Function at 0x7fff25d7fe50
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x330]
sub rsp, 0x430
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rbp + 0x320], rax
xor esi, esi
mov dword [rbp - 0x6c], r9d
mov word [rsp + 0x50], si
mov r15d, r9d
mov word [rsp + 0x60], si
mov r12, r8
mov qword [rsp + 0x58], rsi
mov ebx, edx
lea r13d, [rsi + 1]
mov r14, rcx
mov dword [rbp - 0x7c], r13d
test rcx, rcx
je 0x7fff25decbae
test edx, 0xffffff03
jne 0x7fff25d80270
lea eax, [rsi + 0xc]
mov edi, edx
and edi, eax
cmp edi, eax
je 0x7fff25d80270
test bl, 0x10
jne 0x7fff25d8028d
mov eax, ebx
and eax, 0x60
cmp al, 0x60
je 0x7fff25d80270
cmp qword [0x7fff25fd2490], rsi
je 0x7fff25d80281
mov ecx, ebx
or ecx, 4
test edi, edi
cmovne ecx, ebx
mov ebx, ecx
mov eax, ecx
or ebx, 0x20
and al, 0x70
cmovne ebx, ecx
lea rcx, [rsp + 0x58]
test bl, bl
jns 0x7fff25d801b7
call qword [sym.imp.ntdll.dll_RtlpInitializeLangRegistryInfo]
nop dword [rax + rax]
test eax, eax
js 0x7fff25decbb8
mov edi, ebx
test bl, 0x40
jne 0x7fff25d8020a
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_NtQueryInstallUILanguage]
nop dword [rax + rax]
mov ecx, 0xc0000000
and eax, ecx
cmp eax, ecx
je 0x7fff25decdb7
movzx ecx, word [rsp + 0x50]
mov edx, 0x1000
movzx eax, cx
sub ax, dx
mov edx, 0xfbff
test dx, ax
je 0x7fff25dece0d
mov ebx, 4
movzx ecx, cx
test bl, dil
je 0x7fff25d801c8
lea r9, [rbp - 0x50]
mov dword [rsp + 0x20], 0x104
mov r8d, ebx
lea edx, [rbx + 0xc]
call fcn.7fff25d80978
test eax, eax
jne 0x7fff25dece0d
test r15d, r15d
je 0x7fff25decdc9
lea rcx, [rbp - 0x50]
mov rdx, r12
mov rax, r14
call qword [case.0x7fff25dc97c1.0]
cmp eax, r13d
jne 0x7fff25d80189
mov rax, qword [rsp + 0x58]
mov edx, 8
mov rcx, qword [rax + 0x18]
movzx r8d, word [rcx + 6]
mov rcx, qword gs:[0x60]
shl r8, 3
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rbp - 0x58], rax
mov r15, rax
test rax, rax
je 0x7fff25dece16
mov rbx, qword [rsp + 0x58]
xor ecx, ecx
mov r13d, ecx
mov dword [rsp + 0x64], ecx
mov rax, qword [rbx + 0x18]
cmp cx, word [rax + 6]
jae 0x7fff25d80120
mov eax, edi
and eax, 0x10
mov dword [rbp - 0x74], eax
neg eax
sbb eax, eax
and eax, 0x8000
add eax, 0x820
mov dword [rbp - 0x78], eax
xor edx, edx
mov dword [rbp - 0x70], esi
mov r8d, 0xaa
lea rcx, [rbp + 0x270]
call sub.ntdll.dll_memset
mov eax, r13d
mov ecx, 0xc
imul r13, rax, 0x1c
mov rax, qword [rbx + 0x18]
add r13, qword [rax + 0x10]
lea rax, [rbp + 0x270]
mov qword [rbp - 0x60], rax
mov eax, 0xaa
mov word [rbp - 0x66], ax
movzx eax, word [r13]
test dword [rbp - 0x78], eax
setne dl
bt ax, cx
setae al
test al, dl
je 0x7fff25d80102
lea r8, [rbp - 0x68]
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlpGetNameFromLangInfoNode]
nop dword [rax + rax]
mov ebx, 0xc0000000
and eax, ebx
cmp eax, ebx
je 0x7fff25d800fd
mov rcx, qword [rsp + 0x58]
lea r8, [rsp + 0x60]
mov rdx, r13
call qword [sym.imp.ntdll.dll_RtlpGetLCIDFromLangInfoNode]
nop dword [rax + rax]
and eax, ebx
cmp eax, ebx
je 0x7fff25d800fd
cmp dword [rbp - 0x74], 0
mov rdx, r13
mov rcx, qword [rsp + 0x58]
sete r8b
call qword [sym.imp.ntdll.dll_RtlpIsQualifiedLanguage]
nop dword [rax + rax]
and eax, ebx
cmp eax, ebx
je 0x7fff25d800fd
movzx eax, word [rsp + 0x60]
cmp word [rsp + 0x50], ax
jne 0x7fff25dece36
mov rbx, qword [rsp + 0x58]
mov r13d, dword [rsp + 0x64]
mov rax, qword [rbx + 0x18]
inc r13d
mov dword [rsp + 0x64], r13d
movzx ecx, word [rax + 6]
cmp r13d, ecx
jb 0x7fff25d80036
mov edx, esi
lea r9, [0x7fff25e13120]
mov r8d, 8
mov rcx, r15
call qword [sym.imp.ntdll.dll_qsort]
nop dword [rax + rax]
xor eax, eax
mov dword [rsp + 0x64], eax
test esi, esi
jne 0x7fff25decec7
mov rcx, qword gs:[0x60]
mov r8, r15
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov r13d, dword [rbp - 0x7c]
test dil, dil
jns 0x7fff25d80189
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x7fff25d80189
call qword [sym.imp.ntdll.dll_RtlpMuiFreeLangRegistryInfo]
nop dword [rax + rax]
mov eax, r13d
mov rcx, qword [rbp + 0x320]
xor rcx, rsp
call fcn.7fff25dce640
mov rbx, qword [rsp + 0x488]
add rsp, 0x430
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.ntdll.dll_RtlpCreateProcessRegistryInfo]
nop dword [rax + rax]
jmp 0x7fff25d7ff1e
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x70]
mov eax, 0xaa
mov word [rsp + 0x72], ax
call qword [sym.imp.ntdll.dll_RtlLCIDToCultureName]
nop dword [rax + rax]
test al, al
je 0x7fff25dece0d
test r15d, r15d
je 0x7fff25decdd8
mov rcx, qword [rsp + 0x78]
jmp 0x7fff25d7ffac
mov rdx, qword [rsp + 0x58]
lea r8, [rsp + 0x68]
xor ecx, ecx
mov qword [rsp + 0x68], rsi
call qword [sym.imp.ntdll.dll_RtlpLoadMachineUIByPolicy]
nop dword [rax + rax]
xor edi, edi
cmp qword [rsp + 0x68], rdi
jne 0x7fff25d8029d
mov rdx, qword [rsp + 0x58]
lea r8, [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlpLoadUserUIByPolicy]
nop dword [rax + rax]
test eax, eax
je 0x7fff25decbcd
cmp qword [rsp + 0x68], rdi
jne 0x7fff25decd91
mov edi, ebx
cmp sil, r13b
je 0x7fff25d8016e
or edi, 0x20
xor esi, esi
jmp 0x7fff25d7ff31
mov ecx, 0x3ec
call sub.ntdll.dll_RtlSetLastWin32Error
xor eax, eax
jmp 0x7fff25d8018c
xor ecx, ecx
call fcn.7fff25d4fd80
jmp 0x7fff25d7feef
test bl, 0x20
jne 0x7fff25d80270
test bl, 0x40
je 0x7fff25d7fed5
jmp 0x7fff25d80270
test eax, eax
je 0x7fff25decbd8
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rsp + 0x68]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov qword [rsp + 0x68], rdi
jmp 0x7fff25d80230
mov ecx, 0x57
jmp 0x7fff25d80275
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ecx, eax
jmp 0x7fff25d80275
cmp qword [rsp + 0x68], rdi
je 0x7fff25d8025b
mov rax, qword [rsp + 0x68]
mov sil, r13b
mov r8, qword [rsp + 0x58]
mov rcx, qword [rax + 0x18]
movsx rax, word [rcx + 4]
imul rdx, rax, 0x1c
mov rax, qword [r8 + 0x18]
mov rcx, qword [rax + 0x10]
movzx eax, word [rcx + rdx + 4]
mov word [rsp + 0x50], ax
test ax, ax
je 0x7fff25d80250
mov esi, 4
test sil, bl
je 0x7fff25decc60
mov ecx, 0x1400
cmp ax, cx
jne 0x7fff25decc2b
mov eax, 0x1000
mov word [rsp + 0x50], ax
movzx ecx, ax
lea r9, [rbp - 0x50]
mov r8d, esi
mov dword [rsp + 0x20], 0x104
mov edx, 0x10
call fcn.7fff25d80978
test eax, eax
jne 0x7fff25deccfc
test r15d, r15d
je 0x7fff25decc5a
lea rcx, [rbp - 0x50]
jmp 0x7fff25deccb6
lea r9, [rbp - 0x50]
jmp 0x7fff25deccc9
mov ecx, 0x1000
cmp ax, cx
jne 0x7fff25decd04
mov rax, qword [r8 + 0x18]
mov rcx, qword [rax + 0x10]
movsx rdx, word [rcx + rdx + 6]
test dx, dx
jle 0x7fff25deccfc
mov rax, qword [rsp + 0x58]
lea rcx, [rsp + 0x70]
mov r8, qword [rax + 0x20]
mov rax, qword [r8 + 0x10]
movsx rdx, word [rax + rdx*2]
mov rax, qword [r8 + 0x18]
lea rdx, [rax + rdx*2]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
test r15d, r15d
je 0x7fff25deccc4
mov rcx, qword [rsp + 0x78]
mov rdx, r12
mov rax, r14
call qword [case.0x7fff25dc97c1.0]
jmp 0x7fff25deccf3
mov r9, qword [rsp + 0x78]
mov rax, qword [0x7fff25fd2490]
mov r8d, ebx
mov dword [rsp + 0x40], esi
mov rdx, r14
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], edi
mov ecx, dword [rax]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call sym.KERNELBASE.dll_NlsDispatchAnsiEnumProc
cmp eax, r13d
jne 0x7fff25d80189
mov sil, r13b
jmp 0x7fff25d80250
lea rcx, [rbp + 0x1c0]
mov sil, r13b
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x70]
mov ecx, 0xaa
mov word [rsp + 0x72], cx
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlLCIDToCultureName]
nop dword [rax + rax]
test al, al
je 0x7fff25d80250
test r15d, r15d
je 0x7fff25decd50
mov rcx, qword [rsp + 0x78]
mov rdx, r12
mov rax, r14
call qword [case.0x7fff25dc97c1.0]
jmp 0x7fff25decd83
mov rax, qword [0x7fff25fd2490]
mov r8d, ebx
mov r9, qword [rsp + 0x78]
mov rdx, r14
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x38], r12
mov ecx, dword [rax]
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call sym.KERNELBASE.dll_NlsDispatchAnsiEnumProc
cmp eax, r13d
jne 0x7fff25d80189
jmp 0x7fff25d80250
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rsp + 0x68]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
nop
jmp 0x7fff25d8025b
call sym.KERNELBASE.dll_GetSystemDefaultUILanguage
movzx ecx, ax
mov word [rsp + 0x50], ax
jmp 0x7fff25d7ff56
mov rax, qword [0x7fff25fd2490]
lea r9, [rbp - 0x50]
mov ecx, dword [rax]
jmp 0x7fff25decde6
mov rcx, qword [0x7fff25fd2490]
mov r9, qword [rsp + 0x78]
mov ecx, dword [rcx]
mov dword [rsp + 0x40], ebx
mov r8d, edi
mov qword [rsp + 0x38], r12
mov rdx, r14
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call sym.KERNELBASE.dll_NlsDispatchAnsiEnumProc
nop
jmp 0x7fff25d7ffb8
mov word [rbp - 0x50], si
jmp 0x7fff25d7ffc1
mov ecx, 0xc0000017
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ecx, eax
call sub.ntdll.dll_RtlSetLastWin32Error
mov r13d, esi
jmp 0x7fff25d8016e
mov rcx, qword gs:[0x60]
mov edx, 8
movzx r8d, word [rbp - 0x68]
add r8, 2
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov ebx, esi
xor r13d, r13d
mov qword [r15 + rbx*8], rax
test rax, rax
je 0x7fff25deceb4
movzx edx, word [rbp - 0x68]
mov rcx, rax
mov r8, qword [rbp - 0x60]
add rdx, 2
inc esi
call fcn.7fff25e13154
test eax, eax
jns 0x7fff25d800fd
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [r15 + rbx*8]
mov esi, dword [rbp - 0x70]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov qword [r15 + rbx*8], r13
jmp 0x7fff25d800fd
mov ecx, 8
call sub.ntdll.dll_RtlSetLastWin32Error
mov dword [rbp - 0x7c], r13d
jmp 0x7fff25decfb4
mov r13d, edi
mov rbx, r15
mov r15d, dword [rbp - 0x6c]
and r13d, 4
jmp 0x7fff25deced9
xor eax, eax
mov r9, qword [rbx]
test r13d, r13d
je 0x7fff25decf4e
mov rdx, r9
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntdll.dll_RtlCultureNameToLCID]
nop dword [rax + rax]
test al, al
je 0x7fff25decf97
mov eax, dword [rbp - 0x80]
lea r9, [rbp - 0x50]
mov ecx, 0x1400
mov dword [rsp + 0x20], 0x104
cmp eax, ecx
mov edx, 0x10
mov ecx, 0x1000
cmove eax, ecx
movzx ecx, ax
lea r8d, [rdx - 0xc]
mov dword [rbp - 0x80], eax
call fcn.7fff25d80978
test eax, eax
jne 0x7fff25decf97
lea r9, [rbp - 0x50]
xor eax, eax
test r15d, r15d
je 0x7fff25decf64
mov rdx, r12
mov rcx, r9
mov rax, r14
call qword [case.0x7fff25dc97c1.0]
jmp 0x7fff25decf92
mov dword [rsp + 0x40], 4
mov r8d, edi
mov qword [rsp + 0x38], r12
mov rdx, r14
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
mov rax, qword [0x7fff25fd2490]
mov ecx, dword [rax]
call sym.KERNELBASE.dll_NlsDispatchAnsiEnumProc
cmp eax, 1
jne 0x7fff25decfad
mov eax, dword [rsp + 0x64]
add rbx, 8
inc eax
mov dword [rsp + 0x64], eax
cmp eax, esi
jb 0x7fff25deced7
mov r15, qword [rbp - 0x58]
xor r13d, r13d
test esi, esi
je 0x7fff25d8014c
mov rbx, r15
mov esi, esi
mov r8, qword [rbx]
test r8, r8
je 0x7fff25decfe7
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov qword [rbx], r13
add rbx, 8
sub rsi, 1
jne 0x7fff25decfc1
jmp 0x7fff25d8014c