Function at 0x6cb1d3c0
Capabilities:
Access peb ldr_data
Get process filename

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
lea r12, [0x6cb310e0]
mov qword [rsp + 0x20], 0
lea rbx, [rsp + 0x40]
mov rsi, rcx
mov r15d, edx
lea rcx, [0x6cb311e0]
mov edx, 0x552ddf8e
call fcn.6cb184f0
lea rcx, [rsp + 0x20]
mov edx, 1
mov qword [rsp + 0x20], rax
lea rdi, [rsp + 0x50]
call fcn.6cb026e0
mov edx, 0x2536ec8a
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
lea rcx, [0x6cb311a0]
call fcn.6cb184f0
mov r14, qword [0x6cb9db40]
mov rcx, rsi
mov qword [rsp + 0x40], rax
call qword [r14]
mov rcx, rsi
movsxd rdx, eax
call fcn.6cb0fc10
mov edx, 2
mov rcx, rbx
mov qword [rsp + 0x48], rax
call fcn.6cb026e0
mov edx, 0x4dc64d8e
lea rcx, [0x6cb31120]
call fcn.6cb184f0
mov edx, 0x12d1d90a
mov rcx, rax
call fcn.6cb19f20
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rbp, qword [rax + 0x20]
lea r13, [rax + 0x20]
nop word [rax + rax]
movzx eax, word [rsi]
mov qword [rsp + 0x50], rsi
mov rdx, rsi
test ax, ax
je 0x6cb1d4d9
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x6cb1d4bf
add eax, 0x20
mov word [rdx], ax
mov edx, 1
mov rcx, rdi
call fcn.6cb179f0
mov rdx, qword [rsp + 0x50]
movzx eax, word [rdx]
test ax, ax
jne 0x6cb1d4b0
mov rbx, qword [rbp + 0x50]
mov qword [rsp + 0x50], rbx
movzx eax, word [rbx]
test ax, ax
je 0x6cb1d519
mov rdx, rbx
nop dword [rax]
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x6cb1d4ff
add eax, 0x20
mov word [rdx], ax
mov edx, 1
mov rcx, rdi
call fcn.6cb179f0
mov rdx, qword [rsp + 0x50]
movzx eax, word [rdx]
test ax, ax
jne 0x6cb1d4f0
mov rdx, rbx
mov rcx, rsi
call fcn.6cb1bd30
mov edx, 0x1f765d2e
mov rcx, r12
mov rbx, rax
call fcn.6cb184f0
mov edx, 0x72e6e96a
mov rcx, rax
call fcn.6cb19f20
test rbx, rbx
je 0x6cb1d780
mov rbp, qword [rbp]
cmp r13, rbp
jne 0x6cb1d4a0
lea rcx, [0x6cb31060]
mov edx, 0x5e5023ce
mov qword [rsp + 0x50], 0
call fcn.6cb184f0
mov edx, 1
mov rcx, rdi
mov qword [rsp + 0x50], rax
call fcn.6cb026e0
test r15d, r15d
je 0x6cb1d7c1
lea rcx, [0x6cb30f40]
mov edx, 0x29976e2a
call fcn.6cb184f0
mov edx, 0x2ac6274a
mov rcx, rax
call fcn.6cb19f20
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x28], 0
call qword [0x6cbb8f58]
lea r9, [rsp + 0x28]
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [0x6cbb8df0]
mov edx, 0x23626c0e
lea rcx, [0x6cb30f00]
mov ebx, eax
call fcn.6cb184f0
mov edx, 0x1fefd96e
mov rcx, rax
call fcn.6cb19f20
test ebx, ebx
je 0x6cb1d810
mov qword [rsp + 0x30], 0
mov ecx, 0x44
call fcn.6cb09af0
mov edx, 0x13
mov rcx, rax
mov qword [rsp + 0x38], rax
call fcn.6cb09b20
mov rcx, qword [0x6cb30ed0]
mov qword [rsp + 0x38], rax
mov rdx, qword [rax]
lea rdx, [rax + rdx + 0x10]
mov qword [rdx], rcx
mov rcx, qword [0x6cb30ed8]
mov qword [rdx + 8], rcx
mov ecx, dword [0x6cb30ee0]
mov dword [rdx + 0x10], ecx
mov rcx, rsi
add qword [rax], 0x13
call qword [r14]
mov rcx, rsi
lea rsi, [rsp + 0x38]
movsxd rdx, eax
call fcn.6cb0fc10
xor r8d, r8d
mov rcx, rsi
mov rdx, rax
call fcn.6cb10ad0
mov rcx, qword [rsp + 0x38]
mov edx, 0xa
call fcn.6cb09b20
mov rcx, qword [0x6cb30eb0]
mov qword [rsp + 0x38], rax
mov rdx, qword [rax]
lea rdx, [rax + rdx + 0x10]
mov qword [rdx], rcx
movzx ecx, word [0x6cb30eb8]
mov word [rdx + 8], cx
movzx ecx, byte [0x6cb30eba]
mov byte [rdx + 0xa], cl
movsxd rcx, ebx
add qword [rax], 0xa
call fcn.6cb01fa0
test rax, rax
mov rbx, rax
je 0x6cb1d9ed
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x38]
call fcn.6cb09b20
mov rcx, rsi
mov rdx, rax
call fcn.6cb09d50
mov rsi, qword [rsp + 0x38]
lea rdx, [rbx + 0x10]
mov rax, qword [rsi]
lea rcx, [rsi + rax + 0x10]
mov rax, qword [rbx]
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
mov rax, qword [rbx]
add qword [rsi], rax
mov rcx, qword [rsp + 0x38]
mov edx, 2
call fcn.6cb09b20
movzx ecx, word [0x6cb30d40]
mov qword [rsp + 0x38], rax
mov rdx, qword [rax]
lea rdx, [rax + rdx + 0x10]
mov word [rdx], cx
movzx ecx, byte [0x6cb30d42]
mov byte [rdx + 2], cl
add qword [rax], 2
mov rcx, qword [rsp + 0x38]
call fcn.6cb0b300
lea rcx, [rsp + 0x30]
mov edx, 1
mov qword [rsp + 0x30], rax
call fcn.6cb026e0
cmp qword [rsp + 0x28], 0
jne 0x6cb1d77c
lea rcx, [0x6cb30ce0]
mov edx, 1
call fcn.6cb026e0
xor eax, eax
jmp 0x6cb1d7b0
lea rcx, [0x6cb310a0]
mov edx, 0x3554af6a
mov qword [rsp + 0x50], 0
call fcn.6cb184f0
mov edx, 1
mov rcx, rdi
mov qword [rsp + 0x50], rax
call fcn.6cb026e0
mov rax, qword [rbp + 0x20]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x6cb31020]
mov edx, 0x46285d4a
call fcn.6cb184f0
mov edx, 0x4b8171ce
mov rcx, rax
call fcn.6cb19f20
mov edx, 0x3b8adb6e
mov qword [rsp + 0x50], 0
lea rcx, [0x6cb30fe0]
call fcn.6cb184f0
mov edx, 1
mov rcx, rdi
mov qword [rsp + 0x50], rax
call fcn.6cb026e0
xor eax, eax
jmp 0x6cb1d7b0
mov qword [rsp + 0x30], 0
lea rbp, [rsp + 0x30]
mov ecx, 0x28
movabs rdi, 0x20646564616f4c
call fcn.6cb09af0
mov edx, 7
mov rcx, rax
mov qword [rsp + 0x38], rax
call fcn.6cb09b20
mov rcx, rsi
mov qword [rsp + 0x38], rax
mov rdx, qword [rax]
mov qword [rax + rdx + 0x10], rdi
lea rdi, [rsp + 0x38]
add rdx, 7
mov qword [rax], rdx
call qword [r14]
mov rcx, rsi
movsxd rdx, eax
call fcn.6cb0fc10
xor r8d, r8d
mov rcx, rdi
mov rdx, rax
call fcn.6cb10ad0
mov rcx, qword [rsp + 0x38]
mov edx, 0xe
call fcn.6cb09b20
mov rcx, qword [0x6cb30cd0]
mov qword [rsp + 0x38], rax
mov rdx, qword [rax]
lea rdx, [rax + rdx + 0x10]
mov qword [rdx], rcx
mov ecx, dword [0x6cb30cd8]
mov dword [rdx + 8], ecx
movzx ecx, word [0x6cb30cdc]
mov word [rdx + 0xc], cx
movzx ecx, byte [0x6cb30cde]
mov byte [rdx + 0xe], cl
add qword [rax], 0xe
mov rcx, qword [rsp + 0x38]
call fcn.6cb0b300
mov edx, 1
mov rcx, rbp
mov qword [rsp + 0x30], rax
call fcn.6cb026e0
mov ecx, 0x36
mov qword [rsp + 0x30], 0
call fcn.6cb09af0
mov edx, 0xb
mov rcx, rax
mov qword [rsp + 0x38], rax
call fcn.6cb09b20
mov rcx, qword [0x6cb30cb0]
mov qword [rsp + 0x38], rax
mov rdx, qword [rax]
lea rdx, [rax + rdx + 0x10]
mov qword [rdx], rcx
mov ecx, dword [0x6cb30cb8]
mov dword [rdx + 8], ecx
mov rcx, rsi
add qword [rax], 0xb
call qword [r14]
mov rcx, rsi
movsxd rdx, eax
call fcn.6cb0fc10
xor r8d, r8d
mov rcx, rdi
mov rdx, rax
call fcn.6cb10ad0
mov rcx, qword [rsp + 0x38]
mov edx, 4
call fcn.6cb09b20
mov ecx, dword [0x6cb30c80]
mov qword [rsp + 0x38], rax
mov rdx, qword [rax]
lea rdx, [rax + rdx + 0x10]
mov dword [rdx], ecx
movzx ecx, byte [0x6cb30c84]
mov byte [rdx + 4], cl
add qword [rax], 4
mov rcx, qword [rsp + 0x28]
call fcn.6cb01fa0
test rax, rax
mov rbx, rax
je 0x6cb1da09
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x38]
call fcn.6cb09b20
mov rcx, rdi
mov rdx, rax
call fcn.6cb09d50
mov rsi, qword [rsp + 0x38]
lea rdx, [rbx + 0x10]
mov rax, qword [rsi]
lea rcx, [rsi + rax + 0x10]
mov rax, qword [rbx]
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
mov rax, qword [rbx]
add qword [rsi], rax
mov rcx, qword [rsp + 0x38]
call fcn.6cb0b300
mov edx, 1
mov rcx, rbp
mov qword [rsp + 0x30], rax
call fcn.6cb026e0
mov rax, qword [rsp + 0x28]
jmp 0x6cb1d7b0
mov rcx, qword [rsp + 0x38]
xor edx, edx
call fcn.6cb09b20
mov rcx, rsi
mov rdx, rax
call fcn.6cb09d50
jmp 0x6cb1d711
mov rcx, qword [rsp + 0x38]
xor edx, edx
call fcn.6cb09b20
mov rcx, rdi
mov rdx, rax
call fcn.6cb09d50
jmp 0x6cb1d9c7