Function at 0x14000d558
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x160
mov rax, qword [0x14002d008]
xor rax, rsp
mov qword [rsp + 0x158], rax
mov rbx, r8
mov qword [rsp + 0x40], rbx
mov r13, rcx
mov qword [rsp + 0xc8], rcx
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xa0], rbx
xor r14d, r14d
xor r15d, r15d
and qword [rsp + 0x78], r14
mov rax, qword [rcx]
xor r9d, r9d
lea r8d, [r14 + 0x1c]
lea rdx, [rsp + 0x100]
mov rax, qword [rax + 0x18]
call qword [case.0x140016d37.0]
mov esi, eax
test eax, eax
jne 0x14000e02b
mov ecx, 0xfeff
cmp word [rsp + 0x100], cx
sete al
mov dword [reloc.AppVIsvSubsystems64.dll_Ordinal_1], eax
jne 0x14000d61a
mov ecx, dword [rsp + 0x118]
mov edx, ecx
shr edx, 8
mov eax, ecx
shl eax, 8
xor edx, eax
and edx, 0xff00ff
shl ecx, 8
xor edx, ecx
rol edx, 0x10
mov dword [rsp + 0x118], edx
jmp 0x14000d621
mov edx, dword [rsp + 0x118]
test edx, edx
je 0x14000d8e6
lea ecx, [rdx + rdx*4]
shl ecx, 2
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r12, rax
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x14000d650
mov r14d, 0x80004005
mov r15, rax
jmp 0x14000d8e6
mov ecx, dword [rsp + 0x118]
test ecx, ecx
je 0x14000d716
lea rbx, [rax + 6]
mov rax, qword [r13]
lea r12, [rbx - 6]
xor r9d, r9d
lea r8d, [r9 + 0x14]
mov rdx, r12
mov rcx, r13
mov rax, qword [rax + 0x18]
call qword [case.0x140016d37.0]
mov esi, eax
test eax, eax
jne 0x14000e026
mov r8d, dword [reloc.AppVIsvSubsystems64.dll_Ordinal_1]
test r8d, r8d
je 0x14000d6d0
mov ecx, dword [r12]
mov edx, ecx
shr edx, 8
mov eax, ecx
shl eax, 8
xor edx, eax
and edx, 0xff00ff
shl ecx, 8
xor edx, ecx
rol edx, 0x10
mov dword [r12], edx
movzx eax, word [rbx - 2]
rol ax, 8
mov word [rbx - 2], ax
movzx eax, word [rbx]
rol ax, 8
mov word [rbx], ax
mov edx, dword [rbx + 0xa]
mov ecx, edx
test r8d, r8d
je 0x14000d6f2
shr ecx, 8
mov eax, edx
shl eax, 8
xor ecx, eax
and ecx, 0xff00ff
shl edx, 8
xor ecx, edx
rol ecx, 0x10
mov dword [rbx + 0xa], ecx
inc r15d
add rbx, 0x14
mov ecx, dword [rsp + 0x118]
cmp r15d, ecx
jb 0x14000d663
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x30]
mov rdx, r12
xor r8d, r8d
mov r10, qword [rsp + 0x198]
add r10, 8
mov qword [rsp + 0x70], r10
test ecx, ecx
je 0x14000d760
mov r9, qword [r10]
dec ecx
mov dword [rsp + 0x118], ecx
mov rax, qword [r9]
cmp rax, qword [rdx]
jne 0x14000d753
mov rax, qword [r9 + 8]
cmp rax, qword [rdx + 8]
je 0x14000d892
add rdx, 0x14
test ecx, ecx
jne 0x14000d734
mov qword [rsp + 0x70], r10
dec ecx
mov dword [rsp + 0x118], ecx
mov qword [rsp + 0xc0], r10
test r8d, r8d
je 0x14000d8e1
mov rcx, qword [r10]
mov rax, qword [rcx]
sub rax, qword [0x140025d58]
jne 0x14000d794
mov rax, qword [rcx + 8]
sub rax, qword [0x140025d60]
xor r8d, r8d
test rax, rax
sete r8b
mov dword [rsp + 0x60], r8d
mov dword [rsp + 0x8c], r8d
mov rax, qword [rcx]
sub rax, qword [0x140025d68]
jne 0x14000d7c2
mov rax, qword [rcx + 8]
sub rax, qword [0x140025d70]
xor ecx, ecx
test rax, rax
sete cl
mov dword [rsp + 0x5c], ecx
mov dword [rsp + 0x88], ecx
lea rax, [rdx + 0x10]
mov qword [rsp + 0x98], rax
mov ecx, dword [rax]
mov eax, ecx
sar eax, 0x1f
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0x68], ecx
mov rax, qword [r13]
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rcx, r13
mov rax, qword [rax + 0x28]
call qword [case.0x140016d37.0]
mov esi, eax
test eax, eax
jne 0x14000e026
mov rax, qword [r13]
xor r9d, r9d
lea r8d, [rsi + 8]
lea rdx, [rsp + 0x38]
mov rcx, r13
mov rax, qword [rax + 0x18]
call qword [case.0x140016d37.0]
mov esi, eax
test eax, eax
jne 0x14000e026
mov r12d, 0xff00ff
cmp dword [reloc.AppVIsvSubsystems64.dll_Ordinal_1], r14d
je 0x14000d89d
mov ecx, dword [rsp + 0x3c]
mov r8d, ecx
shr r8d, 8
mov eax, ecx
shl eax, 8
xor r8d, eax
and r8d, r12d
shl ecx, 8
xor r8d, ecx
rol r8d, 0x10
mov dword [rsp + 0x3c], r8d
mov ecx, dword [rsp + 0x38]
mov edx, ecx
shr edx, 8
mov eax, ecx
shl eax, 8
xor edx, eax
and edx, r12d
shl ecx, 8
xor edx, ecx
rol edx, 0x10
mov dword [rsp + 0x38], edx
jmp 0x14000d8a2
mov r8d, 1
jmp 0x14000d769
mov r8d, dword [rsp + 0x3c]
test r8d, r8d
je 0x14000d8e1
mov edx, r8d
mov rcx, rbx
call fcn.14000cf84
mov r14d, eax
test eax, eax
jne 0x14000d8e1
mov ecx, dword [rsp + 0x3c]
shl ecx, 3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0xa8], rax
mov rbx, rax
test rax, rax
jne 0x14000d926
mov r14d, 0x80004005
mov r15, qword [rsp + 0x30]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, r14d
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.14001f240
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x160
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
xor r15d, r15d
cmp dword [rsp + 0x3c], r15d
jbe 0x14000d9b5
mov rax, qword [r13]
xor r9d, r9d
lea r8d, [r9 + 8]
mov rdx, rbx
mov rcx, r13
mov rax, qword [rax + 0x18]
call qword [case.0x140016d37.0]
mov esi, eax
test eax, eax
jne 0x14000e026
mov edx, dword [rbx]
mov r8d, dword [reloc.AppVIsvSubsystems64.dll_Ordinal_1]
mov ecx, edx
test r8d, r8d
je 0x14000d97e
shr ecx, 8
mov eax, edx
shl eax, 8
xor ecx, eax
and ecx, r12d
shl edx, 8
xor ecx, edx
rol ecx, 0x10
mov dword [rbx], ecx
mov edx, dword [rbx + 4]
mov ecx, edx
test r8d, r8d
je 0x14000d99f
shr ecx, 8
mov eax, edx
shl eax, 8
xor ecx, eax
and ecx, r12d
shl edx, 8
xor ecx, edx
rol ecx, 0x10
mov dword [rbx + 4], ecx
inc r15d
add rbx, 8
cmp r15d, dword [rsp + 0x3c]
jb 0x14000d934
mov rax, qword [rsp + 0x78]
mov r12, rax
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x198]
lea rcx, [rdx + 0x18]
mov qword [rsp + 0x90], rcx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x98]
cmp qword [rcx], 0
jne 0x14000da16
mov qword [rsp + 0x20], rbx
mov r9, rax
mov r8d, dword [rsp + 0x3c]
mov edx, dword [rsi]
mov rcx, r13
call fcn.14000cd80
mov r14d, eax
test eax, eax
jne 0x14000d8e1
mov rdx, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x90]
mov eax, dword [rsp + 0x3c]
dec dword [rsp + 0x3c]
test eax, eax
je 0x14000d8e1
mov eax, dword [r12]
cmp eax, 2
jb 0x14000e010
cmp qword [rcx], 0
je 0x14000da42
cmp eax, dword [rdx + 0x10]
jge 0x14000e010
cmp dword [rsp + 0x5c], 0
je 0x14000da54
test eax, 0x11000000
jne 0x14000e010
mov edx, dword [r12 + 4]
add edx, dword [rsi]
mov eax, edx
sar eax, 0x1f
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0x68], edx
mov rax, qword [r13]
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rcx, r13
mov rax, qword [rax + 0x28]
call qword [case.0x140016d37.0]
mov esi, eax
test eax, eax
jne 0x14000e026
cmp dword [rsp + 0x60], eax
je 0x14000dab2
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax]
cmp dword [r12], 0xc
jne 0x14000daa8
mov dword [rbx + 0x34], eax
cmp dword [r12], 0x12
jne 0x14000dab2
mov dword [rbx + 0x30], eax
mov edx, dword [rbx]
lea rcx, [rdx + rdx*2]
mov rax, qword [rbx + 8]
lea r15, [rax + rcx*8]
mov qword [rsp + 0xb0], r15
mov rax, qword [rbx + 0x10]
mov rcx, qword [rax + rdx*8]
lea eax, [rdx + 1]
mov dword [rbx], eax
mov r9d, dword [r12]
mov eax, dword [rbx + 0x20]
mov rdx, qword [rbx + 0x28]
lea r8, [0x140023528]
mov qword [rcx], r8
mov dword [rcx + 8], 1
mov r8, qword [rsp + 0x90]
mov r8, qword [r8]
test r8, r8
je 0x14000db1a
mov eax, r9d
add rax, rax
mov rax, qword [r8 + rax*8 + 8]
mov qword [rcx + 0x10], rax
xor r14d, r14d
mov dword [rsp + 0x58], r14d
jmp 0x14000db5e
and qword [rcx + 0x10], 0
jmp 0x14000db2c
dec eax
cmp dword [rdx], r9d
je 0x14000db32
add rdx, 0x10
test eax, eax
jne 0x14000db21
jmp 0x14000db3a
mov rax, qword [rdx + 8]
mov qword [rcx + 0x10], rax
mov rax, qword [rcx + 0x10]
neg rax
sbb r14d, r14d
not r14d
and r14d, 0x80004005
mov dword [rsp + 0x58], r14d
cmp qword [rcx + 0x10], 0
je 0x14000d8e1
mov rax, qword [r13]
xor r9d, r9d
lea r8d, [r9 + 4]
lea rdx, [rsp + 0x48]
mov rcx, r13
mov rax, qword [rax + 0x18]
call qword [case.0x140016d37.0]
mov esi, eax
test eax, eax
jne 0x14000e026
mov ebx, 0xff00ff
cmp dword [reloc.AppVIsvSubsystems64.dll_Ordinal_1], eax
je 0x14000dbb2
mov ecx, dword [rsp + 0x48]
mov edx, ecx
shr edx, 8
mov eax, ecx
shl eax, 8
xor edx, eax
and edx, ebx
shl ecx, 8
xor edx, ecx
rol edx, 0x10
mov dword [rsp + 0x48], edx
jmp 0x14000dbb6
mov edx, dword [rsp + 0x48]
cmp edx, 0x1e
ja 0x14000dd56
je 0x14000dcde
sub edx, 3
je 0x14000dc86
sub edx, 1
je 0x14000dc5d
sub edx, 1
je 0x14000dc33
sub edx, 2
je 0x14000dc33
sub edx, 1
je 0x14000dcde
cmp edx, 3
jne 0x14000dd72
mov rax, qword [r13]
lea rbx, [r15 + 8]
xor r9d, r9d
lea r8d, [rdx - 1]
mov rdx, rbx
mov rcx, r13
mov rax, qword [rax + 0x18]
call qword [case.0x140016d37.0]
mov esi, eax
movzx eax, word [rbx]
cmp dword [reloc.AppVIsvSubsystems64.dll_Ordinal_1], 0
je 0x14000dc24
rol ax, 8
mov word [rbx], ax
mov dword [r15], 0xb
jmp 0x14000e007
mov rax, qword [r13]
lea rdx, [r15 + 8]
xor r9d, r9d
lea r8d, [r9 + 8]
mov rcx, r13
mov rax, qword [rax + 0x18]
call qword [case.0x140016d37.0]
mov esi, eax
mov dword [r15], 5
jmp 0x14000e007
mov rax, qword [r13]
lea rdx, [r15 + 8]
xor r9d, r9d
lea ebx, [r9 + 4]
mov r8d, ebx
mov rcx, r13
mov rax, qword [rax + 0x18]
call qword [case.0x140016d37.0]
mov esi, eax
mov dword [r15], ebx
jmp 0x14000e007
mov rax, qword [r13]
lea rbx, [r15 + 8]
xor r9d, r9d
lea r8d, [r9 + 4]
mov rdx, rbx
mov rcx, r13
mov rax, qword [rax + 0x18]
call qword [case.0x140016d37.0]
mov esi, eax
cmp dword [reloc.AppVIsvSubsystems64.dll_Ordinal_1], 0
je 0x14000dcce
mov ecx, dword [rbx]
mov edx, ecx
shr edx, 8
mov eax, ecx
shl eax, 8
xor edx, eax
and edx, 0xff00ff
shl ecx, 8
xor edx, ecx
rol edx, 0x10
jmp 0x14000dcd0
mov edx, dword [rbx]
mov dword [rbx], edx
mov dword [r15], 3
jmp 0x14000e007
lea rdx, [r15 + 8]
mov rcx, r13
call fcn.14000c5e8
mov r14d, eax
test eax, eax
jne 0x14000d8e1
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
mov rax, qword [rcx]
cmp rax, qword [0x140025d58]
jne 0x14000dd4a
mov rax, qword [rcx + 8]
cmp rax, qword [0x140025d60]
jne 0x14000dd4a
cmp dword [r12], 5
jne 0x14000dd4a
mov rbx, qword [r15 + 8]
mov dword [r15], 0x101e
mov rcx, r15
call fcn.14000d2d4
mov r14d, eax
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test r14d, r14d
jne 0x14000d8e1
jmp 0x14000e00b
mov dword [r15], 0x1e
jmp 0x14000e00b
sub edx, 0x40
je 0x14000ddd1
sub edx, 7
je 0x14000ddc3
sub edx, 0xfc1
je 0x14000dda1
sub edx, 4
je 0x14000dd7e
cmp edx, 0x12
je 0x14000dda1
mov rbx, qword [rsp + 0x40]
dec dword [rbx]
jmp 0x14000e010
lea rdx, [r15 + 8]
mov rcx, r13
call fcn.14000cba0
test eax, eax
mov r14d, eax
jne 0x14000d8e1
mov dword [r15], 0x102
jmp 0x14000e00b
mov rdx, r15
mov rcx, r13
call fcn.14000cc94
mov r14d, eax
test eax, eax
jne 0x14000d8e1
mov dword [r15], 0x101e
jmp 0x14000e00b
lea rdx, [r15 + 8]
mov rcx, r13
call fcn.14000c6bc
jmp 0x14000dd8a
mov rax, qword [r13]
lea r12, [r15 + 8]
mov qword [rsp + 0xb8], r12
xor r9d, r9d
lea r8d, [r9 + 8]
mov rdx, r12
mov rcx, r13
mov rax, qword [rax + 0x18]
call qword [case.0x140016d37.0]
mov esi, eax
mov dword [rsp + 0x80], eax
mov r8d, dword [reloc.AppVIsvSubsystems64.dll_Ordinal_1]
test r8d, r8d
je 0x14000de29
mov ecx, dword [r12]
mov edx, ecx
shr edx, 8
mov eax, ecx
shl eax, 8
xor edx, eax
and edx, ebx
shl ecx, 8
xor edx, ecx
rol edx, 0x10
jmp 0x14000de2d
mov edx, dword [r12]
mov dword [r12], edx
mov edx, dword [r15 + 0xc]
mov ecx, edx
test r8d, r8d
je 0x14000de50
shr ecx, 8
mov eax, edx
shl eax, 8
xor ecx, eax
and ecx, ebx
shl edx, 8
xor ecx, edx
rol ecx, 0x10
mov dword [r15 + 0xc], ecx
mov dword [r15], 0x40
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
mov rax, qword [rcx]
cmp rax, qword [0x140025d58]
jne 0x14000dffd
mov rax, qword [rcx + 8]
cmp rax, qword [0x140025d60]
jne 0x14000dffd
mov rax, qword [rsp + 0x50]
cmp dword [rax], 0xa
jne 0x14000e004
lea rcx, [rsp + 0xd8]
call fcn.140012e08
nop
mov rcx, qword [r12]
call fcn.14000d20c
mov ecx, eax
mov eax, 0x88888889
mul ecx
mov ebx, edx
shr ebx, 5
mov dword [rsp + 0x84], ebx
lea rcx, [rsp + 0xf0]
call fcn.140013150
mov edx, 0x893d
lea rcx, [rsp + 0xd8]
call fcn.1400136e8
jmp 0x14000df47
call fcn.140013178
mov r8, qword [rsp + 0xd8]
test r8, r8
je 0x14000dff0
mov r9d, ebx
mov edx, 0x32
lea rcx, [rsp + 0x120]
call fcn.1400019d8
lea rcx, [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov ebx, eax
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdx, rax
mov qword [r12], rax
test rax, rax
je 0x14000dfe9
lea rcx, [rbx - 1]
cmp rcx, 0x7ffffffe
ja 0x14000dfe1
mov ecx, 0x7ffffffe
sub rcx, rbx
lea r8, [rsp + 0x120]
sub r8, rax
lea rax, [rcx + rbx]
test rax, rax
je 0x14000dfd4
mov al, byte [r8 + rdx]
test al, al
je 0x14000dfd4
mov byte [rdx], al
inc rdx
sub rbx, 1
jne 0x14000dfb8
lea rax, [rdx - 1]
test rbx, rbx
cmovne rax, rdx
jmp 0x14000dfe6
test rbx, rbx
je 0x14000dfe9
mov byte [rax], 0
mov dword [r15], 0x1e
lea rcx, [rsp + 0xd8]
call fcn.140012e90
mov r12, qword [rsp + 0x50]
jmp 0x14000e007
mov r12, rax
test esi, esi
jne 0x14000e026
mov rbx, qword [rsp + 0x40]
add r12, 8
mov qword [rsp + 0x50], r12
mov rsi, qword [rsp + 0x98]
jmp 0x14000da06
mov r15, qword [rsp + 0x30]
mov r14d, esi
jmp 0x14000d8e6