Function at 0x6f134fc0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x74], 0x60
mov eax, dword [rsp + 0x74]
mov ecx, eax
mov rcx, qword gs:[rcx]
mov qword [rsp + 0x68], rcx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x18]
add rcx, 0x30
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx]
mov qword [rsp + 0x50], rcx
xor eax, eax
mov ecx, eax
mov rdx, rcx
add rdx, 0x20
sub rcx, rdx
mov rdx, qword [rsp + 0x50]
add rdx, rcx
mov qword [rsp + 0x48], rdx
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx + 0x70]
mov rdx, qword [rsp + 0x48]
add rdx, 0x70
cmp rcx, rdx
jne 0x6f135085
jmp 0x6f1352ca
xor eax, eax
mov ecx, dword [0x6f152fd4]
mov edx, dword [0x6f152fdc]
mov r8d, ecx
add r8d, 0xa85eecc3
sub r8d, 0x5c55571c
sub r8d, 0xa85eecc3
sub eax, 1
add r8d, eax
add r8d, 0x4ccdcf18
add r8d, 0x5c55571c
sub r8d, 0x4ccdcf18
imul ecx, r8d
and ecx, 1
cmp ecx, 0
sete r9b
cmp edx, 0xa
setl r10b
mov r11b, r9b
xor r11b, 0xff
mov bl, r10b
xor bl, 0xff
mov sil, 1
xor sil, 0
or r11b, bl
or sil, 0
xor r11b, 0xff
and r11b, sil
mov bl, r9b
xor bl, 0xff
mov sil, r10b
and sil, bl
xor r10b, 0xff
and r9b, r10b
or sil, r9b
mov r9b, r11b
and r9b, sil
xor r11b, sil
or r9b, r11b
test r9b, 1
jne 0x6f13512e
jmp 0x6f1352f0
xor eax, eax
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx + 0x70]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x48]
add rdx, 0x70
cmp rcx, rdx
sete r8b
mov r9d, dword [0x6f152fd4]
mov r10d, dword [0x6f152fdc]
mov r11d, r9d
sub r11d, 0x21319ce2
sub r11d, 0xae4b0794
add r11d, 0x21319ce2
mov esi, eax
sub esi, 1
add r11d, esi
sub eax, 0xae4b0794
sub r11d, eax
imul r9d, r11d
and r9d, 1
cmp r9d, 0
sete bl
cmp r10d, 0xa
setl dil
mov bpl, dil
xor bpl, 0xff
mov r14b, bl
xor r14b, bpl
and r14b, bl
mov bpl, bl
xor bpl, 0xff
mov r15b, dil
and r15b, bpl
xor dil, 0xff
and bl, dil
or r15b, bl
mov bl, r14b
xor bl, 0xff
mov dil, r15b
xor dil, 0xff
mov bpl, 1
xor bpl, 0
mov r12b, bl
and r12b, 0
and r14b, bpl
mov r13b, dil
and r13b, 0
and r15b, bpl
or r12b, r14b
or r13b, r15b
xor r12b, r13b
or bl, dil
xor bl, 0xff
or bpl, 0
and bl, bpl
or r12b, bl
test r12b, 1
mov byte [rsp + 0x27], r8b
jne 0x6f135222
jmp 0x6f1352f0
mov al, byte [rsp + 0x27]
test al, 1
jne 0x6f135233
jmp 0x6f1352c1
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x58]
mov qword [rsp + 0x28], rcx
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x28]
mov edx, 1
call fcn.6f132390
xor edx, edx
mov ecx, edx
mov dword [rsp + 0x3c], eax
mov r8, qword [rsp + 0x48]
mov r8, qword [r8 + 0x70]
mov eax, dword [rsp + 0x3c]
mov r9d, eax
shl r9, 4
movabs r10, 0x790ded77483079b2
sub r8, r10
movabs r11, 0xfe4e1e0e8ced99c6
sub r8, r11
add r8, r10
movabs r10, 0xee5265ffa2c26cc7
add r8, r10
sub r8, r9
sub r8, r10
mov r9, rcx
sub r9, r8
mov r8, rcx
sub r8, r11
add r9, r8
sub rcx, r9
mov qword [rsp + 0x60], rcx
jmp 0x6f1352da
mov qword [rsp + 0x60], 0
mov rax, qword [rsp + 0x58]
cmp rax, qword [rsp + 0x50]
jne 0x6f135037
mov rax, qword [rsp + 0x60]
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x60], rax
jmp 0x6f13512e