Function at 0x1d5c132e0
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2b0
mov r14, qword gs:[0x60]
mov rax, qword [r14 + 0x18]
mov rbx, qword [rax + 0x10]
add rax, 0x10
mov rsi, rcx
mov rbp, rdx
cmp rbx, rax
je 0x1d5c133ba
mov r12, qword [sym.imp.USER32.dll_CharLowerA]
lea r13, [rsp + 0x7f]
nop dword [rax]
test rbx, rbx
je 0x1d5c133ba
mov rax, qword [rbx + 0x50]
movzx edx, word [rax]
test dx, dx
je 0x1d5c1356d
mov eax, 1
jmp 0x1d5c1335c
add rax, 1
cmp rax, 0x104
je 0x1d5c133cc
mov byte [r13 + rax], dl
mov rdx, qword [rbx + 0x50]
movsxd rcx, eax
movzx edx, word [rdx + rax*2]
test dx, dx
jne 0x1d5c13350
mov byte [rsp + rcx + 0x80], 0
cmp qword [rbx + 0x30], rsi
je 0x1d5c133df
lea rdi, [rsp + 0x80]
mov rcx, rdi
call r12
mov rdx, rbp
mov rcx, rax
call sub.msvcrt.dll_strstr
test rax, rax
jne 0x1d5c133df
mov ecx, 0x104
xor eax, eax
rep stosb byte [rdi], al
mov rax, qword [r14 + 0x18]
mov rbx, qword [rbx]
add rax, 0x10
cmp rbx, rax
jne 0x1d5c13328
add rsp, 0x2b0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov ecx, 0x103
mov byte [rsp + rcx + 0x80], 0
cmp qword [rbx + 0x30], rsi
jne 0x1d5c1337f
mov rax, qword [rbx + 8]
mov qword [rsp + 0x50], rsi
mov rdx, qword [rax]
mov qword [rsp + 0x58], rdx
mov rdx, qword [rbx + 0x28]
mov rdx, qword [rdx]
mov qword [rsp + 0x68], rdx
mov rdx, qword [rbx + 0x18]
mov rdx, qword [rdx]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x60], rdx
mov rdx, qword [0x1d5cc32c8]
cmp rdx, qword [0x1d5cc32d0]
je 0x1d5c13574
movdqu xmm0, xmmword [rsp + 0x50]
add rdx, 0x28
movups xmmword [rdx - 0x28], xmm0
movdqu xmm1, xmmword [rsp + 0x60]
movups xmmword [rdx - 0x18], xmm1
mov rcx, qword [rsp + 0x70]
mov qword [rdx - 8], rcx
mov qword [0x1d5cc32c8], rdx
mov rdx, qword [rbx]
lea rsi, [rsp + 0x190]
mov ecx, 0x120
mov rdi, rsi
mov qword [rdx + 8], rax
mov qword [rax], rdx
mov rdx, qword [rbx + 0x28]
mov rax, qword [rbx + 0x20]
mov qword [rax + 8], rdx
mov rdx, qword [rbx + 0x28]
mov qword [rdx], rax
mov rdx, qword [rbx + 0x18]
mov rax, qword [rbx + 0x10]
mov qword [rax + 8], rdx
mov rdx, qword [rbx + 0x18]
mov qword [rdx], rax
mov rdx, qword [rbx + 0x78]
mov rax, qword [rbx + 0x70]
mov qword [rax + 8], rdx
mov rdx, qword [rbx + 0x78]
mov qword [rdx], rax
xor eax, eax
rep stosb byte [rdi], al
lea rdi, [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
mov r8d, 4
mov edx, 0x120
mov r9, rdi
mov dword [rsp + 0x24], 0
call fcn.1d5c11b70
mov rcx, qword [rsp + 0x50]
mov r8, rsi
mov r9d, 0x120
mov rsi, qword [0x1d5cc30e0]
mov edx, 0x120
call rsi
mov r8d, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
mov r9, rdi
mov edx, 0x120
lea rdi, [rsp + 0x30]
call fcn.1d5c11b70
mov rcx, qword [rbx + 0x50]
mov r8, rdi
movabs rax, 0x6c00640074006e
movabs rdx, 0x6c0064002e006c
mov qword [rsp + 0x30], rax
mov r9d, 0x14
mov qword [rsp + 0x38], rdx
movzx edx, word [rbx + 0x48]
mov dword [rsp + 0x40], 0x6c
call rsi
movzx edx, word [rbx + 0x48]
mov rcx, qword [rbx + 0x60]
mov r8, rdi
mov r9d, 0x14
call rsi
lea rcx, [rbx + 0x30]
lea r8, [rsp + 0x28]
mov edx, 8
mov qword [rsp + 0x28], 0x7fff0000
mov r9d, 8
call rsi
jmp 0x1d5c133ba
xor ecx, ecx
jmp 0x1d5c13371
lea r8, [rsp + 0x50]
lea rcx, [0x1d5cc32c0]
call fcn.1d5cab0b0
mov rax, qword [rbx + 8]
jmp 0x1d5c13449
mov r10, qword [0x1d5cc32c8]
mov rax, qword [0x1d5cc32c0]
movabs r8, 0xcccccccccccccccd
mov r9, rdx
mov rdx, r10
sub rdx, rax
sar rdx, 3
imul rdx, r8
mov r8, rdx
sar r8, 2
test r8, r8
jle 0x1d5c13620
lea rdx, [r8 + r8*4]
shl rdx, 5
add rdx, rax
jmp 0x1d5c135f9
cmp rcx, qword [rax + 0x28]
je 0x1d5c13658
cmp rcx, qword [rax + 0x50]
je 0x1d5c13660
cmp rcx, qword [rax + 0x78]
je 0x1d5c13670
add rax, 0xa0
cmp rdx, rax
je 0x1d5c13608
cmp rcx, qword [rax]
jne 0x1d5c135d8
cmp r10, rax
je 0x1d5c13632
ret
movabs r8, 0xcccccccccccccccd
mov rdx, r10
sub rdx, rax
sar rdx, 3
imul rdx, r8
cmp rdx, 2
je 0x1d5c13643
cmp rdx, 3
je 0x1d5c1363a
cmp rdx, 1
je 0x1d5c1364c
mov rdx, r9
jmp 0x1d5c132e0
cmp rcx, qword [rax]
je 0x1d5c135fe
add rax, 0x28
cmp rcx, qword [rax]
je 0x1d5c135fe
add rax, 0x28
cmp rcx, qword [rax]
jne 0x1d5c13632
jmp 0x1d5c135fe
add rax, 0x28
jmp 0x1d5c135fe
add rax, 0x50
jmp 0x1d5c135fe
add rax, 0x78
jmp 0x1d5c135fe