Function at 0x2ac4047b0
Capabilities:
Access peb ldr_data
Get ntdll base address
Populate syswhispers2 syscall list
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rdx, qword [rax + 0x10]
mov rax, qword [rdx + 0x30]
test rax, rax
je 0x2ac404a25
xor r8d, r8d
nop dword [rax]
mov rbx, rax
movsxd rax, dword [rax + 0x3c]
mov eax, dword [rbx + rax + 0x88]
test eax, eax
je 0x2ac404824
lea r8, [rbx + rax]
mov eax, dword [r8 + 0xc]
add rax, rbx
mov ecx, dword [rax]
or ecx, 0x20202020
cmp ecx, 0x6c64746e
jne 0x2ac404824
mov eax, dword [rax + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x2ac404839
mov rdx, qword [rdx]
mov rax, qword [rdx + 0x30]
test rax, rax
jne 0x2ac4047e8
test r8, r8
je 0x2ac404a25
mov eax, dword [r8 + 0x18]
mov r14d, dword [r8 + 0x24]
xor r13d, r13d
xor r12d, r12d
mov r15d, dword [r8 + 0x1c]
lea rbp, [0x2ac40b1a8]
lea edx, [rax - 1]
mov eax, dword [r8 + 0x20]
add r14, rbx
add r15, rbx
lea rsi, [r14 + rdx*2]
add rax, rbx
lea rdi, [rax + rdx*4]
nop word [rax + rax]
mov edx, dword [rdi]
add rdx, rbx
movzx eax, word [rdx]
movzx ecx, byte [rdx]
cmp ax, 0x775a
je 0x2ac404900
mov r10d, r13d
shl r10, 4
add r10, rbp
test cl, cl
mov ecx, 0x832e83ab
je 0x2ac4048bd
xor r9d, r9d
jmp 0x2ac4048a4
movzx eax, word [rdx + rax]
mov r11d, ecx
add r9d, 1
ror r11d, 8
add eax, r11d
xor ecx, eax
mov eax, r9d
cmp byte [rdx + rax], 0
jne 0x2ac4048a0
movzx eax, word [rsi]
mov dword [r10], ecx
add r13d, 1
mov eax, dword [r15 + rax*4]
mov dword [r10 + 4], eax
add rax, rbx
mov qword [r10 + 8], rax
cmp r13d, 0x7d0
je 0x2ac40498c
sub rdi, 4
lea rax, [rsi - 2]
cmp r14, rsi
je 0x2ac40498c
mov rsi, rax
jmp 0x2ac404870
mov r9d, r12d
lea r8, [0x2ac412ec8]
shl r9, 4
add r9, r8
test cl, cl
mov ecx, 0x832e83ab
je 0x2ac40493d
xor r10d, r10d
jmp 0x2ac404924
movzx eax, word [rdx + rax]
mov r11d, ecx
add r10d, 1
ror r11d, 8
add eax, r11d
xor ecx, eax
mov eax, r10d
cmp byte [rdx + rax], 0
jne 0x2ac404920
movzx eax, word [rsi]
mov dword [r9], ecx
add r12d, 1
mov qword [rsp + 0x28], r9
mov eax, dword [r15 + rax*4]
mov dword [r9 + 4], eax
lea rcx, [rax + rbx]
call fcn.2ac404700
mov r9, qword [rsp + 0x28]
mov qword [r9 + 8], rax
cmp r12d, 0x7d0
jne 0x2ac4048e3
mov dword [0x2ac412ec0], 0x7d0
mov r12d, 0x7cf
mov dword [0x2ac40b1a0], r13d
jmp 0x2ac4049a0
mov dword [0x2ac412ec0], r12d
mov dword [0x2ac40b1a0], r13d
sub r12d, 1
je 0x2ac404a0f
xor ebx, ebx
lea edi, [r12 - 1]
lea rsi, [0x2ac412ed8]
nop
cmp r12d, ebx
je 0x2ac404a07
mov r8d, edi
lea rax, [0x2ac412ec8]
sub r8d, ebx
shl r8, 4
add r8, rsi
nop dword [rax]
mov edx, dword [rax + 4]
mov ecx, dword [rax + 0x14]
cmp edx, ecx
jbe 0x2ac4049fe
mov r10d, dword [rax]
mov r9, qword [rax + 8]
mov dword [rax + 4], ecx
mov r11d, dword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov dword [rax + 0x14], edx
mov dword [rax + 0x10], r10d
mov dword [rax], r11d
mov qword [rax + 8], rcx
mov qword [rax + 0x18], r9
add rax, 0x10
cmp rax, r8
jne 0x2ac4049d0
add ebx, 1
cmp ebx, r12d
jb 0x2ac4049b0
mov eax, 1
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x2ac404a14