Function at 0x10023594
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x368
mov qword [rsp + 0xc8], 0xfffffffffffffffe
mov rsi, rdx
mov r13, rcx
xor edi, edi
mov dword [rcx + 0x34], edi
lea r15, [rcx + 0x38]
mov rax, qword [rdx]
mov r9, r15
xor edx, edx
lea r8d, [rdi + 1]
mov rcx, rsi
call qword [rax + 0x20]
cmp eax, edi
jne 0x1002417f
mov qword [rsp + 0x48], rdi
mov rax, qword [rsi]
lea r9, [rsp + 0x48]
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rsi
call qword [rax + 0x20]
cmp eax, edi
jne 0x1002417f
mov rax, qword [rsi]
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [r15]
mov rcx, rsi
call qword [rax + 0x20]
cmp eax, edi
jne 0x1002417f
mov ebp, 0x200
mov r8, rbp
lea rdx, [rsp + 0x160]
mov rcx, rsi
call fcn.1000c5a4
cmp eax, edi
jne 0x1002417f
mov bl, dil
mov byte [rsp + 0x3b0], dil
mov r12d, 0xc
mov r8, r12
lea rdx, str.koly
lea rcx, [rsp + 0x160]
call sub.msvcrt.dll_memcmp
cmp eax, edi
jne 0x10023683
mov r14, qword [r15]
cmp r14, 0x100
ja 0x100236f8
mov dword [r13 + 0x34], ebp
mov bl, 1
mov byte [rsp + 0x3b0], bl
jmp 0x100236f8
mov r14, qword [rsp + 0x48]
cmp r14, rbp
jae 0x10023697
mov eax, 1
jmp 0x1002417f
add r14, 0xfffffffffffffe00
mov rax, qword [rsi]
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [rax + 0x20]
cmp eax, edi
jne 0x1002417f
mov r8, rbp
lea rdx, [rsp + 0x160]
mov rcx, rsi
call fcn.1000c5a4
cmp eax, edi
jne 0x1002417f
mov r8, r12
lea rdx, str.koly
lea rcx, [rsp + 0x160]
call sub.msvcrt.dll_memcmp
cmp eax, edi
je 0x100236f8
mov eax, 1
jmp 0x1002417f
mov r8, qword [rsp + 0x178]
bswap r8
mov r10, qword [rsp + 0x180]
bswap r10
mov rdx, qword [rsp + 0x188]
bswap rdx
mov qword [rsp + 0x80], rdx
mov rbp, qword [rsp + 0x190]
bswap rbp
mov qword [rsp + 0x88], rbp
mov rax, qword [rsp + 0x238]
bswap rax
mov qword [rsp + 0x30], rax
mov r12, qword [rsp + 0x240]
bswap r12
mov qword [rsp + 0x38], r12
mov r9, qword [rsp + 0x288]
bswap r9
mov qword [rsp + 0x60], r9
mov r11, qword [rsp + 0x290]
bswap r11
mov qword [rsp + 0x68], r11
mov rcx, r14
cmp bl, dil
cmovne rcx, qword [rsp + 0x48]
cmp r8, rcx
ja 0x10023796
mov rax, rcx
sub rax, r8
cmp r10, rax
ja 0x10023796
lea rbx, [r10 + r8]
jmp 0x100237a0
mov eax, 1
jmp 0x1002417f
mov r8, qword [rsp + 0x30]
cmp r8, rcx
ja 0x100237c3
mov rax, rcx
sub rax, r8
cmp r12, rax
ja 0x100237c3
lea rax, [r12 + r8]
cmp rbx, rax
ja 0x100237cd
mov rbx, rax
jmp 0x100237cd
mov eax, 1
jmp 0x1002417f
cmp rdx, rcx
ja 0x100237eb
mov rax, rcx
sub rax, rdx
cmp rbp, rax
ja 0x100237eb
lea rax, [rdx + rbp]
cmp rbx, rax
ja 0x100237f5
mov rbx, rax
jmp 0x100237f5
mov eax, 1
jmp 0x1002417f
cmp r9, rcx
ja 0x10023817
sub rcx, r9
cmp r11, rcx
ja 0x10023817
lea rax, [r11 + r9]
cmp rbx, rax
cmovbe rbx, rax
mov byte [rsp + 0x3b8], 1
jmp 0x1002381f
mov byte [rsp + 0x3b8], dil
cmp byte [rsp + 0x3b0], dil
je 0x10023832
mov qword [r13 + 0x40], rbx
jmp 0x100238f0
lea rax, [r14 + 0x200]
mov qword [r13 + 0x40], rax
mov qword [r15], rdi
cmp rbx, r14
je 0x100238f0
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, str.__xml_version
call sub.msvcrt.dll_strlen
mov ecx, eax
mov qword [rsp + 0x3b0], rcx
mov rax, qword [rsp + 0x78]
cmp r12, rcx
cmova rax, rcx
mov qword [rsp + 0x78], rax
mov r15, rdi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rdi
cmp rax, rcx
jb 0x100238cd
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x70]
mov rdx, rsi
mov rcx, r13
call fcn.100203ec
cmp eax, edi
jne 0x100238c8
mov r8, qword [rsp + 0x3b0]
lea rdx, str.__xml_version
mov r15, qword [rsp + 0x20]
mov rcx, r15
call sub.msvcrt.dll_memcmp
cmp eax, edi
je 0x100238df
jmp 0x100238cd
mov r15, qword [rsp + 0x20]
sub r14, rbx
mov qword [r13 + 0x38], r14
lea rax, [rbx + 0x200]
mov qword [r13 + 0x40], rax
mov rcx, r15
call sub.msvcrt.dll_free
lea r15, [r13 + 0x38]
mov r11, qword [rsp + 0x68]
cmp byte [rsp + 0x3b8], dil
je 0x10023956
cmp r11, rdi
je 0x10023956
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x60]
mov rdx, rsi
mov rcx, r13
call fcn.100203ec
mov ebx, eax
cmp eax, edi
je 0x10023935
mov rcx, qword [rsp + 0x20]
call sub.msvcrt.dll_free
mov eax, ebx
jmp 0x1002417f
lea rdx, [rsp + 0x20]
mov rcx, r13
call fcn.10020474
cmp al, dil
jne 0x1002394c
mov byte [r13 + 0x31], 1
mov rcx, qword [rsp + 0x20]
call sub.msvcrt.dll_free
mov eax, dword [rsp + 0x2c0]
bswap eax
mov dword [rsp + 0xd0], eax
mov eax, dword [rsp + 0x2c4]
bswap eax
mov dword [rsp + 0xd4], eax
mov r8d, 0x80
lea rdx, [rsp + 0x2c8]
lea rcx, [rsp + 0xd8]
call sub.msvcrt.dll_memcpy
lea r11, [rbp - 0x101]
cmp r11, 0xfffefe
ja 0x10023da8
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x80]
mov rdx, rsi
mov rcx, r13
call fcn.100203ec
mov ebx, eax
mov rsi, qword [rsp + 0x30]
cmp eax, edi
je 0x100239d7
jmp 0x10023d85
mov edx, dword [rsi]
bswap edx
mov ecx, dword [rsi + 4]
bswap ecx
mov r9d, dword [rsi + 8]
bswap r9d
mov dword [rsp + 0x3c8], r9d
mov r15d, dword [rsi + 0xc]
bswap r15d
cmp edx, 0x100
jne 0x10023da1
mov r8d, ecx
cmp r8, rbp
jae 0x10023da1
mov eax, r9d
cmp rax, rbp
jae 0x10023da1
cmp ecx, r9d
jb 0x10023da1
lea eax, [r9 + rdx]
cmp ecx, eax
jne 0x10023da1
add ecx, r15d
cmp rcx, rbp
je 0x10023a5e
sub rbp, r8
mov eax, r15d
cmp rbp, rax
jb 0x10023a54
sub rbp, rax
cmp rbp, 4
jne 0x10023a54
mov eax, dword [rcx + rsi]
bswap eax
cmp eax, edi
je 0x10023a5e
mov ebx, 1
jmp 0x10023d85
cmp r15d, 0x10
jae 0x10023a6e
mov ebx, 1
jmp 0x10023d85
lea rbp, [r8 + rsi]
mov r8d, 0x10
mov rdx, rbp
mov rcx, rsi
call sub.msvcrt.dll_memcmp
cmp eax, edi
je 0x10023a91
mov ebx, 1
jmp 0x10023d85
movzx ecx, byte [rbp + 0x18]
shl cx, 8
movzx eax, byte [rbp + 0x19]
or cx, ax
cmp cx, 0x1c
je 0x10023ab0
mov ebx, 1
jmp 0x10023d85
movzx eax, byte [rbp + 0x1a]
shl ax, 8
movzx r14d, ax
movzx eax, byte [rbp + 0x1b]
or r14d, eax
cmp r14d, r15d
jbe 0x10023ad2
mov ebx, 1
jmp 0x10023d85
movzx eax, byte [rbp + 0x1c]
shl ax, 8
movzx r12d, ax
movzx eax, byte [rbp + 0x1d]
or r12d, eax
inc r12d
mov dword [rsp + 0x54], r12d
lea eax, [r12*8 + 0x1e]
cmp eax, r14d
jbe 0x10023b04
mov ebx, 1
jmp 0x10023d85
mov r10d, edi
mov dword [rsp + 0x3c0], edi
cmp r12d, edi
jbe 0x10023d94
lea r8, [rbp + 0x23]
mov qword [rsp + 0x60], r8
mov eax, dword [r8 - 5]
bswap eax
cmp eax, 0x626c6b78
jne 0x10023d22
movzx eax, byte [r8 - 1]
shl ax, 8
movzx r9d, ax
movzx eax, byte [r8]
or r9d, eax
inc r9d
mov dword [rsp + 0x40], r9d
movzx eax, byte [r8 + 1]
shl ax, 8
movzx edx, ax
movzx eax, byte [r8 + 2]
or edx, eax
lea eax, [r9 + r9*2]
lea ecx, [rdx + rax*4 + 0x1c]
cmp ecx, r14d
ja 0x10023d41
mov dword [rsp + 0x3b8], edi
movsxd rax, edx
cmp r9d, edi
jbe 0x10023d22
lea rcx, [rax + rbp + 0x1f]
mov qword [rsp + 0x80], rcx
movzx eax, byte [rcx - 1]
shl ax, 8
movzx ebx, ax
movzx eax, byte [rcx]
or ebx, eax
mov ecx, dword [rcx + 1]
bswap ecx
and ecx, 0xffffff
lea eax, [rcx + 4]
mov edx, dword [rsp + 0x3c8]
cmp eax, edx
jae 0x10023d48
mov eax, ecx
mov qword [rsp + 0x70], rax
mov r8d, dword [rcx + rsi + 0x100]
bswap r8d
mov dword [rsp + 0x58], r8d
mov eax, edx
sub eax, ecx
sub eax, 4
cmp eax, r8d
jb 0x10023d4f
lea rcx, [rsp + 0x20]
call fcn.10001fbc
nop
cmp ebx, 0xffff
je 0x10023c9b
mov eax, r15d
sub eax, r14d
cmp ebx, eax
jae 0x10023d56
mov ecx, ebx
movsxd rdx, r14d
add rcx, rdx
movzx edx, byte [rcx + rbp]
mov dword [rsp + 0x50], edx
sub eax, ebx
cmp eax, edx
jbe 0x10023d68
mov r8d, 1
mov dword [rsp + 0x3b0], r8d
cmp edx, r8d
jb 0x10023c9b
lea rsi, [rcx + rbp + 1]
mov edx, dword [rsp + 0x28]
mov r12d, dword [rsp + 0x50]
mov bl, byte [rsi]
lea eax, [rbx - 0x20]
cmp al, 0x5f
ja 0x10023c91
cmp dword [rsp + 0x2c], edx
jne 0x10023c6a
lea rcx, [rsp + 0x20]
call fcn.10001ddc
mov edx, dword [rsp + 0x28]
mov r8d, dword [rsp + 0x3b0]
mov rcx, qword [rsp + 0x20]
mov eax, edx
mov byte [rax + rcx], bl
inc edx
mov byte [rdx + rcx], dil
mov dword [rsp + 0x28], edx
inc r8d
mov dword [rsp + 0x3b0], r8d
inc rsi
cmp r8d, r12d
jbe 0x10023c45
mov rsi, qword [rsp + 0x30]
mov r12d, dword [rsp + 0x54]
lea rcx, [r13 + 0x20]
call fcn.10021c90
mov rbx, rax
lea rcx, [rax + 0x18]
lea rdx, [rsp + 0x20]
call fcn.10002120
mov r11, qword [rsp + 0x70]
lea rdx, [r11 + rsi + 0x104]
mov r8d, dword [rsp + 0x58]
mov rcx, rbx
call fcn.100205c8
mov ebx, eax
cmp eax, edi
jne 0x10023d7a
mov rcx, qword [rsp + 0x20]
call sub.msvcrt.dll_free
mov r11d, dword [rsp + 0x3b8]
inc r11d
mov dword [rsp + 0x3b8], r11d
mov rcx, qword [rsp + 0x80]
add rcx, 0xc
mov qword [rsp + 0x80], rcx
cmp r11d, dword [rsp + 0x40]
jb 0x10023b91
mov r8, qword [rsp + 0x60]
mov r10d, dword [rsp + 0x3c0]
inc r10d
mov dword [rsp + 0x3c0], r10d
add r8, 8
mov qword [rsp + 0x60], r8
cmp r10d, r12d
jb 0x10023b20
jmp 0x10023d94
mov ebx, 1
jmp 0x10023d85
mov ebx, 1
jmp 0x10023d85
mov ebx, 1
jmp 0x10023d85
mov rcx, qword [rsp + 0x20]
call sub.msvcrt.dll_free
nop
mov ebx, 1
jmp 0x10023d85
mov rcx, qword [rsp + 0x20]
call sub.msvcrt.dll_free
nop
mov ebx, 1
jmp 0x10023d85
mov rcx, qword [rsp + 0x20]
call sub.msvcrt.dll_free
nop
mov rcx, rsi
call sub.msvcrt.dll_free
mov eax, ebx
jmp 0x1002417f
mov rcx, rsi
call sub.msvcrt.dll_free
jmp 0x10024107
mov ebx, 1
jmp 0x10023d85
mov eax, 0xffff0000
cmp r12, rax
jae 0x1002417a
cmp r12, rdi
je 0x1002417a
mov r10, qword [rsi]
mov rdx, qword [rsp + 0x30]
add rdx, qword [r15]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call qword [r10 + 0x20]
cmp eax, edi
jne 0x1002417f
lea rcx, [rsp + 0x90]
call fcn.10001fbc
mov qword [rsp + 0xa8], rdi
mov dword [rsp + 0xb0], edi
mov dword [rsp + 0xb4], edi
mov qword [rsp + 0xb8], rdi
mov dword [rsp + 0xc0], edi
mov dword [rsp + 0xc4], edi
lea rcx, [r12 + 1]
mov rbx, rdi
mov qword [rsp + 0x3b0], rdi
cmp rcx, rdi
je 0x10023e3d
call fcn.10003f74
mov rbx, rax
mov qword [rsp + 0x3b0], rax
mov r8, r12
mov rdx, rbx
mov rcx, rsi
call fcn.1000c5a4
mov esi, eax
cmp eax, edi
je 0x10023e5f
mov rcx, rbx
call sub.msvcrt.dll_free
nop
jmp 0x100240e6
mov byte [rbx + r12], dil
mov rdx, rbx
lea rcx, [rsp + 0x90]
call fcn.10003ee8
cmp al, dil
jne 0x10023e8b
mov rcx, rbx
call sub.msvcrt.dll_free
nop
mov esi, 1
jmp 0x100240e6
mov rcx, rbx
call sub.msvcrt.dll_free
lea rdx, str.plist
mov rcx, qword [rsp + 0x90]
call sub.msvcrt.dll_strcmp
cmp eax, edi
je 0x10023eb5
mov esi, 1
jmp 0x100240e6
lea rdx, str.dict
lea rcx, [rsp + 0x90]
call fcn.100035c8
cmp eax, edi
jge 0x10023ed7
mov esi, 1
jmp 0x100240e6
mov ecx, eax
mov rax, qword [rsp + 0xb8]
mov rbx, qword [rax + rcx*8]
lea r8, str.dict
lea rdx, str.resource_fork
mov rcx, rbx
call fcn.10020798
cmp eax, edi
jge 0x10023f09
mov esi, 1
jmp 0x100240e6
mov ecx, eax
mov rax, qword [rbx + 0x28]
mov rbx, qword [rax + rcx*8]
lea r8, str.array
lea rdx, str.blkx
mov rcx, rbx
call fcn.10020798
cmp eax, edi
jge 0x10023f37
mov esi, 1
jmp 0x100240e6
mov ecx, eax
mov rax, qword [rbx + 0x28]
mov rax, qword [rax + rcx*8]
mov qword [rsp + 0x3b0], rax
mov r15d, edi
cmp dword [rax + 0x30], edi
jbe 0x100240fa
mov r14, rdi
mov rax, qword [rax + 0x28]
mov rsi, qword [r14 + rax]
lea rdx, str.dict
mov rcx, rsi
call fcn.10003428
cmp al, dil
je 0x100240a3
mov rbx, rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
lea r8, str.data
lea rdx, str.Data
mov rcx, rsi
call fcn.10020798
cmp eax, edi
jl 0x10023fb3
mov ecx, eax
mov rax, qword [rsi + 0x28]
mov rcx, qword [rax + rcx*8]
call fcn.1000365c
mov rbp, rax
jmp 0x10023fb6
mov rbp, rdi
cmp rbp, rdi
je 0x100240be
mov eax, dword [rbp + 8]
shr eax, 2
lea r12d, [rax + rax*2 + 4]
cmp r12, rdi
je 0x10023fe9
mov qword [rsp + 0x38], rdi
mov rcx, r12
call fcn.10003f74
mov rbx, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], r12
mov rdx, qword [rbp]
mov rcx, rbx
call fcn.1001855c
mov rbp, rax
cmp rax, rdi
je 0x100240cd
sub ebp, ebx
lea rcx, [r13 + 0x20]
call fcn.10021c90
mov r12, rax
lea r8, str.string
lea rdx, str.Name
mov rcx, rsi
call fcn.10020798
cmp eax, edi
jl 0x1002403a
mov edx, eax
mov rcx, qword [rsi + 0x28]
mov rcx, qword [rcx + rdx*8]
call fcn.1000365c
jmp 0x1002403d
mov rax, rdi
cmp rax, rdi
je 0x10024047
cmp dword [rax + 8], edi
jne 0x10024075
lea r8, str.string
lea rdx, str.CFName
mov rcx, rsi
call fcn.10020798
cmp eax, edi
jl 0x10024072
mov ecx, eax
mov rax, qword [rsi + 0x28]
mov rcx, qword [rax + rcx*8]
call fcn.1000365c
jmp 0x10024075
mov rax, rdi
cmp rax, rdi
je 0x10024087
lea rcx, [r12 + 0x18]
mov rdx, rax
call fcn.10002120
mov r8d, ebp
mov rdx, rbx
mov rcx, r12
call fcn.100205c8
mov esi, eax
cmp eax, edi
jne 0x100240dd
mov rcx, rbx
call sub.msvcrt.dll_free
inc r15d
add r14, 8
mov rax, qword [rsp + 0x3b0]
cmp r15d, dword [rax + 0x30]
jb 0x10023f58
jmp 0x100240fa
xor ecx, ecx
call sub.msvcrt.dll_free
nop
mov esi, 1
jmp 0x100240e6
mov rcx, rbx
call sub.msvcrt.dll_free
nop
mov esi, 1
jmp 0x100240e6
mov rcx, rbx
call sub.msvcrt.dll_free
nop
lea rcx, [rsp + 0x90]
call fcn.10003984
mov eax, esi
jmp 0x1002417f
lea rcx, [rsp + 0x90]
call fcn.10003984
cmp dword [rsp + 0xd0], 2
jne 0x10024176
cmp dword [rsp + 0xd4], 0x20
jne 0x10024176
mov ecx, 0xffffffff
cmp dword [r13 + 0x28], edi
jbe 0x1002415c
mov rbx, rdi
mov rax, qword [r13 + 0x20]
mov rdx, qword [rbx + rax]
mov eax, dword [rdx + 0x3c]
test al, 7
jne 0x1002415c
shr eax, 3
cmp eax, 0x80
ja 0x1002415c
mov r8d, eax
add rdx, 0x40
call fcn.1012f3a0
mov ecx, eax
inc edi
add rbx, 8
cmp edi, dword [r13 + 0x28]
jb 0x10024129
cmp edi, dword [r13 + 0x28]
jne 0x10024176
mov eax, dword [rsp + 0xd8]
bswap eax
not ecx
cmp ecx, eax
setne al
mov byte [r13 + 0x30], al
xor eax, eax
jmp 0x1002417f
mov eax, 1
add rsp, 0x368
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret