Function at 0x1002fb68
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r11, rsp
sub rsp, 0xd8
mov qword [rsp + 0xc0], 0xfffffffffffffffe
mov r14, rdx
mov rdi, rcx
mov dword [rcx + 0x150], 0xffffffff
lea rax, [0x100fafe8]
mov qword [r11 - 0x58], rax
xor r15d, r15d
mov qword [r11 - 0x50], r15
mov qword [r11 - 0x48], r15
mov ebx, 0x40000
mov rcx, rbx
call fcn.10002fd0
mov r12, rax
mov qword [rsp + 0x78], rax
xor ecx, ecx
call sub.msvcrt.dll_free
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x88], rbx
lea esi, [r15 + 2]
mov qword [rsp + 0x60], rsi
mov r8, rsi
mov rdx, r12
mov rcx, r14
call fcn.1000abc8
mov ebx, eax
cmp eax, r15d
je 0x1002fc0e
jmp 0x1002fd57
cmp byte [r12], 0x4d
jne 0x100304e1
cmp byte [r12 + 1], 0x5a
jne 0x100304e1
mov qword [rsp + 0x60], 0x3fffe
lea rdx, [r12 + 2]
lea r8, [rsp + 0x60]
mov rcx, r14
call fcn.1000ab5c
cmp eax, r15d
je 0x1002fc4c
mov ebx, eax
jmp 0x1002fd57
mov rax, qword [rsp + 0x60]
add rax, rsi
mov qword [rsp + 0x60], rax
mov r8d, eax
mov rdx, r12
mov rcx, rdi
call fcn.1002e230
cmp al, r15b
jne 0x1002fc76
mov ebx, 1
jmp 0x1002fd57
lea r8, [rsp + 0x138]
mov rdx, r14
mov rcx, rdi
call fcn.1002e9d8
cmp eax, r15d
je 0x1002fc95
mov ebx, eax
jmp 0x1002fd57
cmp dword [rdi + 0xe8], r15d
je 0x1002fd0f
lea rcx, [rsp + 0x20]
call fcn.10001c1c
mov byte [rsp + 0x48], r15b
mov byte [rsp + 0x49], r15b
mov byte [rsp + 0x4a], r15b
lea rdx, str.CERTIFICATE
lea rcx, [rsp + 0x20]
call fcn.10004c94
mov dword [rsp + 0x34], r15d
mov ecx, dword [rdi + 0xe4]
mov dword [rsp + 0x3c], ecx
mov eax, dword [rdi + 0xe8]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x38], eax
lea edx, [rax + rcx]
cmp edx, dword [rdi + 0x148]
jbe 0x1002fcf6
mov dword [rdi + 0x148], edx
lea rcx, [rdi + 0x20]
lea rdx, [rsp + 0x20]
call fcn.1002dfe0
nop
mov rcx, qword [rsp + 0x20]
call sub.msvcrt.dll_free
mov esi, 1
mov ebp, 0x1000
cmp byte [rsp + 0x138], r15b
je 0x1002fe2c
mov ecx, dword [rdi + 0x148]
mov eax, ecx
and eax, 0xfff
je 0x1002fe2c
mov ebx, ebp
sub ebx, eax
mov rax, qword [r14]
mov rdx, rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
call qword [rax + 0x20]
cmp eax, r15d
je 0x1002fd66
mov ebx, eax
mov rcx, r12
call sub.msvcrt.dll_free
mov eax, ebx
jmp 0x100304ee
mov rcx, r12
call sub.msvcrt.dll_free
mov qword [rsp + 0x90], r15
mov qword [rsp + 0x88], r15
mov rcx, rbp
call fcn.10002fd0
mov r12, rax
mov qword [rsp + 0x78], rax
xor ecx, ecx
call sub.msvcrt.dll_free
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x88], rbp
mov r13d, ebx
mov qword [rsp + 0x138], r13
lea r8, [rsp + 0x138]
mov rdx, r12
mov rcx, r14
call fcn.1000ab5c
mov ebx, eax
cmp eax, r15d
je 0x1002fdd9
mov rcx, r12
call sub.msvcrt.dll_free
mov eax, ebx
jmp 0x100304ee
mov rdx, r15
mov rcx, qword [rsp + 0x138]
cmp rcx, r15
jbe 0x1002fdf7
cmp byte [r12 + rdx], r15b
jne 0x1002fdf7
add rdx, rsi
cmp rdx, rcx
jb 0x1002fde9
cmp rcx, r13
jae 0x1002fe0a
cmp rcx, 0x64
jae 0x1002fe0a
add dword [rdi + 0x148], ecx
jmp 0x1002fe2c
mov r8d, dword [rdi + 0x148]
lea rax, [r8 + rdx]
test rax, 0x1ff
je 0x1002fe22
cmp rcx, r13
jae 0x1002fe2c
lea eax, [r8 + rdx]
mov dword [rdi + 0x148], eax
cmp dword [rdi + 0x50], r15d
jbe 0x1002ff4b
cmp dword [rdi + 0x4c], 0x200
jb 0x1002ff4b
cmp dword [rdi + 0x50], 0x1000000
jb 0x1002fe51
jmp 0x1003044d
lea rcx, [rsp + 0x20]
call fcn.10001c1c
mov byte [rsp + 0x48], r15b
mov byte [rsp + 0x49], r15b
mov byte [rsp + 0x4a], r15b
lea rdx, str.COFF_SYMBOLS
lea rcx, [rsp + 0x20]
call fcn.10004c94
mov r11d, dword [rdi + 0x50]
lea ebx, [r11 + r11*8]
add ebx, ebx
mov r10, qword [r14]
mov edx, dword [rdi + 0x4c]
mov eax, ebx
add rdx, rax
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
call qword [r10 + 0x20]
mov r13d, eax
cmp eax, r15d
je 0x1002feb8
mov rcx, qword [rsp + 0x20]
call sub.msvcrt.dll_free
nop
mov esi, r13d
jmp 0x1003044d
mov r8d, 4
lea rdx, [rsp + 0x138]
mov rcx, r14
call fcn.1000abc8
mov r13d, eax
cmp eax, r15d
je 0x1002fee9
mov rcx, qword [rsp + 0x20]
call sub.msvcrt.dll_free
nop
mov esi, r13d
jmp 0x1003044d
cmp dword [rsp + 0x138], 0x10000000
jb 0x1002ff06
mov rcx, qword [rsp + 0x20]
call sub.msvcrt.dll_free
nop
jmp 0x1003044d
add ebx, dword [rsp + 0x138]
mov dword [rsp + 0x34], r15d
mov eax, dword [rdi + 0x4c]
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x38], ebx
lea ecx, [rax + rbx]
cmp ecx, dword [rdi + 0x148]
jbe 0x1002ff32
mov dword [rdi + 0x148], ecx
lea rcx, [rdi + 0x20]
lea rdx, [rsp + 0x20]
call fcn.1002dfe0
nop
mov rcx, qword [rsp + 0x20]
call sub.msvcrt.dll_free
mov rax, qword [r14]
lea r9, [rsp + 0xb8]
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, r14
call qword [rax + 0x20]
cmp eax, r15d
je 0x1002ff6e
mov esi, eax
jmp 0x1003044d
mov ecx, dword [rdi + 0x148]
mov rax, qword [rsp + 0xb8]
cmp rax, rcx
jbe 0x1002ff86
jmp 0x1003044d
cmp rcx, rax
cmovb eax, ecx
mov dword [rdi + 0x14c], eax
lea rax, [rdi + 0x20]
mov qword [rsp + 0x58], rax
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.1002eef0
nop
xor r8d, r8d
lea rdx, [0x1002e098]
lea rcx, [rsp + 0x98]
call fcn.100272a4
mov r14, r15
movsxd r15, dword [rsp + 0xa4]
test r15, r15
jle 0x100300ef
mov edi, r14d
mov r12, qword [rsp + 0x58]
mov rax, qword [rsp + 0xa8]
mov r13, qword [rax + r14*8]
cmp dword [r13 + 0x1c], ebp
jbe 0x100300c2
lea rcx, [rsp + 0x20]
call fcn.10001c1c
mov byte [rsp + 0x48], 0
mov byte [rsp + 0x49], 0
mov dword [rsp + 0x34], ebp
mov dword [rsp + 0x3c], ebp
mov eax, dword [r13 + 0x1c]
sub eax, ebp
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x38], eax
mov byte [rsp + 0x4a], sil
mov dl, 0x5b
lea rcx, [rsp + 0x20]
call fcn.1002b640
mov edx, edi
lea rcx, [rsp + 0x68]
call fcn.1002ba6c
mov rbx, rax
mov edx, dword [rax + 8]
lea rcx, [rsp + 0x20]
call fcn.10001b6c
movsxd r11, dword [rsp + 0x28]
mov rcx, r11
add rcx, qword [rsp + 0x20]
mov rdx, qword [rbx]
mov al, byte [rdx]
mov byte [rcx], al
add rcx, rsi
add rdx, rsi
test al, al
jne 0x1003005c
add r11d, dword [rbx + 8]
mov dword [rsp + 0x28], r11d
add edi, esi
mov rcx, qword [rsp + 0x68]
call sub.msvcrt.dll_free
mov edx, esi
lea rcx, [rsp + 0x20]
call fcn.10001b6c
movsxd r11, dword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov byte [r11 + rbx], 0x5d
add r11d, esi
mov dword [rsp + 0x28], r11d
movsxd rax, r11d
mov byte [rax + rbx], 0
lea rdx, [rsp + 0x20]
mov rcx, r12
call fcn.1002dfe0
mov ebp, dword [r13 + 0x1c]
mov rcx, rbx
call sub.msvcrt.dll_free
mov ecx, dword [r13 + 0x1c]
mov eax, dword [r13 + 0x18]
lea edx, [rcx + rax]
cmp edx, ecx
jb 0x100300e2
cmp edx, ebp
cmovae ebp, edx
add r14, rsi
cmp r14, r15
jl 0x1002ffdf
mov rdi, qword [rsp + 0x120]
mov r12, qword [rsp + 0x78]
lea rax, [0x100f47e0]
mov qword [rsp + 0x98], rax
lea rcx, [rsp + 0x98]
call fcn.10001a14
nop
lea rcx, [rsp + 0x98]
call fcn.10001abc
mov byte [rdi + 0x1e0], sil
xor r14d, r14d
mov rbp, r14
mov qword [rsp + 0x50], r14
mov r13, r14
mov ebx, r14d
mov dword [rsp + 0x120], r14d
cmp dword [rdi + 0x2c], r14d
jle 0x1003047b
mov rcx, r14
mov qword [rsp + 0x58], r14
jmp 0x10030152
mov rbp, qword [rsp + 0x50]
mov rax, qword [rdi + 0x30]
mov r15, qword [rcx + rax]
mov dword [rsp + 0x68], ebx
cmp byte [rdi + 0x1e0], r14b
je 0x100303a9
lea rdx, str..rsrc
mov rcx, qword [r15]
call fcn.100016d0
cmp eax, r14d
jne 0x100303a9
cmp dword [rdi + 0x164], r14d
jne 0x100303a9
mov r9, qword [rsp + 0x130]
mov r8, qword [rsp + 0x128]
mov edx, ebx
mov rcx, rdi
call fcn.1002f240
cmp eax, r14d
jne 0x10030399
mov rdx, r15
lea rcx, [rsp + 0x98]
call fcn.1002b4b4
mov rbp, rax
lea rbx, [rdi + 0x1b8]
cmp rax, rbx
je 0x1003020a
mov dword [rbx + 8], r14d
mov rcx, qword [rbx]
mov word [rcx], r14w
mov edx, dword [rax + 8]
mov rcx, rbx
call fcn.1000178c
mov r11, qword [rbx]
mov rcx, qword [rbp]
movzx eax, word [rcx]
mov word [r11], ax
add r11, 2
add rcx, 2
cmp ax, r14w
jne 0x100301ef
mov eax, dword [rbp + 8]
mov dword [rbx + 8], eax
mov rcx, qword [rsp + 0x98]
call sub.msvcrt.dll_free
cmp dword [rdi + 0x164], 0
jle 0x100302d3
xor ebp, ebp
mov r12, qword [rsp + 0x50]
mov rax, qword [rdi + 0x168]
cmp byte [rax + rbp + 0x2e], 0
je 0x100302b5
mov dword [rsp + 0x6c], r14d
mov dword [rsp + 0x70], 0xffffffff
cmp dword [rax + rbp], 0xa
je 0x10030252
cmp dword [rax + rbp], 0x40
jbe 0x10030276
mov eax, dword [rax + rbp + 0xc]
cmp rax, r12
jb 0x1003026f
mov r13, r12
mov r12, rax
mov eax, dword [rdi + 0x1f4]
mov dword [rdi + 0x150], eax
jmp 0x10030276
cmp rax, r13
cmovae r13, rax
lea rcx, [rdi + 0x1e8]
call fcn.10001a24
movsxd rax, dword [rdi + 0x1f4]
lea rdx, [rax + rax*2]
mov rcx, qword [rdi + 0x1f8]
lea r8, [rsp + 0x68]
mov eax, dword [r8]
mov dword [rcx + rdx*4], eax
mov eax, dword [r8 + 4]
mov dword [rcx + rdx*4 + 4], eax
mov eax, dword [r8 + 8]
mov dword [rcx + rdx*4 + 8], eax
add dword [rdi + 0x1f4], esi
add r14d, esi
add rbp, 0x30
cmp r14d, dword [rdi + 0x164]
jl 0x1003022b
mov qword [rsp + 0x50], r12
mov r12, qword [rsp + 0x78]
mov edx, dword [r15 + 0x10]
cmp dword [r15 + 0x18], edx
jbe 0x1003041f
mov ecx, 9
mov eax, esi
shl eax, cl
cmp eax, dword [rdi + 0x7c]
je 0x100302fb
add ecx, esi
cmp ecx, 0x10
jle 0x100302e6
mov ecx, 0xffffffff
xor r14d, r14d
cmp ecx, r14d
jl 0x10030422
mov eax, esi
shl eax, cl
sub eax, esi
lea ebx, [rax + rdx]
not eax
and ebx, eax
cmp dword [r15 + 0x18], ebx
jbe 0x10030422
lea rcx, [rsp + 0x20]
call fcn.10001c1c
mov byte [rsp + 0x48], r14b
mov byte [rsp + 0x49], r14b
mov byte [rsp + 0x4a], r14b
mov dword [rsp + 0x40], r14d
mov eax, dword [r15 + 0x1c]
lea ecx, [rbx + rax]
mov dword [rsp + 0x3c], ecx
mov eax, dword [r15 + 0x14]
lea ecx, [rbx + rax]
mov dword [rsp + 0x34], ecx
mov eax, dword [r15 + 0x18]
sub eax, ebx
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
lea rdx, str..rsrc_2
lea rcx, [rsp + 0x20]
call fcn.10004c94
mov dword [rsp + 0x44], r14d
mov byte [rsp + 0x4a], sil
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x20]
call fcn.1002dfe0
nop
mov rcx, qword [rsp + 0x20]
call sub.msvcrt.dll_free
jmp 0x10030422
cmp eax, esi
jne 0x1003044b
mov rcx, rdi
call fcn.1002c318
mov eax, 0xffffffff
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x6c], eax
cmp byte [r15 + 0x2a], r14b
je 0x100303de
mov eax, dword [r15 + 0x18]
cmp rax, rbp
jb 0x100303db
mov r13, rbp
mov qword [rsp + 0x50], rax
mov eax, dword [rdi + 0x1f4]
mov dword [rdi + 0x150], eax
jmp 0x100303de
mov r13, rax
lea rcx, [rdi + 0x1e8]
call fcn.10001a24
movsxd rax, dword [rdi + 0x1f4]
lea rdx, [rax + rax*2]
mov rcx, qword [rdi + 0x1f8]
lea r8, [rsp + 0x68]
mov eax, dword [r8]
mov dword [rcx + rdx*4], eax
mov eax, dword [r8 + 4]
mov dword [rcx + rdx*4 + 4], eax
mov eax, dword [r8 + 8]
mov dword [rcx + rdx*4 + 8], eax
add dword [rdi + 0x1f4], esi
jmp 0x10030422
xor r14d, r14d
mov ebx, dword [rsp + 0x120]
add ebx, esi
mov dword [rsp + 0x120], ebx
mov rcx, qword [rsp + 0x58]
add rcx, 8
mov qword [rsp + 0x58], rcx
cmp ebx, dword [rdi + 0x2c]
jl 0x1003014d
jmp 0x1003045c
mov esi, eax
mov rcx, r12
call sub.msvcrt.dll_free
mov eax, esi
jmp 0x100304ee
cmp r13, 0x100000
jb 0x1003047b
lea rax, [r13 + r13]
cmp qword [rsp + 0x50], rax
jae 0x1003047b
mov dword [rdi + 0x150], 0xffffffff
mov ebp, r14d
cmp dword [rdi + 0x1f4], r14d
jle 0x100304d5
mov rbx, r14
mov rax, qword [rdi + 0x1f8]
cmp dword [rbx + rax + 8], r14d
jge 0x100304bf
cmp dword [rbx + rax + 4], r14d
jge 0x100304bf
movsxd rcx, dword [rbx + rax]
mov rax, qword [rdi + 0x30]
mov rcx, qword [rax + rcx*8]
lea rdx, str._winzip_
mov rcx, qword [rcx]
call fcn.100016d0
cmp eax, r14d
je 0x100304cf
add ebp, esi
add rbx, 0xc
cmp ebp, dword [rdi + 0x1f4]
jl 0x1003048a
jmp 0x100304d5
mov dword [rdi + 0x150], ebp
mov rcx, r12
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x100304ee
mov rcx, r12
call sub.msvcrt.dll_free
mov eax, 1
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret