Function at 0x7ff34471a40
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1d0
mov rax, qword [0x7ff34484108]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov edi, edx
mov dword [rsp + 0x44], edx
mov r12, rcx
mov qword [rsp + 0xa0], rcx
xor ebp, ebp
jmp 0x7ff34471a8a
mov edi, dword [rsp + 0x44]
mov rax, qword gs:[0x30]
mov r8, qword [rax + 0x60]
mov rax, qword [r8 + 0x18]
add rax, 0x20
test rbp, rbp
jne 0x7ff34471aa7
mov rbp, qword [rax]
cmp rbp, rax
je 0x7ff34471d26
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
lea rax, [rbp - 0x10]
mov rbx, qword [rax + 0x30]
mov r14d, dword [rax + 0x40]
mov rbp, qword [rax + 0x10]
mov r8, qword [rax + 0x60]
lea rcx, [rsp + 0xb0]
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rcx
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x80], rbp
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x7ff34471a8a
lea rdx, [rsp + 0xb0]
mov r8d, edi
mov rcx, r12
call fcn.7ff344725dc
mov r13d, eax
mov dword [rsp + 0x54], eax
test eax, eax
je 0x7ff34471a8a
xor eax, eax
movsxd rcx, dword [rbx + 0x3c]
mov edi, dword [rsp + 0x44]
mov qword [rsp + 0x68], rax
mov edx, dword [rcx + rbx + 0x90]
test edx, edx
je 0x7ff34471a8a
lea rdi, [rax + rdx]
add rdi, rbx
mov qword [rsp + 0x78], rdi
je 0x7ff34471a86
cmp dword [rdi + 0x10], 0
je 0x7ff34471a86
mov esi, dword [rdi + 0xc]
add rsi, rbx
je 0x7ff34471a86
cmp rsi, rbx
jb 0x7ff34471a86
mov eax, r14d
add rax, rbx
cmp rsi, rax
ja 0x7ff34471a86
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp rax, rbx
jne 0x7ff34471baa
mov r8d, r13d
mov rdx, rsi
mov rcx, r12
call fcn.7ff34471d60
jmp 0x7ff34471d18
lea rax, [rsp + 0x90]
lea r9, [rsp + 0x60]
xor r14d, r14d
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], r14d
call fcn.7ff344715fc
test eax, eax
jne 0x7ff34471d13
mov bpl, r14b
cmp dword [rsp + 0x90], 0
mov rax, qword [rsp + 0x60]
mov r9, qword [rax]
jne 0x7ff34471cdb
xor cl, cl
xor edx, edx
xor r15d, r15d
xor r8d, r8d
mov rdi, r9
mov byte [rsp + 0x40], cl
mov qword [rsp + 0x58], r8
mov dword [rsp + 0x4c], edx
cmp edx, dword [r12 + 0x40]
jge 0x7ff34471cb2
mov rax, qword [r12 + 0x38]
test dword [r8 + rax], r13d
je 0x7ff34471c97
mov rbx, qword [r12 + 0x48]
xor r13d, r13d
xor r14d, r14d
xor r12d, r12d
cmp r14d, dword [r15 + rbx]
jae 0x7ff34471c6c
mov rcx, qword [r15 + rbx + 8]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rcx + r12 + 8]
call qword [sym.imp.SHLWAPI.dll_StrCmpICA]
test eax, eax
jne 0x7ff34471c60
mov rax, qword [r15 + rbx + 8]
lea rcx, [r14 + r14*4]
lea r13, [rax + rcx*8]
inc r14d
add r12, 0x28
test r13, r13
je 0x7ff34471c31
mov r12, qword [rsp + 0xa0]
mov edx, dword [rsp + 0x4c]
mov r8, qword [rsp + 0x58]
test r13, r13
je 0x7ff34471c8e
mov cl, 1
mov qword [r13 + 0x20], rdi
mov byte [rsp + 0x40], cl
jmp 0x7ff34471c92
mov cl, byte [rsp + 0x40]
mov r13d, dword [rsp + 0x54]
inc edx
add r8, 0x18
add r15, 0x10
mov dword [rsp + 0x4c], edx
mov qword [rsp + 0x58], r8
test cl, cl
je 0x7ff34471c0d
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
test cl, cl
je 0x7ff34471cd6
test bpl, bpl
jne 0x7ff34471cd6
mov r8d, r13d
mov rdx, rsi
mov rcx, r12
call fcn.7ff34471d60
mov bpl, 1
mov r14d, dword [rsp + 0x48]
inc r14d
lea rax, [rsp + 0x90]
lea r9, [rsp + 0x60]
mov rdx, rdi
mov rcx, rbx
mov r8d, r14d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], r14d
call fcn.7ff344715fc
test eax, eax
je 0x7ff34471bdd
mov rbp, qword [rsp + 0x80]
mov r14d, dword [rsp + 0x50]
mov rax, qword [rsp + 0x68]
add rax, 0x14
jmp 0x7ff34471b2d
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.7ff344779c0
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret