Function at 0x1400029b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x98
cmp qword [rsp + 0xa0], 0
je 0x1400029da
cmp dword [rsp + 0xa8], 0
jne 0x1400029e1
xor al, al
jmp 0x140002d7c
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0xa0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
add rax, 4
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
movzx eax, word [rax]
cmp eax, 0x14c
jne 0x140002a34
mov byte [rsp + 0x22], 1
jmp 0x140002a39
mov byte [rsp + 0x22], 0
movzx eax, byte [rsp + 0x22]
mov byte [rsp + 0x20], al
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x140002a6d
mov rax, qword [rsp + 0x60]
add rax, 0x14
mov qword [rsp + 0x48], rax
jmp 0x140002a7b
mov rax, qword [rsp + 0x60]
add rax, 0x14
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x38], 0
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x140002aac
mov eax, 8
imul rax, rax, 6
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx + rax + 0x64]
mov dword [rsp + 0x58], eax
jmp 0x140002ac2
mov eax, 8
imul rax, rax, 6
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax + 0x74]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x3c], eax
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x140002ae5
mov rax, qword [rsp + 0x48]
add rax, 0xe0
mov qword [rsp + 0x70], rax
jmp 0x140002af5
mov rax, qword [rsp + 0x50]
add rax, 0xf0
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x40], 0
jmp 0x140002b13
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x60]
movzx eax, word [rax + 2]
cmp dword [rsp + 0x40], eax
jge 0x140002c5f
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x14], 0
je 0x140002b66
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x10], 0
je 0x140002b66
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x14]
mov rcx, qword [rsp + 0x28]
add eax, dword [rcx + 0x10]
cmp dword [rsp + 0x38], eax
jae 0x140002b66
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x14]
mov rcx, qword [rsp + 0x28]
add eax, dword [rcx + 0x10]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x3c], 0
je 0x140002c4c
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x140002be4
mov eax, 8
imul rax, rax, 6
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x48]
mov eax, dword [rdx + rax + 0x60]
cmp dword [rcx + 0xc], eax
ja 0x140002be2
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x28]
add eax, dword [rcx + 0x10]
mov ecx, 8
imul rcx, rcx, 6
mov rdx, qword [rsp + 0x48]
cmp eax, dword [rdx + rcx + 0x60]
jbe 0x140002be2
mov eax, 8
imul rax, rax, 6
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x28]
mov edx, dword [rdx + 0xc]
mov eax, dword [rcx + rax + 0x60]
sub eax, edx
mov rcx, qword [rsp + 0x28]
add eax, dword [rcx + 0x14]
mov dword [rsp + 0x44], eax
jmp 0x140002c4c
mov eax, 8
imul rax, rax, 6
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x50]
mov eax, dword [rdx + rax + 0x70]
cmp dword [rcx + 0xc], eax
ja 0x140002c4c
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x28]
add eax, dword [rcx + 0x10]
mov ecx, 8
imul rcx, rcx, 6
mov rdx, qword [rsp + 0x50]
cmp eax, dword [rdx + rcx + 0x70]
jbe 0x140002c4c
mov eax, 8
imul rax, rax, 6
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x28]
mov edx, dword [rdx + 0xc]
mov eax, dword [rcx + rax + 0x70]
sub eax, edx
mov rcx, qword [rsp + 0x28]
add eax, dword [rcx + 0x14]
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x28]
add rax, 0x28
mov qword [rsp + 0x28], rax
jmp 0x140002b09
mov eax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0xa0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov byte [rsp + 0x21], 0
mov qword [rsp + 0x68], 0
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x3c]
cmp rax, 0x1c
jb 0x140002d5b
movzx eax, byte [rsp + 0x21]
test eax, eax
jne 0x140002d3c
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0xc], 2
jne 0x140002cfc
mov byte [rsp + 0x21], 1
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x18]
mov rcx, qword [rsp + 0xa0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
add rax, 0x18
lea rdx, [0x14000d190]
mov rcx, rax
call sub.ntoskrnl.exe_strstr
test rax, rax
je 0x140002cfc
mov byte [rsp + 0x21], 0
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0x18], 0
je 0x140002d3c
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0x10], 0
je 0x140002d3c
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x18]
mov rcx, qword [rsp + 0x30]
add eax, dword [rcx + 0x10]
cmp dword [rsp + 0x38], eax
jae 0x140002d3c
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x18]
mov rcx, qword [rsp + 0x30]
add eax, dword [rcx + 0x10]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x3c]
sub rax, 0x1c
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x30]
add rax, 0x1c
mov qword [rsp + 0x30], rax
jmp 0x140002c94
movzx eax, byte [rsp + 0x21]
test eax, eax
je 0x140002d7a
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x68]
call fcn.140002ee0
mov al, 1
jmp 0x140002d7c
xor al, al
add rsp, 0x98
ret