Function at 0x402710
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x188
lea rax, fcn.00401860
mov r13d, dword [rsp + 0x1f0]
mov ebp, dword [rsp + 0x1f8]
mov rbx, rcx
mov byte [rcx + 8], 0
mov qword [rcx + 0x10], 0
mov qword [rcx], rax
lea rax, [0x004bf008]
mov qword [rcx + 0x18], 0
mov qword [rcx + 0x20], 0
mov dword [rcx + 0x28], 0
lea rdi, [rcx + 0x40]
mov qword [rcx + 0x30], rax
mov byte [rbx + 0x38], r8b
mov rax, r8
and byte [rcx + 0x38], 1
shr rax, 1
mov dword [rcx + 0x3c], r9d
and eax, 1
mov r12, rdx
mov rsi, r8
mov byte [rcx + 0x39], al
mov rcx, rdi
call fcn.00411810
lea rax, [rbx + 0xb8]
lea rcx, [0x004b01fc]
mov qword [rbx + 0x68], 0
mov qword [rbx + 0x70], 0
mov qword [rbx + 0x78], 0
mov r15, rax
mov qword [rsp + 0x40], rax
lea rax, [rbx + 0xc8]
mov qword [rbx + 0x80], 0
mov qword [rbx + 0x88], 0
mov qword [rbx + 0x90], 0
mov qword [rbx + 0x98], 0
mov byte [rbx + 0xa0], 0
mov byte [rbx + 0xa1], 0
mov byte [rbx + 0xa2], 0
mov qword [rbx + 0xa8], 0
mov qword [rbx + 0xb0], 0
mov qword [rbx + 0xb8], rax
mov qword [rsp + 0x48], rax
call sub.msvcrt.dll_wcslen
lea rdx, [0x004b01fc]
xor r9d, r9d
mov rcx, r15
lea r8, [rdx + rax*2]
call fcn.0049af00
lea rcx, str.Agent::Agent_entered
call fcn.00413ac0
test r13d, r13d
jle 0x402fe4
test ebp, ebp
jle 0x402fe4
cmp r13d, 0x9c4
mov eax, 0x9c4
cmovle eax, r13d
cmp ebp, 0x7d0
mov dword [rsp + 0x38], eax
mov eax, 0x7d0
cmovle eax, ebp
shr rsi, 2
and esi, 1
cmp byte [rbx + 0x39], 0
mov dword [rsp + 0x3c], eax
mov eax, 1
cmove esi, eax
cmp byte [rbx + 0x38], 0
jne 0x402fd2
lea rcx, [rsp + 0xa0]
call fcn.00411c20
cmp byte [rbx + 0x38], 0
je 0x40291c
lea rcx, [rsp + 0xc0]
call fcn.00411ca0
mov rbp, qword [rbx + 0x78]
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0xc0], 0
test rbp, rbp
mov qword [rbx + 0x78], rax
je 0x40291c
cmp byte [rbp + 8], 0
jne 0x4030f0
mov rcx, rbp
call fcn.004aaf10
mov rbp, qword [rsp + 0xc0]
test rbp, rbp
je 0x40291c
cmp byte [rbp + 8], 0
jne 0x403100
mov rcx, rbp
call fcn.004aaf10
mov rbp, qword [rsp + 0xa0]
call fcn.00417510
test al, al
jne 0x403001
mov rdx, r12
mov rcx, rbx
call fcn.00401a20
lea r8, str.conin
mov qword [rbx + 0x80], rax
xor edx, edx
mov rcx, rbx
call fcn.00401a60
lea r8, str.conout
mov qword [rbx + 0x88], rax
mov edx, 1
mov rcx, rbx
call fcn.00401a60
cmp byte [rbx + 0x38], 0
mov qword [rbx + 0x90], rax
je 0x402997
lea r8, str.conerr
mov edx, 1
mov rcx, rbx
call fcn.00401a60
mov qword [rbx + 0x98], rax
lea rbp, [rsp + 0x160]
lea r14, [rsp + 0x100]
mov r8d, 8
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
mov rdx, rbp
mov rcx, r14
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x160], 0
call fcn.00413980
lea r13, [rsp + 0x120]
mov rax, qword [rbx + 0x88]
xor r9d, r9d
lea rdx, [r13 + 0x10]
mov rcx, r13
mov qword [rsp + 0x120], rdx
mov rdx, qword [rax]
mov rax, qword [rax + 8]
lea r8, [rdx + rax*2]
call fcn.0049af00
mov r8, qword [rsp + 0x128]
mov rdx, qword [rsp + 0x120]
mov rcx, r14
call fcn.00413a40
mov rcx, qword [rsp + 0x120]
lea rax, [r13 + 0x10]
cmp rcx, rax
je 0x402a47
call fcn.004aaf10
lea r12, [rsp + 0x140]
mov rax, qword [rbx + 0x90]
xor r9d, r9d
lea rdx, [r12 + 0x10]
mov rcx, r12
mov qword [rsp + 0x140], rdx
mov rdx, qword [rax]
mov rax, qword [rax + 8]
lea r8, [rdx + rax*2]
call fcn.0049af00
mov r8, qword [rsp + 0x148]
mov rdx, qword [rsp + 0x140]
mov rcx, r14
call fcn.00413a40
mov rcx, qword [rsp + 0x140]
lea rax, [r12 + 0x10]
cmp rcx, rax
je 0x402aa8
call fcn.004aaf10
cmp byte [rbx + 0x38], 0
je 0x402b05
mov rax, qword [rbx + 0x98]
lea rdx, [rbp + 0x10]
xor r9d, r9d
mov rcx, rbp
mov qword [rsp + 0x160], rdx
mov rdx, qword [rax]
mov rax, qword [rax + 8]
lea r8, [rdx + rax*2]
call fcn.0049af00
mov r8, qword [rsp + 0x168]
mov rdx, qword [rsp + 0x160]
mov rcx, r14
call fcn.00413a40
mov rcx, qword [rsp + 0x160]
lea rax, [rbp + 0x10]
cmp rcx, rax
je 0x402b05
call fcn.004aaf10
mov rdx, r14
mov rcx, rbx
call fcn.00401d20
mov rcx, qword [rsp + 0x100]
test rcx, rcx
je 0x402b22
call fcn.004aaf10
mov ecx, 0x60
mov qword [rsp + 0xb0], 0
call fcn.004aaf50
mov rcx, qword [rbx + 0x90]
mov r14, qword [rsp + 0xb0]
movzx edx, byte [rbx + 0x39]
mov qword [rax + 8], 0
mov dword [rax + 0x10], 0
mov byte [rax + 0x14], 1
mov qword [rax], rcx
lea rcx, [rax + 0x48]
test r14, r14
mov qword [rax + 0x18], 0
mov qword [rax + 0x20], 0
mov qword [rax + 0x28], 0
mov byte [rax + 0x30], 0
mov dword [rax + 0x34], 0xffffffff
mov qword [rax + 0x38], rcx
mov qword [rax + 0x40], 0
mov byte [rax + 0x48], 0
mov byte [rax + 0x58], dl
mov byte [rax + 0x59], sil
mov byte [rax + 0x5a], 0
mov qword [rsp + 0xb0], rax
je 0x402be0
mov rcx, qword [r14 + 0x38]
lea rax, [r14 + 0x48]
cmp rcx, rax
je 0x402bc2
call fcn.004aaf10
mov rcx, qword [r14 + 0x18]
test rcx, rcx
je 0x402bd0
call fcn.004aaf10
mov rcx, r14
call fcn.004aaf10
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x160], rax
movzx eax, word [rsp + 0x38]
mov ecx, 0x88
mov r15, qword [rsp + 0xa0]
mov qword [rsp + 0xb0], 0
mov word [rsp + 0x140], ax
movzx eax, word [rsp + 0x3c]
mov word [rsp + 0x142], ax
call fcn.004aaf50
mov qword [rsp + 0x20], r12
mov r9, rbp
mov r8, r15
mov rdx, rdi
mov rcx, rax
mov r14, rax
call fcn.00410760
mov r15, qword [rbx + 0x68]
mov qword [rbx + 0x68], r14
test r15, r15
je 0x402c56
mov rcx, r15
call fcn.0040f100
mov rcx, r15
call fcn.004aaf10
mov r14, qword [rsp + 0x160]
test r14, r14
je 0x402c8b
mov rcx, qword [r14 + 0x38]
lea rax, [r14 + 0x48]
cmp rcx, rax
je 0x402c75
call fcn.004aaf10
mov rcx, qword [r14 + 0x18]
test rcx, rcx
je 0x402c83
call fcn.004aaf10
mov rcx, r14
call fcn.004aaf10
cmp byte [rbx + 0x38], 0
je 0x402e2f
mov ecx, 0x60
mov qword [rsp + 0x140], 0
call fcn.004aaf50
mov rcx, qword [rbx + 0x98]
movzx edx, byte [rbx + 0x39]
mov byte [rax + 0x59], sil
mov rsi, qword [rsp + 0x140]
mov qword [rax + 8], 0
mov dword [rax + 0x10], 0
mov qword [rax], rcx
lea rcx, [rax + 0x48]
mov byte [rax + 0x14], 1
test rsi, rsi
mov qword [rax + 0x18], 0
mov qword [rax + 0x20], 0
mov qword [rax + 0x28], 0
mov byte [rax + 0x30], 0
mov dword [rax + 0x34], 0xffffffff
mov qword [rax + 0x38], rcx
mov qword [rax + 0x40], 0
mov byte [rax + 0x48], 0
mov byte [rax + 0x58], dl
mov byte [rax + 0x5a], 0
mov qword [rsp + 0x140], rax
je 0x402d53
mov rcx, qword [rsi + 0x38]
lea rax, [rsi + 0x48]
cmp rcx, rax
je 0x402d35
call fcn.004aaf10
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x402d43
call fcn.004aaf10
mov rcx, rsi
call fcn.004aaf10
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x160], rax
movzx eax, word [rsp + 0x38]
mov ecx, 0x88
mov r14, qword [rbx + 0x78]
mov qword [rsp + 0x140], 0
mov word [rsp + 0x120], ax
movzx eax, word [rsp + 0x3c]
mov word [rsp + 0x122], ax
call fcn.004aaf50
mov qword [rsp + 0x20], r13
mov r9, rbp
mov r8, r14
mov rdx, rdi
mov rcx, rax
mov rsi, rax
call fcn.00410760
mov rbp, qword [rbx + 0x70]
mov qword [rbx + 0x70], rsi
test rbp, rbp
je 0x402dc5
mov rcx, rbp
call fcn.0040f100
mov rcx, rbp
call fcn.004aaf10
mov rsi, qword [rsp + 0x160]
test rsi, rsi
je 0x402dfa
mov rcx, qword [rsi + 0x38]
lea rax, [rsi + 0x48]
cmp rcx, rax
je 0x402de4
call fcn.004aaf10
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x402df2
call fcn.004aaf10
mov rcx, rsi
call fcn.004aaf10
mov rsi, qword [rsp + 0x140]
test rsi, rsi
je 0x402e2f
mov rcx, qword [rsi + 0x38]
lea rax, [rsi + 0x48]
cmp rcx, rax
je 0x402e19
call fcn.004aaf10
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x402e27
call fcn.004aaf10
mov rcx, rsi
call fcn.004aaf10
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call fcn.00411b40
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xf8
mov rsi, rax
call fcn.004aaf50
mov qword [rsp + 0x20], rdi
mov r8d, dword [rbx + 0x3c]
lea r9, [rbx + 0x30]
mov rdx, rsi
mov rcx, rax
mov rbp, rax
call fcn.004060a0
mov rsi, qword [rbx + 0xa8]
mov qword [rbx + 0xa8], rbp
test rsi, rsi
je 0x402f41
mov rcx, qword [rsi + 0x60]
mov rax, qword [rsi + 0x68]
sub rax, rcx
sar rax, 4
test rax, rax
je 0x402ec9
xor edi, edi
nop dword [rax]
mov rax, rdi
add rdi, 1
shl rax, 4
mov rcx, qword [rcx + rax + 8]
call fcn.0042f0e8
mov rcx, qword [rsi + 0x60]
mov rax, qword [rsi + 0x68]
sub rax, rcx
sar rax, 4
cmp rax, rdi
ja 0x402ea0
test rcx, rcx
mov qword [rsi + 0x68], rcx
je 0x402ed7
call fcn.004aaf10
mov rcx, qword [rsi + 0x48]
mov rax, qword [rsi + 0x50]
sub rax, rcx
sar rax, 4
test rax, rax
je 0x402f19
xor edi, edi
nop dword [rax]
mov rax, rdi
add rdi, 1
shl rax, 4
mov rcx, qword [rcx + rax + 8]
call fcn.0042f0e8
mov rcx, qword [rsi + 0x48]
mov rax, qword [rsi + 0x50]
sub rax, rcx
sar rax, 4
cmp rax, rdi
ja 0x402ef0
test rcx, rcx
mov qword [rsi + 0x50], rcx
je 0x402f27
call fcn.004aaf10
mov rcx, qword [rsi + 0x28]
lea rax, [rsi + 0x38]
cmp rcx, rax
je 0x402f39
call fcn.004aaf10
mov rcx, rsi
call fcn.004aaf10
xor edx, edx
xor ecx, ecx
mov rsi, qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
call rsi
mov edx, 1
lea rcx, [0x004015c0]
call rsi
mov edx, 0x19
mov rcx, rbx
call fcn.0040c340
mov rbx, qword [rsp + 0xb0]
test rbx, rbx
je 0x402f9e
mov rcx, qword [rbx + 0x38]
lea rax, [rbx + 0x48]
cmp rcx, rax
je 0x402f88
call fcn.004aaf10
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x402f96
call fcn.004aaf10
mov rcx, rbx
call fcn.004aaf10
mov rbx, qword [rsp + 0xa0]
test rbx, rbx
je 0x402fbe
cmp byte [rbx + 8], 0
jne 0x4030e0
mov rcx, rbx
call fcn.004aaf10
nop
add rsp, 0x188
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0xa0]
call fcn.00411be0
jmp 0x4028b7
lea r8, str.initialCols___1__initialRows___1
lea rcx, str.src_agent_Agent.cc
mov edx, 0x9c
call fcn.00418fa0
jmp 0x402867
lea r14, [rsp + 0x100]
mov rdx, rbp
mov rcx, r14
call fcn.00411e10
movzx r13d, word [rsp + 0x10e]
movzx r15d, word [rsp + 0x110]
cmp word [rsp + 0x10a], r13w
je 0x403130
lea rdx, [rsp + 0x50]
mov rcx, rbp
mov word [rsp + 0x50], r13w
mov word [rsp + 0x52], r15w
call fcn.00412060
cmp byte [rbx + 0x48], 0
jne 0x403110
mov byte [rbx + 0x49], 1
mov edx, 1
mov rcx, rdi
call fcn.00411b70
lea rcx, [rsp + 0x70]
mov rdx, rbp
call fcn.00412030
movzx eax, word [rsp + 0x50]
xor r13d, r13d
cmp word [rsp + 0x70], ax
je 0x4032d0
xor edx, edx
mov rcx, rdi
call fcn.00411b70
xor edx, edx
xor eax, eax
mov rcx, rbp
mov word [rsp + 0x62], dx
lea rdx, [rsp + 0x60]
mov word [rsp + 0x60], ax
call fcn.00412060
lea rax, str.detected
lea rdx, str.not_detected
test r13b, r13b
lea rcx, str.Attempting_to_detect_new_Windows_10_console_using_MARK:__s
cmovne rdx, rax
call fcn.00413ac0
mov byte [rbx + 0x49], 0
mov byte [rbx + 0x4a], r13b
jmp 0x402931
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402fb5
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4028f5
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402914
lea r8, str._console.frozen__
lea rcx, str.src_agent_Agent.cc
mov edx, 0x69
call fcn.00418fa0
jmp 0x403058
cmp word [rsp + 0x10c], r15w
jne 0x403035
lea rcx, str.detectNewWindows10Console:_Initial_console_window_was_1x1____expanding_for_test
call fcn.00413ac0
mov rcx, rbp
call fcn.00411d40
xor r8d, r8d
mov edx, 0x190
mov rcx, rax
call fcn.004055c0
xor eax, eax
lea rdx, [rsp + 0xf0]
mov rcx, rbp
mov word [rsp + 0xf0], ax
xor eax, eax
mov word [rsp + 0xf2], ax
xor eax, eax
mov word [rsp + 0xf4], ax
xor eax, eax
mov word [rsp + 0xf6], ax
call fcn.00412000
mov eax, 0x190
lea rdx, [rsp + 0x90]
mov rcx, rbp
mov word [rsp + 0x90], ax
mov eax, 1
mov word [rsp + 0x92], ax
call fcn.00411fc0
lea rdx, [rsp + 0xe0]
xor r10d, r10d
xor r11d, r11d
mov r13d, 1
xor r15d, r15d
mov rcx, rbp
mov word [rsp + 0xe0], r10w
mov word [rsp + 0xe2], r11w
mov word [rsp + 0xe4], r13w
mov word [rsp + 0xe6], r15w
call fcn.00412000
mov rcx, rbp
call fcn.00411d40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
lea rcx, [rsp + 0x80]
mov rdx, rbp
mov r13d, eax
call fcn.00411e60
cmp word [rsp + 0x80], r13w
mov eax, r13d
lea rdx, [rsp + 0xd0]
cmovle ax, word [rsp + 0x80]
xor ecx, ecx
xor r8d, r8d
mov word [rsp + 0xd0], cx
xor r9d, r9d
mov rcx, rbp
mov word [rsp + 0xd2], r8w
mov word [rsp + 0xd6], r9w
sub eax, 1
mov word [rsp + 0xd4], ax
call fcn.00412000
mov rdx, rbp
mov rcx, r14
call fcn.00411e10
movzx r13d, word [rsp + 0x10e]
movzx r15d, word [rsp + 0x110]
cmp word [rsp + 0x10a], r13w
jl 0x403035
lea r8, str.info.srWindow.Right___info.srWindow.Left___Could_not_expand_console_window_from_1x1_
lea rcx, str.src_agent_Agent.cc
mov edx, 0x63
call fcn.00418fa0
jmp 0x403035
movzx eax, word [rsp + 0x52]
cmp word [rsp + 0x72], ax
sete r13b
jmp 0x403089