Function at 0x210104a90
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rax, qword gs:[0x30]
mov rsi, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rdi, qword [rsi + 0x20]
mov rbx, rcx
mov ebp, edx
mov r12d, r8d
cmp rax, 0xffffffffffffffff
je 0x210104b80
test rax, rax
je 0x210104ca0
mov r13, qword [rsi + 0x30]
mov r8d, 0x238
xor edx, edx
mov rcx, r13
call sym.RtlAllocateHeap
mov rbp, rax
test rax, rax
je 0x210104d10
mov r8d, dword [rbx + 0x14]
mov rdx, qword [rbx + 8]
mov r9d, r12d
test r8d, r8d
jne 0x210104d30
lea r8, [rbx + 0x28]
mov rcx, rbp
call method.fcwd_access_t.FillIn_void___UNICODE_STRING__unsigned_int_
mov rcx, qword [rsi + 0x38]
call sym.RtlEnterCriticalSection
mov rax, qword [rbx + 0x18]
mov r12, qword [rax]
mov qword [rax], rbp
mov rax, qword [0x21023d810]
mov eax, dword [rax + 0x48e8]
cmp eax, 1
je 0x210104dd0
cmp eax, 2
je 0x210104de0
movdqu xmm0, xmmword [rbp + 0x18]
movups xmmword [rdi + 0x38], xmm0
mov rax, qword [rbx + 8]
mov qword [rdi + 0x48], rax
mov rcx, qword [rsi + 0x38]
call sym.RtlLeaveCriticalSection
test r12, r12
je 0x210104d1d
mov rdx, r13
mov rcx, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp method.fcwd_access_t.Free_void_
lea rcx, [0x2102a1a64]
call sym.GetModuleHandleA
mov r13, rax
test rax, rax
je 0x210104c2d
lea rdx, str.RtlGetCurrentDirectory_U
mov rcx, rax
call sym.GetProcAddress
mov rcx, r13
lea rdx, str.RtlEnterCriticalSection
mov r14, rax
call sym.GetProcAddress
mov r13, rax
test r14, r14
je 0x210104c2d
test rax, rax
je 0x210104c2d
mov r8d, 0x50
mov edx, 0xe8
mov rcx, r14
call sym.msys_2.0.dll_memchr
test rax, rax
je 0x210104c2d
movsxd rdx, dword [rax + 1]
mov r9d, 4
lea r8, [0x2102a1a9f]
lea r14, [rax + rdx + 5]
mov edx, 0x50
mov rcx, r14
call sym.msys_2.0.dll_memmem
mov rcx, rax
test rax, rax
je 0x210104ee8
movsxd rax, dword [rax + 4]
mov rdx, qword gs:[0x30]
mov rdx, qword [rdx + 0x60]
lea rax, [rcx + rax + 1]
cmp qword [rdx + 0x38], rax
je 0x210104df0
call sym.GetCurrentProcess
lea rdx, [rsp + 0x3c]
lea r8, [rsp + 0x3e]
mov rcx, rax
call fcn.21022ce30
test eax, eax
je 0x210104c51
cmp word [rsp + 0x3e], 0xaa64
je 0x210104c5d
lea rcx, str.Cygwin_WARNING:_n__Couldnt_compute_FAST_CWD_pointer.__This_typically_occurs_if_youre_using_n__an_older_Cygwin_version_on_a_newer_Windows.__Please_update_to_the_latest_n__available_Cygwin_version_from_https:__cygwin.com_.__If_the_problem_persists__n__please_see_https:__cygwin.com_problems.html_n_n
call sym.small_printf
mov rax, qword gs:[0x30]
mov r12, qword [rax + 0x60]
mov rcx, qword [r12 + 0x38]
call sym.RtlEnterCriticalSection
mov rax, qword [r12 + 0x20]
mov edx, 1
mov rcx, qword [rax + 0x40]
call method.fcwd_access_t.SetVersionFromPointer_unsigned_char__bool_
mov rcx, qword [r12 + 0x38]
call sym.RtlLeaveCriticalSection
mov qword [rbx + 0x18], 0
nop dword [rax]
cmp qword [rdi + 0x48], 0
je 0x210104d40
mov rcx, qword [rsi + 0x38]
call sym.RtlEnterCriticalSection
test bpl, bpl
jne 0x210104cd7
mov ecx, dword [rbx + 0x14]
test ecx, ecx
jne 0x210104d60
lea rcx, [rbx + 0x28]
call sym.RtlSetCurrentDirectory_U
mov ebp, eax
test eax, eax
js 0x210104d76
mov rdx, qword [rbx + 8]
mov rcx, qword [rdi + 0x40]
call method.fcwd_access_t.SetDirHandleFromBufferPointer_wchar_t__void_
mov rax, qword [rbx + 8]
mov r12, qword [rdi + 0x48]
mov qword [rdi + 0x48], rax
mov rcx, qword [rsi + 0x38]
call sym.RtlLeaveCriticalSection
mov rcx, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sym.NtClose
test byte [0x210273880], 1
jne 0x210104e60
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea r8, [0x210297fe0]
jmp 0x210104b06
test bpl, bpl
jne 0x210104d1d
mov rcx, qword [rsi + 0x38]
call sym.RtlEnterCriticalSection
mov eax, dword [rbx + 0x14]
test eax, eax
je 0x210104cc4
nop dword [rax]
lea rcx, [0x210297fe0]
call sym.RtlSetCurrentDirectory_U
mov ebp, eax
test eax, eax
jns 0x210104cd7
mov rcx, qword [rsi + 0x38]
call sym.RtlLeaveCriticalSection
test byte [0x210273880], 1
je 0x210104d1d
mov edx, dword [rbx + 0x14]
lea rax, [0x210297fe0]
test edx, edx
jne 0x210104d9a
lea rax, [rbx + 0x28]
mov dword [rsp + 0x28], ebp
lea r9, str.RtlSetCurrentDirectory_U__S__failed___y
lea r8, str.void_cwdstuff::override_win32_cwd_bool__ULONG_
mov edx, 0x40
mov qword [rsp + 0x20], rax
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x210104d1d
movdqu xmm1, xmmword [rbp]
movups xmmword [rdi + 0x38], xmm1
jmp 0x210104b49
movdqu xmm2, xmmword [rbp + 0x18]
movups xmmword [rdi + 0x38], xmm2
jmp 0x210104b49
mov r9d, 3
lea r8, [0x2102a1aa4]
mov edx, 0x28
call sym.msys_2.0.dll_memmem
mov r13, rax
test rax, rax
je 0x210104c2d
lea rcx, [r13 + 7]
mov r9d, 3
mov edx, 3
lea r8, [0x2102a1ab0]
call sym.msys_2.0.dll_memmem
test rax, rax
je 0x210104c2d
movsxd rdx, dword [r13 + 3]
lea rbp, [rax + rdx]
mov rcx, qword [rbp]
test rcx, rcx
je 0x210104e90
xor edx, edx
call method.fcwd_access_t.SetVersionFromPointer_unsigned_char__bool_
mov qword [rbx + 0x18], rbp
jmp 0x210104ace
lea r9, str.RtlAllocateHeap_failed
lea r8, str.void_cwdstuff::override_win32_cwd_bool__ULONG_
mov edx, 0x40
lea rcx, [0x210273880]
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp method.strace.prntf_unsigned_int__char_const__char_const__..._
lea r14, [0x210297fe0]
mov rcx, r14
mov rax, qword gs:[0x30]
mov r13, qword [rax + 0x60]
call sym.RtlSetCurrentDirectory_U
test eax, eax
js 0x210104f7d
mov rcx, qword [r13 + 0x38]
call sym.RtlEnterCriticalSection
mov rax, qword [r13 + 0x20]
mov edx, 1
mov rcx, qword [rax + 0x40]
call method.fcwd_access_t.SetVersionFromPointer_unsigned_char__bool_
mov rcx, qword [r13 + 0x38]
call sym.RtlLeaveCriticalSection
mov qword [rbx + 0x18], rbp
jmp 0x210104ace
mov edx, 0x50
mov r9d, 3
lea r8, [0x2102a1aa8]
mov rcx, r14
call sym.msys_2.0.dll_memmem
mov edx, 7
test rax, rax
je 0x210104f53
movsxd rcx, dword [rax + 3]
mov r8, qword gs:[0x30]
mov r8, qword [r8 + 0x60]
lea rcx, [rax + rcx + 7]
cmp qword [r8 + 0x38], rcx
jne 0x210104c2d
add rax, rdx
cmp byte [rax], 0xe8
jne 0x210104c2d
movsxd rdx, dword [rax + 1]
lea rdx, [rax + rdx + 5]
cmp r13, rdx
jne 0x210104c2d
lea r13, [rax + 5]
jmp 0x210104e13
mov r9d, 3
lea r8, [0x2102a1aac]
mov edx, 0x50
mov rcx, r14
call sym.msys_2.0.dll_memmem
test rax, rax
je 0x210104c2d
mov edx, 0xe
jmp 0x210104f0c
mov rdx, r14
lea rcx, str.Couldnt_set_directory_to__S_temporarily._nCannot_continue.
call sym.api_fatal
nop
nop
nop