Function at 0x14000d688
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov qword [r11 - 0xb0], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rax, qword [0x140030010]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, r8
mov qword [rsp + 0x48], rbx
mov r13, rcx
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0x90], rbx
xor r14d, r14d
xor r15d, r15d
and qword [rsp + 0x70], r14
mov rax, qword [rcx]
xor r9d, r9d
lea r8d, [r14 + 0x1c]
lea rdx, [r11 - 0x90]
mov rax, qword [rax + 0x18]
call qword [case.0x14002050e.0]
mov esi, eax
test eax, eax
jne 0x14000e130
mov ecx, 0xfeff
cmp word [rsp + 0xe8], cx
sete al
mov dword [reloc.AppVIsvSubsystems64.dll_Ordinal_1], eax
jne 0x14000d755
mov ecx, dword [rsp + 0x100]
mov edx, ecx
shr edx, 8
mov eax, ecx
shl eax, 8
xor edx, eax
and edx, 0xff00ff
shl ecx, 8
xor edx, ecx
rol edx, 0x10
mov dword [rsp + 0x100], edx
jmp 0x14000d75c
mov edx, dword [rsp + 0x100]
test edx, edx
je 0x14000d9dd
lea ecx, [rdx + rdx*4]
shl ecx, 2
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r12, rax
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x14000d78b
mov r14d, 0x80004005
mov r15, rax
jmp 0x14000d9dd
mov ecx, dword [rsp + 0x100]
test ecx, ecx
je 0x14000d84e
lea rbx, [rax + 6]
mov rax, qword [r13]
lea r12, [rbx - 6]
xor r9d, r9d
lea r8d, [r9 + 0x14]
mov rdx, r12
mov rcx, r13
mov rax, qword [rax + 0x18]
call qword [case.0x14002050e.0]
mov esi, eax
test eax, eax
jne 0x14000e12b
cmp dword [reloc.AppVIsvSubsystems64.dll_Ordinal_1], r14d
je 0x14000d827
mov ecx, dword [r12]
mov edx, ecx
shr edx, 8
mov eax, ecx
shl eax, 8
xor edx, eax
mov r8d, 0xff00ff
and edx, r8d
shl ecx, 8
xor edx, ecx
rol edx, 0x10
mov dword [r12], edx
movzx eax, word [rbx - 2]
rol ax, 8
mov word [rbx - 2], ax
movzx eax, word [rbx]
rol ax, 8
mov word [rbx], ax
mov ecx, dword [rbx + 0xa]
mov edx, ecx
shr edx, 8
mov eax, ecx
shl eax, 8
xor edx, eax
and edx, r8d
shl ecx, 8
xor edx, ecx
rol edx, 0x10
jmp 0x14000d82a
mov edx, dword [rbx + 0xa]
mov dword [rbx + 0xa], edx
inc r15d
add rbx, 0x14
mov ecx, dword [rsp + 0x100]
cmp r15d, ecx
jb 0x14000d79e
mov rbx, qword [rsp + 0x48]
mov r12, qword [rsp + 0x30]
mov r8, r12
mov qword [rsp + 0x68], r12
test ecx, ecx
je 0x14000e11d
mov r10, qword [rsp + 0x188]
mov rdx, qword [r10 + 8]
dec ecx
mov dword [rsp + 0x100], ecx
mov rax, qword [rdx]
cmp rax, qword [r8]
jne 0x14000e10c
mov rax, qword [rdx + 8]
cmp rax, qword [r8 + 8]
jne 0x14000e10c
mov rax, qword [rdx]
sub rax, qword [0x140026a30]
jne 0x14000d8a4
mov rax, qword [rdx + 8]
sub rax, qword [0x140026a38]
xor ecx, ecx
test rax, rax
sete cl
mov dword [rsp + 0x54], ecx
mov dword [rsp + 0x80], ecx
mov rax, qword [rdx]
sub rax, qword [0x140026a40]
jne 0x14000d8ce
mov rax, qword [rdx + 8]
sub rax, qword [0x140026a48]
xor ecx, ecx
test rax, rax
sete cl
mov dword [rsp + 0x58], ecx
mov dword [rsp + 0x84], ecx
mov ecx, dword [r8 + 0x10]
mov eax, ecx
sar eax, 0x1f
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x60], ecx
mov rax, qword [r13]
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, r13
mov rax, qword [rax + 0x28]
call qword [case.0x14002050e.0]
mov esi, eax
test eax, eax
jne 0x14000e12b
mov rax, qword [r13]
xor r9d, r9d
lea r8d, [rsi + 8]
lea rdx, [rsp + 0x38]
mov rcx, r13
mov rax, qword [rax + 0x18]
call qword [case.0x14002050e.0]
mov esi, eax
test eax, eax
jne 0x14000e12b
mov r12d, 0xff00ff
cmp dword [reloc.AppVIsvSubsystems64.dll_Ordinal_1], r14d
je 0x14000d994
mov ecx, dword [rsp + 0x3c]
mov r8d, ecx
shr r8d, 8
mov eax, ecx
shl eax, 8
xor r8d, eax
and r8d, r12d
shl ecx, 8
xor r8d, ecx
rol r8d, 0x10
mov dword [rsp + 0x3c], r8d
mov ecx, dword [rsp + 0x38]
mov edx, ecx
shr edx, 8
mov eax, ecx
shl eax, 8
xor edx, eax
and edx, r12d
shl ecx, 8
xor edx, ecx
rol edx, 0x10
mov dword [rsp + 0x38], edx
jmp 0x14000d999
mov r8d, dword [rsp + 0x3c]
test r8d, r8d
je 0x14000d9d8
mov edx, r8d
mov rcx, rbx
call fcn.14000d0e4
mov r14d, eax
test eax, eax
jne 0x14000d9d8
mov ecx, dword [rsp + 0x3c]
shl ecx, 3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x98], rax
mov rbx, rax
test rax, rax
jne 0x14000da1d
mov r14d, 0x80004005
mov r15, qword [rsp + 0x30]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, r14d
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14001fbe0
mov rbx, qword [rsp + 0x198]
add rsp, 0x150
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
xor r15d, r15d
cmp dword [rsp + 0x3c], r15d
jbe 0x14000dab9
mov rax, qword [r13]
xor r9d, r9d
lea r8d, [r9 + 8]
mov rdx, rbx
mov rcx, r13
mov rax, qword [rax + 0x18]
call qword [case.0x14002050e.0]
mov esi, eax
test eax, eax
jne 0x14000e12b
mov r8d, dword [reloc.AppVIsvSubsystems64.dll_Ordinal_1]
test r8d, r8d
je 0x14000da77
mov ecx, dword [rbx]
mov edx, ecx
shr edx, 8
mov eax, ecx
shl eax, 8
xor edx, eax
and edx, r12d
shl ecx, 8
xor edx, ecx
rol edx, 0x10
jmp 0x14000da79
mov edx, dword [rbx]
mov dword [rbx], edx
test r8d, r8d
je 0x14000da9c
mov ecx, dword [rbx + 4]
mov edx, ecx
shr edx, 8
mov eax, ecx
shl eax, 8
xor edx, eax
and edx, r12d
shl ecx, 8
xor edx, ecx
rol edx, 0x10
jmp 0x14000da9f
mov edx, dword [rbx + 4]
mov dword [rbx + 4], edx
inc r15d
add rbx, 8
cmp r15d, dword [rsp + 0x3c]
jb 0x14000da2b
mov rax, qword [rsp + 0x70]
mov r12, rax
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0x188]
mov r15, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x68]
cmp qword [rcx + 0x18], 0
jne 0x14000db08
mov qword [rsp + 0x20], r15
mov r9, rax
mov r8d, dword [rsp + 0x3c]
mov edx, dword [rbx + 0x10]
mov rcx, r13
call fcn.14000cee0
mov r14d, eax
test eax, eax
jne 0x14000d9d8
mov rcx, qword [rsp + 0x188]
mov eax, dword [rsp + 0x3c]
dec dword [rsp + 0x3c]
test eax, eax
je 0x14000d9d8
mov eax, dword [r12]
cmp eax, 2
jb 0x14000e0f1
cmp qword [rcx + 0x18], 0
je 0x14000db35
cmp eax, dword [rcx + 0x10]
jge 0x14000e0f1
cmp dword [rsp + 0x58], 0
je 0x14000db47
test eax, 0x11000000
jne 0x14000e0f1
mov edx, dword [r12 + 4]
add edx, dword [rbx + 0x10]
mov eax, edx
sar eax, 0x1f
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x60], edx
mov rax, qword [r13]
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, r13
mov rax, qword [rax + 0x28]
call qword [case.0x14002050e.0]
mov esi, eax
test eax, eax
jne 0x14000e12b
cmp dword [rsp + 0x54], eax
je 0x14000dbb1
mov eax, dword [r12]
cmp eax, 0xc
jne 0x14000db9e
mov ecx, dword [r15]
mov dword [r15 + 0x34], ecx
mov eax, dword [r12]
jmp 0x14000dba8
mov rcx, qword [rsp + 0x90]
mov ecx, dword [rcx]
cmp eax, 0x12
jne 0x14000dbb1
mov dword [r15 + 0x30], ecx
mov rbx, qword [rsp + 0x48]
mov edx, dword [rbx]
lea rcx, [rdx + rdx*2]
mov rax, qword [rbx + 8]
lea r15, [rax + rcx*8]
mov qword [rsp + 0xa0], r15
mov rax, qword [rbx + 0x10]
mov r8, qword [rax + rdx*8]
lea eax, [rdx + 1]
mov dword [rbx], eax
mov r9d, dword [r12]
mov eax, dword [rbx + 0x20]
mov rdx, qword [rbx + 0x28]
lea rcx, [0x1400244b8]
mov qword [r8], rcx
mov dword [r8 + 8], 1
mov r10, qword [rsp + 0x188]
mov rcx, qword [r10 + 0x18]
test rcx, rcx
je 0x14000dc20
mov eax, r9d
add rax, rax
mov rax, qword [rcx + rax*8 + 8]
mov qword [r8 + 0x10], rax
xor r14d, r14d
mov dword [rsp + 0x50], r14d
jmp 0x14000dc69
and qword [r8 + 0x10], 0
xor ecx, ecx
test eax, eax
je 0x14000dc48
dec eax
cmp dword [rdx], r9d
je 0x14000dc40
add rdx, 0x10
test eax, eax
jne 0x14000dc2b
mov rcx, qword [r8 + 0x10]
jmp 0x14000dc48
mov rcx, qword [rdx + 8]
mov qword [r8 + 0x10], rcx
mov rax, rcx
neg rax
sbb r14d, r14d
not r14d
and r14d, 0x80004005
mov dword [rsp + 0x50], r14d
test rcx, rcx
je 0x14000d9d8
mov rax, qword [r13]
xor r9d, r9d
lea r8d, [r9 + 4]
lea rdx, [rsp + 0x40]
mov rcx, r13
mov rax, qword [rax + 0x18]
call qword [case.0x14002050e.0]
mov esi, eax
test eax, eax
jne 0x14000e12b
cmp dword [reloc.AppVIsvSubsystems64.dll_Ordinal_1], eax
je 0x14000dcbc
mov ecx, dword [rsp + 0x40]
mov edx, ecx
shr edx, 8
mov eax, ecx
shl eax, 8
xor edx, eax
and edx, 0xff00ff
shl ecx, 8
xor edx, ecx
rol edx, 0x10
mov dword [rsp + 0x40], edx
jmp 0x14000dcc0
mov edx, dword [rsp + 0x40]
cmp edx, 0x1e
ja 0x14000de64
je 0x14000dde8
sub edx, 3
je 0x14000dd90
sub edx, 1
je 0x14000dd67
sub edx, 1
je 0x14000dd3d
sub edx, 2
je 0x14000dd3d
sub edx, 1
je 0x14000dde8
cmp edx, 3
jne 0x14000de80
mov rax, qword [r13]
lea rbx, [r15 + 8]
xor r9d, r9d
lea r8d, [rdx - 1]
mov rdx, rbx
mov rcx, r13
mov rax, qword [rax + 0x18]
call qword [case.0x14002050e.0]
mov esi, eax
movzx eax, word [rbx]
cmp dword [reloc.AppVIsvSubsystems64.dll_Ordinal_1], 0
je 0x14000dd2e
rol ax, 8
mov word [rbx], ax
mov dword [r15], 0xb
jmp 0x14000e0ed
mov rax, qword [r13]
lea rdx, [r15 + 8]
xor r9d, r9d
lea r8d, [r9 + 8]
mov rcx, r13
mov rax, qword [rax + 0x18]
call qword [case.0x14002050e.0]
mov esi, eax
mov dword [r15], 5
jmp 0x14000e0ed
mov rax, qword [r13]
lea rdx, [r15 + 8]
xor r9d, r9d
lea ebx, [r9 + 4]
mov r8d, ebx
mov rcx, r13
mov rax, qword [rax + 0x18]
call qword [case.0x14002050e.0]
mov esi, eax
mov dword [r15], ebx
jmp 0x14000e0ed
mov rax, qword [r13]
lea rbx, [r15 + 8]
xor r9d, r9d
lea r8d, [r9 + 4]
mov rdx, rbx
mov rcx, r13
mov rax, qword [rax + 0x18]
call qword [case.0x14002050e.0]
mov esi, eax
cmp dword [reloc.AppVIsvSubsystems64.dll_Ordinal_1], 0
je 0x14000ddd8
mov ecx, dword [rbx]
mov edx, ecx
shr edx, 8
mov eax, ecx
shl eax, 8
xor edx, eax
and edx, 0xff00ff
shl ecx, 8
xor edx, ecx
rol edx, 0x10
jmp 0x14000ddda
mov edx, dword [rbx]
mov dword [rbx], edx
mov dword [r15], 3
jmp 0x14000e0ed
lea rdx, [r15 + 8]
mov rcx, r13
call fcn.14000c7bc
mov r14d, eax
test eax, eax
jne 0x14000d9d8
mov rax, qword [rsp + 0x188]
mov rcx, qword [rax + 8]
mov rax, qword [rcx]
cmp rax, qword [0x140026a30]
jne 0x14000de58
mov rax, qword [rcx + 8]
cmp rax, qword [0x140026a38]
jne 0x14000de58
cmp dword [r12], 5
jne 0x14000de58
mov rbx, qword [r15 + 8]
mov dword [r15], 0x101e
mov rcx, r15
call fcn.14000d41c
mov r14d, eax
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test r14d, r14d
jne 0x14000d9d8
jmp 0x14000e0f1
mov dword [r15], 0x1e
jmp 0x14000e0f1
sub edx, 0x40
je 0x14000deda
sub edx, 7
je 0x14000decc
sub edx, 0xfc1
je 0x14000deaa
sub edx, 4
je 0x14000de87
cmp edx, 0x12
je 0x14000deaa
dec dword [rbx]
jmp 0x14000e0f1
lea rdx, [r15 + 8]
mov rcx, r13
call fcn.14000cd00
test eax, eax
mov r14d, eax
jne 0x14000d9d8
mov dword [r15], 0x102
jmp 0x14000e0f1
mov rdx, r15
mov rcx, r13
call fcn.14000cdf4
mov r14d, eax
test eax, eax
jne 0x14000d9d8
mov dword [r15], 0x101e
jmp 0x14000e0f1
lea rdx, [r15 + 8]
mov rcx, r13
call fcn.14000c894
jmp 0x14000de93
mov rax, qword [r13]
lea rbx, [r15 + 8]
xor r9d, r9d
lea r8d, [r9 + 8]
mov rdx, rbx
mov rcx, r13
mov rax, qword [rax + 0x18]
call qword [case.0x14002050e.0]
mov esi, eax
mov dword [rsp + 0x78], eax
mov r8d, dword [reloc.AppVIsvSubsystems64.dll_Ordinal_1]
test r8d, r8d
je 0x14000df29
mov ecx, dword [rbx]
mov edx, ecx
shr edx, 8
mov eax, ecx
shl eax, 8
xor edx, eax
and edx, 0xff00ff
shl ecx, 8
xor edx, ecx
rol edx, 0x10
jmp 0x14000df2b
mov edx, dword [rbx]
mov dword [rbx], edx
test r8d, r8d
je 0x14000df52
mov ecx, dword [r15 + 0xc]
mov edx, ecx
shr edx, 8
mov eax, ecx
shl eax, 8
xor edx, eax
and edx, 0xff00ff
shl ecx, 8
xor edx, ecx
rol edx, 0x10
jmp 0x14000df56
mov edx, dword [r15 + 0xc]
mov dword [r15 + 0xc], edx
mov dword [r15], 0x40
mov rax, qword [rsp + 0x188]
mov rdx, qword [rax + 8]
mov rax, qword [rdx]
cmp rax, qword [0x140026a30]
jne 0x14000e0ed
mov rax, qword [rdx + 8]
cmp rax, qword [0x140026a38]
jne 0x14000e0ed
cmp dword [r12], 0xa
jne 0x14000e0ed
lea rcx, [rsp + 0xb8]
call fcn.1400130e0
nop
mov rcx, qword [rbx]
call fcn.14000d364
mov ecx, eax
mov eax, 0x88888889
mul ecx
mov ebx, edx
shr ebx, 5
mov dword [rsp + 0x7c], ebx
lea rcx, [rsp + 0xd8]
call fcn.140013410
mov edx, 0x893d
lea rcx, [rsp + 0xb8]
call fcn.1400139a8
jmp 0x14000e037
call fcn.140013438
mov r8, qword [rsp + 0xb8]
test r8, r8
je 0x14000e0e0
mov r9d, ebx
mov edx, 0x32
lea rcx, [rsp + 0x108]
call fcn.14000198c
lea rcx, [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov ebx, eax
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdx, rax
mov qword [r15 + 8], rax
test rax, rax
je 0x14000e0d9
lea rcx, [rbx - 1]
cmp rcx, 0x7ffffffe
ja 0x14000e0d1
mov ecx, 0x7ffffffe
sub rcx, rbx
lea r8, [rsp + 0x108]
sub r8, rax
lea rax, [rcx + rbx]
test rax, rax
je 0x14000e0c4
mov al, byte [r8 + rdx]
test al, al
je 0x14000e0c4
mov byte [rdx], al
inc rdx
sub rbx, 1
jne 0x14000e0a8
lea rax, [rdx - 1]
test rbx, rbx
cmovne rax, rdx
jmp 0x14000e0d6
test rbx, rbx
je 0x14000e0d9
mov byte [rax], 0
mov dword [r15], 0x1e
lea rcx, [rsp + 0xb8]
call fcn.140013168
test esi, esi
jne 0x14000e12b
add r12, 8
mov qword [rsp + 0x88], r12
mov rbx, qword [rsp + 0x68]
mov r15, qword [rsp + 0x48]
jmp 0x14000db00
add r8, 0x14
mov qword [rsp + 0x68], r8
test ecx, ecx
jne 0x14000d86a
dec ecx
mov dword [rsp + 0x100], ecx
jmp 0x14000d9d8
mov r15, qword [rsp + 0x30]
mov r14d, esi
jmp 0x14000d9dd