Function at 0x2fc4cd130
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov qword [rsp + 0x78], rcx
mov dword [rsp + 0x94], 0x60
mov eax, dword [rsp + 0x94]
mov ecx, eax
mov rcx, qword gs:[rcx]
mov qword [rsp + 0x88], rcx
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x70], rcx
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x18]
add rcx, 0x10
mov qword [rsp + 0x68], rcx
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx]
mov qword [rsp + 0x60], rcx
mov rax, qword [rsp + 0x60]
cmp rax, qword [rsp + 0x68]
je 0x2fc4cd5d8
xor eax, eax
mov ecx, dword [0x2fc4f6174]
mov edx, dword [0x2fc4f6180]
sub eax, 0x1c17ba98
mov r8d, ecx
add r8d, eax
sub r8d, 0x7647e1f4
sub r8d, 1
add r8d, 0x7647e1f4
add r8d, 0x9bfeeda8
add r8d, 0x1c17ba98
sub r8d, 0x9bfeeda8
imul ecx, r8d
and ecx, 1
cmp ecx, 0
sete r9b
cmp edx, 0xa
setl r10b
mov r11b, r9b
xor r11b, 0xff
and r11b, 1
mov bl, 1
mov sil, bl
xor sil, 1
mov dil, r9b
and dil, sil
mov bpl, bl
xor bpl, 1
and bpl, 0xff
and sil, 1
or r11b, dil
or bpl, sil
xor r11b, bpl
mov sil, r10b
xor sil, 0xff
and sil, 1
mov dil, bl
xor dil, 1
mov bpl, r10b
and bpl, dil
or sil, bpl
mov dil, bl
xor dil, 1
and dil, 1
mov bpl, bl
xor bpl, 1
and bpl, 1
or dil, bpl
mov bpl, r11b
xor bpl, 0xff
mov r14b, bl
xor r14b, 1
mov r15b, bl
xor r15b, 1
or bpl, r14b
or r15b, 1
xor bpl, 0xff
and bpl, r15b
mov r14b, dil
xor r14b, 0xff
mov r15b, r9b
xor r15b, r14b
and r15b, r9b
mov r9b, sil
xor r9b, 0xff
mov r14b, bl
xor r14b, 1
mov r12b, bl
xor r12b, 0
or r9b, r14b
or r12b, 0
xor r9b, 0xff
and r9b, r12b
mov r14b, dil
xor r14b, 0xff
mov r12b, r10b
xor r12b, r14b
and r12b, r10b
mov r10b, bpl
xor r10b, 0xff
mov r14b, r15b
xor r14b, 0xff
mov r13b, bl
xor r13b, 0
mov al, r10b
and al, 0
and bpl, r13b
mov cl, r14b
and cl, 0
and r15b, r13b
or al, bpl
or cl, r15b
xor al, cl
or r10b, r14b
xor r10b, 0xff
or r13b, 0
and r10b, r13b
or al, r10b
mov cl, r9b
xor cl, 0xff
mov r10b, r12b
xor r10b, 0xff
mov bpl, bl
xor bpl, 0
mov r14b, cl
and r14b, 0
and r9b, bpl
mov r15b, r10b
and r15b, 0
and r12b, bpl
or r14b, r9b
or r15b, r12b
xor r14b, r15b
or cl, r10b
xor cl, 0xff
or bpl, 0
and cl, bpl
or r14b, cl
mov cl, al
xor cl, 0xff
and cl, 0
mov r9b, bl
xor r9b, 0
and al, r9b
mov r10b, r14b
xor r10b, 0xff
and r10b, 0
and r14b, r9b
or cl, al
or r10b, r14b
xor cl, r10b
mov al, r11b
and al, sil
xor r11b, sil
or al, r11b
mov r9b, al
xor r9b, 0xff
and r9b, 0
mov r10b, bl
xor r10b, 0
and al, r10b
xor bl, 1
and bl, 0
and r10b, 1
or r9b, al
or bl, r10b
xor r9b, bl
mov al, dil
and al, 1
xor dil, 1
or al, dil
xor al, 0xff
mov r10b, r9b
xor r10b, al
and r10b, r9b
mov al, cl
and al, r10b
xor cl, r10b
or al, cl
test al, 1
jne 0x2fc4cd3d2
jmp 0x2fc4cdbf2
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x60]
mov rdx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x50], rcx
mov rcx, rax
mov qword [rsp + 0x48], rdx
call sym.StrLen
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov r8, rax
call sym.W2Anicmp
xor r9d, r9d
cmp eax, 0
sete r10b
mov eax, dword [0x2fc4f6174]
mov r11d, dword [0x2fc4f6180]
mov esi, r9d
sub esi, 0x1580481d
mov edi, eax
sub edi, esi
mov esi, r9d
sub esi, 1
add edi, esi
sub r9d, 0x1580481d
add edi, r9d
imul eax, edi
and eax, 1
cmp eax, 0
sete bl
cmp r11d, 0xa
setl bpl
mov r14b, bl
xor r14b, 0xff
and r14b, 1
mov r15b, 1
mov r12b, r15b
xor r12b, 1
mov r13b, bl
and r13b, r12b
mov al, r15b
xor al, 1
and al, 0xff
and r12b, 1
or r14b, r13b
or al, r12b
xor r14b, al
mov al, bpl
xor al, 0xff
and al, 1
mov r12b, r15b
xor r12b, 1
mov r13b, bpl
and r13b, r12b
or al, r13b
mov r12b, r15b
xor r12b, 1
and r12b, 1
mov r13b, r15b
xor r13b, 1
and r13b, 1
or r12b, r13b
mov r13b, r15b
xor r13b, 1
mov cl, r14b
xor cl, r13b
and cl, r14b
xor bl, 0xff
mov r13b, r12b
xor r13b, 0xff
mov dl, r15b
xor dl, 0
or bl, r13b
or dl, 0
xor bl, 0xff
and bl, dl
mov dl, r15b
xor dl, 1
mov r13b, al
xor r13b, dl
and r13b, al
xor bpl, 0xff
mov dl, r12b
xor dl, 0xff
mov r8b, r15b
xor r8b, 0
or bpl, dl
or r8b, 0
xor bpl, 0xff
and bpl, r8b
mov dl, cl
and dl, bl
xor cl, bl
or dl, cl
mov cl, r13b
and cl, bpl
xor r13b, bpl
or cl, r13b
mov r8b, dl
xor r8b, 0xff
and r8b, 1
mov bl, r15b
xor bl, 1
and dl, bl
mov bpl, cl
xor bpl, 0xff
and bpl, 0xff
and cl, bl
or r8b, dl
or bpl, cl
xor r8b, bpl
mov cl, r14b
and cl, al
xor r14b, al
or cl, r14b
mov al, cl
xor al, 0xff
and al, 1
xor r15b, 1
and cl, r15b
or al, cl
mov cl, r12b
and cl, 1
xor r12b, 1
or cl, r12b
xor cl, 0xff
mov dl, al
xor dl, cl
and dl, al
mov al, r8b
and al, dl
xor r8b, dl
or al, r8b
test al, 1
mov byte [rsp + 0x47], r10b
jne 0x2fc4cd59f
jmp 0x2fc4cdbf2
mov al, byte [rsp + 0x47]
test al, 1
jne 0x2fc4cd5b0
jmp 0x2fc4cd5c6
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x80], rax
jmp 0x2fc4cd5e4
mov rax, qword [rsp + 0x60]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
jmp 0x2fc4cd197
mov qword [rsp + 0x80], 0
xor eax, eax
mov ecx, dword [0x2fc4f6174]
mov edx, dword [0x2fc4f6180]
mov r8d, eax
sub r8d, ecx
mov r9d, eax
sub r9d, 0x1748158a
add r8d, r9d
mov r9d, eax
sub r9d, r8d
sub r9d, 0x5d045bd6
sub r9d, 1
add r9d, 0x5d045bd6
sub eax, 0x1748158a
add r9d, eax
imul ecx, r9d
and ecx, 1
cmp ecx, 0
sete r10b
cmp edx, 0xa
setl r11b
mov bl, r10b
xor bl, 0xff
and bl, 0
mov sil, 1
mov dil, sil
xor dil, 0
mov bpl, r10b
and bpl, dil
mov r14b, sil
xor r14b, 1
and r14b, 0
and dil, 1
or bl, bpl
or r14b, dil
xor bl, r14b
mov dil, r11b
xor dil, 0xff
and dil, 1
mov bpl, sil
xor bpl, 1
mov r14b, r11b
and r14b, bpl
mov r15b, sil
xor r15b, 1
and r15b, 0xff
and bpl, 1
or dil, r14b
or r15b, bpl
xor dil, r15b
mov bpl, sil
xor bpl, 0
and bpl, 1
mov r14b, sil
xor r14b, 1
and r14b, 0
or bpl, r14b
mov r14b, bl
xor r14b, 0xff
mov r15b, sil
xor r15b, 0
mov r12b, sil
xor r12b, 0
or r14b, r15b
or r12b, 0
xor r14b, 0xff
and r14b, r12b
mov r15b, bpl
xor r15b, 0xff
mov r12b, r10b
xor r12b, r15b
and r12b, r10b
mov r10b, sil
xor r10b, 0
mov r15b, dil
xor r15b, r10b
and r15b, dil
xor r11b, 0xff
mov r10b, bpl
xor r10b, 0xff
mov r13b, sil
xor r13b, 0
or r11b, r10b
or r13b, 0
xor r11b, 0xff
and r11b, r13b
mov r10b, r14b
and r10b, r12b
xor r14b, r12b
or r10b, r14b
mov r14b, r15b
and r14b, r11b
xor r15b, r11b
or r14b, r15b
mov r11b, r10b
xor r11b, 0xff
mov r15b, r14b
and r15b, r11b
xor r14b, 0xff
and r10b, r14b
or r15b, r10b
mov r10b, bl
xor r10b, 0xff
mov r11b, dil
xor r11b, 0xff
mov r14b, sil
xor r14b, 0
mov r12b, r10b
and r12b, 0
and bl, r14b
mov r13b, r11b
and r13b, 0
and dil, r14b
or r12b, bl
or r13b, dil
xor r12b, r13b
or r10b, r11b
xor r10b, 0xff
or r14b, 0
and r10b, r14b
or r12b, r10b
mov r10b, r12b
xor r10b, 0xff
and r10b, 0
mov r11b, sil
xor r11b, 0
and r12b, r11b
xor sil, 1
and sil, 0
and r11b, 1
or r10b, r12b
or sil, r11b
xor r10b, sil
mov r11b, bpl
and r11b, 0
xor bpl, 0
or r11b, bpl
xor r11b, 0xff
mov bl, r10b
xor bl, r11b
and bl, r10b
mov r10b, r15b
and r10b, bl
xor r15b, bl
or r10b, r15b
test r10b, 1
jne 0x2fc4cd7e9
jmp 0x2fc4cdbed
mov rax, qword [rsp + 0x80]
mov ecx, dword [0x2fc4f6174]
mov edx, dword [0x2fc4f6180]
mov r8d, ecx
add r8d, 0x68769172
add r8d, 0x308d238d
sub r8d, 0x68769172
add r8d, 0x5dd8af4
sub r8d, 1
sub r8d, 0x5dd8af4
sub r8d, 0xc7667e3e
sub r8d, 0x308d238d
add r8d, 0xc7667e3e
imul ecx, r8d
and ecx, 1
cmp ecx, 0
sete r9b
cmp edx, 0xa
setl r10b
mov r11b, r9b
xor r11b, 0xff
and r11b, 1
mov bl, 1
mov sil, bl
xor sil, 1
mov dil, r9b
and dil, sil
or r11b, dil
mov sil, r10b
xor sil, 0xff
and sil, 1
mov dil, bl
xor dil, 1
mov bpl, r10b
and bpl, dil
or sil, bpl
mov dil, bl
xor dil, 1
and dil, 0
mov bpl, bl
xor bpl, 0
mov r14b, bpl
and r14b, 1
mov r15b, bl
xor r15b, 1
and r15b, 0
and bpl, 1
or dil, r14b
or r15b, bpl
xor dil, r15b
mov bpl, bl
xor bpl, 1
mov r14b, r11b
xor r14b, bpl
and r14b, r11b
xor r9b, 0xff
mov bpl, dil
xor bpl, 0xff
mov r15b, bl
xor r15b, 0
or r9b, bpl
or r15b, 0
xor r9b, 0xff
and r9b, r15b
mov bpl, sil
xor bpl, 0xff
mov r15b, bl
xor r15b, 1
mov r12b, bl
xor r12b, 1
or bpl, r15b
or r12b, 1
xor bpl, 0xff
and bpl, r12b
xor r10b, 0xff
mov r15b, dil
xor r15b, 0xff
mov r12b, bl
xor r12b, 1
or r10b, r15b
or r12b, 1
xor r10b, 0xff
and r10b, r12b
mov r15b, r14b
and r15b, r9b
xor r14b, r9b
or r15b, r14b
mov r9b, bpl
and r9b, r10b
xor bpl, r10b
or r9b, bpl
mov r10b, r15b
xor r10b, 0xff
mov bpl, r9b
and bpl, r10b
xor r9b, 0xff
and r15b, r9b
or bpl, r15b
mov r9b, r11b
xor r9b, 0xff
mov r10b, sil
xor r10b, 0xff
mov r14b, bl
xor r14b, 1
mov r15b, r9b
and r15b, 0xff
and r11b, r14b
mov r12b, r10b
and r12b, 0xff
and sil, r14b
or r15b, r11b
or r12b, sil
xor r15b, r12b
or r9b, r10b
xor r9b, 0xff
or r14b, 1
and r9b, r14b
or r15b, r9b
mov r9b, r15b
xor r9b, 0xff
and r9b, 0
mov r10b, bl
xor r10b, 0
and r15b, r10b
mov r11b, bl
xor r11b, 1
and r11b, 0
and r10b, 1
or r9b, r15b
or r11b, r10b
xor r9b, r11b
mov r10b, dil
and r10b, 1
xor dil, 1
or r10b, dil
xor r9b, 0xff
xor r10b, 0xff
xor bl, 1
or r9b, r10b
or bl, 1
xor r9b, 0xff
and r9b, bl
mov r10b, bpl
and r10b, r9b
xor bpl, r9b
or r10b, bpl
test r10b, 1
mov qword [rsp + 0x38], rax
jne 0x2fc4cda12
jmp 0x2fc4cdbed
xor eax, eax
mov ecx, dword [0x2fc4f6174]
mov edx, dword [0x2fc4f6180]
sub eax, 0xc1d8f348
sub eax, 1
add eax, 0xc1d8f348
mov r8d, ecx
add r8d, 0xbf2a3e29
add r8d, eax
sub r8d, 0xbf2a3e29
imul ecx, r8d
and ecx, 1
cmp ecx, 0
sete r9b
cmp edx, 0xa
setl r10b
mov r11b, r9b
xor r11b, 0xff
mov bl, r10b
xor bl, 0xff
mov sil, 1
mov dil, sil
xor dil, 0
or r11b, bl
or dil, 0
xor r11b, 0xff
and r11b, dil
mov bl, r9b
xor bl, 0xff
and bl, 1
mov dil, sil
xor dil, 1
and r9b, dil
mov bpl, r10b
xor bpl, 0xff
and bpl, 0xff
and r10b, dil
or bl, r9b
or bpl, r10b
xor bl, bpl
mov r9b, r11b
xor r9b, 0xff
mov r10b, bl
xor r10b, 0xff
xor sil, 1
mov dil, r9b
and dil, 0xff
and r11b, sil
mov bpl, r10b
and bpl, 0xff
and bl, sil
or dil, r11b
or bpl, bl
xor dil, bpl
or r9b, r10b
xor r9b, 0xff
or sil, 1
and r9b, sil
or dil, r9b
test dil, 1
jne 0x2fc4cdaf4
jmp 0x2fc4cdc38
mov eax, dword [0x2fc4f6174]
mov ecx, dword [0x2fc4f6180]
mov edx, eax
add edx, 0x560c0fdc
sub edx, 0x24231357
sub edx, 0x560c0fdc
sub edx, 0x32518d5b
sub edx, 1
add edx, 0x32518d5b
add edx, 0xbf6f187e
add edx, 0x24231357
sub edx, 0xbf6f187e
imul eax, edx
and eax, 1
cmp eax, 0
sete r8b
cmp ecx, 0xa
setl r9b
mov r10b, r9b
xor r10b, 0xff
mov r11b, r8b
xor r11b, r10b
and r11b, r8b
mov r10b, r8b
xor r10b, 0xff
and r10b, 1
mov bl, 1
mov sil, bl
xor sil, 1
and r8b, sil
mov dil, r9b
xor dil, 0xff
and dil, 0xff
and r9b, sil
or r10b, r8b
or dil, r9b
xor r10b, dil
mov r8b, r11b
xor r8b, 0xff
mov r9b, r10b
xor r9b, 0xff
xor bl, 0
mov sil, r8b
and sil, 0
and r11b, bl
mov dil, r9b
and dil, 0
and r10b, bl
or sil, r11b
or dil, r10b
xor sil, dil
or r8b, r9b
xor r8b, 0xff
or bl, 0
and r8b, bl
or sil, r8b
test sil, 1
jne 0x2fc4cdbd4
jmp 0x2fc4cdc38
mov rax, qword [rsp + 0x38]
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x2fc4cd7e9
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x60]
mov rdx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rcx
mov rcx, rax
mov qword [rsp + 0x28], rdx
call sym.StrLen
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov r8, rax
call sym.W2Anicmp
jmp 0x2fc4cd3d2
jmp 0x2fc4cdaf4