Function at 0x7ff702034d0
Capabilities:
Access peb ldr_data

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x7ff702070c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor r15d, r15d
mov edi, 1
mov rbx, r9
mov rbp, r8
mov r14, rdx
mov qword [rsp + 0x30], rdx
mov rsi, rcx
mov r13d, edi
cmp dword [0x7ff70207a30], r15d
jne 0x7ff70203520
mov dword [r8], r15d
mov dword [r9], r15d
jmp 0x7ff702037b2
call fcn.7ff702032a0
cmp eax, 3
je 0x7ff702037ab
cmp eax, 4
je 0x7ff702037ab
cmp eax, 2
jne 0x7ff7020357a
mov ecx, dword [0x7ff7020778c]
mov rdx, rsi
call fcn.7ff702031f0
mov rdx, rsi
neg eax
sbb ecx, ecx
and edi, ecx
mov ecx, dword [0x7ff702079ac]
call fcn.7ff702031f0
neg eax
sbb ecx, ecx
and ecx, r13d
mov r13d, ecx
cmp edi, r15d
jne 0x7ff7020357a
cmp ecx, r15d
jne 0x7ff7020357a
mov eax, r15d
jmp 0x7ff702037a2
mov r12, qword [r14]
mov esi, r15d
mov dword [rbx], r15d
cmp edi, r15d
je 0x7ff70203631
mov esi, 0x258
cmp dword [rbp], esi
jb 0x7ff7020379d
lea rdx, [0x7ff70207780]
lea r8d, [rsi - 0x38]
mov rcx, r12
call sub.ntdll.dll_memcpy
lea r15, [r12 + 0x220]
xor edx, edx
mov dword [r15], 0x38
mov rdi, qword [0x7ff70207a38]
lea r12, [r15 + 8]
lea r8d, [rdx + 0x30]
mov rcx, r12
call sub.ntdll.dll_memset
mov rax, qword gs:[0x30]
xor r11d, r11d
mov rcx, qword [rax + 0x60]
cmp dword [rcx + 0xb8], r11d
jbe 0x7ff70203628
sub rdi, r12
mov rcx, r12
mov edx, 0xc
mov eax, dword [rdi + rcx]
add dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x7ff702035f9
mov rax, qword gs:[0x30]
inc r11d
add rdi, 0x288
mov rcx, qword [rax + 0x60]
cmp r11d, dword [rcx + 0xb8]
jb 0x7ff702035f1
inc dword [rbx]
lea r12, [r15 + 0x38]
xor r15d, r15d
cmp r13d, r15d
je 0x7ff70203790
mov r8d, 0x90
add esi, r8d
cmp dword [rbp], esi
jb 0x7ff7020379d
lea rdx, [0x7ff702079a0]
mov rcx, r12
call sub.ntdll.dll_memcpy
lea rdi, [r12 + 0x90]
mov r14d, r15d
mov qword [rsp + 0x28], rdi
mov r13, r15
mov r15, qword [0x7ff70207a38]
mov ecx, dword [r13 + r15 + 0x30]
test ecx, ecx
je 0x7ff70203778
lea rdx, [rsp + 0x38]
mov r8d, 0xa
call qword [sym.imp.ntdll.dll__itow]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x38]
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
mov dword [rsp + 0x24], eax
add eax, 7
and eax, 0xfffffff8
mov dword [rsp + 0x20], eax
add eax, 0x28
add esi, eax
cmp dword [rbp], esi
jb 0x7ff7020379a
mov rdi, qword [rsp + 0x28]
mov r8d, eax
xor edx, edx
mov rcx, rdi
call sub.ntdll.dll_memset
mov eax, dword [rsp + 0x24]
mov edx, dword [rsp + 0x20]
and dword [rdi + 4], 0
and dword [rdi + 8], 0
or dword [rdi + 0xc], 0xffffffff
add edx, 0x18
lea rcx, [rdi + 0x18]
mov r8, rax
mov dword [rdi], edx
lea rdx, [rsp + 0x38]
mov dword [rdi + 0x10], 0x18
mov dword [rdi + 0x14], eax
call sub.ntdll.dll_memcpy
mov r8d, dword [rsp + 0x20]
lea rdi, [r8 + rdi + 0x18]
xor r9d, r9d
mov dword [rdi], 0x10
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
cmp dword [rcx + 0xb8], r9d
jbe 0x7ff70203762
lea rdx, [r13 + r15 + 0x38]
mov eax, dword [rdx - 4]
inc r9d
add dword [rdi + 4], eax
mov eax, dword [rdx]
add rdx, 0x288
add dword [rdi + 8], eax
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
cmp r9d, dword [rcx + 0xb8]
jb 0x7ff70203737
inc dword [r12 + 0x28]
lea eax, [r8 + 0x28]
add dword [r12], eax
add rdi, 0x10
mov qword [rsp + 0x28], rdi
inc r14d
add r13, 0xc
cmp r14d, 0x32
jb 0x7ff7020366e
inc dword [rbx]
mov r14, qword [rsp + 0x30]
mov eax, esi
add qword [r14], rax
mov dword [rbp], esi
jmp 0x7ff702037b2
xor r15d, r15d
mov eax, 0xea
mov dword [rbp], r15d
mov dword [rbx], r15d
jmp 0x7ff702037b4
mov dword [rbp], r15d
mov dword [rbx], r15d
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.7ff70202210
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret