Function at 0x1400041a3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
mov qword [rsp + 0xa8], r8
mov edi, edx
mov rbx, rcx
mov eax, 0x93bedab6
cmp eax, 0xeb1a8bd3
jle 0x140004225
cmp eax, 0x1fe7397c
jle 0x14000427a
cmp eax, 0x525ec7a7
jg 0x14000433a
cmp eax, 0x2d878312
jg 0x140004492
cmp eax, 0x1fe7397d
je 0x140004683
cmp eax, 0x25b8ef86
je 0x1400046ab
cmp eax, 0x2b0fba13
jne 0x1400041c8
mov rax, qword [rsp + 0x70]
add rax, 0x20
mov qword [rsp + 0xc8], rax
mov eax, 0x671506ac
jmp 0x1400041c8
cmp eax, 0xba6ece09
jle 0x1400042c8
cmp eax, 0xdbb07676
jg 0x140004381
cmp eax, 0xc2e06646
jg 0x1400044ef
cmp eax, 0xba6ece0a
je 0x1400046c2
cmp eax, 0xbc08751b
je 0x1400046d1
cmp eax, 0xc05d0c0a
jne 0x1400041c8
mov eax, 0xf1290683
mov esi, 4
mov ebp, dword [rsp + 0x24]
jmp 0x1400041c8
cmp eax, 0x1359e8a0
jle 0x1400043cc
cmp eax, 0x1bad6799
jg 0x140004542
cmp eax, 0x1359e8a1
je 0x1400046e8
cmp eax, 0x143e3073
je 0x140004714
cmp eax, 0x14ec5f47
jne 0x1400041c8
cmp byte [rsp + 0x23], 0
mov eax, 0xba69d66a
mov ecx, 0x2d878313
cmovne eax, ecx
jmp 0x1400041c8
cmp eax, 0x9155de38
jle 0x140004415
cmp eax, 0x9d0a8bf1
jg 0x14000457a
cmp eax, 0x9155de39
je 0x14000472b
cmp eax, 0x9284ee61
je 0x14000473d
cmp eax, 0x93bedab6
jne 0x1400041c8
movsxd rax, dword [rbx + 0x3c]
add rax, rbx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov ecx, 0x88
add rax, rcx
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xb0], rax
mov eax, 0x8d175987
jmp 0x1400041c8
cmp eax, 0x671506ab
jg 0x1400045bd
cmp eax, 0x525ec7a8
je 0x14000474f
cmp eax, 0x5bd283bb
je 0x140004783
cmp eax, 0x66db8a81
jne 0x1400041c8
mov rax, qword [rsp + 0xe8]
mov eax, dword [rax]
mov dword [rsp + 0x84], eax
mov eax, 0x525ec7a8
jmp 0x1400041c8
cmp eax, 0xe45c65ed
jg 0x1400045f7
cmp eax, 0xdbb07677
je 0x14000479c
cmp eax, 0xe03de04d
je 0x1400047b9
cmp eax, 0xe1d30e4c
jne 0x1400041c8
cmp dword [rsp + 0x5c], 0
mov eax, 0x2b0fba13
mov ecx, 0xba6ece0a
cmove eax, ecx
mov dword [rsp + 0x4c], 0
jmp 0x1400041c8
cmp eax, 0xb406ad
jg 0x14000462a
cmp eax, 0xeb1a8bd4
je 0x1400047d3
cmp eax, 0xecb7a278
je 0x1400047ed
cmp eax, 0xf1290683
jne 0x1400041c8
test esi, esi
mov eax, 0x844f4d43
mov ecx, 0x812f312d
cmove eax, ecx
mov r13d, ebp
mov r14d, esi
mov r12d, ebp
jmp 0x1400041c8
cmp eax, 0x84dde099
jle 0x140004659
cmp eax, 0x84dde09a
je 0x140004813
cmp eax, 0x88eb3df7
je 0x140004822
cmp eax, 0x8d175987
jne 0x1400041c8
mov rax, qword [rsp + 0xb0]
mov eax, dword [rax]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 4]
mov dword [rsp + 0x78], eax
mov rcx, qword [rsp + 0x28]
mov edx, dword [rsp + 0x30]
mov r8d, edi
call fcn.140003ecb
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
mov eax, 0x72f3853f
mov ecx, 0x12ee9945
cmove eax, ecx
mov dword [rsp + 0x3c], 0
jmp 0x1400041c8
cmp eax, 0x2d878313
je 0x14000482c
cmp eax, 0x399a3d63
je 0x14000483c
cmp eax, 0x4a5a42eb
jne 0x1400041c8
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xa0]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0xd8]
mov eax, dword [rcx + rax*4]
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
cmp ecx, eax
setae byte [rsp + 0x21]
mov eax, 0x25b8ef86
jmp 0x1400041c8
cmp eax, 0xc2e06647
je 0x140004852
cmp eax, 0xce25c2af
je 0x14000486b
cmp eax, 0xd08e8ba5
jne 0x1400041c8
mov eax, dword [rsp + 0x38]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xa0]
lea rax, [rax + rcx*4]
mov qword [rsp + 0xe8], rax
mov eax, 0x66db8a81
jmp 0x1400041c8
cmp eax, 0x1bad679a
je 0x140004875
cmp eax, 0x1c0a6e6b
je 0x1400048c1
cmp eax, 0x1c7941d7
jne 0x1400041c8
cmp byte [rsp + 0x22], 0
mov eax, 0xecb7a278
mov ecx, 0xc05d0c0a
cmovne eax, ecx
jmp 0x1400041c8
cmp eax, 0x9d0a8bf2
je 0x1400048d8
cmp eax, 0xa5169753
je 0x1400048f5
cmp eax, 0xba69d66a
jne 0x1400041c8
mov rcx, qword [rsp + 0x28]
mov edx, dword [rsp + 0x34]
mov r8d, edi
call fcn.140003ecb
mov dword [rsp + 0x90], eax
mov eax, 0xce25c2af
jmp 0x1400041c8
cmp eax, 0x671506ac
je 0x140004907
cmp eax, 0x72f3853f
je 0x14000492c
cmp eax, 0x754f1d3e
jne 0x1400041c8
mov eax, dword [rsp + 0x30]
add eax, dword [rsp + 0x78]
mov dword [rsp + 0x88], eax
mov eax, 0xe03de04d
jmp 0x1400041c8
cmp eax, 0xe45c65ee
je 0x140004942
cmp eax, 0xe5db21f4
je 0x140004961
cmp eax, 0xea1beaff
jne 0x1400041c8
mov eax, 0x9155de39
mov ecx, dword [rsp + 0x24]
mov dword [rsp + 0x50], ecx
jmp 0x1400041c8
cmp eax, 0xb406ae
je 0x140004983
cmp eax, 0xd03fcc4
jne 0x1400049ac
mov eax, dword [rsp + 0x5c]
add rax, rbx
mov qword [rsp + 0xe0], rax
mov eax, 0xeb1a8bd4
jmp 0x1400041c8
cmp eax, 0x812f312d
je 0x14000499c
cmp eax, 0x844f4d43
jne 0x1400041c8
mov dword [rsp + 0x68], r13d
mov dword [rsp + 0x6c], r14d
mov eax, 0xb406ae
jmp 0x1400041c8
mov eax, dword [rsp + 0x60]
add rax, rbx
mov qword [rsp + 0xd0], rax
mov eax, dword [rsp + 0x58]
add rax, rbx
mov qword [rsp + 0xd8], rax
mov eax, 0xd03fcc4
jmp 0x1400041c8
cmp byte [rsp + 0x21], 0
mov eax, 0xecb7a278
mov ecx, 0x754f1d3e
cmovne eax, ecx
jmp 0x1400041c8
mov eax, 0x84dde09a
mov r15d, dword [rsp + 0x4c]
jmp 0x1400041c8
cmp dword [rsp + 0x8c], 0
setne byte [rsp + 0x23]
mov eax, 0x14ec5f47
jmp 0x1400041c8
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x7c]
mov ecx, dword [rsp + 0x38]
cmp ecx, eax
mov eax, 0xea1beaff
mov ecx, 0xd08e8ba5
cmovb eax, ecx
jmp 0x1400041c8
cmp dword [rsp + 0x6c], 0
mov eax, 0x9284ee61
mov ecx, 0x1c0a6e6b
cmove eax, ecx
jmp 0x1400041c8
mov eax, 0xa5169753
mov ecx, dword [rsp + 0x50]
mov dword [rsp + 0x48], ecx
jmp 0x1400041c8
mov eax, 0x9155de39
mov ecx, dword [rsp + 0x68]
mov dword [rsp + 0x50], ecx
jmp 0x1400041c8
mov rcx, qword [rsp + 0x28]
mov edx, dword [rsp + 0x84]
mov r8d, edi
call fcn.140003ecb
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x64], 0
mov eax, 0xc2e06647
mov ecx, 0x812f312d
cmove eax, ecx
mov r12d, dword [rsp + 0x24]
jmp 0x1400041c8
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x24]
mov dword [rsp + 0x80], eax
mov eax, 0xe5db21f4
jmp 0x1400041c8
mov rax, qword [rsp + 0xb8]
add rax, rbx
mov qword [rsp + 0xc0], rax
mov eax, 0x1bad679a
jmp 0x1400041c8
mov eax, dword [rsp + 0x34]
cmp eax, dword [rsp + 0x88]
setb byte [rsp + 0x22]
mov eax, 0x1c7941d7
jmp 0x1400041c8
mov eax, 0x1359e8a1
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x40], 0
jmp 0x1400041c8
mov rcx, qword [rsp + 0xf0]
mov rdx, qword [rsp + 0xa8]
call sub.ntoskrnl.exe_strcmp
mov dword [rsp + 0x8c], eax
mov eax, 0xbc08751b
jmp 0x1400041c8
mov eax, 0x12ee9945
mov dword [rsp + 0x3c], r15d
jmp 0x1400041c8
mov eax, 0x9d0a8bf2
jmp 0x1400041c8
mov eax, 0xf1290683
xor esi, esi
mov ebp, dword [rsp + 0x24]
jmp 0x1400041c8
mov eax, 0xf1290683
mov esi, 2
mov ebp, dword [rsp + 0x90]
jmp 0x1400041c8
mov eax, dword [rsp + 0x64]
add rax, rbx
mov qword [rsp + 0xf0], rax
mov eax, 0x4a5a42eb
jmp 0x1400041c8
mov eax, 0x399a3d63
jmp 0x1400041c8
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x7c], eax
mov rax, qword [rsp + 0x70]
mov edx, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x28]
mov r8d, edi
call fcn.140003ecb
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
mov eax, 0x5bd283bb
mov ecx, 0x84dde09a
cmove eax, ecx
xor r15d, r15d
jmp 0x1400041c8
mov eax, dword [rsp + 0x38]
inc eax
mov dword [rsp + 0x94], eax
mov eax, 0x88eb3df7
jmp 0x1400041c8
mov eax, dword [rsp + 0x94]
mov dword [rsp + 0x40], eax
mov eax, 0x1359e8a1
mov ecx, dword [rsp + 0x68]
mov dword [rsp + 0x44], ecx
jmp 0x1400041c8
mov eax, 0xba6ece0a
mov ecx, dword [rsp + 0x48]
mov dword [rsp + 0x4c], ecx
jmp 0x1400041c8
mov rax, qword [rsp + 0xc8]
mov edx, dword [rax]
mov rcx, qword [rsp + 0x28]
mov r8d, edi
call fcn.140003ecb
mov dword [rsp + 0x60], eax
mov eax, 0xe45c65ee
jmp 0x1400041c8
mov eax, dword [rsp + 0x54]
mov qword [rsp + 0xb8], rax
mov eax, 0xdbb07677
jmp 0x1400041c8
cmp dword [rsp + 0x60], 0
mov eax, 0x1fe7397d
mov ecx, 0xa5169753
cmove eax, ecx
mov dword [rsp + 0x48], 0
jmp 0x1400041c8
mov rcx, qword [rsp + 0x28]
mov edx, dword [rsp + 0x80]
mov r8d, edi
call fcn.140003ecb
mov dword [rsp + 0x5c], eax
mov eax, 0xe1d30e4c
jmp 0x1400041c8
mov eax, dword [rsp + 0x6c]
cmp eax, 4
mov eax, 0x1c0a6e6b
mov ecx, 0x143e3073
cmovl eax, ecx
jmp 0x1400041c8
mov eax, 0x844f4d43
xor r14d, r14d
mov r13d, r12d
jmp 0x1400041c8
cmp eax, 0x12ee9945
jne 0x1400041c8
mov eax, dword [rsp + 0x3c]
add rsp, 0xf8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret