Function at 0x2fc4cacd0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov qword [rsp + 0x78], rcx
mov dword [rsp + 0x94], 0x60
mov eax, dword [rsp + 0x94]
mov ecx, eax
mov rcx, qword gs:[rcx]
mov qword [rsp + 0x88], rcx
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x70], rcx
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x18]
add rcx, 0x10
mov qword [rsp + 0x68], rcx
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx]
mov qword [rsp + 0x60], rcx
mov rax, qword [rsp + 0x60]
cmp rax, qword [rsp + 0x68]
je 0x2fc4cb2e8
xor eax, eax
mov ecx, dword [0x2fc4f5174]
mov edx, dword [0x2fc4f5180]
sub eax, 0xc69755dc
sub eax, 1
add eax, 0xc69755dc
mov r8d, ecx
sub r8d, 0x2cdc5cc2
add r8d, eax
add r8d, 0x2cdc5cc2
imul ecx, r8d
and ecx, 1
cmp ecx, 0
sete r9b
cmp edx, 0xa
setl r10b
mov r11b, r10b
xor r11b, 0xff
mov bl, r9b
xor bl, r11b
and bl, r9b
mov r11b, r9b
xor r11b, 0xff
mov sil, r10b
and sil, r11b
xor r10b, 0xff
and r9b, r10b
or sil, r9b
mov r9b, bl
and r9b, sil
xor bl, sil
or r9b, bl
test r9b, 1
jne 0x2fc4cadcd
jmp 0x2fc4cb310
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x60]
mov rdx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x50], rcx
mov rcx, rax
mov qword [rsp + 0x48], rdx
call sym.StrLen
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov r8, rax
call sym.W2Anicmp
xor r9d, r9d
cmp eax, 0
sete r10b
mov eax, dword [0x2fc4f5174]
mov r11d, dword [0x2fc4f5180]
mov esi, r9d
sub esi, 0xfea05961
mov edi, eax
add edi, esi
mov esi, r9d
sub esi, 1
add edi, esi
mov esi, r9d
sub esi, edi
mov edi, r9d
sub edi, 0xfea05961
add esi, edi
sub r9d, esi
imul eax, r9d
and eax, 1
cmp eax, 0
sete bl
cmp r11d, 0xa
setl bpl
mov r14b, bl
xor r14b, 0xff
and r14b, 1
mov r15b, 1
mov r12b, r15b
xor r12b, 1
mov r13b, bl
and r13b, r12b
or r14b, r13b
mov r12b, bpl
xor r12b, 0xff
and r12b, 1
mov r13b, r15b
xor r13b, 1
mov al, bpl
and al, r13b
or r12b, al
mov al, r15b
xor al, 1
and al, 1
mov r13b, r15b
xor r13b, 1
and r13b, 1
or al, r13b
mov r13b, r15b
xor r13b, 1
mov cl, r14b
xor cl, r13b
and cl, r14b
mov r13b, al
xor r13b, 0xff
mov dl, bl
xor dl, r13b
and dl, bl
mov bl, r15b
xor bl, 1
mov r13b, r12b
xor r13b, bl
and r13b, r12b
xor bpl, 0xff
mov bl, al
xor bl, 0xff
mov r8b, r15b
xor r8b, 1
or bpl, bl
or r8b, 1
xor bpl, 0xff
and bpl, r8b
mov r8b, cl
xor r8b, 0xff
mov bl, dl
xor bl, 0xff
mov r9b, r15b
xor r9b, 0
mov r11b, r8b
and r11b, 0
and cl, r9b
mov sil, bl
and sil, 0
and dl, r9b
or r11b, cl
or sil, dl
xor r11b, sil
or r8b, bl
xor r8b, 0xff
or r9b, 0
and r8b, r9b
or r11b, r8b
mov cl, r13b
and cl, bpl
xor r13b, bpl
or cl, r13b
mov dl, r11b
xor dl, 0xff
and dl, 1
mov r8b, r15b
xor r8b, 1
and r11b, r8b
mov r9b, cl
xor r9b, 0xff
and r9b, 0xff
and cl, r8b
or dl, r11b
or r9b, cl
xor dl, r9b
mov cl, r14b
and cl, r12b
xor r14b, r12b
or cl, r14b
mov r8b, cl
xor r8b, 0xff
and r8b, 1
mov r9b, r15b
xor r9b, 1
and cl, r9b
or r8b, cl
mov cl, al
and cl, 1
xor al, 1
or cl, al
xor r8b, 0xff
xor cl, 0xff
xor r15b, 1
or r8b, cl
or r15b, 1
xor r8b, 0xff
and r8b, r15b
mov al, dl
and al, r8b
xor dl, r8b
or al, dl
test al, 1
mov byte [rsp + 0x47], r10b
jne 0x2fc4cafd4
jmp 0x2fc4cb310
mov al, byte [rsp + 0x47]
test al, 1
jne 0x2fc4cafe5
jmp 0x2fc4cb2d6
mov eax, dword [0x2fc4f5174]
mov ecx, dword [0x2fc4f5180]
mov edx, eax
sub edx, 0xd7211515
sub edx, 0x7348a728
add edx, 0xd7211515
add edx, 0x4434be61
sub edx, 1
sub edx, 0x4434be61
add edx, 0xc60d4a70
add edx, 0x7348a728
sub edx, 0xc60d4a70
imul eax, edx
and eax, 1
cmp eax, 0
sete r8b
cmp ecx, 0xa
setl r9b
mov r10b, r8b
xor r10b, 0xff
mov r11b, r9b
xor r11b, 0xff
mov bl, 1
mov sil, bl
xor sil, 0
or r10b, r11b
or sil, 0
xor r10b, 0xff
and r10b, sil
mov r11b, r8b
xor r11b, 0xff
and r11b, 0
xor bl, 0
and r8b, bl
mov sil, r9b
xor sil, 0xff
and sil, 0
and r9b, bl
or r11b, r8b
or sil, r9b
xor r11b, sil
mov r8b, r10b
and r8b, r11b
xor r10b, r11b
or r8b, r10b
test r8b, 1
jne 0x2fc4cb0a2
jmp 0x2fc4cb6c5
xor eax, eax
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx + 0x30]
mov qword [rsp + 0x80], rcx
mov edx, dword [0x2fc4f5174]
mov r8d, dword [0x2fc4f5180]
mov r9d, 0x85ffd747
add r9d, 0
sub r9d, 1
sub r9d, 0x85ffd747
mov r10d, eax
sub r10d, edx
mov r11d, eax
sub r11d, r9d
add r10d, r11d
sub eax, r10d
imul edx, eax
and edx, 1
cmp edx, 0
sete bl
cmp r8d, 0xa
setl sil
mov dil, bl
xor dil, 0xff
and dil, 1
mov bpl, 1
mov r14b, bpl
xor r14b, 1
mov r15b, bl
and r15b, r14b
or dil, r15b
mov r14b, sil
xor r14b, 0xff
and r14b, 0
mov r15b, bpl
xor r15b, 0
mov r12b, sil
and r12b, r15b
mov r13b, bpl
xor r13b, 1
and r13b, 0
and r15b, 1
or r14b, r12b
or r13b, r15b
xor r14b, r13b
mov r15b, bpl
xor r15b, 1
and r15b, 0
mov r12b, bpl
xor r12b, 0
mov r13b, r12b
and r13b, 1
mov al, bpl
xor al, 1
and al, 0
and r12b, 1
or r15b, r13b
or al, r12b
xor r15b, al
mov al, dil
xor al, 0xff
mov r12b, bpl
xor r12b, 1
mov r13b, bpl
xor r13b, 0
or al, r12b
or r13b, 0
xor al, 0xff
and al, r13b
xor bl, 0xff
mov r12b, r15b
xor r12b, 0xff
mov r13b, bpl
xor r13b, 0
or bl, r12b
or r13b, 0
xor bl, 0xff
and bl, r13b
mov r12b, bpl
xor r12b, 1
mov r13b, r14b
xor r13b, r12b
and r13b, r14b
mov r12b, r15b
xor r12b, 0xff
mov cl, sil
xor cl, r12b
and cl, sil
mov sil, al
and sil, bl
xor al, bl
or sil, al
mov al, r13b
xor al, 0xff
mov bl, cl
xor bl, 0xff
mov r12b, bpl
xor r12b, 0
mov dl, al
and dl, 0
and r13b, r12b
mov r8b, bl
and r8b, 0
and cl, r12b
or dl, r13b
or r8b, cl
xor dl, r8b
or al, bl
xor al, 0xff
or r12b, 0
and al, r12b
or dl, al
mov al, sil
xor al, 0xff
mov cl, dl
and cl, al
xor dl, 0xff
and sil, dl
or cl, sil
mov al, dil
xor al, 0xff
mov dl, r14b
xor dl, 0xff
mov r8b, bpl
xor r8b, 1
mov bl, al
and bl, 0xff
and dil, r8b
mov sil, dl
and sil, 0xff
and r14b, r8b
or bl, dil
or sil, r14b
xor bl, sil
or al, dl
xor al, 0xff
or r8b, 1
and al, r8b
or bl, al
mov al, bl
xor al, 0xff
and al, 1
mov dl, bpl
xor dl, 1
and bl, dl
or al, bl
mov dl, r15b
and dl, 1
xor r15b, 1
or dl, r15b
xor dl, 0xff
mov r8b, al
xor r8b, dl
and r8b, al
mov al, cl
xor al, 0xff
mov dl, r8b
xor dl, 0xff
xor bpl, 1
mov bl, al
and bl, 0xff
and cl, bpl
mov sil, dl
and sil, 0xff
and r8b, bpl
or bl, cl
or sil, r8b
xor bl, sil
or al, dl
xor al, 0xff
or bpl, 1
and al, bpl
or bl, al
test bl, 1
jne 0x2fc4cb2d1
jmp 0x2fc4cb6c5
jmp 0x2fc4cb2f4
mov rax, qword [rsp + 0x60]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
jmp 0x2fc4cad37
mov qword [rsp + 0x80], 0
mov rax, qword [rsp + 0x80]
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
mov ecx, dword [0x2fc4f5174]
mov edx, dword [0x2fc4f5180]
mov r8d, ecx
add r8d, 0xaa52ed22
sub r8d, 0x6a2170a0
sub r8d, 0xaa52ed22
sub r8d, 0xc967ab05
sub r8d, 1
add r8d, 0xc967ab05
mov r9d, eax
sub r9d, r8d
mov r8d, eax
sub r8d, 0x6a2170a0
add r9d, r8d
sub eax, r9d
imul ecx, eax
and ecx, 1
cmp ecx, 0
sete r10b
cmp edx, 0xa
setl r11b
mov bl, r10b
xor bl, 0xff
and bl, 1
mov sil, 1
mov dil, sil
xor dil, 1
mov bpl, r10b
and bpl, dil
or bl, bpl
mov dil, r11b
xor dil, 0xff
and dil, 1
mov bpl, sil
xor bpl, 1
mov r14b, r11b
and r14b, bpl
or dil, r14b
mov bpl, sil
xor bpl, 0
and bpl, 0
mov r14b, sil
xor r14b, 0
mov r15b, r14b
and r15b, 0
mov r12b, sil
xor r12b, 1
and r12b, 0
and r14b, 1
or bpl, r15b
or r12b, r14b
xor bpl, r12b
mov r14b, bl
xor r14b, 0xff
mov r15b, sil
xor r15b, 0
mov r12b, sil
xor r12b, 0
or r14b, r15b
or r12b, 0
xor r14b, 0xff
and r14b, r12b
xor r10b, 0xff
mov r15b, bpl
xor r15b, 0xff
mov r12b, sil
xor r12b, 1
or r10b, r15b
or r12b, 1
xor r10b, 0xff
and r10b, r12b
mov r15b, dil
xor r15b, 0xff
mov r12b, sil
xor r12b, 0
mov r13b, sil
xor r13b, 1
or r15b, r12b
or r13b, 1
xor r15b, 0xff
and r15b, r13b
xor r11b, 0xff
mov r12b, bpl
xor r12b, 0xff
mov r13b, sil
xor r13b, 0
or r11b, r12b
or r13b, 0
xor r11b, 0xff
and r11b, r13b
mov r12b, r14b
xor r12b, 0xff
mov r13b, r10b
xor r13b, 0xff
mov al, sil
xor al, 0
mov cl, r12b
and cl, 0
and r14b, al
mov dl, r13b
and dl, 0
and r10b, al
or cl, r14b
or dl, r10b
xor cl, dl
or r12b, r13b
xor r12b, 0xff
or al, 0
and r12b, al
or cl, r12b
mov al, r15b
xor al, 0xff
mov dl, r11b
xor dl, 0xff
mov r10b, sil
xor r10b, 0
mov r14b, al
and r14b, 0
and r15b, r10b
mov r12b, dl
and r12b, 0
and r11b, r10b
or r14b, r15b
or r12b, r11b
xor r14b, r12b
or al, dl
xor al, 0xff
or r10b, 0
and al, r10b
or r14b, al
mov al, cl
xor al, 0xff
and al, 0
mov dl, sil
xor dl, 0
and cl, dl
mov r10b, r14b
xor r10b, 0xff
and r10b, 0
and r14b, dl
or al, cl
or r10b, r14b
xor al, r10b
mov cl, bl
and cl, dil
xor bl, dil
or cl, bl
mov dl, cl
xor dl, 0xff
and dl, 1
mov r10b, sil
xor r10b, 1
and cl, r10b
mov r11b, sil
xor r11b, 1
and r11b, 0xff
and r10b, 1
or dl, cl
or r11b, r10b
xor dl, r11b
mov cl, bpl
and cl, 0
xor bpl, 0
or cl, bpl
xor cl, 0xff
mov r10b, dl
xor r10b, cl
and r10b, dl
mov cl, al
xor cl, 0xff
mov dl, r10b
xor dl, 0xff
xor sil, 0
mov r11b, cl
and r11b, 0
and al, sil
mov bl, dl
and bl, 0
and r10b, sil
or r11b, al
or bl, r10b
xor r11b, bl
or cl, dl
xor cl, 0xff
or sil, 0
and cl, sil
or r11b, cl
test r11b, 1
jne 0x2fc4cb591
jmp 0x2fc4cb6db
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x60]
mov rdx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x38], rcx
mov rcx, rax
mov qword [rsp + 0x30], rdx
call sym.StrLen
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov r8, rax
call sym.W2Anicmp
mov r9d, dword [0x2fc4f5174]
mov r10d, dword [0x2fc4f5180]
mov r11d, r9d
sub r11d, 0xc9f101bd
add r11d, 0x5cb35f58
add r11d, 0xc9f101bd
add r11d, 0xb9482d85
sub r11d, 1
sub r11d, 0xb9482d85
add r11d, 0x16cce94e
sub r11d, 0x5cb35f58
sub r11d, 0x16cce94e
imul r9d, r11d
and r9d, 1
cmp r9d, 0
sete bl
cmp r10d, 0xa
setl sil
mov dil, bl
xor dil, 0xff
mov bpl, sil
xor bpl, 0xff
mov r14b, 1
mov r15b, r14b
xor r15b, 0
or dil, bpl
or r15b, 0
xor dil, 0xff
and dil, r15b
mov bpl, bl
xor bpl, 0xff
mov r15b, sil
and r15b, bpl
xor sil, 0xff
and bl, sil
or r15b, bl
mov bl, dil
xor bl, 0xff
mov sil, r15b
xor sil, 0xff
xor r14b, 1
mov bpl, bl
and bpl, 0xff
and dil, r14b
mov r12b, sil
and r12b, 0xff
and r15b, r14b
or bpl, dil
or r12b, r15b
xor bpl, r12b
or bl, sil
xor bl, 0xff
or r14b, 1
and bl, r14b
or bpl, bl
test bpl, 1
jne 0x2fc4cb6c0
jmp 0x2fc4cb6db
jmp 0x2fc4cadcd
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x80], rax
jmp 0x2fc4cb0a2
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x60]
mov rdx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov rcx, rax
mov qword [rsp + 0x20], rdx
call sym.StrLen
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov r8, rax
call sym.W2Anicmp
jmp 0x2fc4cb591