Function at 0x2fc4cf4a0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x84], 0x60
mov eax, dword [rsp + 0x84]
mov ecx, eax
mov rcx, qword gs:[rcx]
mov qword [rsp + 0x78], rcx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x18]
add rcx, 0x10
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx]
mov qword [rsp + 0x50], rcx
mov rax, qword [rsp + 0x50]
cmp rax, qword [rsp + 0x58]
je 0x2fc4cf820
mov eax, dword [0x2fc4f6174]
mov ecx, dword [0x2fc4f6180]
mov edx, 0x21313b39
add edx, 0
sub edx, 1
sub edx, 0x21313b39
mov r8d, eax
sub r8d, 0x85554d6a
add r8d, edx
add r8d, 0x85554d6a
imul eax, r8d
and eax, 1
cmp eax, 0
sete r9b
cmp ecx, 0xa
setl r10b
mov r11b, r9b
xor r11b, 0xff
and r11b, 1
mov bl, 1
mov sil, bl
xor sil, 1
mov dil, r9b
and dil, sil
or r11b, dil
mov sil, r10b
xor sil, 0xff
and sil, 0
mov dil, bl
xor dil, 0
mov bpl, r10b
and bpl, dil
mov r14b, bl
xor r14b, 1
and r14b, 0
and dil, 1
or sil, bpl
or r14b, dil
xor sil, r14b
mov dil, bl
xor dil, 0
and dil, 1
mov bpl, bl
xor bpl, 1
and bpl, 0
or dil, bpl
mov bpl, r11b
xor bpl, 0xff
mov r14b, bl
xor r14b, 0
mov r15b, bl
xor r15b, 1
or bpl, r14b
or r15b, 1
xor bpl, 0xff
and bpl, r15b
xor r9b, 0xff
mov r14b, dil
xor r14b, 0xff
mov r15b, bl
xor r15b, 0
or r9b, r14b
or r15b, 0
xor r9b, 0xff
and r9b, r15b
mov r14b, bl
xor r14b, 0
mov r15b, sil
xor r15b, r14b
and r15b, sil
mov r14b, dil
xor r14b, 0xff
mov r12b, r10b
xor r12b, r14b
and r12b, r10b
mov r10b, bpl
xor r10b, 0xff
mov r14b, r9b
xor r14b, 0xff
mov r13b, bl
xor r13b, 1
mov al, r10b
and al, 0xff
and bpl, r13b
mov cl, r14b
and cl, 0xff
and r9b, r13b
or al, bpl
or cl, r9b
xor al, cl
or r10b, r14b
xor r10b, 0xff
or r13b, 1
and r10b, r13b
or al, r10b
mov cl, r15b
and cl, r12b
xor r15b, r12b
or cl, r15b
mov r9b, al
xor r9b, 0xff
and r9b, 1
mov r10b, bl
xor r10b, 1
and al, r10b
mov bpl, cl
xor bpl, 0xff
and bpl, 0xff
and cl, r10b
or r9b, al
or bpl, cl
xor r9b, bpl
mov al, r11b
and al, sil
xor r11b, sil
or al, r11b
mov cl, al
xor cl, 0xff
and cl, 0
mov r10b, bl
xor r10b, 0
and al, r10b
xor bl, 1
and bl, 0
and r10b, 1
or cl, al
or bl, r10b
xor cl, bl
mov al, dil
and al, 0
xor dil, 0
or al, dil
xor al, 0xff
mov r10b, cl
xor r10b, al
and r10b, cl
mov al, r9b
and al, r10b
xor r9b, r10b
or al, r9b
test al, 1
jne 0x2fc4cf6f6
jmp 0x2fc4cf842
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x60]
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x40], rcx
mov rcx, rax
mov qword [rsp + 0x38], rdx
call sym.StrLen
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov r8, rax
call sym.W2Anicmp
xor r9d, r9d
cmp eax, 0
sete r10b
mov eax, dword [0x2fc4f6174]
mov r11d, dword [0x2fc4f6180]
mov esi, eax
sub esi, 0x628ecb74
add esi, 0x17388124
add esi, 0x628ecb74
sub esi, 0x4c810d88
sub esi, 1
add esi, 0x4c810d88
sub r9d, 0x17388124
add esi, r9d
imul eax, esi
and eax, 1
cmp eax, 0
sete bl
cmp r11d, 0xa
setl dil
mov bpl, dil
xor bpl, 0xff
mov r14b, bl
xor r14b, bpl
and r14b, bl
mov bpl, bl
xor bpl, 0xff
and bpl, 0
mov r15b, 1
xor r15b, 0
and bl, r15b
mov r12b, dil
xor r12b, 0xff
and r12b, 0
and dil, r15b
or bpl, bl
or r12b, dil
xor bpl, r12b
mov bl, r14b
and bl, bpl
xor r14b, bpl
or bl, r14b
test bl, 1
mov byte [rsp + 0x37], r10b
jne 0x2fc4cf7ea
jmp 0x2fc4cf842
mov al, byte [rsp + 0x37]
test al, 1
jne 0x2fc4cf7fb
jmp 0x2fc4cf80e
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x70], rax
jmp 0x2fc4cf829
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
jmp 0x2fc4cf501
mov qword [rsp + 0x70], 0
mov rax, qword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x60]
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov rcx, rax
mov qword [rsp + 0x20], rdx
call sym.StrLen
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov r8, rax
call sym.W2Anicmp
jmp 0x2fc4cf6f6