Function at 0x2fc4cd050
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov qword [rsp + 0x78], rcx
mov dword [rsp + 0x94], 0x60
mov eax, dword [rsp + 0x94]
mov ecx, eax
mov rcx, qword gs:[rcx]
mov qword [rsp + 0x88], rcx
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x70], rcx
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x18]
add rcx, 0x10
mov qword [rsp + 0x68], rcx
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx]
mov qword [rsp + 0x60], rcx
mov rax, qword [rsp + 0x60]
cmp rax, qword [rsp + 0x68]
je 0x2fc4cd5a7
mov eax, dword [0x2fc4f5174]
mov ecx, dword [0x2fc4f5180]
mov edx, eax
sub edx, 0xa898ad31
sub edx, 0x130cf6fb
add edx, 0xa898ad31
sub edx, 0xe7647684
sub edx, 1
add edx, 0xe7647684
sub edx, 0x51d420bf
add edx, 0x130cf6fb
add edx, 0x51d420bf
imul eax, edx
and eax, 1
cmp eax, 0
sete r8b
cmp ecx, 0xa
setl r9b
mov r10b, r9b
xor r10b, 0xff
mov r11b, r8b
xor r11b, r10b
and r11b, r8b
mov r10b, r8b
xor r10b, 0xff
and r10b, 1
mov bl, 1
xor bl, 1
and r8b, bl
mov sil, r9b
xor sil, 0xff
and sil, 0xff
and r9b, bl
or r10b, r8b
or sil, r9b
xor r10b, sil
mov r8b, r11b
and r8b, r10b
xor r11b, r10b
or r8b, r11b
test r8b, 1
jne 0x2fc4cd171
jmp 0x2fc4cd757
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x60]
mov rdx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x50], rcx
mov rcx, rax
mov qword [rsp + 0x48], rdx
call sym.StrLen
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov r8, rax
call sym.W2Anicmp
xor r9d, r9d
cmp eax, 0
sete r10b
mov eax, dword [0x2fc4f5174]
mov r11d, dword [0x2fc4f5180]
mov esi, r9d
sub esi, 0x3da5db56
mov edi, eax
add edi, esi
sub edi, 0x5a7e80dd
sub edi, 1
add edi, 0x5a7e80dd
mov esi, r9d
sub esi, edi
mov edi, r9d
sub edi, 0x3da5db56
add esi, edi
sub r9d, esi
imul eax, r9d
and eax, 1
cmp eax, 0
sete bl
cmp r11d, 0xa
setl bpl
mov r14b, bl
xor r14b, 0xff
mov r15b, bpl
xor r15b, 0xff
mov r12b, 1
xor r12b, 1
or r14b, r15b
or r12b, 1
xor r14b, 0xff
and r14b, r12b
mov r15b, bl
xor r15b, 0xff
mov r12b, bpl
and r12b, r15b
xor bpl, 0xff
and bl, bpl
or r12b, bl
mov bl, r14b
and bl, r12b
xor r14b, r12b
or bl, r14b
test bl, 1
mov byte [rsp + 0x47], r10b
jne 0x2fc4cd266
jmp 0x2fc4cd757
xor eax, eax
mov ecx, dword [0x2fc4f5174]
mov edx, dword [0x2fc4f5180]
mov r8d, eax
sub r8d, 0x347c7518
sub r8d, 1
add r8d, 0x347c7518
mov r9d, eax
sub r9d, ecx
mov r10d, eax
sub r10d, r8d
add r9d, r10d
sub eax, r9d
imul ecx, eax
and ecx, 1
cmp ecx, 0
sete r11b
cmp edx, 0xa
setl bl
mov sil, r11b
xor sil, 0xff
mov dil, bl
xor dil, 0xff
mov bpl, 1
mov r14b, bpl
xor r14b, 1
or sil, dil
or r14b, 1
xor sil, 0xff
and sil, r14b
mov dil, r11b
xor dil, 0xff
mov r14b, bl
and r14b, dil
xor bl, 0xff
and r11b, bl
or r14b, r11b
mov r11b, sil
xor r11b, 0xff
mov bl, r14b
xor bl, 0xff
xor bpl, 1
mov dil, r11b
and dil, 0xff
and sil, bpl
mov r15b, bl
and r15b, 0xff
and r14b, bpl
or dil, sil
or r15b, r14b
xor dil, r15b
or r11b, bl
xor r11b, 0xff
or bpl, 1
and r11b, bpl
or dil, r11b
test dil, 1
jne 0x2fc4cd338
jmp 0x2fc4cda9c
mov eax, dword [0x2fc4f5174]
mov ecx, dword [0x2fc4f5180]
mov edx, 0x9e237415
add edx, 0
sub edx, 1
sub edx, 0x9e237415
mov r8d, eax
add r8d, 0x36e9515e
add r8d, edx
sub r8d, 0x36e9515e
imul eax, r8d
and eax, 1
cmp eax, 0
sete r9b
cmp ecx, 0xa
setl r10b
mov r11b, r10b
xor r11b, 0xff
mov bl, r9b
xor bl, r11b
and bl, r9b
mov r11b, r9b
xor r11b, 0xff
and r11b, 1
mov sil, 1
mov dil, sil
xor dil, 1
and r9b, dil
mov bpl, r10b
xor bpl, 0xff
and bpl, 0xff
and r10b, dil
or r11b, r9b
or bpl, r10b
xor r11b, bpl
mov r9b, bl
xor r9b, 0xff
mov r10b, r11b
xor r10b, 0xff
xor sil, 0
mov dil, r9b
and dil, 0
and bl, sil
mov bpl, r10b
and bpl, 0
and r11b, sil
or dil, bl
or bpl, r11b
xor dil, bpl
or r9b, r10b
xor r9b, 0xff
or sil, 0
and r9b, sil
or dil, r9b
test dil, 1
jne 0x2fc4cd40c
jmp 0x2fc4cda9c
mov al, byte [rsp + 0x47]
test al, 1
jne 0x2fc4cd41d
jmp 0x2fc4cd595
xor eax, eax
mov ecx, dword [0x2fc4f5174]
mov edx, dword [0x2fc4f5180]
sub eax, 0xd66aba96
mov r8d, ecx
add r8d, eax
add r8d, 0x5ba13bf8
sub r8d, 1
sub r8d, 0x5ba13bf8
sub r8d, 0xdb618dd4
add r8d, 0xd66aba96
add r8d, 0xdb618dd4
imul ecx, r8d
and ecx, 1
cmp ecx, 0
sete r9b
cmp edx, 0xa
setl r10b
mov r11b, r10b
xor r11b, 0xff
mov bl, r9b
xor bl, r11b
and bl, r9b
mov r11b, r9b
xor r11b, 0xff
and r11b, 0
mov sil, 1
mov dil, sil
xor dil, 0
and r9b, dil
mov bpl, r10b
xor bpl, 0xff
and bpl, 0
and r10b, dil
or r11b, r9b
or bpl, r10b
xor r11b, bpl
mov r9b, bl
xor r9b, 0xff
mov r10b, r11b
xor r10b, 0xff
xor sil, 0
mov dil, r9b
and dil, 0
and bl, sil
mov bpl, r10b
and bpl, 0
and r11b, sil
or dil, bl
or bpl, r11b
xor dil, bpl
or r9b, r10b
xor r9b, 0xff
or sil, 0
and r9b, sil
or dil, r9b
test dil, 1
jne 0x2fc4cd500
jmp 0x2fc4cdaa1
xor eax, eax
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx + 0x30]
mov qword [rsp + 0x80], rcx
mov edx, dword [0x2fc4f5174]
mov r8d, dword [0x2fc4f5180]
sub eax, 1
add eax, 0
mov r9d, edx
sub r9d, 0x2b6d5f92
add r9d, eax
add r9d, 0x2b6d5f92
imul edx, r9d
and edx, 1
cmp edx, 0
sete r10b
cmp r8d, 0xa
setl r11b
mov bl, r11b
xor bl, 0xff
mov sil, r10b
xor sil, bl
and sil, r10b
mov bl, r10b
xor bl, 0xff
mov dil, r11b
and dil, bl
xor r11b, 0xff
and r10b, r11b
or dil, r10b
mov r10b, sil
and r10b, dil
xor sil, dil
or r10b, sil
test r10b, 1
jne 0x2fc4cd590
jmp 0x2fc4cdaa1
jmp 0x2fc4cd73b
mov rax, qword [rsp + 0x60]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
jmp 0x2fc4cd0b7
xor eax, eax
mov ecx, dword [0x2fc4f5174]
mov edx, dword [0x2fc4f5180]
mov r8d, eax
sub r8d, 1
add r8d, 0
mov r9d, eax
sub r9d, ecx
mov r10d, eax
sub r10d, r8d
add r9d, r10d
sub eax, r9d
imul ecx, eax
and ecx, 1
cmp ecx, 0
sete r11b
cmp edx, 0xa
setl bl
mov sil, bl
xor sil, 0xff
mov dil, r11b
xor dil, sil
and dil, r11b
mov sil, r11b
xor sil, 0xff
mov bpl, bl
and bpl, sil
xor bl, 0xff
and r11b, bl
or bpl, r11b
mov r11b, dil
xor r11b, 0xff
mov bl, bpl
xor bl, 0xff
mov sil, 1
xor sil, 0
mov r14b, r11b
and r14b, 0
and dil, sil
mov r15b, bl
and r15b, 0
and bpl, sil
or r14b, dil
or r15b, bpl
xor r14b, r15b
or r11b, bl
xor r11b, 0xff
or sil, 0
and r11b, sil
or r14b, r11b
test r14b, 1
jne 0x2fc4cd65c
jmp 0x2fc4cdab7
mov qword [rsp + 0x80], 0
mov eax, dword [0x2fc4f5174]
mov ecx, dword [0x2fc4f5180]
mov edx, eax
sub edx, 0x4db9faf0
add edx, 0x93d3e7b
add edx, 0x4db9faf0
sub edx, 0x39bb4da5
sub edx, 1
add edx, 0x39bb4da5
sub edx, 0x88ae1975
sub edx, 0x93d3e7b
add edx, 0x88ae1975
imul eax, edx
and eax, 1
cmp eax, 0
sete r8b
cmp ecx, 0xa
setl r9b
mov r10b, r9b
xor r10b, 0xff
mov r11b, r8b
xor r11b, r10b
and r11b, r8b
mov r10b, r8b
xor r10b, 0xff
mov bl, r9b
and bl, r10b
xor r9b, 0xff
and r8b, r9b
or bl, r8b
mov r8b, r11b
xor r8b, 0xff
mov r9b, bl
xor r9b, 0xff
mov r10b, 1
xor r10b, 0
mov sil, r8b
and sil, 0
and r11b, r10b
mov dil, r9b
and dil, 0
and bl, r10b
or sil, r11b
or dil, bl
xor sil, dil
or r8b, r9b
xor r8b, 0xff
or r10b, 0
and r8b, r10b
or sil, r8b
test sil, 1
jne 0x2fc4cd736
jmp 0x2fc4cdab7
jmp 0x2fc4cd73b
mov rax, qword [rsp + 0x80]
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [0x2fc4f5174]
mov ecx, dword [0x2fc4f5180]
mov edx, 0x8cc97aa3
add edx, 0
sub edx, 1
sub edx, 0x8cc97aa3
mov r8d, eax
sub r8d, 0xe9d25541
add r8d, edx
add r8d, 0xe9d25541
imul eax, r8d
and eax, 1
cmp eax, 0
sete r9b
cmp ecx, 0xa
setl r10b
mov r11b, r10b
xor r11b, 0xff
mov bl, r9b
xor bl, r11b
and bl, r9b
mov r11b, r9b
xor r11b, 0xff
mov sil, r10b
and sil, r11b
xor r10b, 0xff
and r9b, r10b
or sil, r9b
mov r9b, bl
xor r9b, 0xff
mov r10b, sil
xor r10b, 0xff
mov r11b, 1
xor r11b, 1
mov dil, r9b
and dil, 0xff
and bl, r11b
mov bpl, r10b
and bpl, 0xff
and sil, r11b
or dil, bl
or bpl, sil
xor dil, bpl
or r9b, r10b
xor r9b, 0xff
or r11b, 1
and r9b, r11b
or dil, r9b
test dil, 1
jne 0x2fc4cd816
jmp 0x2fc4cdac8
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x60]
mov rdx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x38], rcx
mov rcx, rax
mov qword [rsp + 0x30], rdx
call sym.StrLen
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov r8, rax
call sym.W2Anicmp
xor r9d, r9d
mov r10d, dword [0x2fc4f5174]
mov r11d, dword [0x2fc4f5180]
mov esi, 0x37daaa05
add esi, 0
sub esi, 1
sub esi, 0x37daaa05
sub r9d, esi
mov esi, r10d
sub esi, r9d
imul r10d, esi
and r10d, 1
cmp r10d, 0
sete bl
cmp r11d, 0xa
setl dil
mov bpl, bl
xor bpl, 0xff
and bpl, 1
mov r14b, 1
mov r15b, r14b
xor r15b, 1
mov r12b, bl
and r12b, r15b
mov r13b, r14b
xor r13b, 1
and r13b, 0xff
and r15b, 1
or bpl, r12b
or r13b, r15b
xor bpl, r13b
mov r15b, dil
xor r15b, 0xff
and r15b, 1
mov r12b, r14b
xor r12b, 1
mov r13b, dil
and r13b, r12b
or r15b, r13b
mov r12b, r14b
xor r12b, 1
and r12b, 1
mov r13b, r14b
xor r13b, 1
and r13b, 1
or r12b, r13b
mov r13b, bpl
xor r13b, 0xff
mov cl, r14b
xor cl, 1
mov dl, r14b
xor dl, 0
or r13b, cl
or dl, 0
xor r13b, 0xff
and r13b, dl
mov cl, r12b
xor cl, 0xff
mov dl, bl
xor dl, cl
and dl, bl
mov cl, r14b
xor cl, 1
mov bl, r15b
xor bl, cl
and bl, r15b
mov cl, r12b
xor cl, 0xff
mov r8b, dil
xor r8b, cl
and r8b, dil
mov cl, r13b
xor cl, 0xff
mov dil, dl
xor dil, 0xff
mov r9b, r14b
xor r9b, 0
mov r10b, cl
and r10b, 0
and r13b, r9b
mov r11b, dil
and r11b, 0
and dl, r9b
or r10b, r13b
or r11b, dl
xor r10b, r11b
or cl, dil
xor cl, 0xff
or r9b, 0
and cl, r9b
or r10b, cl
mov cl, bl
and cl, r8b
xor bl, r8b
or cl, bl
mov dl, r10b
xor dl, 0xff
and dl, 0
mov r8b, r14b
xor r8b, 0
and r10b, r8b
mov r9b, cl
xor r9b, 0xff
and r9b, 0
and cl, r8b
or dl, r10b
or r9b, cl
xor dl, r9b
mov cl, bpl
and cl, r15b
xor bpl, r15b
or cl, bpl
mov r8b, cl
xor r8b, 0xff
and r8b, 1
mov r9b, r14b
xor r9b, 1
and cl, r9b
mov r10b, r14b
xor r10b, 1
and r10b, 0xff
and r9b, 1
or r8b, cl
or r10b, r9b
xor r8b, r10b
mov cl, r14b
xor cl, 1
mov r9b, r12b
xor r9b, 0xff
mov r10b, r14b
xor r10b, 1
mov r11b, cl
and r11b, 0xff
mov bl, r10b
and bl, 1
mov dil, r9b
and dil, 0xff
and r12b, r10b
or r11b, bl
or dil, r12b
xor r11b, dil
or cl, r9b
xor cl, 0xff
or r10b, 1
and cl, r10b
or r11b, cl
xor r11b, 0xff
mov cl, r8b
xor cl, r11b
and cl, r8b
mov r8b, dl
xor r8b, 0xff
mov r9b, cl
xor r9b, 0xff
xor r14b, 0
mov r10b, r8b
and r10b, 0
and dl, r14b
mov r11b, r9b
and r11b, 0
and cl, r14b
or r10b, dl
or r11b, cl
xor r10b, r11b
or r8b, r9b
xor r8b, 0xff
or r14b, 0
and r8b, r14b
or r10b, r8b
test r10b, 1
jne 0x2fc4cda97
jmp 0x2fc4cdac8
jmp 0x2fc4cd171
jmp 0x2fc4cd338
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x80], rax
jmp 0x2fc4cd500
mov qword [rsp + 0x80], 0
jmp 0x2fc4cd65c
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x60]
mov rdx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov rcx, rax
mov qword [rsp + 0x20], rdx
call sym.StrLen
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov r8, rax
call sym.W2Anicmp
jmp 0x2fc4cd816