Function at 0x2fc4c9b20
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x84], 0x60
mov eax, dword [rsp + 0x84]
mov ecx, eax
mov rcx, qword gs:[rcx]
mov qword [rsp + 0x78], rcx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x18]
add rcx, 0x10
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx]
mov qword [rsp + 0x50], rcx
mov rax, qword [rsp + 0x50]
cmp rax, qword [rsp + 0x58]
je 0x2fc4ca7ac
xor eax, eax
mov ecx, dword [0x2fc4f3174]
mov edx, dword [0x2fc4f3180]
mov r8d, ecx
sub r8d, 0x5260fe7c
sub r8d, 0x1e606e61
add r8d, 0x5260fe7c
add r8d, 0xc11b075a
sub r8d, 1
sub r8d, 0xc11b075a
sub eax, 0x1e606e61
sub r8d, eax
imul ecx, r8d
and ecx, 1
cmp ecx, 0
sete r9b
cmp edx, 0xa
setl r10b
mov r11b, r9b
xor r11b, 0xff
and r11b, 1
mov bl, 1
mov sil, bl
xor sil, 1
mov dil, r9b
and dil, sil
or r11b, dil
mov sil, r10b
xor sil, 0xff
and sil, 1
mov dil, bl
xor dil, 1
mov bpl, r10b
and bpl, dil
or sil, bpl
mov dil, bl
xor dil, 0
and dil, 0
mov bpl, bl
xor bpl, 0
mov r14b, bpl
and r14b, 0
mov r15b, bl
xor r15b, 1
and r15b, 0
and bpl, 1
or dil, r14b
or r15b, bpl
xor dil, r15b
mov bpl, r11b
xor bpl, 0xff
mov r14b, bl
xor r14b, 0
mov r15b, bl
xor r15b, 1
or bpl, r14b
or r15b, 1
xor bpl, 0xff
and bpl, r15b
xor r9b, 0xff
mov r14b, dil
xor r14b, 0xff
mov r15b, bl
xor r15b, 1
or r9b, r14b
or r15b, 1
xor r9b, 0xff
and r9b, r15b
mov r14b, bl
xor r14b, 0
mov r15b, sil
xor r15b, r14b
and r15b, sil
mov r14b, dil
xor r14b, 0xff
mov r12b, r10b
xor r12b, r14b
and r12b, r10b
mov r10b, bpl
and r10b, r9b
xor bpl, r9b
or r10b, bpl
mov r9b, r15b
xor r9b, 0xff
mov bpl, r12b
xor bpl, 0xff
mov r14b, bl
xor r14b, 1
mov r13b, r9b
and r13b, 0xff
and r15b, r14b
mov al, bpl
and al, 0xff
and r12b, r14b
or r13b, r15b
or al, r12b
xor r13b, al
or r9b, bpl
xor r9b, 0xff
or r14b, 1
and r9b, r14b
or r13b, r9b
mov al, r10b
xor al, 0xff
mov r9b, r13b
and r9b, al
xor r13b, 0xff
and r10b, r13b
or r9b, r10b
mov al, r11b
xor al, 0xff
mov r10b, sil
xor r10b, 0xff
mov bpl, bl
xor bpl, 1
mov r14b, al
and r14b, 0xff
and r11b, bpl
mov r15b, r10b
and r15b, 0xff
and sil, bpl
or r14b, r11b
or r15b, sil
xor r14b, r15b
or al, r10b
xor al, 0xff
or bpl, 1
and al, bpl
or r14b, al
mov al, r14b
xor al, 0xff
and al, 1
mov r10b, bl
xor r10b, 1
and r14b, r10b
or al, r14b
mov r10b, bl
xor r10b, 0
mov r11b, dil
xor r11b, 0xff
xor bl, 1
mov sil, r10b
and sil, 0xff
mov bpl, bl
and bpl, 0
mov r14b, r11b
and r14b, 0xff
and dil, bl
or sil, bpl
or r14b, dil
xor sil, r14b
or r10b, r11b
xor r10b, 0xff
or bl, 1
and r10b, bl
or sil, r10b
xor sil, 0xff
mov r10b, al
xor r10b, sil
and r10b, al
mov al, r9b
and al, r10b
xor r9b, r10b
or al, r9b
test al, 1
jne 0x2fc4c9dcf
jmp 0x2fc4ca7ce
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x60]
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x40], rcx
mov rcx, rax
mov qword [rsp + 0x38], rdx
call sym.StrLen
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov r8, rax
call sym.W2Anicmp
cmp eax, 0
sete r9b
mov eax, dword [0x2fc4f3174]
mov r10d, dword [0x2fc4f3180]
mov r11d, eax
sub r11d, 0xf818d37b
sub r11d, 0x4f13b9aa
add r11d, 0xf818d37b
add r11d, 0x8d82efd4
sub r11d, 1
sub r11d, 0x8d82efd4
sub r11d, 0x105eaa8
add r11d, 0x4f13b9aa
add r11d, 0x105eaa8
imul eax, r11d
and eax, 1
cmp eax, 0
sete bl
cmp r10d, 0xa
setl sil
mov dil, sil
xor dil, 0xff
mov bpl, bl
xor bpl, dil
and bpl, bl
mov dil, bl
xor dil, 0xff
and dil, 0
mov r14b, 1
xor r14b, 0
and bl, r14b
mov r15b, sil
xor r15b, 0xff
and r15b, 0
and sil, r14b
or dil, bl
or r15b, sil
xor dil, r15b
mov bl, bpl
and bl, dil
xor bpl, dil
or bl, bpl
test bl, 1
mov byte [rsp + 0x37], r9b
jne 0x2fc4c9ed3
jmp 0x2fc4ca7ce
mov al, byte [rsp + 0x37]
test al, 1
jne 0x2fc4c9ee4
jmp 0x2fc4ca79a
mov eax, dword [0x2fc4f3174]
mov ecx, dword [0x2fc4f3180]
mov edx, eax
add edx, 0x82291cd7
sub edx, 0xe12fac5e
sub edx, 0x82291cd7
sub edx, 0x4d8313ec
sub edx, 1
add edx, 0x4d8313ec
add edx, 0x78b8aad3
add edx, 0xe12fac5e
sub edx, 0x78b8aad3
imul eax, edx
and eax, 1
cmp eax, 0
sete r8b
cmp ecx, 0xa
setl r9b
mov r10b, r8b
xor r10b, 0xff
and r10b, 1
mov r11b, 1
mov bl, r11b
xor bl, 1
mov sil, r8b
and sil, bl
or r10b, sil
mov bl, r9b
xor bl, 0xff
and bl, 1
mov sil, r11b
xor sil, 1
mov dil, r9b
and dil, sil
mov bpl, r11b
xor bpl, 1
and bpl, 0xff
and sil, 1
or bl, dil
or bpl, sil
xor bl, bpl
mov sil, r11b
xor sil, 0
and sil, 1
mov dil, r11b
xor dil, 1
and dil, 0
or sil, dil
mov dil, r11b
xor dil, 0
mov bpl, r10b
xor bpl, dil
and bpl, r10b
xor r8b, 0xff
mov dil, sil
xor dil, 0xff
mov r14b, r11b
xor r14b, 1
or r8b, dil
or r14b, 1
xor r8b, 0xff
and r8b, r14b
mov dil, bl
xor dil, 0xff
mov r14b, r11b
xor r14b, 0
mov r15b, r11b
xor r15b, 1
or dil, r14b
or r15b, 1
xor dil, 0xff
and dil, r15b
mov r14b, sil
xor r14b, 0xff
mov r15b, r9b
xor r15b, r14b
and r15b, r9b
mov r9b, bpl
and r9b, r8b
xor bpl, r8b
or r9b, bpl
mov r8b, dil
and r8b, r15b
xor dil, r15b
or r8b, dil
mov dil, r9b
xor dil, 0xff
mov bpl, r8b
and bpl, dil
xor r8b, 0xff
and r9b, r8b
or bpl, r9b
mov r8b, r10b
xor r8b, 0xff
mov r9b, bl
xor r9b, 0xff
mov dil, r11b
xor dil, 1
mov r14b, r8b
and r14b, 0xff
and r10b, dil
mov r15b, r9b
and r15b, 0xff
and bl, dil
or r14b, r10b
or r15b, bl
xor r14b, r15b
or r8b, r9b
xor r8b, 0xff
or dil, 1
and r8b, dil
or r14b, r8b
mov r8b, r14b
xor r8b, 0xff
and r8b, 1
mov r9b, r11b
xor r9b, 1
and r14b, r9b
xor r11b, 1
and r11b, 0xff
and r9b, 1
or r8b, r14b
or r11b, r9b
xor r8b, r11b
mov r9b, sil
and r9b, 0
xor sil, 0
or r9b, sil
xor r9b, 0xff
mov r10b, r8b
xor r10b, r9b
and r10b, r8b
mov r8b, bpl
and r8b, r10b
xor bpl, r10b
or r8b, bpl
test r8b, 1
jne 0x2fc4ca0d2
jmp 0x2fc4ca827
xor eax, eax
mov ecx, dword [0x2fc4f3174]
mov edx, dword [0x2fc4f3180]
mov r8d, eax
sub r8d, ecx
mov r9d, eax
sub r9d, 0x8368c2e2
add r8d, r9d
sub eax, r8d
add eax, 0x88b272fd
sub eax, 1
sub eax, 0x88b272fd
sub eax, 0x8704382c
sub eax, 0x8368c2e2
add eax, 0x8704382c
imul ecx, eax
and ecx, 1
cmp ecx, 0
sete r10b
cmp edx, 0xa
setl r11b
mov bl, r10b
xor bl, 0xff
and bl, 1
mov sil, 1
mov dil, sil
xor dil, 1
mov bpl, r10b
and bpl, dil
or bl, bpl
mov dil, r11b
xor dil, 0xff
and dil, 1
mov bpl, sil
xor bpl, 1
mov r14b, r11b
and r14b, bpl
or dil, r14b
mov bpl, sil
xor bpl, 0
and bpl, 1
mov r14b, sil
xor r14b, 1
and r14b, 0
or bpl, r14b
mov r14b, bl
xor r14b, 0xff
mov r15b, sil
xor r15b, 0
mov r12b, sil
xor r12b, 1
or r14b, r15b
or r12b, 1
xor r14b, 0xff
and r14b, r12b
xor r10b, 0xff
mov r15b, bpl
xor r15b, 0xff
mov r12b, sil
xor r12b, 0
or r10b, r15b
or r12b, 0
xor r10b, 0xff
and r10b, r12b
mov r15b, dil
xor r15b, 0xff
mov r12b, sil
xor r12b, 0
mov r13b, sil
xor r13b, 1
or r15b, r12b
or r13b, 1
xor r15b, 0xff
and r15b, r13b
xor r11b, 0xff
mov r12b, bpl
xor r12b, 0xff
mov r13b, sil
xor r13b, 1
or r11b, r12b
or r13b, 1
xor r11b, 0xff
and r11b, r13b
mov r12b, r14b
xor r12b, 0xff
mov r13b, r10b
xor r13b, 0xff
mov al, sil
xor al, 1
mov cl, r12b
and cl, 0xff
and r14b, al
mov dl, r13b
and dl, 0xff
and r10b, al
or cl, r14b
or dl, r10b
xor cl, dl
or r12b, r13b
xor r12b, 0xff
or al, 1
and r12b, al
or cl, r12b
mov al, r15b
and al, r11b
xor r15b, r11b
or al, r15b
mov dl, cl
xor dl, 0xff
mov r10b, al
and r10b, dl
xor al, 0xff
and cl, al
or r10b, cl
mov al, bl
xor al, 0xff
mov cl, dil
xor cl, 0xff
mov dl, sil
xor dl, 0
mov r11b, al
and r11b, 0
and bl, dl
mov r14b, cl
and r14b, 0
and dil, dl
or r11b, bl
or r14b, dil
xor r11b, r14b
or al, cl
xor al, 0xff
or dl, 0
and al, dl
or r11b, al
mov al, r11b
xor al, 0xff
and al, 1
mov cl, sil
xor cl, 1
and r11b, cl
or al, r11b
mov cl, sil
xor cl, 0
mov dl, bpl
xor dl, 0xff
mov r11b, sil
xor r11b, 0
mov bl, cl
and bl, 0
mov dil, r11b
and dil, 0
mov r14b, dl
and r14b, 0
and bpl, r11b
or bl, dil
or r14b, bpl
xor bl, r14b
or cl, dl
xor cl, 0xff
or r11b, 0
and cl, r11b
or bl, cl
xor bl, 0xff
mov cl, al
xor cl, bl
and cl, al
mov al, r10b
xor al, 0xff
mov dl, cl
xor dl, 0xff
xor sil, 1
mov r11b, al
and r11b, 0xff
and r10b, sil
mov bl, dl
and bl, 0xff
and cl, sil
or r11b, r10b
or bl, cl
xor r11b, bl
or al, dl
xor al, 0xff
or sil, 1
and al, sil
or r11b, al
test r11b, 1
jne 0x2fc4ca32f
jmp 0x2fc4ca827
xor eax, eax
mov ecx, dword [0x2fc4f3174]
mov edx, dword [0x2fc4f3180]
sub eax, 0x5ce1a8d9
mov r8d, ecx
sub r8d, eax
sub r8d, 0x130e3c7
sub r8d, 1
add r8d, 0x130e3c7
sub r8d, 0x823a927d
sub r8d, 0x5ce1a8d9
add r8d, 0x823a927d
imul ecx, r8d
and ecx, 1
cmp ecx, 0
sete r9b
cmp edx, 0xa
setl r10b
mov r11b, r9b
xor r11b, 0xff
and r11b, 1
mov bl, 1
mov sil, bl
xor sil, 1
mov dil, r9b
and dil, sil
or r11b, dil
mov sil, r10b
xor sil, 0xff
and sil, 1
mov dil, bl
xor dil, 1
mov bpl, r10b
and bpl, dil
or sil, bpl
mov dil, bl
xor dil, 1
and dil, 0
mov bpl, bl
xor bpl, 0
mov r14b, bpl
and r14b, 1
mov r15b, bl
xor r15b, 1
and r15b, 0
and bpl, 1
or dil, r14b
or r15b, bpl
xor dil, r15b
mov bpl, r11b
xor bpl, 0xff
mov r14b, bl
xor r14b, 1
mov r15b, bl
xor r15b, 0
or bpl, r14b
or r15b, 0
xor bpl, 0xff
and bpl, r15b
xor r9b, 0xff
mov r14b, dil
xor r14b, 0xff
mov r15b, bl
xor r15b, 1
or r9b, r14b
or r15b, 1
xor r9b, 0xff
and r9b, r15b
mov r14b, sil
xor r14b, 0xff
mov r15b, bl
xor r15b, 1
mov r12b, bl
xor r12b, 0
or r14b, r15b
or r12b, 0
xor r14b, 0xff
and r14b, r12b
mov r15b, dil
xor r15b, 0xff
mov r12b, r10b
xor r12b, r15b
and r12b, r10b
mov r10b, bpl
xor r10b, 0xff
mov r15b, r9b
xor r15b, 0xff
mov r13b, bl
xor r13b, 0
mov al, r10b
and al, 0
and bpl, r13b
mov cl, r15b
and cl, 0
and r9b, r13b
or al, bpl
or cl, r9b
xor al, cl
or r10b, r15b
xor r10b, 0xff
or r13b, 0
and r10b, r13b
or al, r10b
mov cl, r14b
xor cl, 0xff
mov r9b, r12b
xor r9b, 0xff
mov r10b, bl
xor r10b, 0
mov bpl, cl
and bpl, 0
and r14b, r10b
mov r15b, r9b
and r15b, 0
and r12b, r10b
or bpl, r14b
or r15b, r12b
xor bpl, r15b
or cl, r9b
xor cl, 0xff
or r10b, 0
and cl, r10b
or bpl, cl
mov cl, al
xor cl, 0xff
and cl, 0
mov r9b, bl
xor r9b, 0
and al, r9b
mov r10b, bpl
xor r10b, 0xff
and r10b, 0
and bpl, r9b
or cl, al
or r10b, bpl
xor cl, r10b
mov al, r11b
and al, sil
xor r11b, sil
or al, r11b
mov r9b, al
xor r9b, 0xff
and r9b, 0
mov r10b, bl
xor r10b, 0
and al, r10b
mov r11b, bl
xor r11b, 1
and r11b, 0
and r10b, 1
or r9b, al
or r11b, r10b
xor r9b, r11b
mov al, dil
and al, 1
xor dil, 1
or al, dil
xor al, 0xff
mov r10b, r9b
xor r10b, al
and r10b, r9b
mov al, cl
xor al, 0xff
mov r9b, r10b
xor r9b, 0xff
xor bl, 0
mov r11b, al
and r11b, 0
and cl, bl
mov sil, r9b
and sil, 0
and r10b, bl
or r11b, cl
or sil, r10b
xor r11b, sil
or al, r9b
xor al, 0xff
or bl, 0
and al, bl
or r11b, al
test r11b, 1
jne 0x2fc4ca5a1
jmp 0x2fc4ca814
xor eax, eax
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx + 0x30]
mov qword [rsp + 0x70], rcx
mov edx, dword [0x2fc4f3174]
mov r8d, dword [0x2fc4f3180]
mov r9d, eax
sub r9d, 1
add r9d, 0
mov r10d, eax
sub r10d, edx
mov r11d, eax
sub r11d, r9d
add r10d, r11d
sub eax, r10d
imul edx, eax
and edx, 1
cmp edx, 0
sete bl
cmp r8d, 0xa
setl sil
mov dil, bl
xor dil, 0xff
and dil, 1
mov bpl, 1
mov r14b, bpl
xor r14b, 1
mov r15b, bl
and r15b, r14b
mov r12b, bpl
xor r12b, 1
and r12b, 0xff
and r14b, 1
or dil, r15b
or r12b, r14b
xor dil, r12b
mov r14b, sil
xor r14b, 0xff
and r14b, 1
mov r15b, bpl
xor r15b, 1
mov r12b, sil
and r12b, r15b
or r14b, r12b
mov r15b, bpl
xor r15b, 0
and r15b, 1
mov r12b, bpl
xor r12b, 1
and r12b, 0
or r15b, r12b
mov r12b, dil
xor r12b, 0xff
mov r13b, bpl
xor r13b, 0
mov al, bpl
xor al, 0
or r12b, r13b
or al, 0
xor r12b, 0xff
and r12b, al
xor bl, 0xff
mov al, r15b
xor al, 0xff
mov r13b, bpl
xor r13b, 1
or bl, al
or r13b, 1
xor bl, 0xff
and bl, r13b
mov al, bpl
xor al, 0
mov r13b, r14b
xor r13b, al
and r13b, r14b
xor sil, 0xff
mov al, r15b
xor al, 0xff
mov cl, bpl
xor cl, 0
or sil, al
or cl, 0
xor sil, 0xff
and sil, cl
mov al, r12b
and al, bl
xor r12b, bl
or al, r12b
mov cl, r13b
xor cl, 0xff
mov bl, sil
xor bl, 0xff
mov r12b, bpl
xor r12b, 1
mov dl, cl
and dl, 0xff
and r13b, r12b
mov r8b, bl
and r8b, 0xff
and sil, r12b
or dl, r13b
or r8b, sil
xor dl, r8b
or cl, bl
xor cl, 0xff
or r12b, 1
and cl, r12b
or dl, cl
mov cl, al
xor cl, 0xff
mov r8b, dl
and r8b, cl
xor dl, 0xff
and al, dl
or r8b, al
mov al, dil
xor al, 0xff
mov cl, r14b
xor cl, 0xff
mov dl, bpl
xor dl, 1
mov bl, al
and bl, 0xff
and dil, dl
mov sil, cl
and sil, 0xff
and r14b, dl
or bl, dil
or sil, r14b
xor bl, sil
or al, cl
xor al, 0xff
or dl, 1
and al, dl
or bl, al
mov al, bl
xor al, 0xff
and al, 1
mov cl, bpl
xor cl, 1
and bl, cl
or al, bl
mov cl, r15b
and cl, 0
xor r15b, 0
or cl, r15b
xor al, 0xff
xor cl, 0xff
xor bpl, 1
or al, cl
or bpl, 1
xor al, 0xff
and al, bpl
mov cl, r8b
and cl, al
xor r8b, al
or cl, r8b
test cl, 1
jne 0x2fc4ca795
jmp 0x2fc4ca814
jmp 0x2fc4ca7b5
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
jmp 0x2fc4c9b81
mov qword [rsp + 0x70], 0
mov rax, qword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x60]
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov rcx, rax
mov qword [rsp + 0x20], rdx
call sym.StrLen
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov r8, rax
call sym.W2Anicmp
jmp 0x2fc4c9dcf
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x70], rax
jmp 0x2fc4ca5a1
jmp 0x2fc4ca0d2