Function at 0x6e75ca90
Capabilities:
Access peb ldr_data
Get process filename

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
lea r12, [0x6e76ff20]
mov qword [rsp + 0x20], 0
lea rbx, [rsp + 0x40]
mov rsi, rcx
mov r15d, edx
lea rcx, [0x6e770060]
mov edx, 0xfff6b0e
call fcn.6e757c00
lea rcx, [rsp + 0x20]
mov edx, 1
mov qword [rsp + 0x20], rax
lea rdi, [rsp + 0x50]
call fcn.6e7426e0
mov edx, 0x3d15870a
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
lea rcx, [0x6e770020]
call fcn.6e757c00
mov r14, qword [str._2zn]
mov rcx, rsi
mov qword [rsp + 0x40], rax
call qword [r14]
mov rcx, rsi
movsxd rdx, eax
call fcn.6e74fc50
mov edx, 2
mov rcx, rbx
mov qword [rsp + 0x48], rax
call fcn.6e7426e0
mov edx, 0x7fcc190e
lea rcx, [0x6e76ff60]
call fcn.6e757c00
mov edx, 0x46fa638a
mov rcx, rax
call fcn.6e7595f0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rbp, qword [rax + 0x20]
lea r13, [rax + 0x20]
nop word [rax + rax]
movzx eax, word [rsi]
mov qword [rsp + 0x50], rsi
mov rdx, rsi
test ax, ax
je 0x6e75cba9
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x6e75cb8f
add eax, 0x20
mov word [rdx], ax
mov edx, 1
mov rcx, rdi
call fcn.6e757100
mov rdx, qword [rsp + 0x50]
movzx eax, word [rdx]
test ax, ax
jne 0x6e75cb80
mov rbx, qword [rbp + 0x50]
mov qword [rsp + 0x50], rbx
movzx eax, word [rbx]
test ax, ax
je 0x6e75cbe9
mov rdx, rbx
nop dword [rax]
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x6e75cbcf
add eax, 0x20
mov word [rdx], ax
mov edx, 1
mov rcx, rdi
call fcn.6e757100
mov rdx, qword [rsp + 0x50]
movzx eax, word [rdx]
test ax, ax
jne 0x6e75cbc0
mov rdx, rbx
mov rcx, rsi
call fcn.6e75b400
mov edx, 0x32e394ae
mov rcx, r12
mov rbx, rax
call fcn.6e757c00
mov edx, 0x7ce407ea
mov rcx, rax
call fcn.6e7595f0
test rbx, rbx
je 0x6e75ce50
mov rbp, qword [rbp]
cmp r13, rbp
jne 0x6e75cb70
lea rcx, [0x6e76fea0]
mov edx, 0x518ee74e
mov qword [rsp + 0x50], 0
call fcn.6e757c00
mov edx, 1
mov rcx, rdi
mov qword [rsp + 0x50], rax
call fcn.6e7426e0
test r15d, r15d
je 0x6e75ce91
lea rcx, [0x6e76fd80]
mov edx, 0x74ad34aa
call fcn.6e757c00
mov edx, 0x2120a9ca
mov rcx, rax
call fcn.6e7595f0
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x28], 0
call qword [0x6e7a4bd0]
lea r9, [rsp + 0x28]
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [0x6e7a4e10]
mov edx, 0x56a9e78e
lea rcx, [0x6e76fd40]
mov ebx, eax
call fcn.6e757c00
mov edx, 0x706b48ee
mov rcx, rax
call fcn.6e7595f0
test ebx, ebx
je 0x6e75cee0
mov qword [rsp + 0x30], 0
mov ecx, 0x44
call fcn.6e749b50
mov edx, 0x13
mov rcx, rax
mov qword [rsp + 0x38], rax
call fcn.6e749b80
mov rcx, qword [0x6e76fd10]
mov qword [rsp + 0x38], rax
mov rdx, qword [rax]
lea rdx, [rax + rdx + 0x10]
mov qword [rdx], rcx
mov rcx, qword [0x6e76fd18]
mov qword [rdx + 8], rcx
mov ecx, dword [0x6e76fd20]
mov dword [rdx + 0x10], ecx
mov rcx, rsi
add qword [rax], 0x13
call qword [r14]
mov rcx, rsi
lea rsi, [rsp + 0x38]
movsxd rdx, eax
call fcn.6e74fc50
xor r8d, r8d
mov rcx, rsi
mov rdx, rax
call fcn.6e750b10
mov rcx, qword [rsp + 0x38]
mov edx, 0xa
call fcn.6e749b80
mov rcx, qword [0x6e76fcf0]
mov qword [rsp + 0x38], rax
mov rdx, qword [rax]
lea rdx, [rax + rdx + 0x10]
mov qword [rdx], rcx
movzx ecx, word [0x6e76fcf8]
mov word [rdx + 8], cx
movzx ecx, byte [0x6e76fcfa]
mov byte [rdx + 0xa], cl
movsxd rcx, ebx
add qword [rax], 0xa
call fcn.6e741fa0
test rax, rax
mov rbx, rax
je 0x6e75d0bd
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x38]
call fcn.6e749b80
mov rcx, rsi
mov rdx, rax
call fcn.6e749db0
mov rsi, qword [rsp + 0x38]
lea rdx, [rbx + 0x10]
mov rax, qword [rsi]
lea rcx, [rsi + rax + 0x10]
mov rax, qword [rbx]
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
mov rax, qword [rbx]
add qword [rsi], rax
mov rcx, qword [rsp + 0x38]
mov edx, 2
call fcn.6e749b80
movzx ecx, word [0x6e76fb80]
mov qword [rsp + 0x38], rax
mov rdx, qword [rax]
lea rdx, [rax + rdx + 0x10]
mov word [rdx], cx
movzx ecx, byte [0x6e76fb82]
mov byte [rdx + 2], cl
add qword [rax], 2
mov rcx, qword [rsp + 0x38]
call fcn.6e74b360
lea rcx, [rsp + 0x30]
mov edx, 1
mov qword [rsp + 0x30], rax
call fcn.6e7426e0
cmp qword [rsp + 0x28], 0
jne 0x6e75ce4c
lea rcx, [0x6e76fb20]
mov edx, 1
call fcn.6e7426e0
xor eax, eax
jmp 0x6e75ce80
lea rcx, [0x6e76fee0]
mov edx, 0x4a430dea
mov qword [rsp + 0x50], 0
call fcn.6e757c00
mov edx, 1
mov rcx, rdi
mov qword [rsp + 0x50], rax
call fcn.6e7426e0
mov rax, qword [rbp + 0x20]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x6e76fe60]
mov edx, 0x31f61fca
call fcn.6e757c00
mov edx, 0x4f8754e
mov rcx, rax
call fcn.6e7595f0
mov edx, 0x70740aee
mov qword [rsp + 0x50], 0
lea rcx, [0x6e76fe20]
call fcn.6e757c00
mov edx, 1
mov rcx, rdi
mov qword [rsp + 0x50], rax
call fcn.6e7426e0
xor eax, eax
jmp 0x6e75ce80
mov qword [rsp + 0x30], 0
lea rbp, [rsp + 0x30]
mov ecx, 0x28
movabs rdi, 0x20646564616f4c
call fcn.6e749b50
mov edx, 7
mov rcx, rax
mov qword [rsp + 0x38], rax
call fcn.6e749b80
mov rcx, rsi
mov qword [rsp + 0x38], rax
mov rdx, qword [rax]
mov qword [rax + rdx + 0x10], rdi
lea rdi, [rsp + 0x38]
add rdx, 7
mov qword [rax], rdx
call qword [r14]
mov rcx, rsi
movsxd rdx, eax
call fcn.6e74fc50
xor r8d, r8d
mov rcx, rdi
mov rdx, rax
call fcn.6e750b10
mov rcx, qword [rsp + 0x38]
mov edx, 0xe
call fcn.6e749b80
mov rcx, qword [0x6e76fb10]
mov qword [rsp + 0x38], rax
mov rdx, qword [rax]
lea rdx, [rax + rdx + 0x10]
mov qword [rdx], rcx
mov ecx, dword [0x6e76fb18]
mov dword [rdx + 8], ecx
movzx ecx, word [0x6e76fb1c]
mov word [rdx + 0xc], cx
movzx ecx, byte [0x6e76fb1e]
mov byte [rdx + 0xe], cl
add qword [rax], 0xe
mov rcx, qword [rsp + 0x38]
call fcn.6e74b360
mov edx, 1
mov rcx, rbp
mov qword [rsp + 0x30], rax
call fcn.6e7426e0
mov ecx, 0x36
mov qword [rsp + 0x30], 0
call fcn.6e749b50
mov edx, 0xb
mov rcx, rax
mov qword [rsp + 0x38], rax
call fcn.6e749b80
mov rcx, qword [0x6e76faf0]
mov qword [rsp + 0x38], rax
mov rdx, qword [rax]
lea rdx, [rax + rdx + 0x10]
mov qword [rdx], rcx
mov ecx, dword [0x6e76faf8]
mov dword [rdx + 8], ecx
mov rcx, rsi
add qword [rax], 0xb
call qword [r14]
mov rcx, rsi
movsxd rdx, eax
call fcn.6e74fc50
xor r8d, r8d
mov rcx, rdi
mov rdx, rax
call fcn.6e750b10
mov rcx, qword [rsp + 0x38]
mov edx, 4
call fcn.6e749b80
mov ecx, dword [0x6e76fac0]
mov qword [rsp + 0x38], rax
mov rdx, qword [rax]
lea rdx, [rax + rdx + 0x10]
mov dword [rdx], ecx
movzx ecx, byte [0x6e76fac4]
mov byte [rdx + 4], cl
add qword [rax], 4
mov rcx, qword [rsp + 0x28]
call fcn.6e741fa0
test rax, rax
mov rbx, rax
je 0x6e75d0d9
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x38]
call fcn.6e749b80
mov rcx, rdi
mov rdx, rax
call fcn.6e749db0
mov rsi, qword [rsp + 0x38]
lea rdx, [rbx + 0x10]
mov rax, qword [rsi]
lea rcx, [rsi + rax + 0x10]
mov rax, qword [rbx]
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
mov rax, qword [rbx]
add qword [rsi], rax
mov rcx, qword [rsp + 0x38]
call fcn.6e74b360
mov edx, 1
mov rcx, rbp
mov qword [rsp + 0x30], rax
call fcn.6e7426e0
mov rax, qword [rsp + 0x28]
jmp 0x6e75ce80
mov rcx, qword [rsp + 0x38]
xor edx, edx
call fcn.6e749b80
mov rcx, rsi
mov rdx, rax
call fcn.6e749db0
jmp 0x6e75cde1
mov rcx, qword [rsp + 0x38]
xor edx, edx
call fcn.6e749b80
mov rcx, rdi
mov rdx, rax
call fcn.6e749db0
jmp 0x6e75d097