Function at 0x1400f5730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push r13
push r15
sub rsp, 0x50
xor r13d, r13d
mov rbp, rdx
mov r15, rcx
cmp byte [rdx + 0x4e], r13b
jne 0x1400f5763
lea r8, [0x1401e1658]
call fcn.140090560
lea eax, [r13 + 1]
add rsp, 0x50
pop r15
pop r13
pop rbp
ret
cmp dword [rdx + 0x9c], 1
jle 0x1400f5787
lea r8, [0x1401e1680]
call fcn.140090560
mov eax, 1
add rsp, 0x50
pop r15
pop r13
pop rbp
ret
mov eax, dword [rdx + 0x2c]
mov ecx, dword [rdx + 0x60]
mov qword [rsp + 0x70], rbx
mov ebx, dword [rdx + 0x28]
mov dword [rsp + 0x88], eax
and eax, 0xfffaffff
or eax, 0x100500
cmp byte [rdx + 0x4f], 2
mov dword [rsp + 0x20], ecx
mov ecx, dword [rdx + 0x64]
mov dword [rdx + 0x2c], eax
mov rax, qword [rdx + 0x20]
mov dword [rsp + 0x24], ecx
mov rcx, qword [rdx + 0xb8]
mov qword [rdx + 0xb8], r13
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x30], r14
mov r14, qword [rax + 8]
lea r8, [0x1401e16b0]
mov rdx, r15
mov rax, qword [r14 + 8]
mov rcx, qword [rax]
movzx eax, byte [rcx + 0x12]
mov rcx, rbp
mov dword [rsp + 0x80], eax
lea rax, [0x1401e16d0]
cmovne r8, rax
call fcn.1400f5450
mov edi, eax
movsxd rax, dword [rbp + 0x28]
cmp eax, ebx
jle 0x1400f5824
lea ecx, [rax - 1]
movsxd r13, ecx
shl r13, 5
add r13, qword [rbp + 0x20]
test edi, edi
jne 0x1400f5d05
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov qword [rsp + 0x38], r12
shl rcx, 5
mov r12, qword [rcx + rax - 0x18]
mov rcx, r12
call fcn.1400a63e0
mov rcx, r14
call fcn.1400a2330
mov rcx, qword [r14 + 8]
mov eax, dword [rcx + 0x30]
sub eax, dword [rcx + 0x34]
mov dword [rsp + 0x78], eax
cmp byte [r14 + 0x11], dil
je 0x1400f587f
dec dword [r14 + 0x14]
jne 0x1400f587f
mov rcx, qword [rcx + 0x50]
test rcx, rcx
je 0x1400f587a
call qword [0x140237070]
mov byte [r14 + 0x12], 0
lea r8, [0x1401e16e8]
mov rdx, r15
mov rcx, rbp
call fcn.1400f5450
mov edi, eax
test eax, eax
jne 0x1400f5d00
lea r8, [0x1401e170c]
mov rdx, r15
mov rcx, rbp
call fcn.1400f5450
mov edi, eax
test eax, eax
jne 0x1400f5d00
mov rbx, qword [r14 + 8]
mov rcx, r14
mov qword [rsp + 0x48], rsi
call fcn.1400a2330
cmp byte [r14 + 0x10], 2
je 0x1400f5ae6
movzx edx, word [rbx + 0x26]
test dl, 1
je 0x1400f58e6
mov edi, 8
jmp 0x1400f5af9
cmp byte [rbx + 0x24], 2
je 0x1400f5934
test dl, 0x40
jne 0x1400f5934
mov rax, qword [rbx + 0x70]
test rax, rax
je 0x1400f590e
nop word [rax + rax]
cmp qword [rax], r14
jne 0x1400f592f
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1400f5900
cmp byte [r14 + 0x11], 0
mov rax, qword [r14 + 8]
je 0x1400f596d
cmp qword [rax + 0x78], r14
je 0x1400f594a
test byte [rax + 0x26], 0x20
je 0x1400f594a
mov edi, 0x106
jmp 0x1400f5af9
mov rax, qword [rax]
jmp 0x1400f5938
mov rax, qword [rbx + 0x78]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400f590e
mov edi, 0x106
jmp 0x1400f5af9
mov rax, qword [rax + 0x70]
test rax, rax
je 0x1400f596d
cmp qword [rax], r14
je 0x1400f5964
cmp dword [rax + 8], 1
jne 0x1400f5964
cmp byte [rax + 0xc], 1
jne 0x1400f5940
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1400f5953
mov eax, 0xfff7
xor edi, edi
and dx, ax
mov word [rbx + 0x26], dx
cmp dword [rbx + 0x3c], edi
jne 0x1400f5988
or dx, 8
mov word [rbx + 0x26], dx
cmp qword [rbx + 0x18], 0
jne 0x1400f599f
mov rcx, rbx
call fcn.1400a4d50
mov edi, eax
test eax, eax
je 0x1400f5988
jmp 0x1400f59df
test edi, edi
jne 0x1400f59df
test byte [rbx + 0x26], 1
je 0x1400f59b0
mov edi, 8
jmp 0x1400f59df
mov rax, qword [r14]
mov rcx, qword [rbx]
xor r8d, r8d
cmp byte [rax + 0x4f], 2
mov edx, 1
sete r8b
call fcn.14009e280
mov edi, eax
test eax, eax
jne 0x1400f59df
mov rcx, rbx
call fcn.1400a5060
mov edi, eax
test eax, eax
je 0x1400f59ff
cmp byte [rbx + 0x24], 0
jne 0x1400f59ff
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400f59ff
mov rcx, qword [rcx + 0x68]
call fcn.14009e0e0
mov qword [rbx + 0x18], 0
cmp dil, 5
jne 0x1400f5a40
cmp byte [rbx + 0x24], 0
jne 0x1400f5a40
mov rsi, qword [rbx + 8]
add rsi, reloc.SHELL32.dll_IsUserAnAdmin
je 0x1400f5a40
mov rax, qword [rsi]
test rax, rax
je 0x1400f5a40
mov edx, dword [rsi + 0x10]
test edx, edx
js 0x1400f5a40
mov rcx, qword [rsi + 8]
call rax
test eax, eax
je 0x1400f5a39
inc dword [rsi + 0x10]
jmp 0x1400f5988
mov dword [rsi + 0x10], 0xffffffff
test edi, edi
jne 0x1400f5af9
cmp byte [r14 + 0x10], dil
jne 0x1400f5a6c
inc dword [rbx + 0x38]
cmp byte [r14 + 0x11], dil
je 0x1400f5a6c
mov byte [r14 + 0x3c], 1
mov rax, qword [rbx + 0x70]
mov qword [r14 + 0x40], rax
lea rax, [r14 + 0x30]
mov qword [rbx + 0x70], rax
mov byte [r14 + 0x10], 2
cmp byte [rbx + 0x24], 2
jae 0x1400f5a7b
mov byte [rbx + 0x24], 2
or word [rbx + 0x26], 0x20
mov rsi, qword [rbx + 0x18]
mov qword [rbx + 0x78], r14
mov rcx, qword [rsi + 0x50]
movzx eax, byte [rcx + 0x1d]
movzx edx, byte [rcx + 0x1c]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 0x1e]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 0x1f]
shl edx, 8
or edx, eax
cmp dword [rbx + 0x3c], edx
je 0x1400f5ae6
mov rcx, qword [rsi + 0x68]
call fcn.14009e540
mov edi, eax
test eax, eax
jne 0x1400f5af9
mov r8d, dword [rbx + 0x3c]
mov rdx, qword [rsi + 0x50]
mov eax, r8d
mov byte [rdx + 0x1f], r8b
shr eax, 0x18
mov byte [rdx + 0x1c], al
mov eax, r8d
shr eax, 0x10
mov byte [rdx + 0x1d], al
mov eax, r8d
shr eax, 8
mov byte [rdx + 0x1e], al
mov rax, qword [r14]
mov rcx, qword [rbx]
mov edx, dword [rax + 0x30c]
call fcn.14009eb90
mov edi, eax
cmp byte [r14 + 0x11], 0
je 0x1400f5b1e
dec dword [r14 + 0x14]
jne 0x1400f5b1e
mov rax, qword [r14 + 8]
mov rcx, qword [rax + 0x50]
test rcx, rcx
je 0x1400f5b19
call qword [0x140237070]
mov byte [r14 + 0x12], 0
test edi, edi
jne 0x1400f5cfb
mov rax, qword [r14 + 8]
mov rcx, qword [rax]
cmp byte [rcx + 9], 5
jne 0x1400f5b36
mov dword [rbp + 0x58], edi
mov rax, qword [r14 + 8]
mov esi, dword [rsp + 0x78]
xor r9d, r9d
mov edx, dword [rax + 0x30]
mov r8d, esi
mov rcx, r12
call fcn.1400a4a90
test eax, eax
jne 0x1400f5cf6
cmp dword [rsp + 0x80], eax
jne 0x1400f5b79
mov edx, dword [rbp + 0x58]
xor r9d, r9d
mov r8d, esi
mov rcx, r12
call fcn.1400a4a90
test eax, eax
jne 0x1400f5cf6
cmp byte [rbp + 0x50], 0
jne 0x1400f5cf6
movzx eax, byte [rbp + 0x52]
test al, al
js 0x1400f5b90
movsx eax, al
jmp 0x1400f5b98
mov rcx, r14
call fcn.1400a4d00
mov edx, eax
mov rcx, r12
call fcn.1400a4c70
lea r8, [0x1401e1720]
mov rdx, r15
mov rcx, rbp
call fcn.1400f5500
mov edi, eax
test eax, eax
jne 0x1400f5cfb
lea r8, [0x1401e17b0]
mov rdx, r15
mov rcx, rbp
call fcn.1400f5500
mov edi, eax
test eax, eax
jne 0x1400f5cfb
lea r8, [0x1401e1820]
mov rdx, r15
mov rcx, rbp
call fcn.1400f5500
mov edi, eax
test eax, eax
jne 0x1400f5cfb
lea r8, [0x1401e18a0]
mov rdx, r15
mov rcx, rbp
call fcn.1400f5500
mov edi, eax
test eax, eax
jne 0x1400f5cfb
lea r8, str._EIy
mov rdx, r15
mov rcx, rbp
call fcn.1400f5500
mov edi, eax
test eax, eax
jne 0x1400f5cfb
lea r8, [0x1401e19e0]
mov rdx, r15
mov rcx, rbp
call fcn.1400f5500
mov edi, eax
test eax, eax
jne 0x1400f5cfb
lea r8, [0x1401e1a80]
mov rdx, r15
mov rcx, rbp
call fcn.1400f5450
mov edi, eax
test eax, eax
jne 0x1400f5cfb
xor ebx, ebx
lea r15, [0x1401bc458]
nop
movzx edx, byte [rbx + r15]
lea r8, [rsp + 0x78]
mov rcx, r14
call fcn.1400abc80
movzx r8d, byte [rbx + r15 + 1]
movzx edx, byte [rbx + r15]
add r8d, dword [rsp + 0x78]
mov rcx, r12
call fcn.1400abd20
mov edi, eax
test eax, eax
jne 0x1400f5cfb
add rbx, 2
cmp rbx, 0xa
jl 0x1400f5c70
mov rdx, r12
mov rcx, r14
call fcn.1400ae8c0
mov edi, eax
test eax, eax
jne 0x1400f5cfb
mov rcx, r12
call fcn.1400a63e0
mov edi, eax
test eax, eax
jne 0x1400f5cfb
mov rcx, r12
call fcn.1400a4d00
mov rcx, r14
mov edx, eax
call fcn.1400a4c70
mov rax, qword [r12 + 8]
lea r9d, [rdi + 1]
mov edx, dword [rax + 0x30]
mov r8d, esi
mov rcx, r14
call fcn.1400a4a90
mov edi, eax
jmp 0x1400f5cfb
mov edi, 7
mov rsi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x38]
mov eax, dword [rsp + 0x88]
or r8d, 0xffffffff
mov r9d, 1
mov dword [rbp + 0x2c], eax
mov eax, dword [rsp + 0x20]
or edx, r8d
mov dword [rbp + 0x60], eax
mov eax, dword [rsp + 0x24]
mov rcx, r14
mov dword [rbp + 0x64], eax
mov rax, qword [rsp + 0x28]
mov qword [rbp + 0xb8], rax
call fcn.1400a4a90
mov r14, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x70]
mov byte [rbp + 0x4e], 1
test r13, r13
je 0x1400f5d6a
mov rcx, qword [r13 + 8]
call fcn.1400a4770
mov qword [r13 + 8], 0
mov qword [r13 + 0x18], 0
mov rcx, rbp
call fcn.1400cd440
mov eax, edi
mov rdi, qword [rsp + 0x40]
add rsp, 0x50
pop r15
pop r13
pop rbp
ret