Function at 0x1800150a0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1d0
mov r14, r8
mov edi, edx
mov rbx, rcx
mov r12b, 1
mov byte [rsp + 0x49], r12b
mov byte [rsp + 0x48], 0
mov dword [rsp + 0x8c], 1
xor r13d, r13d
mov qword [rsp + 0xa0], r13
mov word [rsp + 0x4c], r13w
cmp rcx, r8
jne 0x18001511a
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov rdx, rcx
lea ecx, [r13 + 9]
call fcn.18009a4c0
xor eax, eax
jmp 0x180016a5f
or edi, dword [rcx + 0x74]
test edi, 0x7d010f60
je 0x180015150
xor r12b, r12b
mov byte [rsp + 0x49], r12b
mov r8d, 4
test edi, 0x61000000
je 0x180015156
bt edi, 0x1c
jb 0x180015156
mov r8, r9
mov edx, edi
call fcn.1800ffeb0
jmp 0x180016a5f
mov r8d, 3
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
test rcx, rcx
je 0x18001518e
cmp dword [rcx], r13d
je 0x18001518e
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x226
mov esi, 0x7ffe0380
jmp 0x180015195
mov esi, 0x7ffe0380
mov ecx, esi
cmp byte [rcx], r13b
je 0x1800151dc
mov rax, qword gs:[0x60]
test byte [rax + 0x378], 1
je 0x1800151dc
mov ecx, dword [rbx + 0x7c]
shr ecx, 0x11
movzx eax, byte [rbx + 0x8a]
and ecx, eax
mov r15, qword [rsp + 0x210]
movzx eax, byte [r15 + 0xa]
xor ecx, eax
test cl, 8
jne 0x1800151e4
mov rdx, r9
mov rcx, rbx
call fcn.1800fe26c
jmp 0x1800151e4
mov r15, qword [rsp + 0x210]
test dil, 1
jne 0x1800152fc
mov rcx, qword [rbx + 0x160]
mov rax, qword gs:[0x30]
lock btr dword [rcx + 8], 0
mov rax, qword [rax + 0x48]
jae 0x18001521d
mov qword [rcx + 0x10], rax
mov dword [rcx + 0xc], 1
inc dword [rbx + 0x248]
jmp 0x180015250
cmp qword [rcx + 0x10], rax
jne 0x18001522e
inc dword [rcx + 0xc]
inc dword [rbx + 0x248]
jmp 0x180015250
cmp byte [0x18015c3a8], 0
jne 0x1800152b6
mov rcx, qword [rbx + 0x160]
call sym.ntdll.dll_RtlEnterCriticalSection
mov edx, 1
mov rcx, rbx
call fcn.18007c6f0
mov byte [rsp + 0x48], 1
mov r15, qword [rsp + 0x210]
cmp dword [rbx + 0x7c], 0
je 0x180015291
mov edx, dword [rbx + 0x88]
xor edx, dword [r15 + 8]
mov dword [r15 + 8], edx
mov ecx, edx
shr ecx, 0x10
mov eax, edx
shr eax, 8
xor cl, al
xor cl, dl
shr edx, 0x18
cmp dl, cl
je 0x180015291
mov rdx, r15
mov rcx, rbx
call fcn.1800fbec0
movzx edx, word [r15 + 8]
mov rcx, qword [rbx + 0x138]
nop dword [rax]
mov eax, dword [rcx + 8]
cmp rdx, rax
jb 0x180015330
mov rcx, qword [rcx]
test rcx, rcx
je 0x180015330
jmp 0x1800152a0
mov rax, qword gs:[0x30]
mov dword [rax + 0x1250], 0xc0000194
mov rdi, qword gs:[0x30]
mov qword [rsp + 0x128], rdi
mov ecx, 0xc0000194
call sym.ntdll.dll_RtlNtStatusToDosError
mov dword [rdi + 0x68], eax
mov dword [rsp + 0x8c], r13d
mov qword [rsp + 0x210], r13
jmp 0x18001693a
cmp dword [rbx + 0x7c], 0
je 0x180015330
mov edx, dword [rbx + 0x88]
xor edx, dword [r15 + 8]
mov dword [r15 + 8], edx
mov ecx, edx
shr ecx, 0x10
mov eax, edx
shr eax, 8
xor cl, al
xor cl, dl
shr edx, 0x18
cmp dl, cl
je 0x180015330
mov rdx, r15
mov rcx, rbx
call fcn.1800fbec0
lea r8, [r15 + 0xa]
movzx eax, byte [r8]
test al, 8
je 0x180015341
and al, 0xf7
mov byte [r8], al
cmp byte [r15 + 0xf], 4
je 0x1800166cd
lea rsi, [r15 + 8]
movzx eax, word [rsi]
cmp ax, word [rbx + 0x190]
jae 0x1800153a1
movzx ecx, ax
mov eax, ecx
shr rax, 3
and cl, 7
movzx edx, byte [rax + rbx + 0x192]
mov edi, 1
shl edi, cl
test dl, dil
jne 0x180015399
movzx ecx, word [rsi]
mov rax, qword [rbx + 0x188]
lea rdx, [rax + rcx*2]
movzx eax, word [rdx]
cmp ax, 1
jbe 0x180015399
dec ax
mov word [rdx], ax
mov r15, qword [rsp + 0x210]
test r12b, r12b
jne 0x180015407
mov rax, qword gs:[0x60]
mov ecx, dword [rax + 0xbc]
mov dword [rsp + 0xc0], ecx
mov r15, qword [rsp + 0x210]
bt ecx, 0xb
jae 0x180015407
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov rcx, rbx
test byte [r8], 2
movzx r8d, word [r14 + 8]
je 0x1800153f1
mov eax, r8d
add rax, rax
movzx edx, word [r15 + rax*8 - 0xe]
jmp 0x1800153fd
movzx eax, byte [r15 + 0xb]
mov byte [rsp + 0x70], al
movzx edx, ax
call fcn.1800ed110
mov word [rsp + 0x4c], ax
movzx r8d, word [rsi]
mov qword [rsp + 0x58], r8
test byte [rbx + 0x70], 0x80
jne 0x180015e6a
xor dil, dil
mov byte [rsp + 0x40], dil
mov qword [rsp + 0xd8], r15
movzx ecx, word [rbx + 0x8c]
movzx eax, word [r15 + 0xc]
xor rcx, rax
shl rcx, 4
mov r12, r15
sub r12, rcx
mov qword [rsp + 0x50], r12
cmp r12, r15
je 0x1800157c2
mov ecx, dword [rbx + 0x7c]
mov eax, ecx
shr eax, 0x14
and al, byte [rbx + 0x8a]
xor al, byte [r12 + 0xa]
test al, 1
jne 0x1800157c2
test ecx, ecx
je 0x1800154a0
mov edx, dword [rbx + 0x88]
xor edx, dword [r12 + 8]
mov dword [r12 + 8], edx
mov ecx, edx
shr ecx, 0x10
mov eax, edx
shr eax, 8
xor cl, al
xor cl, dl
shr edx, 0x18
cmp dl, cl
je 0x1800154a0
mov rdx, r12
mov rcx, rbx
call fcn.1800fbec0
lea r11, [r12 + 0x10]
mov rdi, qword [r11]
mov qword [rsp + 0x78], rdi
mov rax, qword [r12 + 0x18]
mov qword [rsp + 0x80], rax
mov rax, qword [rax]
mov r9, qword [rdi + 8]
cmp rax, r9
jne 0x18001579e
cmp rax, r11
jne 0x18001579e
movzx eax, word [r12 + 8]
sub qword [rbx + 0xc0], rax
mov rdi, qword [rbx + 0x138]
test rdi, rdi
je 0x180015616
movzx r13d, word [r12 + 8]
mov ecx, dword [rdi + 8]
cmp r13, rcx
jae 0x18001550b
mov qword [rsp + 0xc8], r13
mov ecx, r13d
jmp 0x180015523
mov rax, qword [rdi]
test rax, rax
jne 0x180015699
dec ecx
mov eax, ecx
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0x60], r13
mov esi, ecx
sub esi, dword [rdi + 0x18]
cmp dword [rdi + 0xc], 0
je 0x180015538
lea eax, [rsi + rsi]
jmp 0x18001553a
mov eax, esi
lea r9, [rax*8]
mov qword [rsp + 0x60], r9
mov r8, qword [rdi + 0x30]
mov r10, qword [r8 + r9]
dec dword [rdi + 0x10]
mov eax, dword [rdi + 8]
lea edx, [rax - 1]
cmp ecx, edx
jne 0x18001555f
dec dword [rdi + 0x14]
cmp r10, r11
jne 0x180015613
mov dword [rsp + 0x90], eax
cmp qword [rdi], 0
cmove eax, edx
mov dword [rsp + 0x90], eax
mov r14, qword [r11]
mov rdx, qword [rdi + 0x20]
cmp ecx, eax
jae 0x180015685
cmp r14, rdx
je 0x18001565a
lea r8, [r14 - 0x10]
mov edx, dword [r8 + 8]
mov dword [rsp + 0x140], edx
cmp dword [rbx + 0x7c], 0
je 0x180015603
mov r12d, dword [rbx + 0x88]
xor r12d, edx
mov dword [rsp + 0x140], r12d
movzx edx, r12w
mov ecx, r12d
shr ecx, 0x10
mov eax, r12d
shr eax, 8
xor cl, al
xor cl, r12b
mov eax, r12d
shr eax, 0x18
cmp al, cl
je 0x1800155fe
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov rdx, rbx
lea ecx, [rax + 3]
call fcn.18009a4c0
movzx edx, r12w
mov r9, qword [rsp + 0x60]
mov r12, qword [rsp + 0x50]
movzx eax, dx
sub r13d, eax
jne 0x18001565a
mov rax, qword [rdi + 0x30]
mov qword [r9 + rax], r14
xor r13d, r13d
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
mov qword [rcx], rax
mov qword [rax + 8], rcx
test byte [r12 + 0xa], 8
je 0x1800156a1
mov rdx, r12
mov rcx, rbx
call fcn.18005ca3c
test al, al
jne 0x1800156a1
movzx r8d, word [r12 + 8]
mov r9b, 1
mov rdx, r12
mov rcx, rbx
call fcn.1800128f0
jmp 0x1800157b8
mov rax, qword [rdi + 0x30]
xor r13d, r13d
mov qword [r9 + rax], r13
mov eax, esi
shr eax, 5
and esi, 0x1f
mov edx, 1
movzx ecx, sil
shl edx, cl
mov ecx, eax
mov rax, qword [rdi + 0x28]
not edx
and dword [rax + rcx*4], edx
jmp 0x180015616
xor r13d, r13d
cmp r14, rdx
je 0x180015693
mov qword [r8 + r9], r14
jmp 0x180015616
mov qword [r8 + r9], r13
jmp 0x180015665
mov rdi, rax
jmp 0x1800154f6
movzx eax, byte [r12 + 0xa]
test al, 4
je 0x180015751
movzx edi, word [r12 + 8]
shl rdi, 4
sub rdi, 0x20
mov qword [rsp + 0xd0], rdi
test al, 2
je 0x1800156db
cmp rdi, 4
jbe 0x1800156db
sub rdi, 4
mov qword [rsp + 0xd0], rdi
lea rcx, [r12 + 0x20]
mov r8d, 0xfeeefeee
mov rdx, rdi
call sym.ntdll.dll_RtlCompareMemoryUlong
mov rsi, rax
cmp rax, rdi
je 0x180015751
mov rcx, qword gs:[0x60]
cmp qword [rcx + 0x18], 0
je 0x180015729
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
mov rdx, qword [rdx + 0x10]
add rdx, 0x58
lea rcx, str.HEAP__wZ_:
call sym.ntdll.dll_DbgPrint
jmp 0x180015735
lea rcx, str.HEAP:
call sym.ntdll.dll_DbgPrint
lea r8, [r12 + 0x20]
add r8, rsi
mov rdx, r12
lea rcx, str.HEAP:_Free_Heap_block__p_modified_at__p_after_it_was_freed_n
call sym.ntdll.dll_DbgPrint
call fcn.18010109c
mov byte [r12 + 0xa], 0
mov byte [r12 + 0xf], 0
mov r15, r12
mov qword [rsp + 0xd8], r12
movzx eax, word [r12 + 8]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov qword [rsp + 0x58], rcx
mov word [r12 + 8], cx
mov rcx, qword [rsp + 0x58]
mov rdx, rcx
add rdx, rdx
movzx eax, word [rbx + 0x8c]
xor ax, cx
mov word [r12 + rdx*8 + 0xc], ax
jmp 0x1800157b8
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
mov r8, r11
mov rdx, rbx
mov ecx, 0xd
call fcn.18009a4c0
mov r8, qword [rsp + 0x58]
movzx edi, byte [rsp + 0x40]
mov r14, r8
shl r14, 4
add r14, r15
mov qword [rsp + 0x50], r14
cmp dword [rbx + 0x7c], 0
je 0x180015830
mov eax, dword [r14 + 8]
mov dword [rsp + 0x150], eax
mov edx, dword [rbx + 0x88]
xor edx, eax
mov dword [rsp + 0x150], edx
mov ecx, edx
shr ecx, 0x10
mov eax, edx
shr eax, 8
xor cl, al
xor cl, dl
shr edx, 0x18
cmp dl, cl
je 0x180015822
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, r14
mov rdx, rbx
lea ecx, [r9 + 3]
call fcn.18009a4c0
mov r8, qword [rsp + 0x58]
nop word [rax + rax]
mov ecx, dword [rbx + 0x7c]
mov eax, ecx
shr eax, 0x14
and al, byte [rbx + 0x8a]
xor al, byte [r14 + 0xa]
test al, 1
jne 0x180015e5c
test ecx, ecx
je 0x18001587c
mov edx, dword [rbx + 0x88]
xor edx, dword [r14 + 8]
mov dword [r14 + 8], edx
mov ecx, edx
shr ecx, 0x10
mov eax, edx
shr eax, 8
xor cl, al
xor cl, dl
shr edx, 0x18
cmp dl, cl
je 0x18001587c
mov rdx, r14
mov rcx, rbx
call fcn.1800fbec0
test dil, dil
je 0x180015b62
lea r11, [r15 + 0x10]
mov r12, qword [r11]
mov qword [rsp + 0x60], r12
mov rax, qword [r15 + 0x18]
mov qword [rsp + 0x78], rax
mov rax, qword [rax]
mov r9, qword [r12 + 8]
cmp rax, r9
jne 0x180015b40
cmp rax, r11
jne 0x180015b40
movzx eax, word [r15 + 8]
sub qword [rbx + 0xc0], rax
mov rdi, qword [rbx + 0x138]
test rdi, rdi
je 0x180015a06
movzx r13d, word [r15 + 8]
mov ecx, dword [rdi + 8]
cmp r13, rcx
jae 0x1800158ea
mov qword [rsp + 0xe0], r13
mov ecx, r13d
jmp 0x180015902
mov rax, qword [rdi]
test rax, rax
jne 0x180015a8a
dec ecx
mov eax, ecx
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0x80], r13
mov esi, ecx
sub esi, dword [rdi + 0x18]
cmp dword [rdi + 0xc], 0
je 0x18001591a
lea eax, [rsi + rsi]
jmp 0x18001591c
mov eax, esi
lea r10, [rax*8]
mov qword [rsp + 0x80], r10
mov r8, qword [rdi + 0x30]
mov rax, qword [r8 + r10]
dec dword [rdi + 0x10]
mov edx, dword [rdi + 8]
lea r9d, [rdx - 1]
cmp ecx, r9d
jne 0x180015946
dec dword [rdi + 0x14]
cmp rax, r11
jne 0x180015a03
mov dword [rsp + 0x94], edx
cmp qword [rdi], 0
cmove edx, r9d
mov dword [rsp + 0x94], edx
mov r14, qword [r11]
mov rax, qword [rdi + 0x20]
cmp ecx, edx
jae 0x180015a71
cmp r14, rax
je 0x180015a41
lea r8, [r14 - 0x10]
mov edx, dword [r8 + 8]
mov dword [rsp + 0x160], edx
cmp dword [rbx + 0x7c], 0
je 0x1800159ee
mov r12d, dword [rbx + 0x88]
xor r12d, edx
mov dword [rsp + 0x160], r12d
movzx edx, r12w
mov ecx, r12d
shr ecx, 0x10
mov eax, r12d
shr eax, 8
xor cl, al
xor cl, r12b
mov eax, r12d
shr eax, 0x18
cmp al, cl
je 0x1800159e9
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov rdx, rbx
lea ecx, [rax + 3]
call fcn.18009a4c0
movzx edx, r12w
mov r10, qword [rsp + 0x80]
mov r12, qword [rsp + 0x60]
movzx eax, dx
sub r13d, eax
jne 0x180015a41
mov rax, qword [rdi + 0x30]
mov qword [r10 + rax], r14
mov r14, qword [rsp + 0x50]
xor r13d, r13d
mov rax, qword [rsp + 0x78]
mov qword [rax], r12
mov qword [r12 + 8], rax
test byte [r15 + 0xa], 8
je 0x180015a92
mov rdx, r15
mov rcx, rbx
call fcn.18005ca3c
test al, al
jne 0x180015a92
movzx r8d, word [r15 + 8]
mov r9b, 1
mov rdx, r15
mov rcx, rbx
call fcn.1800128f0
jmp 0x180015b5a
mov rax, qword [rdi + 0x30]
xor r13d, r13d
mov qword [r10 + rax], r13
mov eax, esi
shr eax, 5
and esi, 0x1f
mov edx, 1
movzx ecx, sil
shl edx, cl
mov ecx, eax
mov rax, qword [rdi + 0x28]
not edx
and dword [rax + rcx*4], edx
mov r14, qword [rsp + 0x50]
jmp 0x180015a06
xor r13d, r13d
cmp r14, rax
je 0x180015a84
mov qword [r8 + r10], r14
mov r14, qword [rsp + 0x50]
jmp 0x180015a06
mov qword [r8 + r10], r13
jmp 0x180015a4c
mov rdi, rax
jmp 0x1800158d5
movzx eax, byte [r15 + 0xa]
test al, 4
je 0x180015b5a
movzx edi, word [r15 + 8]
shl rdi, 4
sub rdi, 0x20
mov qword [rsp + 0xe8], rdi
test al, 2
je 0x180015aca
cmp rdi, 4
jbe 0x180015aca
sub rdi, 4
mov qword [rsp + 0xe8], rdi
lea rcx, [r15 + 0x20]
mov r8d, 0xfeeefeee
mov rdx, rdi
call sym.ntdll.dll_RtlCompareMemoryUlong
mov rsi, rax
cmp rax, rdi
je 0x180015b5a
mov rcx, qword gs:[0x60]
cmp qword [rcx + 0x18], 0
je 0x180015b17
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
mov rdx, qword [rdx + 0x10]
add rdx, 0x58
lea rcx, str.HEAP__wZ_:
call sym.ntdll.dll_DbgPrint
jmp 0x180015b23
lea rcx, str.HEAP:
call sym.ntdll.dll_DbgPrint
lea r8, [r15 + 0x20]
add r8, rsi
mov rdx, r15
lea rcx, str.HEAP:_Free_Heap_block__p_modified_at__p_after_it_was_freed_n
call sym.ntdll.dll_DbgPrint
call fcn.18010109c
jmp 0x180015b5a
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
mov r8, r11
mov rdx, rbx
mov ecx, 0xd
call fcn.18009a4c0
xor dil, dil
mov byte [rsp + 0x40], dil
lea r11, [r14 + 0x10]
mov r12, qword [r11]
mov qword [rsp + 0x60], r12
mov rax, qword [r14 + 0x18]
mov qword [rsp + 0x78], rax
mov rax, qword [rax]
mov r9, qword [r12 + 8]
cmp rax, r9
jne 0x180015ea7
cmp rax, r11
jne 0x180015ea7
movzx eax, word [r14 + 8]
sub qword [rbx + 0xc0], rax
mov rdi, qword [rbx + 0x138]
test rdi, rdi
je 0x180015ce3
movzx r13d, word [r14 + 8]
mov ecx, dword [rdi + 8]
cmp r13, rcx
jae 0x180015bc7
mov qword [rsp + 0xf0], r13
mov ecx, r13d
jmp 0x180015bdf
mov rax, qword [rdi]
test rax, rax
jne 0x180015d67
dec ecx
mov eax, ecx
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0x130], r13
mov esi, ecx
sub esi, dword [rdi + 0x18]
cmp dword [rdi + 0xc], 0
je 0x180015bf7
lea eax, [rsi + rsi]
jmp 0x180015bf9
mov eax, esi
lea r10, [rax*8]
mov qword [rsp + 0x80], r10
mov r8, qword [rdi + 0x30]
mov rax, qword [r8 + r10]
dec dword [rdi + 0x10]
mov edx, dword [rdi + 8]
lea r9d, [rdx - 1]
cmp ecx, r9d
jne 0x180015c23
dec dword [rdi + 0x14]
cmp rax, r11
jne 0x180015ce0
mov dword [rsp + 0x98], edx
cmp qword [rdi], 0
cmove edx, r9d
mov dword [rsp + 0x98], edx
mov r14, qword [r11]
mov rax, qword [rdi + 0x20]
cmp ecx, edx
jae 0x180015d4e
cmp r14, rax
je 0x180015d1e
lea r8, [r14 - 0x10]
mov edx, dword [r8 + 8]
mov dword [rsp + 0x170], edx
cmp dword [rbx + 0x7c], 0
je 0x180015ccb
mov r12d, dword [rbx + 0x88]
xor r12d, edx
mov dword [rsp + 0x170], r12d
movzx edx, r12w
mov ecx, r12d
shr ecx, 0x10
mov eax, r12d
shr eax, 8
xor cl, al
xor cl, r12b
mov eax, r12d
shr eax, 0x18
cmp al, cl
je 0x180015cc6
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov rdx, rbx
lea ecx, [rax + 3]
call fcn.18009a4c0
movzx edx, r12w
mov r10, qword [rsp + 0x80]
mov r12, qword [rsp + 0x60]
movzx eax, dx
sub r13d, eax
jne 0x180015d1e
mov rax, qword [rdi + 0x30]
mov qword [r10 + rax], r14
mov r14, qword [rsp + 0x50]
xor r13d, r13d
mov rax, qword [rsp + 0x78]
mov qword [rax], r12
mov qword [r12 + 8], rax
test byte [r14 + 0xa], 8
je 0x180015d6f
mov rdx, r14
mov rcx, rbx
call fcn.18005ca3c
test al, al
jne 0x180015d6f
movzx r8d, word [r14 + 8]
mov r9b, 1
mov rdx, r14
mov rcx, rbx
call fcn.1800128f0
jmp 0x180015ec1
mov rax, qword [rdi + 0x30]
xor r13d, r13d
mov qword [r10 + rax], r13
mov eax, esi
shr eax, 5
and esi, 0x1f
mov edx, 1
movzx ecx, sil
shl edx, cl
mov ecx, eax
mov rax, qword [rdi + 0x28]
not edx
and dword [rax + rcx*4], edx
mov r14, qword [rsp + 0x50]
jmp 0x180015ce3
xor r13d, r13d
cmp r14, rax
je 0x180015d61
mov qword [r8 + r10], r14
mov r14, qword [rsp + 0x50]
jmp 0x180015ce3
mov qword [r8 + r10], r13
jmp 0x180015d29
mov rdi, rax
jmp 0x180015bb2
movzx eax, byte [r14 + 0xa]
test al, 4
je 0x180015e1b
movzx edi, word [r14 + 8]
shl rdi, 4
sub rdi, 0x20
mov qword [rsp + 0xf8], rdi
test al, 2
je 0x180015da7
cmp rdi, 4
jbe 0x180015da7
sub rdi, 4
mov qword [rsp + 0xf8], rdi
lea rcx, [r14 + 0x20]
mov r8d, 0xfeeefeee
mov rdx, rdi
call sym.ntdll.dll_RtlCompareMemoryUlong
mov rsi, rax
cmp rax, rdi
je 0x180015e1b
mov rdx, qword gs:[0x60]
cmp qword [rdx + 0x18], 0
je 0x180015df4
mov rdx, qword gs:[0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x10]
add rdx, 0x58
lea rcx, str.HEAP__wZ_:
call sym.ntdll.dll_DbgPrint
jmp 0x180015e00
lea rcx, str.HEAP:
call sym.ntdll.dll_DbgPrint
lea r8, [r14 + 0x20]
add r8, rsi
mov rdx, r14
lea rcx, str.HEAP:_Free_Heap_block__p_modified_at__p_after_it_was_freed_n
call sym.ntdll.dll_DbgPrint
call fcn.18010109c
mov byte [r15 + 0xa], 0
mov byte [r15 + 0xf], 0
movzx eax, word [r14 + 8]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov qword [rsp + 0x58], rcx
mov word [r15 + 8], cx
mov rcx, qword [rsp + 0x58]
mov rdx, rcx
add rdx, rdx
movzx eax, word [rbx + 0x8c]
xor ax, cx
mov word [r15 + rdx*8 + 0xc], ax
mov r8, qword [rsp + 0x58]
mov qword [rsp + 0x210], r15
movzx r12d, byte [rsp + 0x49]
cmp r8, qword [rbx + 0xb0]
jb 0x180015ecb
mov rax, qword [rbx + 0xc0]
lea rcx, [r8 + rax]
cmp rcx, qword [rbx + 0xb8]
jb 0x180015ecb
xor r9d, r9d
mov rdx, r15
mov rcx, rbx
call fcn.1800128f0
mov edi, 0x100
mov qword [rsp + 0x210], r13
jmp 0x18001693f
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
mov r8, r11
mov rdx, rbx
mov ecx, 0xd
call fcn.18009a4c0
movzx edi, byte [rsp + 0x40]
jmp 0x180015822
mov rax, qword [rbx + 0xc0]
lea rcx, [r8 + rax]
cmp rcx, qword [rbx + 0xb8]
jbe 0x180015f18
mov edi, 0x100
cmp r8, rdi
jb 0x180015f18
movzx eax, word [r15 + 0xc]
cmp word [rbx + 0x8c], ax
jne 0x180015f18
xor r9d, r9d
mov rdx, r15
mov rcx, rbx
call fcn.1800128f0
mov word [rsp + 0x4c], r13w
mov qword [rsp + 0x210], r13
jmp 0x18001693f
cmp r8, 0xff00
ja 0x1800165fc
test r12b, r12b
je 0x18001644d
movzx edx, r8w
mov qword [rsp + 0x50], rdx
mov byte [r15 + 0xa], 0
mov byte [r15 + 0xf], 0
lea rax, [rbx + 0x150]
mov r12, qword [rbx + 0x138]
test r12, r12
je 0x180016236
nop dword [rax + rax]
mov ecx, dword [r12 + 8]
cmp rdx, rcx
jae 0x180015f77
mov r14, rdx
mov qword [rsp + 0xa8], rdx
jmp 0x180015f90
mov rax, qword [r12]
test rax, rax
jne 0x18001622e
lea r14d, [rcx - 1]
mov qword [rsp + 0xa8], r14
sub r14d, dword [r12 + 0x18]
mov rsi, r13
mov r13, qword [r12 + 0x20]
mov rax, qword [r13 + 8]
cmp r13, rax
jne 0x180015fae
mov rsi, r13
jmp 0x1800161fa
lea r8, [rax - 0x10]
mov edx, dword [r8 + 8]
mov dword [rsp + 0x180], edx
xor r15d, r15d
cmp dword [rbx + 0x7c], r15d
je 0x18001600c
mov edi, dword [rbx + 0x88]
xor edi, edx
mov dword [rsp + 0x180], edi
movzx edx, di
mov ecx, edi
shr ecx, 0x10
mov eax, edi
shr eax, 8
xor cl, al
xor cl, dil
mov eax, edi
shr eax, 0x18
cmp al, cl
je 0x18001600c
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov rdx, rbx
lea ecx, [r15 + 3]
call fcn.18009a4c0
movzx edx, di
movzx eax, dx
mov rdx, qword [rsp + 0x50]
mov ecx, edx
sub ecx, eax
test ecx, ecx
jle 0x180016024
mov rsi, r13
jmp 0x1800161f2
mov r8, qword [r13]
add r8, 0xfffffffffffffff0
mov edx, dword [r8 + 8]
mov dword [rsp + 0x190], edx
cmp dword [rbx + 0x7c], 0
je 0x180016083
mov edi, dword [rbx + 0x88]
xor edi, edx
mov dword [rsp + 0x190], edi
movzx edx, di
mov ecx, edi
shr ecx, 0x10
mov eax, edi
shr eax, 8
xor cl, al
xor cl, dil
mov eax, edi
shr eax, 0x18
cmp al, cl
je 0x180016083
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov rdx, rbx
lea ecx, [r9 + 3]
call fcn.18009a4c0
movzx edx, di
movzx eax, dx
mov rdx, qword [rsp + 0x50]
mov ecx, edx
sub ecx, eax
test ecx, ecx
jg 0x18001609c
mov rsi, qword [r13]
jmp 0x1800161f2
cmp qword [r12], 0
jne 0x1800160f7
mov eax, dword [r12 + 8]
dec eax
cmp dword [rsp + 0xa8], eax
jne 0x1800160f7
cmp dword [r12 + 0xc], 0
je 0x1800160be
add r14d, r14d
mov rax, qword [r12 + 0x30]
mov rdi, qword [rax + r14*8]
cmp r13, rdi
je 0x1800161f2
mov r9b, 1
mov r8, rdx
mov rdx, rdi
mov rcx, rbx
call fcn.18005c2ac
test eax, eax
jg 0x1800160ed
mov rsi, rdi
jmp 0x1800161ed
mov rdi, qword [rdi]
mov rdx, qword [rsp + 0x50]
jmp 0x1800160c7
mov edi, r14d
shr edi, 5
mov dword [rsp + 0x88], edi
mov r9d, dword [r12 + 8]
sub r9d, dword [r12 + 0x18]
shr r9d, 5
dec r9d
mov rax, qword [r12 + 0x28]
lea r8, [rax + rdi*4]
mov qword [rsp + 0x100], r8
and r14d, 0x1f
mov edx, 1
movzx ecx, r14b
shl edx, cl
dec edx
not edx
and edx, dword [r8]
nop dword [rax]
test edx, edx
jne 0x18001616b
cmp edi, r9d
ja 0x180016163
add r8, 4
mov qword [rsp + 0x100], r8
mov edx, dword [r8]
inc edi
mov dword [rsp + 0x88], edi
jmp 0x180016140
test edx, edx
je 0x180016208
mov ecx, edx
test dx, dx
je 0x18001619d
test dl, dl
je 0x180016186
movzx eax, cl
lea rcx, [0x180119500]
movzx ecx, byte [rax + rcx]
jmp 0x1800161ce
shr rcx, 8
movzx eax, cl
lea rcx, [0x180119500]
movzx ecx, byte [rax + rcx]
add ecx, 8
jmp 0x1800161ce
test edx, 0xff0000
je 0x1800161bc
shr rcx, 0x10
movzx eax, cl
lea rcx, [0x180119500]
movzx ecx, byte [rax + rcx]
add ecx, 0x10
jmp 0x1800161ce
shr rcx, 0x18
lea rax, [0x180119500]
movzx ecx, byte [rcx + rax]
add ecx, 0x18
shl edi, 5
add edi, ecx
mov dword [rsp + 0x88], edi
cmp dword [r12 + 0xc], 0
je 0x1800161e4
add edi, edi
mov rax, qword [r12 + 0x30]
mov rsi, qword [rax + rdi*8]
mov rdx, qword [rsp + 0x50]
mov r15, qword [rsp + 0x210]
test rsi, rsi
je 0x180016210
lea rax, [rbx + 0x150]
jmp 0x180016240
mov r15, qword [rsp + 0x210]
mov r12, qword [r12]
mov r14d, dword [r12 + 0x18]
mov qword [rsp + 0xa8], r14
mov rdx, qword [rsp + 0x50]
xor r13d, r13d
jmp 0x180015f90
mov r12, rax
jmp 0x180015f60
mov rsi, qword [rax]
nop dword [rax]
cmp rax, rsi
je 0x18001629c
cmp dword [rbx + 0x7c], 0
je 0x18001627f
mov ecx, dword [rsi - 8]
mov dword [rsp + 0x1a0], ecx
test dword [rbx + 0x7c], ecx
je 0x180016273
mov eax, dword [rbx + 0x88]
xor eax, ecx
mov dword [rsp + 0x1a0], eax
mov r15, qword [rsp + 0x210]
jmp 0x180016283
mov eax, ecx
mov r15, qword [rsp + 0x210]
jmp 0x180016283
movzx eax, word [rsi - 8]
mov word [rsp + 0x72], ax
movzx eax, ax
cmp rdx, rax
jbe 0x18001629c
mov rsi, qword [rsi]
lea rax, [rbx + 0x150]
jmp 0x180016240
lea r14, [r15 + 0x10]
mov qword [rsp + 0x60], r14
mov rax, qword [rsi + 8]
mov rcx, qword [rax]
cmp rcx, rsi
jne 0x1800162c1
mov qword [r14], rsi
mov qword [r14 + 8], rax
mov qword [rax], r14
mov qword [rsi + 8], r14
jmp 0x1800162dd
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8, rsi
xor edx, edx
lea ecx, [rax + 0xd]
call fcn.18009a4c0
movzx eax, word [r15 + 8]
add qword [rbx + 0xc0], rax
mov rdi, qword [rbx + 0x138]
test rdi, rdi
je 0x18001641b
movzx r12d, word [r15 + 8]
nop
mov ecx, dword [rdi + 8]
cmp r12, rcx
jae 0x180016315
mov qword [rsp + 0x108], r12
mov ecx, r12d
jmp 0x18001632d
mov rax, qword [rdi]
test rax, rax
jne 0x180016445
dec ecx
mov eax, ecx
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x78], r12
mov esi, ecx
sub esi, dword [rdi + 0x18]
cmp dword [rdi + 0xc], 0
je 0x180016342
lea eax, [rsi + rsi]
jmp 0x180016344
mov eax, esi
inc dword [rdi + 0x10]
lea rdx, [rax*8]
mov qword [rsp + 0x50], rdx
mov rax, qword [rdi + 0x30]
mov r13, qword [rdx + rax]
mov eax, dword [rdi + 8]
dec eax
cmp ecx, eax
jne 0x180016368
inc dword [rdi + 0x14]
test r13, r13
je 0x1800163f2
lea r8, [r13 - 0x10]
mov ecx, dword [r8 + 8]
mov dword [rsp + 0x1b0], ecx
cmp dword [rbx + 0x7c], 0
je 0x1800163df
mov r14d, dword [rbx + 0x88]
xor r14d, ecx
mov dword [rsp + 0x1b0], r14d
movzx ecx, r14w
mov edx, r14d
shr edx, 0x10
mov eax, r14d
shr eax, 8
xor dl, al
xor dl, r14b
mov eax, r14d
shr eax, 0x18
cmp al, dl
je 0x1800163d5
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov rdx, rbx
lea ecx, [rax + 3]
call fcn.18009a4c0
movzx ecx, r14w
mov r14, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
movzx eax, cx
sub r12d, eax
mov r15, qword [rsp + 0x210]
test r12d, r12d
jg 0x1800163fa
mov rax, qword [rdi + 0x30]
mov qword [rdx + rax], r14
test r13, r13
jne 0x18001641b
mov eax, esi
shr eax, 5
and esi, 0x1f
mov edx, 1
movzx ecx, sil
shl edx, cl
mov ecx, eax
mov rax, qword [rdi + 0x28]
or dword [rax + rcx*4], edx
cmp dword [rbx + 0x7c], 0
je 0x180016607
movzx eax, byte [r15 + 0xa]
xor al, byte [r15 + 9]
xor al, byte [r15 + 8]
mov byte [r15 + 0xb], al
mov eax, dword [rbx + 0x88]
xor dword [r15 + 8], eax
jmp 0x180016607
mov rdi, rax
jmp 0x180016300
movzx esi, r8w
and byte [r15 + 0xa], 0xf0
mov byte [r15 + 0xf], 0
test byte [rbx + 0x70], 0x40
je 0x1800164e0
mov edx, esi
shl rdx, 4
sub rdx, 0x20
mov qword [rsp + 0xb0], rdx
lea r8, [r15 + 0x20]
mov qword [rsp + 0x110], r8
shr rdx, 2
mov qword [rsp + 0xb0], rdx
test rdx, rdx
je 0x1800164db
test r8b, 4
je 0x1800164b7
mov dword [r8], 0xfeeefeee
sub rdx, 1
mov qword [rsp + 0xb0], rdx
je 0x1800164db
add r8, 4
mov qword [rsp + 0x110], r8
mov rcx, rdx
shr rcx, 1
movabs rax, 0xfeeefeeefeeefeee
mov rdi, r8
rep stosq qword [rdi], rax
test dl, 1
je 0x1800164db
mov dword [r8 + rdx*4 - 4], 0xfeeefeee
or byte [r15 + 0xa], 4
lea rdi, [rbx + 0x150]
cmp qword [rbx + 0x138], 0
je 0x180016501
mov rdx, rsi
mov rcx, rbx
call fcn.18005c238
mov r8, rax
jmp 0x180016504
mov r8, qword [rdi]
cmp rdi, r8
je 0x18001655b
cmp dword [rbx + 0x7c], 0
je 0x180016544
mov ecx, dword [r8 - 8]
mov dword [rsp + 0x1c0], ecx
test dword [rbx + 0x7c], ecx
je 0x180016538
mov eax, dword [rbx + 0x88]
xor eax, ecx
mov dword [rsp + 0x1c0], eax
mov r15, qword [rsp + 0x210]
jmp 0x180016549
mov eax, ecx
mov r15, qword [rsp + 0x210]
jmp 0x180016549
movzx eax, word [r8 - 8]
mov word [rsp + 0x74], ax
movzx eax, ax
cmp rsi, rax
jbe 0x18001655b
mov r8, qword [r8]
jmp 0x180016504
lea rsi, [r15 + 0x10]
mov rax, qword [r8 + 8]
mov rcx, qword [rax]
cmp rcx, r8
jne 0x18001657b
mov qword [rsi], r8
mov qword [rsi + 8], rax
mov qword [rax], rsi
mov qword [r8 + 8], rsi
jmp 0x180016592
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor edx, edx
lea ecx, [rdx + 0xd]
call fcn.18009a4c0
movzx eax, word [r15 + 8]
add qword [rbx + 0xc0], rax
mov rdx, qword [rbx + 0x138]
test rdx, rdx
je 0x18001641b
movzx ecx, word [r15 + 8]
mov edi, dword [rdx + 8]
cmp rcx, rdi
jae 0x1800165c8
mov rax, rcx
mov qword [rsp + 0x118], rcx
jmp 0x1800165db
mov rax, qword [rdx]
test rax, rax
jne 0x1800165f7
lea eax, [rdi - 1]
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
mov r9, rsi
mov r8b, 1
mov rcx, rbx
call fcn.18005c190
jmp 0x18001641b
mov rdx, rax
jmp 0x1800165b3
mov rdx, r15
mov rcx, rbx
call fcn.180012f50
cmp word [rsp + 0x4c], 0
je 0x1800166b8
cmp dword [rbx + 0x7c], 0
je 0x180016647
mov edx, dword [rbx + 0x88]
xor edx, dword [r15 + 8]
mov dword [r15 + 8], edx
mov ecx, edx
shr ecx, 0x10
mov eax, edx
shr eax, 8
xor cl, al
xor cl, dl
shr edx, 0x18
cmp dl, cl
je 0x180016647
mov rdx, r15
mov rcx, rbx
call fcn.1800fbec0
or byte [r15 + 0xa], 2
movzx ecx, word [r15 + 8]
movzx edx, cx
shr dx, 8
mov eax, ecx
shl rax, 4
lea rdi, [rax + r15]
cmp dword [rbx + 0x7c], 0
je 0x18001667f
movzx eax, byte [r15 + 0xa]
xor al, dl
xor al, cl
mov byte [r15 + 0xb], al
mov eax, dword [rbx + 0x88]
xor dword [r15 + 8], eax
movzx eax, word [rsp + 0x4c]
mov word [rdi - 4], ax
xor r13d, r13d
mov word [rdi - 2], r13w
test dword [rbx + 0x70], 0x8000000
je 0x1800166bb
lea ecx, [r13 + 1]
call fcn.1800244c4
mov word [rdi - 2], ax
mov edi, 0x100
mov qword [rsp + 0x210], r13
jmp 0x18001693f
xor r13d, r13d
mov edi, 0x100
mov qword [rsp + 0x210], r13
jmp 0x18001693f
add r15, 0xffffffffffffffd0
mov qword [rsp + 0x68], r15
mov rcx, qword [r15 + 0x20]
mov qword [rsp + 0xb8], rcx
mov rax, r15
and rax, 0xffffffffffff0000
mov qword [rsp + 0xa0], rax
sub qword [rbx + 0x230], rcx
mov rax, qword [r15]
mov rcx, qword [r15 + 8]
mov rdx, qword [rcx]
mov r9, qword [rax + 8]
cmp rdx, r9
jne 0x18001671b
cmp rdx, r15
jne 0x18001671b
mov qword [rcx], rax
mov qword [rax + 8], rcx
jmp 0x180016732
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rdx
mov r8, r15
xor edx, edx
lea ecx, [rdx + 0xd]
call fcn.18009a4c0
test r12b, r12b
jne 0x18001677f
mov rax, qword gs:[0x60]
mov ecx, dword [rax + 0xbc]
mov dword [rsp + 0xc4], ecx
bt ecx, 0xb
jae 0x18001677a
mov r8, qword [r15 + 0x20]
shr r8, 4
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r15, qword [rsp + 0x68]
movzx edx, word [r15 + 0x12]
mov rcx, rbx
call fcn.1800ed110
jmp 0x18001677f
mov r15, qword [rsp + 0x68]
mov qword [rsp + 0x210], r13
cmp byte [rsp + 0x48], 0
je 0x18001679f
mov rcx, qword [rbx + 0x160]
call sym.ntdll.dll_RtlLeaveCriticalSection
mov byte [rsp + 0x48], 0
mov rdi, qword [r15 + 0x28]
mov qword [rsp + 0x120], rdi
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x1800167da
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x22e
mov r15, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x120]
jmp 0x1800167df
mov ecx, 0x7ffe0388
cmp byte [rcx], 0
je 0x1800167f7
mov r8, rdi
mov rdx, qword [rsp + 0xa0]
mov rcx, rbx
call fcn.1800fc3d4
mov qword [rsp + 0x58], r13
mov r9d, 0x8000
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0xa0]
call fcn.18005cd8c
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x18001683b
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x226
mov r15, qword [rsp + 0x68]
jmp 0x18001683e
mov rcx, rsi
cmp byte [rcx], 0
je 0x1800168b1
mov rax, qword gs:[0x60]
test byte [rax + 0x378], 1
je 0x1800168ac
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x180016875
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x90]
add rsi, 0x226
movzx eax, byte [rsi]
mov r9, qword [rbx + 0xc0]
shl r9, 4
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov byte [rsp + 0x20], 0
mov r8, qword [rsp + 0xb8]
mov r15, qword [rsp + 0x68]
mov rdx, r15
mov rcx, rbx
call fcn.1800fdffc
jmp 0x1800168b1
mov r15, qword [rsp + 0x68]
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
mov edi, 0x7ffe038a
test eax, eax
je 0x1800168dd
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x230
mov r15, qword [rsp + 0x68]
jmp 0x1800168e0
mov rcx, rdi
cmp byte [rcx], 0
je 0x18001693a
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x18001690a
mov rax, qword gs:[0x60]
mov rdi, qword [rax + 0x90]
add rdi, 0x230
mov r15, qword [rsp + 0x68]
movzx eax, byte [rdi]
mov r9, qword [rbx + 0xc0]
shl r9, 4
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov byte [rsp + 0x20], 0
mov r8, qword [rsp + 0xb8]
mov rdx, r15
mov rcx, rbx
call fcn.1800fdffc
mov edi, 0x100
cmp byte [rsp + 0x48], 0
je 0x180016a58
test dword [rbx + 0x74], 0x1000000
jne 0x1800169ee
inc dword [rbx + 0x260]
mov edx, dword [rbx + 0x268]
cmp dword [rbx + 0x260], edx
jbe 0x18001699e
mov dword [rbx + 0x260], r13d
mov rax, qword [rbx + 0xc0]
shl rax, 4
mov rcx, qword [rbx + 0x220]
sub rcx, rax
cmp rcx, qword [rbx + 0x280]
jbe 0x180016997
mov qword [rbx + 0x280], rcx
mov qword [rbx + 0x288], rcx
inc dword [rbx + 0x26c]
cmp dword [rbx + 0x26c], 0x1000
jb 0x1800169ee
cmp byte [rbx + 0x182], 2
jne 0x1800169c2
cmp dword [rbx + 0x270], 0x10
ja 0x1800169c7
mov edi, 0x10
cmp dword [rbx + 0x264], edi
jbe 0x1800169e0
cmp edx, 0x10000
jae 0x1800169e0
lea eax, [rdx + rdx]
mov dword [rbx + 0x268], eax
mov dword [rbx + 0x264], r13d
mov dword [rbx + 0x26c], r13d
mov rdi, qword [rbx + 0x160]
sub dword [rdi + 0xc], 1
jne 0x180016a58
mov qword [rdi + 0x10], r13
or ecx, 0xffffffff
mov eax, 0xfffffffe
lock cmpxchg dword [rdi + 8], ecx
mov ebx, eax
je 0x180016a58
test byte [rdi + 8], 1
je 0x180016a1e
mov rcx, rdi
call sym.ntdll.dll_RtlpNotOwnerCriticalSection
mov r8, qword [rdi + 0x18]
test r8, r8
jne 0x180016a32
mov rcx, rdi
call fcn.18004ae34
mov r8, rax
mov edx, ebx
and edx, 2
or edx, 1
lea ecx, [rbx + rdx]
mov eax, ebx
lock cmpxchg dword [rdi + 8], ecx
mov ebx, eax
jne 0x180016a32
test dl, 2
je 0x180016a58
mov rdx, r8
mov rcx, rdi
call fcn.18009a1f0
mov eax, dword [rsp + 0x8c]
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret