Function at 0x1400023ec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x320
mov qword [rsp + 0xf0], 0xfffffffffffffffe
mov rax, qword [0x14002f008]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov qword [rsp + 0x78], r9
mov rdi, r8
mov r12, rdx
mov r13, rcx
mov qword [rsp + 0xd8], rcx
mov qword [rsp + 0xd0], r9
mov rax, qword [rsp + 0x380]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x388]
mov qword [rsp + 0x60], rax
mov r14, qword [rsp + 0x390]
mov qword [rsp + 0xe0], r14
mov dword [rsp + 0x30], 1
xor r15d, r15d
mov esi, r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x80], r15
mov r8d, r15d
mov dword [rsp + 0x38], r15d
mov eax, dword [r14]
mov dword [rsp + 0xb8], eax
cmp dword [rdx + 4], r15d
je 0x14000254b
mov rax, qword [rdi]
mov rbx, qword [rax + 0x28]
mov rcx, rbx
call qword [sym.WmiApSrv.exe_void___cdecl_SetCHStringResourceHandle_struct_HINSTANCE______ptr64_]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call rbx
cmp eax, 0x8004103c
jne 0x140002fcb
mov ecx, dword [rsp + 0x38]
lea eax, [r15 + 8]
mul rcx
lea rcx, [r15 - 1]
cmovo rax, rcx
mov rcx, rax
call fcn.14001930c
mov rsi, rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x80], rax
test rax, rax
jne 0x140002508
mov eax, 0x8007000e
jmp 0x140002fcb
mov rax, qword [rdi]
mov rbx, qword [rax + 0x28]
mov rcx, rbx
call qword [sym.WmiApSrv.exe_void___cdecl_SetCHStringResourceHandle_struct_HINSTANCE______ptr64_]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9, rsi
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call rbx
mov dword [rsp + 0x30], eax
mov r8d, dword [rsp + 0x38]
mov r9, qword [rsp + 0x78]
jmp 0x14000254b
mov edx, dword [r12 + 4]
cmp dword [r12 + 0x14], r15d
je 0x140002561
test edx, edx
je 0x140002576
lea rcx, [rdx + 4]
jmp 0x140002569
test edx, edx
je 0x140002576
lea rcx, [rdx + 1]
mov eax, r8d
imul rcx, rax
shl rcx, 3
jmp 0x140002579
mov rcx, r15
lea eax, [rdx + 2]
lea eax, [rdx + rax*4]
lea eax, [rcx + rax*8]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0xe8], r12
mov qword [rsp + 0xc8], r15
mov qword [rsp + 0xc0], r15
test rsi, rsi
je 0x140002611
mov rax, qword [r9]
mov eax, dword [rax]
mov dword [rsp + 0x34], eax
test eax, eax
je 0x1400025dc
mov rdi, qword [rsi]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x100]
mov rcx, rbx
call qword [sym.WmiApSrv.exe_void___cdecl_SetCHStringResourceHandle_struct_HINSTANCE______ptr64_]
lea r8, [rsp + 0xc8]
mov edx, dword [rsp + 0x34]
mov rcx, rdi
call rbx
mov r9, qword [rsp + 0x78]
mov rax, qword [r9]
mov eax, dword [rax + 4]
mov dword [rsp + 0x34], eax
test eax, eax
je 0x140002611
mov rdi, qword [rsi]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x100]
mov rcx, rbx
call qword [sym.WmiApSrv.exe_void___cdecl_SetCHStringResourceHandle_struct_HINSTANCE______ptr64_]
lea r8, [rsp + 0xc0]
mov edx, dword [rsp + 0x34]
mov rcx, rdi
call rbx
mov r8, r14
mov edx, dword [rsp + 0x40]
mov rcx, r13
call fcn.140001fe4
mov eax, dword [r12 + 4]
lea edx, [rax + rax*4]
lea edx, [rdx*8 + 0x40]
mov r8, r14
mov rcx, r13
call fcn.140001fe4
mov r8, r14
mov edx, 0x40
mov rcx, r13
call fcn.140001fe4
mov r8, r14
mov rax, qword [rsp + 0x48]
mov edx, dword [rax]
mov rcx, r13
call fcn.140001fe4
mov r8, r14
xor edx, edx
mov rcx, r13
call fcn.140001fe4
mov r8, r14
mov rax, qword [rsp + 0x60]
mov edx, dword [rax]
mov rcx, r13
call fcn.140001fe4
mov r8, r14
xor edx, edx
mov rcx, r13
call fcn.140001fe4
mov r8, r14
mov edx, dword [r12 + 0x18]
mov rcx, r13
call fcn.140001fe4
mov r8, r14
mov edx, dword [r12 + 4]
mov rcx, r13
call fcn.140001fe4
mov r8, r14
or ebx, 0xffffffff
mov edx, ebx
mov rcx, r13
call fcn.140001fe4
mov edx, dword [rsp + 0x38]
cmp dword [r12 + 0x14], r15d
cmove edx, ebx
mov r8, r14
mov rcx, r13
call fcn.140001fe4
mov r8, r14
xor edx, edx
mov rcx, r13
call fcn.140001fe4
mov eax, dword [r14]
mov dword [rsp + 0x20], eax
mov edi, 8
mov r8d, edi
lea rdx, [rsp + 0xc8]
lea rcx, [r13 + 0x38]
call fcn.140003030
add dword [r14], edi
mov eax, dword [r14]
mov dword [rsp + 0x20], eax
mov r8d, edi
lea rdx, [rsp + 0xc0]
lea rcx, [r13 + 0x38]
call fcn.140003030
add dword [r14], edi
mov rcx, qword [rsp + 0x48]
add dword [rcx], 2
mov rcx, qword [rsp + 0x60]
add dword [rcx], 2
cmp dword [r12 + 0x14], r15d
je 0x140002743
mov eax, dword [r12 + 0x1c]
add rax, r12
mov ebx, dword [rax]
add rbx, rax
jmp 0x140002757
cmp dword [r12 + 4], r15d
je 0x140002754
mov ebx, dword [r12 + 0x1c]
add rbx, r12
jmp 0x140002757
mov rbx, r15
mov eax, r15d
mov dword [rsp + 0x3c], eax
cmp eax, dword [r12 + 4]
jae 0x140002852
test rbx, rbx
je 0x140002842
mov r8, r14
mov edx, 0x28
mov rcx, r13
call fcn.140001fe4
mov r8, r14
mov rax, qword [rsp + 0x48]
mov edx, dword [rax]
mov rcx, r13
call fcn.140001fe4
mov r8, r14
xor edx, edx
mov rcx, r13
call fcn.140001fe4
mov r8, r14
mov rax, qword [rsp + 0x60]
mov edx, dword [rax]
mov rcx, r13
call fcn.140001fe4
mov r8, r14
xor edx, edx
mov rcx, r13
call fcn.140001fe4
mov r8, r14
mov edx, dword [rbx + 0x10]
mov rcx, r13
call fcn.140001fe4
mov r8, r14
mov edx, dword [rbx + 0x14]
mov rcx, r13
call fcn.140001fe4
mov r8, r14
mov edx, dword [rbx + 0x18]
mov rcx, r13
call fcn.140001fe4
mov r8, r14
mov edx, edi
mov rcx, r13
call fcn.140001fe4
mov edx, dword [rsp + 0x3c]
lea edx, [rdx*8 + 8]
mov r8, r14
mov rcx, r13
call fcn.140001fe4
mov rax, qword [rsp + 0x48]
add dword [rax], 2
mov rax, qword [rsp + 0x60]
add dword [rax], 2
mov eax, dword [rbx]
add rbx, rax
mov eax, dword [rsp + 0x3c]
inc eax
jmp 0x14000275a
mov r14d, 0x8007000e
mov rsi, qword [rsp + 0x58]
jmp 0x140002f80
mov edx, dword [r12 + 4]
test edx, edx
je 0x140002f57
test rsi, rsi
je 0x140002dde
cmp dword [r12 + 0x14], r15d
je 0x140002dde
mov eax, dword [r12 + 0x1c]
add rax, r12
mov qword [rsp + 0x70], rax
mov ebx, r15d
mov dword [rsp + 0x3c], ebx
cmp ebx, dword [rsp + 0x38]
jae 0x140002dc5
mov word [rsp + 0x100], r15w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x102]
call sub.msvcrt.dll_memset
xor edx, edx
lea r8d, [rdx + 0x18]
lea rcx, [rsp + 0x88]
call qword [sym.imp.msvcrt.dll_memset]
mov word [rsp + 0x88], r15w
xor edx, edx
lea r8d, [rdx + 0x18]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.msvcrt.dll_memset]
mov word [rsp + 0xa0], r15w
mov qword [rsp + 0x48], r15
mov eax, ebx
mov rdi, qword [rsi + rax*8]
mov rax, qword [rdi]
mov rbx, qword [rax]
mov rcx, rbx
call qword [sym.WmiApSrv.exe_void___cdecl_SetCHStringResourceHandle_struct_HINSTANCE______ptr64_]
lea r8, [rsp + 0x48]
lea rdx, [0x14001f330]
mov rcx, rdi
call rbx
test eax, eax
js 0x1400029ad
mov rbx, qword [rsp + 0x48]
mov rax, qword [rbx]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rax + 0x20]
mov rcx, rsi
call qword [sym.WmiApSrv.exe_void___cdecl_SetCHStringResourceHandle_struct_HINSTANCE______ptr64_]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, [rdi + 8]
mov rcx, rbx
call rsi
mov dword [rsp + 0x30], eax
test eax, eax
js 0x1400029ad
mov edi, 8
cmp word [rsp + 0x88], di
je 0x1400029a3
mov r9d, edi
lea r8d, [rdi - 7]
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
mov dword [rsp + 0x30], eax
test eax, eax
js 0x1400029ad
mov rsi, qword [rsp + 0xa8]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_VariantInit]
jmp 0x1400029ee
mov rsi, qword [rsp + 0x90]
jmp 0x140002998
mov r9d, dword [rsp + 0x3c]
lea r8, str._simulated__d
mov edx, 0x104
lea rcx, [rsp + 0x100]
call fcn.140001bfc
lea rsi, [rsp + 0x100]
lea rcx, [rsp + 0x100]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
mov dword [rsp + 0x30], 1
mov edi, 8
lea ebx, [rax + 1]
mov ecx, ebx
and ecx, 7
je 0x140002a00
sub edi, ecx
add edi, ebx
add edi, edi
jmp 0x140002a03
lea edi, [rbx + rbx]
mov eax, dword [rsp + 0x40]
add eax, edi
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x70]
mov eax, dword [rcx]
add rax, rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rax
lea edx, [rdi + 0x18]
mov r8, r14
mov rcx, r13
call fcn.140001fe4
mov r8, r14
xor edx, edx
mov rcx, r13
call fcn.140001fe4
mov r8, r14
xor edx, edx
mov rcx, r13
call fcn.140001fe4
mov r8, r14
or edx, 0xffffffff
mov rcx, r13
call fcn.140001fe4
mov eax, 0xc
sub eax, ebx
lea edx, [rdi + rax*2]
mov r8, r14
mov rcx, r13
call fcn.140001fe4
add ebx, ebx
mov r8, r14
mov edx, ebx
mov rcx, r13
call fcn.140001fe4
sub edi, ebx
add dword [r14], edi
mov eax, dword [r14]
lea rcx, [r13 + 0x38]
mov dword [rsp + 0x20], eax
mov r8d, ebx
mov rdx, rsi
call fcn.140003030
add dword [r14], ebx
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x140002af8
mov edx, dword [r12 + 4]
lea edx, [rdx*8 + 8]
mov r8, r14
mov rcx, r13
call fcn.140001fe4
add dword [r14], 4
mov r8, r15
mov qword [rsp + 0x50], r15
test rsi, rsi
je 0x140002b2d
mov eax, dword [rsp + 0x3c]
mov r8, qword [rsi + rax*8]
mov qword [rsp + 0x50], r8
mov edx, r15d
mov dword [rsp + 0x34], edx
cmp edx, dword [r12 + 4]
jae 0x140002d4a
test r8, r8
je 0x140002d1e
mov ecx, dword [rbx + 0xc]
lea eax, [rcx - 3]
test eax, 0xffffffef
je 0x140002c53
lea eax, [rcx - 0x14]
cmp eax, 1
jbe 0x140002b74
mov r8, r14
or edx, 0xffffffff
mov rcx, r13
call fcn.140001fe4
jmp 0x140002d2c
mov qword [rsp + 0x68], r15
mov rcx, qword [r8]
lea edi, [rdx + 2]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rax]
mov rsi, qword [rcx + 0x100]
mov rcx, rsi
call qword [sym.WmiApSrv.exe_void___cdecl_SetCHStringResourceHandle_struct_HINSTANCE______ptr64_]
lea r8, [rsp + 0x68]
mov edx, dword [rbx + rdi*4]
mov rcx, qword [rsp + 0x50]
call rsi
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x140002c29
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x140002bce
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [sym.WmiApSrv.exe_void___cdecl_SetCHStringResourceHandle_struct_HINSTANCE______ptr64_]
mov rcx, rbx
call rdi
nop
mov edi, 0xfff
mov ebx, 8
cmp word [rsp + 0xa0], di
jne 0x140002bea
mov word [rsp + 0xa0], bx
lea rcx, [rsp + 0xa0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
cmp word [rsp + 0x88], di
jne 0x140002c0b
mov word [rsp + 0x88], bx
lea rcx, [rsp + 0x88]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rsi, qword [rsp + 0x58]
mov r14d, dword [rsp + 0x30]
jmp 0x140002f80
lea rcx, [r13 + 0x38]
mov eax, dword [r14]
mov dword [rsp + 0x20], eax
mov ebx, 8
mov r8d, ebx
lea rdx, [rsp + 0x68]
call fcn.140003030
add dword [r14], ebx
mov rbx, qword [rsp + 0x60]
jmp 0x140002d30
mov dword [rsp + 0x68], r15d
mov rcx, qword [r8]
lea edi, [rdx + 2]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rax]
mov rsi, qword [rcx + 0xf0]
mov rcx, rsi
call qword [sym.WmiApSrv.exe_void___cdecl_SetCHStringResourceHandle_struct_HINSTANCE______ptr64_]
lea r8, [rsp + 0x68]
mov edx, dword [rbx + rdi*4]
mov rcx, qword [rsp + 0x50]
call rsi
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x140002d08
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x140002cad
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [sym.WmiApSrv.exe_void___cdecl_SetCHStringResourceHandle_struct_HINSTANCE______ptr64_]
mov rcx, rbx
call rdi
nop
mov edi, 0xfff
mov ebx, 8
cmp word [rsp + 0xa0], di
jne 0x140002cc9
mov word [rsp + 0xa0], bx
lea rcx, [rsp + 0xa0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
cmp word [rsp + 0x88], di
jne 0x140002cea
mov word [rsp + 0x88], bx
lea rcx, [rsp + 0x88]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rsi, qword [rsp + 0x58]
mov r14d, dword [rsp + 0x30]
jmp 0x140002f80
mov r8, r14
mov edx, dword [rsp + 0x68]
mov rcx, r13
call fcn.140001fe4
mov rbx, qword [rsp + 0x60]
jmp 0x140002d2c
mov r8, r14
or edx, 0xffffffff
mov rcx, r13
call fcn.140001fe4
add dword [r14], 4
mov eax, dword [rbx]
add rbx, rax
mov qword [rsp + 0x60], rbx
mov edx, dword [rsp + 0x34]
inc edx
mov r8, qword [rsp + 0x50]
jmp 0x140002b30
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x140002d6a
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [sym.WmiApSrv.exe_void___cdecl_SetCHStringResourceHandle_struct_HINSTANCE______ptr64_]
mov rcx, rbx
call rdi
nop
mov ebx, 0xfff
mov edi, 8
cmp word [rsp + 0xa0], bx
jne 0x140002d86
mov word [rsp + 0xa0], di
lea rcx, [rsp + 0xa0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
cmp word [rsp + 0x88], bx
jne 0x140002da7
mov word [rsp + 0x88], di
lea rcx, [rsp + 0x88]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ebx, dword [rsp + 0x3c]
inc ebx
mov rsi, qword [rsp + 0x58]
jmp 0x140002883
lea r8, [rsp + 0xb8]
mov edx, dword [rsp + 0x40]
mov rcx, r13
call fcn.140001fe4
jmp 0x140002f57
lea edx, [rdx*8 + 8]
mov r8, r14
mov rcx, r13
call fcn.140001fe4
add dword [r14], 4
mov rdx, r15
mov qword [rsp + 0x50], rdx
test rsi, rsi
je 0x140002e09
mov rdx, qword [rsi]
mov qword [rsp + 0x50], rdx
cmp dword [r12 + 4], r15d
je 0x140002e1a
mov ecx, dword [r12 + 0x1c]
add rcx, r12
jmp 0x140002e1d
mov rcx, r15
mov r8d, r15d
mov dword [rsp + 0x68], r8d
mov qword [rsp + 0x70], rcx
cmp r8d, dword [r12 + 4]
jae 0x140002f57
test rdx, rdx
je 0x140002f29
mov r9d, dword [rcx + 0xc]
lea eax, [r9 - 3]
test eax, 0xffffffef
je 0x140002ed9
lea eax, [r9 - 0x14]
cmp eax, 1
jbe 0x140002e6d
or edx, 0xffffffff
mov r8, r14
mov rcx, r13
call fcn.140001fe4
jmp 0x140002f37
mov qword [rsp + 0x48], r15
mov rcx, qword [rdx]
lea edi, [r8 + 2]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rax]
mov rsi, qword [rcx + 0x100]
mov rcx, rsi
call qword [sym.WmiApSrv.exe_void___cdecl_SetCHStringResourceHandle_struct_HINSTANCE______ptr64_]
lea r8, [rsp + 0x48]
mov edx, dword [rbx + rdi*4]
mov rcx, qword [rsp + 0x50]
call rsi
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x140002eb7
mov rsi, qword [rsp + 0x58]
mov r14d, dword [rsp + 0x30]
jmp 0x140002f80
lea rcx, [r13 + 0x38]
mov eax, dword [r14]
mov dword [rsp + 0x20], eax
mov edi, 8
mov r8d, edi
lea rdx, [rsp + 0x48]
call fcn.140003030
add dword [r14], edi
jmp 0x140002f3b
mov dword [rsp + 0x34], r15d
mov rcx, qword [rdx]
lea edi, [r8 + 2]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rax]
mov rsi, qword [rcx + 0xf0]
mov rcx, rsi
call qword [sym.WmiApSrv.exe_void___cdecl_SetCHStringResourceHandle_struct_HINSTANCE______ptr64_]
lea r8, [rsp + 0x34]
mov edx, dword [rbx + rdi*4]
mov rcx, qword [rsp + 0x50]
call rsi
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x140002f20
mov rsi, qword [rsp + 0x58]
mov r14d, dword [rsp + 0x30]
jmp 0x140002f80
mov edx, dword [rsp + 0x34]
jmp 0x140002e5d
mov r8, r14
or edx, 0xffffffff
mov rcx, r13
call fcn.140001fe4
add dword [r14], 4
mov rcx, qword [rsp + 0x70]
mov eax, dword [rcx]
add rcx, rax
mov r8d, dword [rsp + 0x68]
inc r8d
mov rdx, qword [rsp + 0x50]
jmp 0x140002e20
mov rsi, qword [rsp + 0x58]
jmp 0x140002f69
mov r14d, dword [rsp + 0x30]
jmp 0x140002f80
test rsi, rsi
je 0x140002fc8
mov edi, r15d
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x140002fc0
mov r13d, edi
mov r12, qword [rsi + r13*8]
test r12, r12
je 0x140002fba
mov rax, qword [r12]
mov rbx, qword [rax + 0x10]
mov rcx, rbx
call qword [sym.WmiApSrv.exe_void___cdecl_SetCHStringResourceHandle_struct_HINSTANCE______ptr64_]
mov rcx, r12
call rbx
mov qword [rsi + r13*8], r15
mov eax, dword [rsp + 0x38]
inc edi
cmp edi, eax
jb 0x140002f90
mov rcx, rsi
call sub.msvcrt.dll_free
mov eax, r14d
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.140019770
add rsp, 0x320
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret