8d, word [rax + 0xac]
mov rax, qword [rax]
mov rcx, qword [rax + 0x18]
mov rcx, qword [rcx + r8*8 + 0x4a8]
add rcx, 0x90
jmp 0x18001712e
xor eax, eax
lock cmpxchg qword [rcx + 0x10], rbx
je 0x180017133
jmp 0x1800172df
inc r8d
cmp r8d, edx
jbe 0x180016f65
or ebx, 0xffffffff
jmp 0x180016f8e
lea rax, [rsp + 0xb0]
mov r8d, r12d
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov rcx, rdi
call fcn.180017f70
mov esi, eax
test eax, eax
je 0x18001700d
movzx eax, word [rsp + 0xb0]
test ax, ax
je 0x18001700d
jmp 0x1800a98eb
lea rdx, [r14 + 0x10]
lea rcx, [r15 + 0x10]
call fcn.18009e460
jmp 0x180016fe1
lea rcx, [r15 + 0x10]
call fcn.18009e4a0
mov r8d, esi
test rax, rax
je 0x180016fb7
mov edx, dword [rax - 4]
inc r8d
mov rax, qword [rax]
mov rcx, qword [r14 + 0x28]
shr edx, 8
movzx r13d, dx
btr qword [rcx], r13
test rax, rax
je 0x180016fb7
jmp 0x1800173a1
mov rax, qword [rbx]
lea rdx, [rbx + 0x30]
mov rcx, qword [rax]
mov qword [rbx], rsi
jmp 0x18001712e
xor edx, edx
mov qword [rsp + 0x28], rsi
xor r9d, r9d
mov qword [rsp + 0x20], rsi
lea ecx, [rdx + 0x13]
call fcn.18009a4c0
nop
jmp 0x180016e1e
mov r8, qword [rsp + 0x38]
movzx ecx, ax
neg r8
mov rax, qword [0x18015aa38]
mov rdx, qword [rax + rcx*8 - 8]
lock xadd qword [rdx + 0x20], r8
jmp 0x18001700d
mov rdx, rbp
mov rcx, rdi
call fcn.18006377c
mov r14, rax
jmp 0x180016e87
movzx eax, byte [r14 + 0xe]
shl rax, 4
sub r14, rax
jmp 0x180016e7c
xor r9d, r9d
mov qword [rsp + 0x28], rsi
mov r8, r14
mov qword [rsp + 0x20], rsi
mov rdx, rdi
lea ecx, [r9 + 8]
call fcn.18009a4c0
mov r14, rsi
jmp 0x180016e87
xor r9d, r9d
mov qword [rsp + 0x28], rsi
mov r8, rbp
mov qword [rsp + 0x20], rsi
mov rdx, rdi
lea ecx, [r9 + 9]
call fcn.18009a4c0
nop
jmp 0x180016e87
cmp byte [r14 + 0xf], sil
jge 0x1800a9994
mov rdx, r14
mov rcx, rdi
call fcn.180102a20
movzx ebx, al
test al, al
jne 0x1800a99be
jmp 0x1800a9a6f
cmp dword [rdi + 0x7c], esi
je 0x1800a99be
mov eax, dword [r14 + 8]
mov edx, dword [rdi + 0x88]
xor edx, eax
mov ecx, edx
mov eax, edx
shr ecx, 0x10
shr eax, 8
xor cl, al
xor cl, dl
shr edx, 0x18
cmp dl, cl
jne 0x1800a9a6d
cmp byte [r14 + 0xf], sil
jge 0x1800a99f4
mov rcx, r14
shr rcx, 4
xor ecx, dword [r14 + 8]
xor ecx, dword [0x18015d458]
xor ecx, edi
test cx, cx
je 0x1800a99e1
mov rax, rsi
jmp 0x1800a99ee
shr rcx, 0xc
mov rax, r14
sub rax, rcx
mov rax, qword [rax]
movzx eax, word [rax + 0x24]
jmp 0x1800a9a1c
cmp dword [rdi + 0x7c], esi
je 0x1800a9a17
mov eax, dword [r14 + 8]
mov dword [rsp + 0x48], eax
test dword [rdi + 0x7c], eax
je 0x1800a9a10
xor eax, dword [rdi + 0x88]
mov dword [rsp + 0x48], eax
movzx eax, word [rsp + 0x48]
jmp 0x1800a9a1c
movzx eax, word [r14 + 8]
cmp byte [r14 + 0xf], 4
movzx edx, ax
jne 0x1800a9a5d
cmp dword [rdi + 0x7c], esi
je 0x1800a9a49
mov eax, dword [r14 + 8]
mov dword [rsp + 0x48], eax
test dword [rdi + 0x7c], eax
je 0x1800a9a42
xor eax, dword [rdi + 0x88]
mov dword [rsp + 0x48], eax
movzx eax, word [rsp + 0x48]
jmp 0x1800a9a4e
movzx eax, word [r14 + 8]
mov rcx, qword [r14 - 0x10]
movzx eax, ax
sub rcx, rax
add rcx, rdx
jmp 0x1800a9a64
mov rcx, rdx
shl rcx, 4
lea rax, [rcx + r14]
cmp rax, rbp
jae 0x1800a9a90
xor bl, bl
mov qword [rsp + 0x28], rsi
mov r9, rbp
mov r8, r14
mov qword [rsp + 0x20], rsi
mov rdx, rdi
mov ecx, 3
call fcn.18009a4c0
test bl, bl
je 0x1800a9adc
test r12d, 0x3c000102
jne 0x180016e9a
cmp byte [rbp - 1], 5
lea rcx, [rbp - 0x10]
jne 0x1800a9ab8
movzx eax, byte [rcx + 0xe]
shl rax, 4
sub rcx, rax
add rcx, 0x10
jmp 0x1800a9abb
mov rcx, rsi
mov qword [rsp + 0x20], rcx
mov r9d, 3
mov ecx, dword [rbp - 8]
mov r8, rbp
mov rdx, rdi
call fcn.1800ebde8
test eax, eax
jns 0x180016e9a
mov rax, qword gs:[0x30]
mov ecx, 0xc000000d
mov dword [rax + 0x1250], 0xc000000d
mov rbx, qword gs:[0x30]
call sym.ntdll.dll_RtlNtStatusToDosError
mov dword [rbx + 0x68], eax
jmp 0x180017000
mov rdx, qword [rbx + 0x18]
jmp 0x1800a9bce
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x226
jmp 0x180016f3f
mov rax, qword gs:[0x60]
test byte [rax + 0x378], 1
je 0x180016f48
mov rcx, qword [rbx + 0x18]
lea rdx, [r14 + 0x10]
mov r8d, 2
call fcn.1800fe26c
nop
jmp 0x180016f48
mov edx, esi
jmp 0x180016f5c
mov rax, qword [r15 + 8]
mov rcx, r15
add rax, 0x1037
and rax, 0xfffffffffffff000
mov qword [rsp + 0x58], rax
call fcn.180102608
mov rcx, qword [rbx + 0x18]
movzx edx, ax
movzx eax, word [r15 + 0x28]
imul rax, rdx
mov edx, 1
shl rax, 4
mov qword [rsp + 0x50], rax
call fcn.18002ae30
mov r9d, eax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x30]
or rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x20], rax
call sym.ntdll.dll_NtProtectVirtualMemory
nop
jmp 0x180017148
mov rdx, rdi
xor r9d, r9d
mov qword [rsp + 0x28], rsi
mov r8, r14
mov qword [rsp + 0x20], rsi
lea ecx, [r9 + 3]
call fcn.18009a4c0
nop
jmp 0x180016fe1
bt r12d, 0x1c
jb 0x180017000
mov rdx, rbp
mov rcx, rdi
call fcn.1800fd5bc
nop
jmp 0x180017000