Function at 0x2fc4ced10
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x84], 0x60
mov eax, dword [rsp + 0x84]
mov ecx, eax
mov rcx, qword gs:[rcx]
mov qword [rsp + 0x78], rcx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x18]
add rcx, 0x10
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx]
mov qword [rsp + 0x50], rcx
mov rax, qword [rsp + 0x50]
cmp rax, qword [rsp + 0x58]
je 0x2fc4cf54e
xor eax, eax
mov ecx, dword [0x2fc4f8174]
mov edx, dword [0x2fc4f8180]
mov r8d, ecx
sub r8d, 0x9f5dad27
sub r8d, 0x95b6bee9
add r8d, 0x9f5dad27
add r8d, 0x237dab9c
sub r8d, 1
sub r8d, 0x237dab9c
sub eax, 0x95b6bee9
sub r8d, eax
imul ecx, r8d
and ecx, 1
cmp ecx, 0
sete r9b
cmp edx, 0xa
setl r10b
mov r11b, r9b
xor r11b, 0xff
and r11b, 1
mov bl, 1
mov sil, bl
xor sil, 1
mov dil, r9b
and dil, sil
mov bpl, bl
xor bpl, 1
and bpl, 0xff
and sil, 1
or r11b, dil
or bpl, sil
xor r11b, bpl
mov sil, r10b
xor sil, 0xff
and sil, 1
mov dil, bl
xor dil, 1
mov bpl, r10b
and bpl, dil
or sil, bpl
mov dil, bl
xor dil, 0
and dil, 1
mov bpl, bl
xor bpl, 1
and bpl, 0
or dil, bpl
mov bpl, r11b
xor bpl, 0xff
mov r14b, bl
xor r14b, 0
mov r15b, bl
xor r15b, 1
or bpl, r14b
or r15b, 1
xor bpl, 0xff
and bpl, r15b
xor r9b, 0xff
mov r14b, dil
xor r14b, 0xff
mov r15b, bl
xor r15b, 0
or r9b, r14b
or r15b, 0
xor r9b, 0xff
and r9b, r15b
mov r14b, bl
xor r14b, 0
mov r15b, sil
xor r15b, r14b
and r15b, sil
mov r14b, dil
xor r14b, 0xff
mov r12b, r10b
xor r12b, r14b
and r12b, r10b
mov r10b, bpl
and r10b, r9b
xor bpl, r9b
or r10b, bpl
mov r9b, r15b
xor r9b, 0xff
mov bpl, r12b
xor bpl, 0xff
mov r14b, bl
xor r14b, 1
mov r13b, r9b
and r13b, 0xff
and r15b, r14b
mov al, bpl
and al, 0xff
and r12b, r14b
or r13b, r15b
or al, r12b
xor r13b, al
or r9b, bpl
xor r9b, 0xff
or r14b, 1
and r9b, r14b
or r13b, r9b
mov al, r10b
xor al, 0xff
mov r9b, r13b
and r9b, al
xor r13b, 0xff
and r10b, r13b
or r9b, r10b
mov al, r11b
xor al, 0xff
mov r10b, sil
xor r10b, 0xff
mov bpl, bl
xor bpl, 1
mov r14b, al
and r14b, 0xff
and r11b, bpl
mov r15b, r10b
and r15b, 0xff
and sil, bpl
or r14b, r11b
or r15b, sil
xor r14b, r15b
or al, r10b
xor al, 0xff
or bpl, 1
and al, bpl
or r14b, al
mov al, r14b
xor al, 0xff
and al, 1
mov r10b, bl
xor r10b, 1
and r14b, r10b
or al, r14b
mov r10b, bl
xor r10b, 0
mov r11b, dil
xor r11b, 0xff
mov sil, bl
xor sil, 1
mov bpl, r10b
and bpl, 0xff
mov r14b, sil
and r14b, 0
mov r15b, r11b
and r15b, 0xff
and dil, sil
or bpl, r14b
or r15b, dil
xor bpl, r15b
or r10b, r11b
xor r10b, 0xff
or sil, 1
and r10b, sil
or bpl, r10b
xor al, 0xff
xor bpl, 0xff
xor bl, 0
or al, bpl
or bl, 0
xor al, 0xff
and al, bl
mov r10b, r9b
and r10b, al
xor r9b, al
or r10b, r9b
test r10b, 1
jne 0x2fc4cefc9
jmp 0x2fc4cf9f4
xor eax, eax
mov ecx, dword [0x2fc4f8174]
mov edx, dword [0x2fc4f8180]
mov r8d, ecx
sub r8d, 0x38e46548
sub r8d, 0x4df2dac8
add r8d, 0x38e46548
add r8d, 0x83f28d32
sub r8d, 1
sub r8d, 0x83f28d32
mov r9d, eax
sub r9d, r8d
mov r8d, eax
sub r8d, 0x4df2dac8
add r9d, r8d
sub eax, r9d
imul ecx, eax
and ecx, 1
cmp ecx, 0
sete r10b
cmp edx, 0xa
setl r11b
mov bl, r11b
xor bl, 0xff
mov sil, r10b
xor sil, bl
and sil, r10b
mov bl, r10b
xor bl, 0xff
mov dil, r11b
and dil, bl
xor r11b, 0xff
and r10b, r11b
or dil, r10b
mov r10b, sil
and r10b, dil
xor sil, dil
or r10b, sil
test r10b, 1
jne 0x2fc4cf06b
jmp 0x2fc4cf9f4
xor eax, eax
mov ecx, dword [0x2fc4f8174]
mov edx, dword [0x2fc4f8180]
sub eax, 1
add eax, 0
mov r8d, ecx
sub r8d, 0xd19683ce
add r8d, eax
add r8d, 0xd19683ce
imul ecx, r8d
and ecx, 1
cmp ecx, 0
sete r9b
cmp edx, 0xa
setl r10b
mov r11b, r9b
xor r11b, 0xff
and r11b, 0
mov bl, 1
mov sil, bl
xor sil, 0
mov dil, r9b
and dil, sil
mov bpl, bl
xor bpl, 1
and bpl, 0
and sil, 1
or r11b, dil
or bpl, sil
xor r11b, bpl
mov sil, r10b
xor sil, 0xff
and sil, 1
mov dil, bl
xor dil, 1
mov bpl, r10b
and bpl, dil
mov r14b, bl
xor r14b, 1
and r14b, 0xff
and dil, 1
or sil, bpl
or r14b, dil
xor sil, r14b
mov dil, bl
xor dil, 0
and dil, 0
mov bpl, bl
xor bpl, 0
mov r14b, bpl
and r14b, 0
mov r15b, bl
xor r15b, 1
and r15b, 0
and bpl, 1
or dil, r14b
or r15b, bpl
xor dil, r15b
mov bpl, r11b
xor bpl, 0xff
mov r14b, bl
xor r14b, 0
mov r15b, bl
xor r15b, 0
or bpl, r14b
or r15b, 0
xor bpl, 0xff
and bpl, r15b
xor r9b, 0xff
mov r14b, dil
xor r14b, 0xff
mov r15b, bl
xor r15b, 1
or r9b, r14b
or r15b, 1
xor r9b, 0xff
and r9b, r15b
mov r14b, bl
xor r14b, 0
mov r15b, sil
xor r15b, r14b
and r15b, sil
mov r14b, dil
xor r14b, 0xff
mov r12b, r10b
xor r12b, r14b
and r12b, r10b
mov r10b, bpl
and r10b, r9b
xor bpl, r9b
or r10b, bpl
mov r9b, r15b
and r9b, r12b
xor r15b, r12b
or r9b, r15b
mov bpl, r10b
xor bpl, 0xff
mov r14b, r9b
and r14b, bpl
xor r9b, 0xff
and r10b, r9b
or r14b, r10b
mov r9b, r11b
and r9b, sil
xor r11b, sil
or r9b, r11b
mov r10b, r9b
xor r10b, 0xff
and r10b, 1
mov r11b, bl
xor r11b, 1
and r9b, r11b
or r10b, r9b
mov r9b, dil
and r9b, 0
xor dil, 0
or r9b, dil
xor r10b, 0xff
xor r9b, 0xff
mov r11b, bl
xor r11b, 0
or r10b, r9b
or r11b, 0
xor r10b, 0xff
and r10b, r11b
mov r9b, r14b
xor r9b, 0xff
mov r11b, r10b
xor r11b, 0xff
xor bl, 0
mov sil, r9b
and sil, 0
and r14b, bl
mov dil, r11b
and dil, 0
and r10b, bl
or sil, r14b
or dil, r10b
xor sil, dil
or r9b, r11b
xor r9b, 0xff
or bl, 0
and r9b, bl
or sil, r9b
test sil, 1
jne 0x2fc4cf269
jmp 0x2fc4cf98d
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x60]
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x40], rcx
mov rcx, rax
mov qword [rsp + 0x38], rdx
call sym.StrLen
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov r8, rax
call sym.W2Anicmp
xor r9d, r9d
cmp eax, 0
sete r10b
mov eax, dword [0x2fc4f8174]
mov r11d, dword [0x2fc4f8180]
mov esi, r9d
sub esi, 0x816dcae3
sub esi, 1
add esi, 0x816dcae3
mov edi, r9d
sub edi, eax
mov ebx, r9d
sub ebx, esi
add edi, ebx
sub r9d, edi
imul eax, r9d
and eax, 1
cmp eax, 0
sete bpl
cmp r11d, 0xa
setl r14b
mov r15b, bpl
xor r15b, 0xff
mov r12b, r14b
xor r12b, 0xff
mov r13b, 1
mov al, r13b
xor al, 0
or r15b, r12b
or al, 0
xor r15b, 0xff
and r15b, al
mov al, bpl
xor al, 0xff
mov r12b, r14b
and r12b, al
xor r14b, 0xff
and bpl, r14b
or r12b, bpl
mov al, r15b
xor al, 0xff
mov bpl, r12b
xor bpl, 0xff
xor r13b, 0
mov r14b, al
and r14b, 0
and r15b, r13b
mov cl, bpl
and cl, 0
and r12b, r13b
or r14b, r15b
or cl, r12b
xor r14b, cl
or al, bpl
xor al, 0xff
or r13b, 0
and al, r13b
or r14b, al
test r14b, 1
mov byte [rsp + 0x37], r10b
jne 0x2fc4cf37e
jmp 0x2fc4cf98d
mov al, byte [rsp + 0x37]
test al, 1
jne 0x2fc4cf38f
jmp 0x2fc4cf53c
mov eax, dword [0x2fc4f8174]
mov ecx, dword [0x2fc4f8180]
mov edx, eax
add edx, 0x3b64826f
sub edx, 0x2f3e3016
sub edx, 0x3b64826f
add edx, 0x3aae7ad8
sub edx, 1
sub edx, 0x3aae7ad8
add edx, 0xcbe2238d
add edx, 0x2f3e3016
sub edx, 0xcbe2238d
imul eax, edx
and eax, 1
cmp eax, 0
sete r8b
cmp ecx, 0xa
setl r9b
mov r10b, r9b
xor r10b, 0xff
mov r11b, r8b
xor r11b, r10b
and r11b, r8b
mov r10b, r8b
xor r10b, 0xff
mov bl, r9b
and bl, r10b
xor r9b, 0xff
and r8b, r9b
or bl, r8b
mov r8b, r11b
xor r8b, 0xff
mov r9b, bl
xor r9b, 0xff
mov r10b, 1
xor r10b, 1
mov sil, r8b
and sil, 0xff
and r11b, r10b
mov dil, r9b
and dil, 0xff
and bl, r10b
or sil, r11b
or dil, bl
xor sil, dil
or r8b, r9b
xor r8b, 0xff
or r10b, 1
and r8b, r10b
or sil, r8b
test sil, 1
jne 0x2fc4cf45d
jmp 0x2fc4cf9d3
xor eax, eax
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx + 0x30]
mov qword [rsp + 0x70], rcx
mov edx, dword [0x2fc4f8174]
mov r8d, dword [0x2fc4f8180]
mov r9d, edx
sub r9d, 0xbc714963
sub r9d, 0xaada6a50
add r9d, 0xbc714963
sub eax, 1
add r9d, eax
sub r9d, 0xdc5083d0
add r9d, 0xaada6a50
add r9d, 0xdc5083d0
imul edx, r9d
and edx, 1
cmp edx, 0
sete r10b
cmp r8d, 0xa
setl r11b
mov bl, r11b
xor bl, 0xff
mov sil, r10b
xor sil, bl
and sil, r10b
mov bl, r10b
xor bl, 0xff
mov dil, r11b
and dil, bl
xor r11b, 0xff
and r10b, r11b
or dil, r10b
mov r10b, sil
xor r10b, 0xff
mov r11b, dil
xor r11b, 0xff
mov bl, 1
xor bl, 0
mov bpl, r10b
and bpl, 0
and sil, bl
mov r14b, r11b
and r14b, 0
and dil, bl
or bpl, sil
or r14b, dil
xor bpl, r14b
or r10b, r11b
xor r10b, 0xff
or bl, 0
and r10b, bl
or bpl, r10b
test bpl, 1
jne 0x2fc4cf537
jmp 0x2fc4cf9d3
jmp 0x2fc4cf974
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
jmp 0x2fc4ced71
xor eax, eax
mov ecx, dword [0x2fc4f8174]
mov edx, dword [0x2fc4f8180]
mov r8d, eax
sub r8d, 0x93b8b919
mov r9d, ecx
add r9d, r8d
sub eax, 1
add r9d, eax
add r9d, 0xc18392b9
add r9d, 0x93b8b919
sub r9d, 0xc18392b9
imul ecx, r9d
and ecx, 1
cmp ecx, 0
sete r10b
cmp edx, 0xa
setl r11b
mov bl, r11b
xor bl, 0xff
mov sil, r10b
xor sil, bl
and sil, r10b
mov bl, r10b
xor bl, 0xff
mov dil, r11b
and dil, bl
xor r11b, 0xff
and r10b, r11b
or dil, r10b
mov r10b, sil
and r10b, dil
xor sil, dil
or r10b, sil
test r10b, 1
jne 0x2fc4cf5dc
jmp 0x2fc4cf9e6
mov eax, dword [0x2fc4f8174]
mov ecx, dword [0x2fc4f8180]
mov edx, eax
add edx, 0xdc7f0224
add edx, 0x525cfacb
sub edx, 0xdc7f0224
sub edx, 0xe5de5368
sub edx, 1
add edx, 0xe5de5368
add edx, 0x7a0db35b
sub edx, 0x525cfacb
sub edx, 0x7a0db35b
imul eax, edx
and eax, 1
cmp eax, 0
sete r8b
cmp ecx, 0xa
setl r9b
mov r10b, r8b
xor r10b, 0xff
and r10b, 1
mov r11b, 1
mov bl, r11b
xor bl, 1
mov sil, r8b
and sil, bl
or r10b, sil
mov bl, r9b
xor bl, 0xff
and bl, 1
mov sil, r11b
xor sil, 1
mov dil, r9b
and dil, sil
or bl, dil
mov sil, r11b
xor sil, 1
and sil, 1
mov dil, r11b
xor dil, 1
and dil, 1
or sil, dil
mov dil, r10b
xor dil, 0xff
mov bpl, r11b
xor bpl, 1
mov r14b, r11b
xor r14b, 1
or dil, bpl
or r14b, 1
xor dil, 0xff
and dil, r14b
xor r8b, 0xff
mov bpl, sil
xor bpl, 0xff
mov r14b, r11b
xor r14b, 1
or r8b, bpl
or r14b, 1
xor r8b, 0xff
and r8b, r14b
mov bpl, bl
xor bpl, 0xff
mov r14b, r11b
xor r14b, 1
mov r15b, r11b
xor r15b, 1
or bpl, r14b
or r15b, 1
xor bpl, 0xff
and bpl, r15b
xor r9b, 0xff
mov r14b, sil
xor r14b, 0xff
mov r15b, r11b
xor r15b, 0
or r9b, r14b
or r15b, 0
xor r9b, 0xff
and r9b, r15b
mov r14b, dil
xor r14b, 0xff
mov r15b, r8b
xor r15b, 0xff
mov r12b, r11b
xor r12b, 1
mov r13b, r14b
and r13b, 0xff
and dil, r12b
mov al, r15b
and al, 0xff
and r8b, r12b
or r13b, dil
or al, r8b
xor r13b, al
or r14b, r15b
xor r14b, 0xff
or r12b, 1
and r14b, r12b
or r13b, r14b
mov al, bpl
and al, r9b
xor bpl, r9b
or al, bpl
mov r8b, r13b
xor r8b, 0xff
mov r9b, al
and r9b, r8b
xor al, 0xff
and r13b, al
or r9b, r13b
mov al, r10b
and al, bl
xor r10b, bl
or al, r10b
mov r8b, al
xor r8b, 0xff
and r8b, 1
mov r10b, r11b
xor r10b, 1
and al, r10b
or r8b, al
mov al, sil
and al, 1
xor sil, 1
or al, sil
xor r8b, 0xff
xor al, 0xff
mov r10b, r11b
xor r10b, 1
or r8b, al
or r10b, 1
xor r8b, 0xff
and r8b, r10b
mov al, r9b
xor al, 0xff
mov r10b, r8b
xor r10b, 0xff
xor r11b, 1
mov bl, al
and bl, 0xff
and r9b, r11b
mov sil, r10b
and sil, 0xff
and r8b, r11b
or bl, r9b
or sil, r8b
xor bl, sil
or al, r10b
xor al, 0xff
or r11b, 1
and al, r11b
or bl, al
test bl, 1
jne 0x2fc4cf7f9
jmp 0x2fc4cf9f9
xor eax, eax
mov qword [rsp + 0x70], 0
mov ecx, dword [0x2fc4f8174]
mov edx, dword [0x2fc4f8180]
mov r8d, ecx
add r8d, 0x9a03a09d
sub r8d, 0xec12a5ea
sub r8d, 0x9a03a09d
sub eax, 1
add r8d, eax
sub r8d, 0x30570270
add r8d, 0xec12a5ea
add r8d, 0x30570270
imul ecx, r8d
and ecx, 1
cmp ecx, 0
sete r9b
cmp edx, 0xa
setl r10b
mov r11b, r9b
xor r11b, 0xff
mov bl, r10b
xor bl, 0xff
mov sil, 1
mov dil, sil
xor dil, 1
or r11b, bl
or dil, 1
xor r11b, 0xff
and r11b, dil
mov bl, r9b
xor bl, 0xff
and bl, 1
mov dil, sil
xor dil, 1
and r9b, dil
mov bpl, r10b
xor bpl, 0xff
and bpl, 0xff
and r10b, dil
or bl, r9b
or bpl, r10b
xor bl, bpl
mov r9b, r11b
xor r9b, 0xff
mov r10b, bl
xor r10b, 0xff
xor sil, 1
mov dil, r9b
and dil, 0xff
and r11b, sil
mov bpl, r10b
and bpl, 0xff
and bl, sil
or dil, r11b
or bpl, bl
xor dil, bpl
or r9b, r10b
xor r9b, 0xff
or sil, 1
and r9b, sil
or dil, r9b
test dil, 1
jne 0x2fc4cf8f6
jmp 0x2fc4cf9f9
xor eax, eax
mov ecx, dword [0x2fc4f8174]
mov edx, dword [0x2fc4f8180]
mov r8d, eax
sub r8d, 1
add r8d, 0
sub eax, r8d
mov r8d, ecx
sub r8d, eax
imul ecx, r8d
and ecx, 1
cmp ecx, 0
sete r9b
cmp edx, 0xa
setl r10b
mov r11b, r10b
xor r11b, 0xff
mov bl, r9b
xor bl, r11b
and bl, r9b
mov r11b, r9b
xor r11b, 0xff
mov sil, r10b
and sil, r11b
xor r10b, 0xff
and r9b, r10b
or sil, r9b
mov r9b, bl
and r9b, sil
xor bl, sil
or r9b, bl
test r9b, 1
jne 0x2fc4cf96f
jmp 0x2fc4cf9e6
jmp 0x2fc4cf974
mov rax, qword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x60]
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov rcx, rax
mov qword [rsp + 0x20], rdx
call sym.StrLen
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov r8, rax
call sym.W2Anicmp
jmp 0x2fc4cf269
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x70], rax
jmp 0x2fc4cf45d
mov qword [rsp + 0x70], 0
jmp 0x2fc4cf5dc
jmp 0x2fc4cefc9
mov qword [rsp + 0x70], 0
jmp 0x2fc4cf7f9