Function at 0x39ac82a70
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2b0
mov r14, qword gs:[0x60]
mov rax, qword [r14 + 0x18]
mov rbx, qword [rax + 0x10]
add rax, 0x10
mov rsi, rcx
mov rbp, rdx
cmp rbx, rax
je 0x39ac82b4a
mov r12, qword [sym.imp.USER32.dll_CharLowerA]
lea r13, [rsp + 0x7f]
nop dword [rax]
test rbx, rbx
je 0x39ac82b4a
mov rax, qword [rbx + 0x50]
movzx edx, word [rax]
test dx, dx
je 0x39ac82cfd
mov eax, 1
jmp 0x39ac82aec
add rax, 1
cmp rax, 0x104
je 0x39ac82b5c
mov byte [r13 + rax], dl
mov rdx, qword [rbx + 0x50]
movsxd rcx, eax
movzx edx, word [rdx + rax*2]
test dx, dx
jne 0x39ac82ae0
mov byte [rsp + rcx + 0x80], 0
cmp qword [rbx + 0x30], rsi
je 0x39ac82b6f
lea rdi, [rsp + 0x80]
mov rcx, rdi
call r12
mov rdx, rbp
mov rcx, rax
call sub.msvcrt.dll_strstr
test rax, rax
jne 0x39ac82b6f
mov ecx, 0x104
xor eax, eax
rep stosb byte [rdi], al
mov rax, qword [r14 + 0x18]
mov rbx, qword [rbx]
add rax, 0x10
cmp rbx, rax
jne 0x39ac82ab8
add rsp, 0x2b0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov ecx, 0x103
mov byte [rsp + rcx + 0x80], 0
cmp qword [rbx + 0x30], rsi
jne 0x39ac82b0f
mov rax, qword [rbx + 8]
mov qword [rsp + 0x50], rsi
mov rdx, qword [rax]
mov qword [rsp + 0x58], rdx
mov rdx, qword [rbx + 0x28]
mov rdx, qword [rdx]
mov qword [rsp + 0x68], rdx
mov rdx, qword [rbx + 0x18]
mov rdx, qword [rdx]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x60], rdx
mov rdx, qword [0x39ad342c8]
cmp rdx, qword [0x39ad342d0]
je 0x39ac82d04
movdqu xmm0, xmmword [rsp + 0x50]
add rdx, 0x28
movups xmmword [rdx - 0x28], xmm0
movdqu xmm1, xmmword [rsp + 0x60]
movups xmmword [rdx - 0x18], xmm1
mov rcx, qword [rsp + 0x70]
mov qword [rdx - 8], rcx
mov qword [0x39ad342c8], rdx
mov rdx, qword [rbx]
lea rsi, [rsp + 0x190]
mov ecx, 0x120
mov rdi, rsi
mov qword [rdx + 8], rax
mov qword [rax], rdx
mov rdx, qword [rbx + 0x28]
mov rax, qword [rbx + 0x20]
mov qword [rax + 8], rdx
mov rdx, qword [rbx + 0x28]
mov qword [rdx], rax
mov rdx, qword [rbx + 0x18]
mov rax, qword [rbx + 0x10]
mov qword [rax + 8], rdx
mov rdx, qword [rbx + 0x18]
mov qword [rdx], rax
mov rdx, qword [rbx + 0x78]
mov rax, qword [rbx + 0x70]
mov qword [rax + 8], rdx
mov rdx, qword [rbx + 0x78]
mov qword [rdx], rax
xor eax, eax
rep stosb byte [rdi], al
lea rdi, [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
mov r8d, 4
mov edx, 0x120
mov r9, rdi
mov dword [rsp + 0x24], 0
call fcn.39ac81b70
mov rcx, qword [rsp + 0x50]
mov r8, rsi
mov r9d, 0x120
mov rsi, qword [0x39ad340e0]
mov edx, 0x120
call rsi
mov r8d, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
mov r9, rdi
mov edx, 0x120
lea rdi, [rsp + 0x30]
call fcn.39ac81b70
mov rcx, qword [rbx + 0x50]
mov r8, rdi
movabs rax, 0x6c00640074006e
movabs rdx, 0x6c0064002e006c
mov qword [rsp + 0x30], rax
mov r9d, 0x14
mov qword [rsp + 0x38], rdx
movzx edx, word [rbx + 0x48]
mov dword [rsp + 0x40], 0x6c
call rsi
movzx edx, word [rbx + 0x48]
mov rcx, qword [rbx + 0x60]
mov r8, rdi
mov r9d, 0x14
call rsi
lea rcx, [rbx + 0x30]
lea r8, [rsp + 0x28]
mov edx, 8
mov qword [rsp + 0x28], 0x7fff0000
mov r9d, 8
call rsi
jmp 0x39ac82b4a
xor ecx, ecx
jmp 0x39ac82b01
lea r8, [rsp + 0x50]
lea rcx, [0x39ad342c0]
call fcn.39ad1b740
mov rax, qword [rbx + 8]
jmp 0x39ac82bd9
mov r10, qword [0x39ad342c8]
mov rax, qword [0x39ad342c0]
movabs r8, 0xcccccccccccccccd
mov r9, rdx
mov rdx, r10
sub rdx, rax
sar rdx, 3
imul rdx, r8
mov r8, rdx
sar r8, 2
test r8, r8
jle 0x39ac82db0
lea rdx, [r8 + r8*4]
shl rdx, 5
add rdx, rax
jmp 0x39ac82d89
cmp rcx, qword [rax + 0x28]
je 0x39ac82de8
cmp rcx, qword [rax + 0x50]
je 0x39ac82df0
cmp rcx, qword [rax + 0x78]
je 0x39ac82e00
add rax, 0xa0
cmp rdx, rax
je 0x39ac82d98
cmp rcx, qword [rax]
jne 0x39ac82d68
cmp r10, rax
je 0x39ac82dc2
ret
movabs r8, 0xcccccccccccccccd
mov rdx, r10
sub rdx, rax
sar rdx, 3
imul rdx, r8
cmp rdx, 2
je 0x39ac82dd3
cmp rdx, 3
je 0x39ac82dca
cmp rdx, 1
je 0x39ac82ddc
mov rdx, r9
jmp 0x39ac82a70
cmp rcx, qword [rax]
je 0x39ac82d8e
add rax, 0x28
cmp rcx, qword [rax]
je 0x39ac82d8e
add rax, 0x28
cmp rcx, qword [rax]
jne 0x39ac82dc2
jmp 0x39ac82d8e
add rax, 0x28
jmp 0x39ac82d8e
add rax, 0x50
jmp 0x39ac82d8e
add rax, 0x78
jmp 0x39ac82d8e