Function at 0x140079de0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe08
movaps xmmword [rsp + 0xdf0], xmm10
movaps xmmword [rsp + 0xde0], xmm9
movaps xmmword [rsp + 0xdd0], xmm8
movaps xmmword [rsp + 0xdc0], xmm7
movaps xmmword [rsp + 0xdb0], xmm6
mov rsi, rdx
mov rdi, rcx
movzx r14d, byte [rdx + 0xb8]
movzx eax, byte [rdx + 0xd8]
lea ecx, [rax - 2]
cmp ecx, 2
jae 0x140079e5a
movzx ebp, byte [rsi + 0x60]
test ebp, ebp
je 0x140079f04
cmp ebp, 1
jne 0x140079f06
movzx r15d, byte [rsi + 0x61]
jmp 0x140079f59
cmp eax, 1
jne 0x140079ea0
cmp r14b, 7
jne 0x140079e3b
movzx eax, byte [0x1401aa178]
mov edx, 0x98
xor ecx, ecx
call fcn.14011ab20
test rax, rax
je 0x14007a930
mov rdi, rax
mov qword [rax], 3
mov qword [rax + 8], 0
mov byte [rax + 0x31], 2
mov byte [rax + 0x38], 3
jmp 0x14007a251
movzx eax, byte [0x1401aa178]
mov edx, 0x98
xor ecx, ecx
call fcn.14011ab20
test rax, rax
je 0x14007a930
mov rbx, rax
mov qword [rax], 3
mov qword [rax + 8], 0
mov byte [rax + 0x31], 2
mov byte [rax + 0x38], 4
movzx eax, byte [0x1401aa178]
mov edx, 8
xor ecx, ecx
call fcn.14011ab20
test rax, rax
je 0x14007a95d
mov rdi, rax
mov qword [rax], rbx
lea rbx, [0x140162538]
jmp 0x14007a258
jmp 0x140079f59
mov r15, qword [rsi + 0x68]
movzx eax, byte [0x1401aa178]
mov edx, 0x20
xor ecx, ecx
call fcn.14011ab20
test rax, rax
je 0x14007a93f
mov rbx, rax
lea rdx, [r15 + 0x18]
mov rax, qword [r15]
mov r8, qword [r15 + 8]
mov r9, qword [r15 + 0x10]
lea rcx, [rsp + 0x2b0]
call qword [rax]
movups xmm0, xmmword [rsp + 0x2b0]
movups xmm1, xmmword [rsp + 0x2c0]
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx], xmm0
lea rdx, [rsi + 0x88]
mov rax, qword [rsi + 0x70]
mov r8, qword [rsi + 0x78]
mov r9, qword [rsi + 0x80]
lea rcx, [rsp + 0x2c0]
call qword [rax]
lea rdx, [rsi + 0xa8]
mov rax, qword [rsi + 0x90]
mov r8, qword [rsi + 0x98]
mov r9, qword [rsi + 0xa0]
lea rcx, [rsp + 0x2e0]
call qword [rax]
movzx eax, word [rsi + 0xb0]
mov byte [rsp + 0x2b0], bpl
mov byte [rsp + 0x2b1], r15b
mov qword [rsp + 0x2b8], rbx
mov word [rsp + 0x300], ax
mov r9, qword [rsp + 0x2d0]
test bpl, bpl
je 0x14007a07e
test r9, r9
je 0x14007a0dd
cmp bpl, 2
jne 0x14007a03f
movzx eax, byte [0x1401aa178]
mov edx, 0x20
xor ecx, ecx
call fcn.14011ab20
test rax, rax
je 0x14007a93f
mov r14, rax
lea rdx, [rbx + 0x18]
mov rax, qword [rbx]
mov r8, qword [rbx + 8]
mov r9, qword [rbx + 0x10]
lea rcx, [rsp + 0x120]
call qword [rax]
movups xmm0, xmmword [rsp + 0x120]
movups xmm1, xmmword [rsp + 0x130]
movups xmmword [r14 + 0x10], xmm1
movups xmmword [r14], xmm0
mov r9, qword [rsp + 0x2d0]
lea rdx, [rsp + 0x2d8]
mov rax, qword [rsp + 0x2c0]
mov r8, qword [rsp + 0x2c8]
lea rcx, [rsp + 0x1c8]
call qword [rax]
mov byte [rsp + 0x1b8], bpl
mov byte [rsp + 0x1b9], r15b
mov qword [rsp + 0x1c0], r14
jmp 0x14007a181
test r9, r9
setne al
cmp r14b, 7
sete cl
test al, cl
je 0x14007a0dd
lea rbx, [rsi + 0x60]
mov rdx, qword [rsp + 0x2c8]
lea rcx, [rsp + 0x120]
mov r8, r9
call fcn.140029cf0
cmp qword [rsp + 0x120], 0
je 0x14007a10f
movzx eax, word [rsp + 0x130]
cmp eax, 0x1bb
jne 0x14007a10f
lea rdx, [0x140182400]
mov rcx, rbx
call fcn.14003d9f0
movaps xmm0, xmmword [0x140145dc0]
jmp 0x14007a125
mov qword [rsp + 0x1b8], 0
mov byte [rsp + 0x1e1], 2
mov byte [rsp + 0x1e8], 5
mov bpl, 1
cmp byte [rsp + 0x2b0], 2
jae 0x14007a18d
jmp 0x14007a1b9
lea rdx, [0x140184258]
mov rcx, rbx
call fcn.14003d9f0
movups xmm0, xmmword [0x140184258]
movaps xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x2d8]
mov rax, qword [rsp + 0x2c0]
mov r8, qword [rsp + 0x2c8]
mov r9, qword [rsp + 0x2d0]
lea rcx, [rsp + 0x130]
call qword [rax]
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsp + 0x1b8], xmm0
movaps xmm0, xmmword [rsp + 0x130]
movaps xmm1, xmmword [rsp + 0x140]
movups xmmword [rsp + 0x1c8], xmm0
movups xmmword [rsp + 0x1d8], xmm1
xor ebp, ebp
cmp byte [rsp + 0x2b0], 2
jb 0x14007a1b9
mov rbx, qword [rsp + 0x2b8]
lea rcx, [rbx + 0x18]
mov rax, qword [rbx]
mov rdx, qword [rbx + 8]
mov r8, qword [rbx + 0x10]
call qword [rax + 0x20]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
lea rcx, [rsp + 0x2d8]
mov rax, qword [rsp + 0x2c0]
mov rdx, qword [rsp + 0x2c8]
mov r8, qword [rsp + 0x2d0]
call qword [rax + 0x20]
lea rcx, [rsp + 0x2f8]
mov rax, qword [rsp + 0x2e0]
mov rdx, qword [rsp + 0x2e8]
mov r8, qword [rsp + 0x2f0]
call qword [rax + 0x20]
lea rbx, [rsp + 0x1b8]
test bpl, bpl
je 0x14007a265
movzx eax, byte [0x1401aa178]
mov edx, 0x98
xor ecx, ecx
call fcn.14011ab20
test rax, rax
je 0x14007a930
mov rdi, rax
mov qword [rax], 3
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movups xmm2, xmmword [rbx + 0x20]
movups xmmword [rax + 8], xmm0
movups xmmword [rax + 0x18], xmm1
movups xmmword [rax + 0x28], xmm2
mov rax, qword [rbx + 0x30]
mov qword [rdi + 0x38], rax
lea rbx, [0x140181340]
mov rcx, rsi
call fcn.14007a970
jmp 0x14007a8e9
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movups xmm2, xmmword [rbx + 0x20]
movaps xmmword [rsp + 0x1a0], xmm2
movaps xmmword [rsp + 0x190], xmm1
movaps xmmword [rsp + 0x180], xmm0
movzx eax, byte [rdi + 0x172]
mov byte [rsp + 0x1b2], al
movzx eax, word [rdi + 0x170]
mov word [rsp + 0x1b0], ax
mov rax, qword [rdi + 0x158]
lock inc qword [rax]
jle 0x14007a92e
movups xmm6, xmmword [rdi + 0x158]
movsd xmm7, qword [rdi + 0xb0]
movzx r13d, byte [rdi + 0xba]
movzx r14d, byte [rdi + 0xb8]
movzx ecx, byte [rdi + 0xb9]
mov rdx, qword [rdi + 0x80]
mov r8, qword [rdi + 0x88]
mov r9, qword [rdi + 0x90]
mov r10, qword [rdi + 0x98]
mov r11, qword [rdi + 0xa0]
mov rbp, qword [rdi + 0xa8]
mov rbx, qword [rdi + 0x138]
mov rax, qword [rdi + 0x140]
lock inc qword [rbx]
jle 0x14007a92e
mov r15, qword [rdi + 0x148]
test r15, r15
mov qword [rsp + 0x118], rax
je 0x14007a34d
lock inc qword [r15]
jle 0x14007a92e
mov rax, qword [rdi + 0x150]
mov qword [rsp + 0x80], rax
jmp 0x14007a34d
mov qword [rsp + 0x110], rbp
movzx eax, byte [rdi + 0x134]
movsd xmm8, qword [rdi + 0x128]
mov ebp, dword [rdi + 0xe0]
mov dword [rsp + 0x48], ebp
mov ebp, dword [rdi + 0xe4]
mov dword [rsp + 0x44], ebp
mov ebp, dword [rdi + 0x130]
mov dword [rsp + 0x54], ebp
mov ebp, dword [rdi + 0x110]
mov dword [rsp + 0x50], ebp
mov rbp, qword [rdi + 0x108]
mov qword [rsp + 0x108], rbp
mov rbp, qword [rdi + 0xf8]
mov qword [rsp + 0x100], rbp
mov ebp, dword [rdi + 0x100]
mov dword [rsp + 0x4c], ebp
movzx ebp, byte [rdi + 0x135]
mov byte [rsp + 0x2f], bpl
mov r12, qword [rdi + 0x20]
mov rbp, qword [rdi + 0xc0]
mov qword [rsp + 0xf8], rbp
mov rbp, qword [rdi + 0xc8]
mov qword [rsp + 0xf0], rbp
movups xmm9, xmmword [rdi + 0x118]
mov rbp, qword [rdi + 0xd0]
mov qword [rsp + 0xe8], rbp
mov rbp, qword [rdi + 0xd8]
mov qword [rsp + 0xe0], rbp
mov ebp, dword [rdi + 0xe8]
mov dword [rsp + 0x40], ebp
mov ebp, dword [rdi + 0xec]
mov dword [rsp + 0x3c], ebp
mov ebp, dword [rdi + 0xf0]
mov dword [rsp + 0x38], ebp
mov ebp, dword [rdi + 0xf4]
mov dword [rsp + 0x34], ebp
mov qword [rsp + 0xd8], r12
lock inc qword [r12]
jle 0x14007a92e
mov rbp, qword [rdi + 0x28]
lock inc qword [rbp]
jle 0x14007a92e
mov r12, qword [rdi + 0x30]
cmp dword [rdi], 1
mov byte [rsp + 0x2e], cl
mov qword [rsp + 0xd0], rdx
mov qword [rsp + 0xc8], r8
mov qword [rsp + 0xc0], r9
mov qword [rsp + 0xb8], r10
mov qword [rsp + 0xb0], r11
mov byte [rsp + 0x2d], al
jne 0x14007a4a6
mov rcx, qword [rdi + 8]
call sub.crypt32.dll_CertDuplicateCertificateContext
mov qword [rsp + 0x78], rax
mov eax, 1
mov qword [rsp + 0x58], rax
jmp 0x14007a4af
mov qword [rsp + 0x58], 0
mov rcx, qword [rdi + 0x10]
call sub.crypt32.dll_CertDuplicateStore
movzx ecx, byte [rdi + 0x1c]
movzx edx, byte [rdi + 0x1d]
movsd xmm10, qword [rdi + 0x18]
mov r8, qword [rdi + 0x70]
lock inc qword [r8]
jle 0x14007a92e
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x98], r12
mov byte [rsp + 0x2b], r14b
mov byte [rsp + 0x2c], r13b
mov qword [rsp + 0xa0], r15
mov r15d, dword [rdi + 0x40]
cmp r15d, 0x3b9aca00
je 0x14007a50c
mov r8, qword [rdi + 0x38]
mov qword [rsp + 0x70], r8
mov rbp, rax
mov r13d, edx
mov r12d, ecx
mov qword [rsp + 0xa8], rbx
mov rax, qword [rdi + 0x70]
mov qword [rsp + 0x88], rax
movzx eax, byte [rdi + 0x78]
mov byte [rsp + 0x2a], al
movzx eax, byte [rdi + 0x79]
mov byte [rsp + 0x29], al
movzx eax, byte [rdi + 0x7a]
mov byte [rsp + 0x28], al
mov r14b, 2
cmp byte [rdi + 0x68], 2
je 0x14007a569
lea rdx, [rdi + 0x60]
mov rax, qword [rdi + 0x48]
mov r8, qword [rdi + 0x50]
mov r9, qword [rdi + 0x58]
lea rcx, [rsp + 0x2b0]
call qword [rax]
movzx r14d, byte [rdi + 0x68]
movups xmm0, xmmword [rsp + 0x2b0]
movups xmm1, xmmword [rsp + 0x2c0]
movups xmmword [rsp + 0x170], xmm1
movups xmmword [rsp + 0x160], xmm0
mov rbx, qword [rdi + 0x168]
test rbx, rbx
je 0x14007a59f
lock inc qword [rbx]
jle 0x14007a92e
movzx eax, byte [rsp + 0x1b2]
mov byte [rsp + 0x32], al
movzx eax, word [rsp + 0x1b0]
mov word [rsp + 0x30], ax
lea rcx, [rsp + 0x1b0]
mov r8d, 0x100
mov rdx, rsi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
movzx eax, byte [0x1401aa178]
mov edx, 0xdb0
xor ecx, ecx
call fcn.14011ab20
test rax, rax
je 0x14007a94e
mov rdi, rax
mov rax, qword [rsp + 0x58]
mov qword [rdi], rax
mov rax, qword [rsp + 0x78]
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rbp
movss dword [rdi + 0x18], xmm10
mov byte [rdi + 0x1c], r12b
mov byte [rdi + 0x1d], r13b
mov rax, qword [rsp + 0xd8]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x90]
mov qword [rdi + 0x28], rax
mov rax, qword [rsp + 0x98]
mov qword [rdi + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rdi + 0x38], rax
mov dword [rdi + 0x40], r15d
movups xmm0, xmmword [rsp + 0x15c]
movups xmm1, xmmword [rsp + 0x16c]
movups xmmword [rdi + 0x44], xmm0
movups xmmword [rdi + 0x54], xmm1
mov eax, dword [rsp + 0x17c]
mov dword [rdi + 0x64], eax
mov byte [rdi + 0x68], r14b
mov rax, qword [rsp + 0x88]
mov qword [rdi + 0x70], rax
movzx eax, byte [rsp + 0x2a]
mov byte [rdi + 0x78], al
movzx eax, byte [rsp + 0x29]
mov byte [rdi + 0x79], al
movzx eax, byte [rsp + 0x28]
mov byte [rdi + 0x7a], al
mov rax, qword [rsp + 0xd0]
mov qword [rdi + 0x80], rax
mov rax, qword [rsp + 0xc8]
mov qword [rdi + 0x88], rax
mov rax, qword [rsp + 0xc0]
mov qword [rdi + 0x90], rax
mov rax, qword [rsp + 0xb8]
mov qword [rdi + 0x98], rax
mov rax, qword [rsp + 0xb0]
mov qword [rdi + 0xa0], rax
mov rax, qword [rsp + 0x110]
mov qword [rdi + 0xa8], rax
movlps qword [rdi + 0xb0], xmm7
movzx eax, byte [rsp + 0x2b]
mov byte [rdi + 0xb8], al
movzx eax, byte [rsp + 0x2e]
mov byte [rdi + 0xb9], al
movzx eax, byte [rsp + 0x2c]
mov byte [rdi + 0xba], al
mov rax, qword [rsp + 0xf8]
mov qword [rdi + 0xc0], rax
mov rax, qword [rsp + 0xf0]
mov qword [rdi + 0xc8], rax
mov rax, qword [rsp + 0xe8]
mov qword [rdi + 0xd0], rax
mov rax, qword [rsp + 0xe0]
mov qword [rdi + 0xd8], rax
mov eax, dword [rsp + 0x48]
mov dword [rdi + 0xe0], eax
mov eax, dword [rsp + 0x44]
mov dword [rdi + 0xe4], eax
mov eax, dword [rsp + 0x40]
mov dword [rdi + 0xe8], eax
mov eax, dword [rsp + 0x3c]
mov dword [rdi + 0xec], eax
mov eax, dword [rsp + 0x38]
mov dword [rdi + 0xf0], eax
mov eax, dword [rsp + 0x34]
mov dword [rdi + 0xf4], eax
mov rax, qword [rsp + 0x100]
mov qword [rdi + 0xf8], rax
mov eax, dword [rsp + 0x4c]
mov dword [rdi + 0x100], eax
mov rax, qword [rsp + 0x108]
mov qword [rdi + 0x108], rax
mov eax, dword [rsp + 0x50]
mov dword [rdi + 0x110], eax
movups xmmword [rdi + 0x118], xmm9
movlps qword [rdi + 0x128], xmm8
mov eax, dword [rsp + 0x54]
mov dword [rdi + 0x130], eax
movzx eax, byte [rsp + 0x2d]
mov byte [rdi + 0x134], al
movzx eax, byte [rsp + 0x2f]
mov byte [rdi + 0x135], al
mov rax, qword [rsp + 0xa8]
mov qword [rdi + 0x138], rax
mov rax, qword [rsp + 0x118]
mov qword [rdi + 0x140], rax
mov rax, qword [rsp + 0xa0]
mov qword [rdi + 0x148], rax
mov rax, qword [rsp + 0x80]
mov qword [rdi + 0x150], rax
movups xmmword [rdi + 0x158], xmm6
mov qword [rdi + 0x168], rbx
movzx eax, byte [rsp + 0x32]
mov byte [rdi + 0x172], al
movzx eax, word [rsp + 0x30]
mov word [rdi + 0x170], ax
mov eax, dword [rsp + 0x60]
mov dword [rdi + 0x173], eax
movzx eax, byte [rsp + 0x64]
mov byte [rdi + 0x177], al
lea rcx, [rdi + 0x178]
lea rdx, [rsp + 0x1b0]
mov r8d, 0x100
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
movaps xmm0, xmmword [rsp + 0x180]
movaps xmm1, xmmword [rsp + 0x190]
movaps xmm2, xmmword [rsp + 0x1a0]
movups xmmword [rdi + 0x278], xmm0
movups xmmword [rdi + 0x288], xmm1
movups xmmword [rdi + 0x298], xmm2
mov rcx, rdi
add rcx, 0x2a8
lea rdx, [rsp + 0x2b0]
mov r8d, 0xb00
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov byte [rdi + 0xda8], 0
mov eax, dword [rsp + 0x120]
mov ecx, dword [rsp + 0x123]
mov dword [rdi + 0xda9], eax
mov dword [rdi + 0xdac], ecx
lea rbx, [0x140181360]
mov rax, rdi
mov rdx, rbx
movaps xmm6, xmmword [rsp + 0xdb0]
movaps xmm7, xmmword [rsp + 0xdc0]
movaps xmm8, xmmword [rsp + 0xdd0]
movaps xmm9, xmmword [rsp + 0xde0]
movaps xmm10, xmmword [rsp + 0xdf0]
add rsp, 0xe08
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
mov ecx, 8
mov edx, 0x98
call fcn.140006e69
mov ecx, 8
mov edx, 0x20
call fcn.140006e69
mov ecx, 8
mov edx, 0xdb0
call fcn.140006e69
mov ecx, 8
mov edx, 8
call fcn.140006e69
int3