Function at 0x14002c207
Capabilities:
Access peb ldr_data
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rdi, rcx
test rdx, rdx
jne 0x14002c66b
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rsi, qword [rcx + 0x10]
lea r14, str.ntdll.dll___no_ntdll.dll_
lea rax, str.library_std_src_sys_commonwtf8.rs
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x90], rsi
mov rdx, qword [rsi + 0x60]
test rdx, rdx
je 0x14002c7a1
movzx eax, word [rsi + 0x58]
test ax, ax
je 0x14002c7a1
mov rcx, qword [rsi + 0x30]
mov qword [rsp + 0x50], rcx
movzx r8d, ax
shr r8d, 1
lea rcx, [rsp + 0x60]
call fcn.1400a1840
mov r15, qword [rsp + 0x60]
mov r13, qword [rsp + 0x70]
test r13, r13
mov qword [rsp + 0x28], r15
je 0x14002c33c
lea rbx, [r15 + r13]
xor ebp, ebp
mov rcx, r15
lea rax, [rcx + 1]
mov dl, byte [rcx]
mov r8d, 1
test dl, dl
jns 0x14002c32d
cmp dl, 0xe0
jae 0x14002c2cf
add rcx, 2
cmp rax, rbx
cmovne rax, rcx
mov r8d, 2
jmp 0x14002c32d
cmp dl, 0xed
jne 0x14002c2fb
cmp rax, rbx
je 0x14002c33c
lea rax, [rcx + 2]
cmp rax, rbx
je 0x14002c33c
cmp byte [rcx + 1], 0x9f
ja 0x14002c3ce
add rcx, 3
mov r8d, 3
mov rax, rcx
jmp 0x14002c32d
add rcx, 2
cmp rax, rbx
cmove rcx, rax
xor eax, eax
cmp rcx, rbx
setne al
add rax, rcx
mov r8d, 3
cmp dl, 0xf0
jb 0x14002c32d
xor ecx, ecx
cmp rax, rbx
setne cl
add rax, rcx
mov r8d, 4
add rbp, r8
mov rcx, rax
cmp rax, rbx
jne 0x14002c2a7
xor r12d, r12d
test r12, r12
mov rax, r12
cmove rax, r15
cmp r13, 9
jne 0x14002c39e
xor edx, edx
cmp rdx, 9
je 0x14002c64c
mov rcx, rdx
inc rdx
mov r8b, byte [rax + rcx]
lea r9d, [r8 - 0x41]
cmp r9b, 0x1a
setb r9b
shl r9b, 5
mov r10b, byte [rcx + r14]
lea r11d, [r10 - 0x41]
cmp r11b, 0x1a
setb r11b
shl r11b, 5
or r9b, r8b
or r11b, r10b
cmp r9b, r11b
je 0x14002c351
cmp rcx, 8
ja 0x14002c64c
mov rcx, r12
mov rdx, r15
call fcn.1400ede5f
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x28]
call fcn.140030983
mov rsi, qword [rsi]
cmp rsi, qword [rsp + 0x90]
jne 0x14002c252
jmp 0x14002c7a1
test r13, r13
js 0x14002c7ea
mov qword [rsp + 0x48], rdi
mov al, byte [0x1401d21f0]
mov edx, 1
mov rcx, r13
call fcn.14002c8c0
test rax, rax
je 0x14002c7db
mov r12, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], r13
mov rdi, r13
sub rdi, rbp
jb 0x14002c800
mov rcx, r12
mov rdx, qword [rsp + 0x28]
mov r8, rbp
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x40], rbp
mov r9, rbp
cmp rdi, 2
mov rdi, qword [rsp + 0x48]
ja 0x14002c451
mov r8d, 3
lea rcx, [rsp + 0x30]
mov rdx, rbp
call fcn.1400a2580
mov r12, qword [rsp + 0x30]
mov r9, qword [rsp + 0x40]
mov byte [r12 + r9 + 2], 0xbd
mov word [r12 + r9], 0xbfef
add r9, 3
mov qword [rsp + 0x40], r9
add rbp, 3
cmp rbp, r13
ja 0x14002c7c4
cmp rbp, r13
je 0x14002c5f8
mov rax, qword [rsp + 0x28]
lea rcx, [rax + rbp]
mov r15, rbp
mov qword [rsp + 0x88], rcx
lea rax, [rcx + 1]
mov dl, byte [rcx]
mov r8d, 1
test dl, dl
jns 0x14002c51b
cmp dl, 0xe0
jae 0x14002c4b9
add rcx, 2
cmp rax, rbx
cmovne rax, rcx
mov r8d, 2
jmp 0x14002c51b
cmp dl, 0xed
jne 0x14002c4e9
cmp rax, rbx
je 0x14002c5fb
lea rax, [rcx + 2]
cmp rax, rbx
je 0x14002c5fb
cmp byte [rcx + 1], 0x9f
ja 0x14002c52f
add rcx, 3
mov r8d, 3
mov rax, rcx
jmp 0x14002c51b
add rcx, 2
cmp rax, rbx
cmove rcx, rax
xor eax, eax
cmp rcx, rbx
setne al
add rax, rcx
mov r8d, 3
cmp dl, 0xf0
jb 0x14002c51b
xor ecx, ecx
cmp rax, rbx
setne cl
add rax, rcx
mov r8d, 4
add r15, r8
mov rcx, rax
cmp rax, rbx
jne 0x14002c491
jmp 0x14002c5fb
mov r8, r15
sub r8, rbp
jb 0x14002c812
cmp r15, r13
ja 0x14002c7f1
mov rdi, qword [rsp + 0x38]
mov rax, rdi
sub rax, r9
cmp rax, r8
jae 0x14002c576
lea rcx, [rsp + 0x30]
mov rdx, r9
mov rbp, r8
call fcn.1400a2580
mov r9, qword [rsp + 0x40]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r8, rbp
mov qword [rsp + 0x80], r9
lea rcx, [r12 + r9]
mov rdx, qword [rsp + 0x88]
mov rbp, r8
call sub.msvcrt.dll_memcpy
mov r9, qword [rsp + 0x80]
add r9, rbp
mov qword [rsp + 0x40], r9
sub rdi, r9
cmp rdi, 2
ja 0x14002c5c8
mov r8d, 3
lea rcx, [rsp + 0x30]
mov rdx, r9
call fcn.1400a2580
mov r12, qword [rsp + 0x30]
mov r9, qword [rsp + 0x40]
mov byte [r12 + r9 + 2], 0xbd
mov word [r12 + r9], 0xbfef
add r9, 3
mov qword [rsp + 0x40], r9
add r15, 3
mov rbp, r15
cmp r15, r13
mov rdi, qword [rsp + 0x48]
jbe 0x14002c474
jmp 0x14002c7c7
mov rbp, r13
sub r13, rbp
mov r15, qword [rsp + 0x38]
mov rax, r15
sub rax, r9
cmp rax, r13
jae 0x14002c62d
lea rcx, [rsp + 0x30]
mov rdx, r9
mov r8, r13
call fcn.1400a2580
mov r9, qword [rsp + 0x40]
mov r12, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
add rbp, qword [rsp + 0x28]
lea rcx, [r12 + r9]
mov rdx, rbp
mov r8, r13
mov rbx, r9
call sub.msvcrt.dll_memcpy
add r13, rbx
jmp 0x14002c33f
mov rcx, r12
mov rdx, r15
call fcn.1400ede5f
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x28]
call fcn.140030983
mov r8, qword [rsp + 0x50]
cmp word [r8], 0x5a4d
jne 0x14002c7a1
movsxd rax, dword [r8 + 0x3c]
cmp dword [r8 + rax], 0x4550
jne 0x14002c7a1
mov qword [rsp + 0x48], rdi
mov eax, dword [r8 + rax + 0x88]
mov ebp, dword [r8 + rax + 0x18]
mov ecx, dword [r8 + rax + 0x1c]
mov esi, dword [r8 + rax + 0x20]
mov eax, dword [r8 + rax + 0x24]
add rcx, r8
mov qword [rsp + 0x28], rcx
add rsi, r8
add rax, r8
mov qword [rsp + 0x50], rax
xor ebx, ebx
lea r15, str.Invalid_UTF_8
cmp rbx, rbp
je 0x14002c7b9
mov r14, rbx
mov edx, dword [rsi + rbx*4]
mov rdi, r8
add rdx, r8
mov r8, 0xffffffffffffffff
cmp byte [rdx + r8 + 1], 0
lea r8, [r8 + 1]
jne 0x14002c6e2
lea rcx, [rsp + 0x60]
call fcn.14001fd60
cmp qword [rsp + 0x60], 0
mov r12, qword [rsp + 0x70]
mov eax, 0xd
cmovne r12, rax
mov r13, qword [rsp + 0x68]
cmovne r13, r15
mov r9d, 0xd
mov rcx, r13
mov rdx, r12
mov r8, r15
call fcn.14005fba7
test al, al
jne 0x14002c7b9
lea rbx, [r14 + 1]
mov r9d, 0xc
mov rcx, r13
mov rdx, r12
lea r8, str.NtTraceEvent____Error_finding_address_of_NtTraceEvent
call fcn.14005fba7
test al, al
mov r8, rdi
je 0x14002c6c6
mov rax, qword [rsp + 0x50]
movzx eax, word [rax + r14*2]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx + rax*4]
add rax, r8
lea rcx, str.ntdll.dll___no_ntdll.dll_
mov rdx, qword [rsp + 0x48]
mov qword [rdx], rcx
mov qword [rdx + 8], 9
lea rcx, str.NtTraceEvent____Error_finding_address_of_NtTraceEvent
mov qword [rdx + 0x10], rcx
mov qword [rdx + 0x18], 0xc
mov qword [rdx + 0x20], r8
mov qword [rdx + 0x28], rax
jmp 0x14002c7a5
and qword [rdi], 0
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x48]
and qword [rax], 0
jmp 0x14002c7a5
mov r15, rbp
lea r8, str.library_std_src_sys_commonwtf8.rs
mov rcx, r15
mov rdx, r13
call fcn.140019d50
jmp 0x14002c824
mov ecx, 1
mov rdx, r13
call fcn.14000fd90
jmp 0x14002c824
call fcn.14000fd50
jmp 0x14002c824
mov rbp, r15
lea rax, str.library_std_src_sys_commonwtf8.rs
mov qword [rsp + 0x58], rax
mov rcx, rbp
mov rdx, r13
mov r8, qword [rsp + 0x58]
call fcn.14001ac80
jmp 0x14002c824
lea r8, str.library_std_src_sys_commonwtf8.rs
mov rcx, rbp
mov rdx, r15
call fcn.14001f650
ud2