Function at 0x2fc4cfa20
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x84], 0x60
mov eax, dword [rsp + 0x84]
mov ecx, eax
mov rcx, qword gs:[rcx]
mov qword [rsp + 0x78], rcx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x18]
add rcx, 0x10
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx]
mov qword [rsp + 0x50], rcx
xor eax, eax
mov ecx, dword [0x2fc4fa174]
mov edx, dword [0x2fc4fa180]
mov r8d, eax
sub r8d, 0x32f8ff
mov r9d, ecx
add r9d, r8d
sub r9d, 0x4b2a77d7
sub r9d, 1
add r9d, 0x4b2a77d7
mov r8d, eax
sub r8d, r9d
mov r9d, eax
sub r9d, 0x32f8ff
add r8d, r9d
sub eax, r8d
imul ecx, eax
and ecx, 1
cmp ecx, 0
sete r10b
cmp edx, 0xa
setl r11b
mov bl, r10b
xor bl, 0xff
mov sil, r11b
xor sil, 0xff
mov dil, 1
mov bpl, dil
xor bpl, 0
or bl, sil
or bpl, 0
xor bl, 0xff
and bl, bpl
mov sil, r10b
xor sil, 0xff
and sil, 1
xor dil, 1
and r10b, dil
mov bpl, r11b
xor bpl, 0xff
and bpl, 0xff
and r11b, dil
or sil, r10b
or bpl, r11b
xor sil, bpl
mov r10b, bl
and r10b, sil
xor bl, sil
or r10b, bl
test r10b, 1
jne 0x2fc4cfb43
jmp 0x2fc4d0695
xor eax, eax
mov rcx, qword [rsp + 0x50]
cmp rcx, qword [rsp + 0x58]
setne dl
mov r8d, dword [0x2fc4fa174]
mov r9d, dword [0x2fc4fa180]
mov r10d, 0x5e72e582
add r10d, 0
sub r10d, 1
sub r10d, 0x5e72e582
mov r11d, eax
sub r11d, r8d
mov esi, eax
sub esi, r10d
add r11d, esi
sub eax, r11d
imul r8d, eax
and r8d, 1
cmp r8d, 0
sete bl
cmp r9d, 0xa
setl dil
mov bpl, dil
xor bpl, 0xff
mov r14b, bl
xor r14b, bpl
and r14b, bl
mov bpl, bl
xor bpl, 0xff
and bpl, 0
mov r15b, 1
xor r15b, 0
and bl, r15b
mov r12b, dil
xor r12b, 0xff
and r12b, 0
and dil, r15b
or bpl, bl
or r12b, dil
xor bpl, r12b
mov bl, r14b
and bl, bpl
xor r14b, bpl
or bl, r14b
test bl, 1
mov byte [rsp + 0x47], dl
jne 0x2fc4cfbf7
jmp 0x2fc4d0695
mov al, byte [rsp + 0x47]
test al, 1
jne 0x2fc4cfc08
jmp 0x2fc4cff4a
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x60]
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], rcx
mov rcx, rax
mov qword [rsp + 0x30], rdx
call sym.StrLen
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov r8, rax
call sym.W2Anicmp
cmp eax, 0
jne 0x2fc4cfc65
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x70], rax
jmp 0x2fc4cff53
xor eax, eax
mov ecx, dword [0x2fc4fa174]
mov edx, dword [0x2fc4fa180]
mov r8d, ecx
add r8d, 0x96bdedf6
add r8d, 0x37ae8a7d
sub r8d, 0x96bdedf6
sub eax, 1
add r8d, eax
add r8d, 0x69c7b071
sub r8d, 0x37ae8a7d
sub r8d, 0x69c7b071
imul ecx, r8d
and ecx, 1
cmp ecx, 0
sete r9b
cmp edx, 0xa
setl r10b
mov r11b, r9b
xor r11b, 0xff
mov bl, r10b
xor bl, 0xff
mov sil, 1
mov dil, sil
xor dil, 0
or r11b, bl
or dil, 0
xor r11b, 0xff
and r11b, dil
mov bl, r9b
xor bl, 0xff
and bl, 1
xor sil, 1
and r9b, sil
mov dil, r10b
xor dil, 0xff
and dil, 0xff
and r10b, sil
or bl, r9b
or dil, r10b
xor bl, dil
mov r9b, r11b
and r9b, bl
xor r11b, bl
or r9b, r11b
test r9b, 1
jne 0x2fc4cfd22
jmp 0x2fc4d0308
mov eax, dword [0x2fc4fa174]
mov ecx, dword [0x2fc4fa180]
mov edx, eax
sub edx, 0x66d4e149
add edx, 0xcff01626
add edx, 0x66d4e149
sub edx, 0x84686399
sub edx, 1
add edx, 0x84686399
add edx, 0xd115a0e9
sub edx, 0xcff01626
sub edx, 0xd115a0e9
imul eax, edx
and eax, 1
cmp eax, 0
sete r8b
cmp ecx, 0xa
setl r9b
mov r10b, r8b
xor r10b, 0xff
mov r11b, r9b
xor r11b, 0xff
mov bl, 1
mov sil, bl
xor sil, 1
or r10b, r11b
or sil, 1
xor r10b, 0xff
and r10b, sil
mov r11b, r8b
xor r11b, 0xff
mov sil, r9b
and sil, r11b
xor r9b, 0xff
and r8b, r9b
or sil, r8b
mov r8b, r10b
xor r8b, 0xff
mov r9b, sil
xor r9b, 0xff
xor bl, 1
mov r11b, r8b
and r11b, 0xff
and r10b, bl
mov dil, r9b
and dil, 0xff
and sil, bl
or r11b, r10b
or dil, sil
xor r11b, dil
or r8b, r9b
xor r8b, 0xff
or bl, 1
and r8b, bl
or r11b, r8b
test r11b, 1
jne 0x2fc4cfe00
jmp 0x2fc4d069a
xor eax, eax
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov qword [rsp + 0x50], rcx
mov edx, dword [0x2fc4fa174]
mov r8d, dword [0x2fc4fa180]
mov r9d, edx
add r9d, 0x4ee9f3e0
add r9d, 0x6f8687d1
sub r9d, 0x4ee9f3e0
sub r9d, 0xe7e2eb45
sub r9d, 1
add r9d, 0xe7e2eb45
sub eax, 0x6f8687d1
add r9d, eax
imul edx, r9d
and edx, 1
cmp edx, 0
sete r10b
cmp r8d, 0xa
setl r11b
mov bl, r10b
xor bl, 0xff
mov sil, r11b
xor sil, 0xff
mov dil, 1
xor dil, 0
or bl, sil
or dil, 0
xor bl, 0xff
and bl, dil
mov sil, r10b
xor sil, 0xff
mov dil, r11b
and dil, sil
xor r11b, 0xff
and r10b, r11b
or dil, r10b
mov r10b, bl
and r10b, dil
xor bl, dil
or r10b, bl
test r10b, 1
jne 0x2fc4cfeb7
jmp 0x2fc4d069a
xor eax, eax
mov ecx, dword [0x2fc4fa174]
mov edx, dword [0x2fc4fa180]
mov r8d, eax
sub r8d, 0x9c2c2ac4
mov r9d, ecx
add r9d, r8d
sub eax, 1
add r9d, eax
sub r9d, 0xc9f1a576
add r9d, 0x9c2c2ac4
add r9d, 0xc9f1a576
imul ecx, r9d
and ecx, 1
cmp ecx, 0
sete r10b
cmp edx, 0xa
setl r11b
mov bl, r11b
xor bl, 0xff
mov sil, r10b
xor sil, bl
and sil, r10b
mov bl, r10b
xor bl, 0xff
mov dil, r11b
and dil, bl
xor r11b, 0xff
and r10b, r11b
or dil, r10b
mov r10b, sil
and r10b, dil
xor sil, dil
or r10b, sil
test r10b, 1
jne 0x2fc4cff45
jmp 0x2fc4d0308
jmp 0x2fc4cfa81
mov qword [rsp + 0x70], 0
mov eax, dword [0x2fc4fa174]
mov ecx, dword [0x2fc4fa180]
mov edx, eax
add edx, 0x462e0cfc
sub edx, 0x2e3114de
sub edx, 0x462e0cfc
sub edx, 0xf67c6e63
sub edx, 1
add edx, 0xf67c6e63
add edx, 0x6bdb0b68
add edx, 0x2e3114de
sub edx, 0x6bdb0b68
imul eax, edx
and eax, 1
cmp eax, 0
sete r8b
cmp ecx, 0xa
setl r9b
mov r10b, r8b
xor r10b, 0xff
mov r11b, r9b
xor r11b, 0xff
mov bl, 1
mov sil, bl
xor sil, 0
or r10b, r11b
or sil, 0
xor r10b, 0xff
and r10b, sil
mov r11b, r8b
xor r11b, 0xff
mov sil, r9b
and sil, r11b
xor r9b, 0xff
and r8b, r9b
or sil, r8b
mov r8b, r10b
xor r8b, 0xff
mov r9b, sil
xor r9b, 0xff
xor bl, 1
mov r11b, r8b
and r11b, 0xff
and r10b, bl
mov dil, r9b
and dil, 0xff
and sil, bl
or r11b, r10b
or dil, sil
xor r11b, dil
or r8b, r9b
xor r8b, 0xff
or bl, 1
and r8b, bl
or r11b, r8b
test r11b, 1
jne 0x2fc4d0031
jmp 0x2fc4d031a
mov rax, qword [rsp + 0x70]
mov ecx, dword [0x2fc4fa174]
mov edx, dword [0x2fc4fa180]
mov r8d, 0xafb9e819
add r8d, 0
sub r8d, 1
sub r8d, 0xafb9e819
mov r9d, ecx
sub r9d, 0x81acf0ee
add r9d, r8d
add r9d, 0x81acf0ee
imul ecx, r9d
and ecx, 1
cmp ecx, 0
sete r10b
cmp edx, 0xa
setl r11b
mov bl, r10b
xor bl, 0xff
and bl, 0
mov sil, 1
mov dil, sil
xor dil, 0
mov bpl, r10b
and bpl, dil
mov r14b, sil
xor r14b, 1
and r14b, 0
and dil, 1
or bl, bpl
or r14b, dil
xor bl, r14b
mov dil, r11b
xor dil, 0xff
and dil, 1
mov bpl, sil
xor bpl, 1
mov r14b, r11b
and r14b, bpl
mov r15b, sil
xor r15b, 1
and r15b, 0xff
and bpl, 1
or dil, r14b
or r15b, bpl
xor dil, r15b
mov bpl, sil
xor bpl, 0
and bpl, 0
mov r14b, sil
xor r14b, 0
mov r15b, r14b
and r15b, 0
mov r12b, sil
xor r12b, 1
and r12b, 0
and r14b, 1
or bpl, r15b
or r12b, r14b
xor bpl, r12b
mov r14b, sil
xor r14b, 0
mov r15b, bl
xor r15b, r14b
and r15b, bl
xor r10b, 0xff
mov r14b, bpl
xor r14b, 0xff
mov r12b, sil
xor r12b, 1
or r10b, r14b
or r12b, 1
xor r10b, 0xff
and r10b, r12b
mov r14b, dil
xor r14b, 0xff
mov r12b, sil
xor r12b, 0
mov r13b, sil
xor r13b, 1
or r14b, r12b
or r13b, 1
xor r14b, 0xff
and r14b, r13b
mov r12b, bpl
xor r12b, 0xff
mov r13b, r11b
xor r13b, r12b
and r13b, r11b
mov r11b, r15b
xor r11b, 0xff
mov r12b, r10b
xor r12b, 0xff
mov cl, sil
xor cl, 0
mov dl, r11b
and dl, 0
and r15b, cl
mov r8b, r12b
and r8b, 0
and r10b, cl
or dl, r15b
or r8b, r10b
xor dl, r8b
or r11b, r12b
xor r11b, 0xff
or cl, 0
and r11b, cl
or dl, r11b
mov cl, r14b
xor cl, 0xff
mov r8b, r13b
xor r8b, 0xff
mov r10b, sil
xor r10b, 1
mov r11b, cl
and r11b, 0xff
and r14b, r10b
mov r15b, r8b
and r15b, 0xff
and r13b, r10b
or r11b, r14b
or r15b, r13b
xor r11b, r15b
or cl, r8b
xor cl, 0xff
or r10b, 1
and cl, r10b
or r11b, cl
mov cl, dl
xor cl, 0xff
and cl, 0
mov r8b, sil
xor r8b, 0
and dl, r8b
mov r10b, r11b
xor r10b, 0xff
and r10b, 0
and r11b, r8b
or cl, dl
or r10b, r11b
xor cl, r10b
mov dl, bl
xor dl, 0xff
mov r8b, dil
xor r8b, 0xff
mov r10b, sil
xor r10b, 1
mov r11b, dl
and r11b, 0xff
and bl, r10b
mov r14b, r8b
and r14b, 0xff
and dil, r10b
or r11b, bl
or r14b, dil
xor r11b, r14b
or dl, r8b
xor dl, 0xff
or r10b, 1
and dl, r10b
or r11b, dl
mov dl, r11b
xor dl, 0xff
and dl, 1
mov r8b, sil
xor r8b, 1
and r11b, r8b
or dl, r11b
mov r8b, sil
xor r8b, 0
mov r10b, bpl
xor r10b, 0xff
mov r11b, sil
xor r11b, 1
mov bl, r8b
and bl, 0xff
mov dil, r11b
and dil, 0
mov r14b, r10b
and r14b, 0xff
and bpl, r11b
or bl, dil
or r14b, bpl
xor bl, r14b
or r8b, r10b
xor r8b, 0xff
or r11b, 1
and r8b, r11b
or bl, r8b
xor dl, 0xff
xor bl, 0xff
xor sil, 0
or dl, bl
or sil, 0
xor dl, 0xff
and dl, sil
mov r8b, cl
and r8b, dl
xor cl, dl
or r8b, cl
test r8b, 1
mov qword [rsp + 0x28], rax
jne 0x2fc4d02ef
jmp 0x2fc4d031a
mov rax, qword [rsp + 0x28]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
jmp 0x2fc4cfd22
xor eax, eax
mov ecx, dword [0x2fc4fa174]
mov edx, dword [0x2fc4fa180]
sub eax, 0x5619f962
sub eax, 1
add eax, 0x5619f962
mov r8d, ecx
add r8d, 0xb80ef1
add r8d, eax
sub r8d, 0xb80ef1
imul ecx, r8d
and ecx, 1
cmp ecx, 0
sete r9b
cmp edx, 0xa
setl r10b
mov r11b, r9b
xor r11b, 0xff
mov bl, r10b
xor bl, 0xff
mov sil, 1
mov dil, sil
xor dil, 1
or r11b, bl
or dil, 1
xor r11b, 0xff
and r11b, dil
mov bl, r9b
xor bl, 0xff
and bl, 1
mov dil, sil
xor dil, 1
and r9b, dil
mov bpl, r10b
xor bpl, 0xff
and bpl, 0xff
and r10b, dil
or bl, r9b
or bpl, r10b
xor bl, bpl
mov r9b, r11b
xor r9b, 0xff
mov r10b, bl
xor r10b, 0xff
xor sil, 1
mov dil, r9b
and dil, 0xff
and r11b, sil
mov bpl, r10b
and bpl, 0xff
and bl, sil
or dil, r11b
or bpl, bl
xor dil, bpl
or r9b, r10b
xor r9b, 0xff
or sil, 1
and r9b, sil
or dil, r9b
test dil, 1
jne 0x2fc4d03fc
jmp 0x2fc4d06ac
xor eax, eax
mov ecx, dword [0x2fc4fa174]
mov edx, dword [0x2fc4fa180]
mov r8d, eax
sub r8d, ecx
mov r9d, eax
sub r9d, 0xe0f1d002
add r8d, r9d
mov r9d, eax
sub r9d, r8d
sub eax, 1
add r9d, eax
add r9d, 0x1a822908
sub r9d, 0xe0f1d002
sub r9d, 0x1a822908
imul ecx, r9d
and ecx, 1
cmp ecx, 0
sete r10b
cmp edx, 0xa
setl r11b
mov bl, r10b
xor bl, 0xff
and bl, 1
mov sil, 1
mov dil, sil
xor dil, 1
mov bpl, r10b
and bpl, dil
or bl, bpl
mov dil, r11b
xor dil, 0xff
and dil, 0
mov bpl, sil
xor bpl, 0
mov r14b, r11b
and r14b, bpl
mov r15b, sil
xor r15b, 1
and r15b, 0
and bpl, 1
or dil, r14b
or r15b, bpl
xor dil, r15b
mov bpl, sil
xor bpl, 1
and bpl, 0
mov r14b, sil
xor r14b, 0
mov r15b, r14b
and r15b, 1
mov r12b, sil
xor r12b, 1
and r12b, 0
and r14b, 1
or bpl, r15b
or r12b, r14b
xor bpl, r12b
mov r14b, bl
xor r14b, 0xff
mov r15b, sil
xor r15b, 1
mov r12b, sil
xor r12b, 1
or r14b, r15b
or r12b, 1
xor r14b, 0xff
and r14b, r12b
xor r10b, 0xff
mov r15b, bpl
xor r15b, 0xff
mov r12b, sil
xor r12b, 0
or r10b, r15b
or r12b, 0
xor r10b, 0xff
and r10b, r12b
mov r15b, dil
xor r15b, 0xff
mov r12b, sil
xor r12b, 1
mov r13b, sil
xor r13b, 1
or r15b, r12b
or r13b, 1
xor r15b, 0xff
and r15b, r13b
xor r11b, 0xff
mov r12b, bpl
xor r12b, 0xff
mov r13b, sil
xor r13b, 1
or r11b, r12b
or r13b, 1
xor r11b, 0xff
and r11b, r13b
mov r12b, r14b
and r12b, r10b
xor r14b, r10b
or r12b, r14b
mov r10b, r15b
xor r10b, 0xff
mov r14b, r11b
xor r14b, 0xff
mov r13b, sil
xor r13b, 0
mov al, r10b
and al, 0
and r15b, r13b
mov cl, r14b
and cl, 0
and r11b, r13b
or al, r15b
or cl, r11b
xor al, cl
or r10b, r14b
xor r10b, 0xff
or r13b, 0
and r10b, r13b
or al, r10b
mov cl, r12b
xor cl, 0xff
and cl, 1
mov r10b, sil
xor r10b, 1
and r12b, r10b
mov r11b, al
xor r11b, 0xff
and r11b, 0xff
and al, r10b
or cl, r12b
or r11b, al
xor cl, r11b
mov al, bl
xor al, 0xff
mov r10b, dil
xor r10b, 0xff
mov r11b, sil
xor r11b, 0
mov r14b, al
and r14b, 0
and bl, r11b
mov r15b, r10b
and r15b, 0
and dil, r11b
or r14b, bl
or r15b, dil
xor r14b, r15b
or al, r10b
xor al, 0xff
or r11b, 0
and al, r11b
or r14b, al
mov al, r14b
xor al, 0xff
and al, 1
mov r10b, sil
xor r10b, 1
and r14b, r10b
or al, r14b
mov r10b, bpl
and r10b, 1
xor bpl, 1
or r10b, bpl
xor al, 0xff
xor r10b, 0xff
mov r11b, sil
xor r11b, 1
or al, r10b
or r11b, 1
xor al, 0xff
and al, r11b
mov r10b, cl
xor r10b, 0xff
mov r11b, al
xor r11b, 0xff
xor sil, 1
mov bl, r10b
and bl, 0xff
and cl, sil
mov dil, r11b
and dil, 0xff
and al, sil
or bl, cl
or dil, al
xor bl, dil
or r10b, r11b
xor r10b, 0xff
or sil, 1
and r10b, sil
or bl, r10b
test bl, 1
jne 0x2fc4d0690
jmp 0x2fc4d06ac
jmp 0x2fc4d0031
jmp 0x2fc4cfb43
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
jmp 0x2fc4cfe00
jmp 0x2fc4d03fc