Function at 0x7ff74af1004
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
lea rax, [0x7ff74b48a28]
mov dword [rcx + 8], 1
xor ebp, ebp
mov qword [rcx], rax
mov eax, dword [0x7ff74b582c8]
mov r14, rdx
mov r13, r9
mov r12, r8
mov rbx, rcx
mov sil, 0x20
mov r15d, 0xa
lea rdx, [0x7ff74b58350]
cmp eax, ebp
je 0x7ff74af1067
mov rcx, qword [0x7ff74b58350]
cmp rcx, rdx
je 0x7ff74af1067
test byte [rcx + 0x1c], sil
jne 0x7ff74b11659
mov dword [rbx + 0xb0], 2
mov dword [rbx + 0xb4], ebp
mov qword [rbx + 0xb8], rbp
cmp eax, ebp
je 0x7ff74af1098
mov rcx, qword [0x7ff74b58350]
cmp rcx, rdx
je 0x7ff74af1098
test byte [rcx + 0x1c], sil
jne 0x7ff74b11685
lea r9, [rbx + 0xd0]
mov dword [rbx + 0xc0], 8
mov dword [rbx + 0xc4], ebp
mov qword [rbx + 0xc8], rbp
mov qword [r9], rbp
mov qword [r9 + 8], rbp
cmp eax, ebp
je 0x7ff74af10de
mov rcx, qword [0x7ff74b58350]
lea rax, [0x7ff74b58350]
cmp rcx, rax
je 0x7ff74af10de
test byte [rcx + 0x1c], sil
jne 0x7ff74b116aa
mov dword [rbx + 0x10], 1
mov qword [rbx + 0x30], rbp
mov qword [rbx + 0x38], rbp
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], rbp
mov qword [rbx + 0x48], rbp
mov qword [rbx + 0x58], rbp
mov dword [rbx + 0x60], ebp
mov qword [rbx + 0x80], rbp
lea rcx, [rbx + 0x88]
mov dword [rbx + 0x64], 4
mov qword [rbx + 0x68], rbp
mov dword [rbx + 0x40], ebp
mov qword [rbx + 0x90], rbp
mov dword [rbx + 0x98], ebp
mov qword [rbx + 0xa0], rbp
mov dword [rbx + 0xe0], ebp
mov dword [rbx + 0xe4], ebp
mov dword [rbx + 0xe8], ebp
mov qword [rbx + 0xf0], rbp
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea r15, [rbx + 0x70]
mov rcx, r15
call qword [sym.imp.RPCRT4.dll_UuidCreate]
mov rsi, qword [rsp + 0xa8]
movdqu xmm5, xmmword [0x7ff74b497c8]
mov dword [rbx + 0xa8], ebp
mov qword [rbx + 0x50], rbp
mov dword [rsi], ebp
movdqu xmmword [rbx + 0xf8], xmm5
mov ebp, dword [rsp + 0xa0]
test r12, r12
je 0x7ff74b116c5
mov rcx, qword [0x7ff74b584e0]
xor edx, edx
lea r8d, [rdx + 0x10]
call qword [0x7ff74b58358]
test rax, rax
je 0x7ff74b11706
and qword [rax], 0
lea rcx, [0x7ff74b4aae0]
mov qword [rax + 8], rcx
jmp 0x7ff74af11bd
mov qword [rbx + 0x28], rax
test rax, rax
je 0x7ff74b1170d
cmp dword [rsi], 0
jne 0x7ff74b116cb
or r8, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
mov rcx, r8
repne scasw ax, word [rdi]
lea eax, [r8 + 3]
not rcx
mov rdi, rcx
mul rcx
mov rcx, qword [0x7ff74b584e0]
cmovo rax, r8
xor edx, edx
mov r8, rax
call qword [0x7ff74b58358]
mov qword [rbx + 0x20], rax
test rax, rax
je 0x7ff74b11718
mov r8, r12
mov rdx, rdi
mov rcx, rax
call fcn.7ff74af051c
xor r12d, r12d
cmp dword [rsi], r12d
jne 0x7ff74af134d
or r8, 0xffffffffffffffff
xor eax, eax
mov rdi, r13
mov rcx, r8
repne scasw ax, word [rdi]
lea eax, [r12 + 2]
not rcx
mov rdi, rcx
mul rcx
mov rcx, qword [0x7ff74b584e0]
cmovo rax, r8
xor edx, edx
mov r8, rax
call qword [0x7ff74b58358]
mov qword [rbx + 0xf0], rax
cmp rax, r12
je 0x7ff74b11720
mov r8, r13
mov rdx, rdi
mov rcx, rax
call fcn.7ff74af051c
cmp dword [rsi], r12d
jne 0x7ff74af134d
mov rax, qword [r14]
lea rdx, [0x7ff74b4f1f6]
lea rcx, [0x7ff74b4a7e0]
mov qword [rbx + 0x18], rax
mov r8, qword [0x7ff74b58398]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov r9d, ebp
mov qword [r14], r12
mov dword [rsp + 0x90], r12d
mov dword [rsp + 0x80], r12d
mov qword [rsp + 0x20], rax
call sub.RPCRT4.dll_NdrClientCall2
mov rdi, rax
cmp eax, r12d
jne 0x7ff74b1172b
mov edi, dword [rsp + 0x80]
cmp edi, r12d
jl 0x7ff74b1178c
cmp dword [rsp + 0x90], r12d
jne 0x7ff74b06407
cmp dword [rsi], r12d
jne 0x7ff74af134d
mov rcx, qword [0x7ff74b58428]
call fcn.7ff74ae3010
mov ecx, ebp
call fcn.7ff74af1398
cmp eax, r12d
je 0x7ff74b11797
mov rcx, qword [0x7ff74b584b0]
mov rdx, rbx
call fcn.7ff74ae3fe4
mov dword [rsi], eax
jmp 0x7ff74af1335
mov rcx, qword [0x7ff74b58428]
lock add dword [rcx + 0x3c], 0xffffffff
mov dword [rcx + 0x40], r12d
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x7ff74af134d
mov dword [rbx + 0x60], ebp
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74af1376
mov rcx, qword [0x7ff74b58350]
lea rax, [0x7ff74b58350]
cmp rcx, rax
je 0x7ff74af1376
test byte [rcx + 0x1c], 0x10
jne 0x7ff74b116d3
mov rax, rbx
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
bts dword [rbx + 0x64], 7
jmp 0x7ff74af1301
mov rcx, qword [rcx + 0x10]
lea r9, [rbx + 0xb0]
lea r8, [0x7ff74b51cf0]
mov edx, r15d
call fcn.7ff74b263d0
mov eax, dword [0x7ff74b582c8]
lea rdx, [0x7ff74b58350]
jmp 0x7ff74af1067
mov rcx, qword [rcx + 0x10]
lea r9, [rbx + 0xc0]
lea r8, [0x7ff74b51cf0]
mov edx, r15d
call fcn.7ff74b263d0
mov eax, dword [0x7ff74b582c8]
jmp 0x7ff74af1098
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b51ce0]
mov edx, 0xd
call fcn.7ff74b263d0
nop
jmp 0x7ff74af10de
mov dword [rsi], 0x57
xor r12d, r12d
jmp 0x7ff74af134d
mov rax, qword [rbx + 0xf0]
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
lea r8, [0x7ff74b51c00]
mov edx, 0xd
mov r9, rbx
mov dword [rsp + 0x20], ebp
call fcn.7ff74b2722c
nop
jmp 0x7ff74af1376
xor eax, eax
jmp 0x7ff74af11bd
mov dword [rsi], 0xe
jmp 0x7ff74af11ca
mov dword [rsi], 0xe
jmp 0x7ff74b116cb
mov dword [rsi], 0xe
jmp 0x7ff74af134d
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74b11765
mov rcx, qword [0x7ff74b58350]
lea rax, [0x7ff74b58350]
cmp rcx, rax
je 0x7ff74b11765
test byte [rcx + 0x1c], 1
je 0x7ff74b11765
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b51830]
mov edx, 0x2a
mov r9d, edi
call fcn.7ff74b25ec4
mov eax, edi
and eax, 0x1fff0000
cmp eax, 0x10000
je 0x7ff74af12ea
movzx eax, di
or eax, 0x80070000
cmp edi, r12d
cmovle eax, edi
mov edi, eax
jmp 0x7ff74af12ea
mov dword [rsi], 0x57
jmp 0x7ff74af1301
mov dword [rsi], 5
jmp 0x7ff74af1335