Function at 0x517a90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
cmp dword [rcx], 2
mov rbx, rcx
mov r14, rdx
mov edi, r8d
je 0x517b94
cmp r8d, 1
jle 0x517c50
cmp dword [0x007f0400], 2
jg 0x5184af
movzx edx, byte [r14 + 1]
movzx ecx, byte [r14]
call fcn.00538e70
mov esi, eax
movzx eax, byte [r14]
mov rcx, rbx
mov edx, esi
mov byte [rbx + 0x940], al
movzx eax, byte [r14 + 1]
mov byte [rbx + 0x941], al
call fcn.00516160
test eax, eax
js 0x517be0
cmp edi, 0x21
jle 0x517c70
lea rdx, [r14 + 2]
mov rcx, rbx
call fcn.00516000
test eax, eax
js 0x517c30
xor edx, edx
mov rcx, rbx
call fcn.005160b0
test eax, eax
js 0x517c90
sub edi, 0x23
xor ecx, ecx
call qword [sub.msvcrt.dll__time64_1]
cmp edi, 0xffffffff
mov qword [rbx + 0xb0], rax
je 0x517cb0
movzx r12d, byte [r14 + 0x22]
cmp r12b, 0x20
jbe 0x517d70
mov edx, dword [0x007f0400]
cmp edx, 1
jle 0x517c5f
mov r9d, 0x1e8
lea rdx, [0x00780d93]
lea r8, str.gnutls_handshake.c
mov ecx, 2
call fcn.0051c740
mov edx, dword [0x007f0400]
jmp 0x517c5f
cmp r8d, 0x25
jle 0x517c14
cmp dword [0x007f0400], 2
jg 0x518508
movzx edx, byte [r14 + 1]
movzx ecx, byte [r14]
call fcn.00538e70
mov rcx, rbx
mov edx, eax
mov esi, eax
call fcn.00538ef0
test eax, eax
jne 0x517cd0
cmp dword [0x007f0400], 1
jg 0x5186a8
mov eax, 0xfffffff8
jmp 0x517c00
mov edx, dword [0x007f0400]
cmp edx, 1
jg 0x5185ea
nop
cmp edx, 1
jg 0x5185db
nop dword [rax]
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp dword [0x007f0400], 1
jg 0x5185ab
mov eax, 0xfffffff7
jmp 0x517c00
mov edx, dword [0x007f0400]
cmp edx, 1
jle 0x517bf0
mov dword [rsp + 0x34], eax
mov r9d, 0x1d7
jmp 0x518288
mov edx, dword [0x007f0400]
cmp edx, 1
jg 0x5185f9
mov eax, 0xfffffff7
jmp 0x517bf0
mov edx, dword [0x007f0400]
cmp edx, 1
jle 0x517c5f
mov r9d, 0x1d4
jmp 0x517b71
mov edx, dword [0x007f0400]
cmp edx, 1
jle 0x517bf0
mov dword [rsp + 0x34], eax
mov r9d, 0x1dd
jmp 0x518288
mov edx, dword [0x007f0400]
cmp edx, 1
jle 0x517c5f
mov r9d, 0x1e1
jmp 0x517b71
lea rdx, [r14 + 2]
mov dword [rbx + 0xc8], esi
mov rcx, rbx
call fcn.005160b0
test eax, eax
js 0x517e90
movzx ebp, byte [r14 + 0x22]
sub edi, 0x23
movzx esi, bpl
cmp edi, esi
jge 0x517ed0
cmp dword [0x007f0400], 1
jle 0x517bd6
mov r9d, 0x68d
lea r8, str.gnutls_handshake.c
lea rdx, [0x00780d93]
mov ecx, 2
call fcn.0051c740
mov eax, 0xfffffff8
cmp dword [0x007f0400], 1
jle 0x517c00
mov dword [rsp + 0x34], eax
mov r9d, 0x866
lea r8, str.gnutls_handshake.c
lea rdx, [0x00780d93]
mov ecx, 2
call fcn.0051c740
mov eax, dword [rsp + 0x34]
jmp 0x517c00
movzx r8d, r12b
sub edi, r8d
mov ebp, edi
js 0x517e70
cmp dword [rbx + 0x1068], 1
lea rdi, [r14 + 0x23]
lea r15d, [r8 + 0x23]
jne 0x517db1
sub ebp, 1
cmp ebp, 0xffffffff
je 0x5181d0
movsxd r15, r15d
movzx eax, byte [r14 + r15]
sub ebp, eax
lea r15d, [r8 + rax + 0x24]
js 0x518230
mov rdx, rdi
mov rcx, rbx
call fcn.0053fd20
test r12b, r12b
je 0x517dc8
or byte [rbx + 0x600], 2
test eax, eax
jne 0x518010
sub ebp, 2
js 0x5181b5
movsxd rax, r15d
movzx eax, word [r14 + rax]
rol ax, 8
movzx eax, ax
sub ebp, eax
js 0x5181f0
lea edx, [rbp - 1]
cmp edx, 0xffffffff
je 0x518250
lea ecx, [r15 + rax + 2]
movsxd rax, ecx
movzx eax, byte [r14 + rax]
sub edx, eax
mov r9d, edx
js 0x518210
lea eax, [rcx + rax + 1]
mov edx, 3
mov rcx, rbx
cdqe
lea r8, [r14 + rax]
call fcn.0053d280
test eax, eax
mov edi, eax
jns 0x5182cf
mov edx, dword [0x007f0400]
cmp edx, 1
jle 0x517bf0
lea rdx, [0x00780d93]
lea r8, str.gnutls_handshake.c
mov r9d, 0x216
mov ecx, 2
call fcn.0051c740
mov edx, dword [0x007f0400]
mov eax, edi
jmp 0x517bf0
mov edx, dword [0x007f0400]
cmp edx, 1
jle 0x517c5f
mov r9d, 0x1eb
jmp 0x517b71
cmp dword [0x007f0400], 1
jle 0x517c00
mov dword [rsp + 0x34], eax
mov r9d, 0x681
lea r8, str.gnutls_handshake.c
lea rdx, [0x00780d93]
mov ecx, 2
call fcn.0051c740
mov eax, dword [rsp + 0x34]
jmp 0x517d2e
sub edi, esi
js 0x518180
cmp dword [0x007f0400], 2
lea r13, [r14 + 0x23]
jg 0x5186db
movzx r12d, bpl
test byte [rbx + 0x600], 2
jne 0x517f03
test byte [rbx + 0x10e8], 1
je 0x518313
test esi, esi
je 0x518313
movzx eax, byte [rbx + 0x6b0]
cmp esi, eax
jne 0x518313
lea rdx, [rbx + 0x690]
mov r8, r12
mov rcx, r13
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x518313
mov rcx, qword [rbx + 0x68]
mov rdx, qword [rbx + 0x80]
lea r8, [rbx + 0x618]
mov qword [rbx + 0x670], rcx
mov rcx, qword [rbx + 0x70]
mov qword [rbx + 0x688], rdx
mov rdx, qword [rbx + 0x60]
mov qword [rbx + 0x678], rcx
mov rcx, qword [rbx + 0x78]
mov qword [rbx + 0x668], rdx
mov edx, 0x11172
mov qword [rbx + 0x680], rcx
mov rcx, qword [rbx + 0x48]
mov qword [rbx + 0x650], rcx
mov rcx, qword [rbx + 0x50]
mov qword [rbx + 0x658], rcx
mov rcx, qword [rbx + 0x58]
mov qword [rbx + 0x660], rcx
mov rcx, rbx
call fcn.00531970
mov r8d, dword [rbx + 0x61c]
mov edx, 0x11172
mov rcx, rbx
call fcn.00531a90
or byte [rbx + 0x600], 1
sub edi, 3
mov r9d, edi
js 0x5182fb
lea eax, [rsi + 0x26]
mov edx, 3
mov rcx, rbx
cdqe
lea r8, [r14 + rax]
call fcn.0053d280
test eax, eax
js 0x518475
mov rcx, rbx
call fcn.005387e0
mov ebx, eax
xor eax, eax
test ebx, ebx
jns 0x517c00
cmp dword [0x007f0400], 1
jg 0x5185b6
mov eax, ebx
jmp 0x517c00
lea rdx, [rbx + 0xa8]
lea rcx, [rbx + 0x88]
call fcn.00517a20
mov edx, ebp
and byte [rbx + 0x600], 0xfe
sub edx, 2
js 0x51826a
movsxd rax, r15d
movzx eax, word [r14 + rax]
rol ax, 8
movzx ebp, ax
sub edx, ebp
js 0x5182af
lea ecx, [rdx - 1]
cmp ecx, 0xffffffff
je 0x518434
lea eax, [r15 + 2]
mov dword [rsp + 0x38], eax
add eax, ebp
movsxd rdx, eax
movzx edx, byte [r14 + rdx]
sub ecx, edx
mov dword [rsp + 0x34], edx
mov r15d, ecx
js 0x518411
add eax, 1
mov r9d, ecx
mov edx, 1
mov dword [rsp + 0x3c], eax
add eax, dword [rsp + 0x34]
mov rcx, rbx
movsxd r13, eax
add r13, r14
mov r8, r13
call fcn.0053d280
test eax, eax
js 0x518457
mov edx, esi
mov rcx, rbx
call fcn.005161d0
test eax, eax
js 0x518491
mov r9d, r15d
mov r8, r13
mov edx, 3
mov rcx, rbx
call fcn.0053d280
test eax, eax
js 0x518604
mov r8, r13
mov r9d, r15d
mov edx, 2
mov rcx, rbx
call fcn.0053d280
test eax, eax
mov r13d, eax
js 0x518622
test byte [rbx + 0x600], 1
jne 0x518842
movsxd rdx, dword [rsp + 0x38]
mov r8d, ebp
mov rcx, rbx
add rdx, r14
call fcn.00516270
test eax, eax
js 0x5187e4
lea rsi, [rsp + 0x40]
mov r8d, 0x20
mov rcx, rbx
mov rdx, rsi
call fcn.00520440
test eax, eax
js 0x518802
movsxd rdx, dword [rsp + 0x3c]
xor ecx, ecx
test byte [rbx + 0x5f0], 2
lea r10, [r14 + rdx]
jne 0x5187bf
cmp dword [rsp + 0x34], ecx
jle 0x51878b
xor r8d, r8d
jmp 0x518170
movzx edx, byte [rsi + r8]
add r8, 1
cmp dl, byte [r10 + rcx]
je 0x51873e
cmp eax, r8d
jg 0x51815d
add rcx, 1
jmp 0x51814e
cmp dword [0x007f0400], 1
jle 0x517c21
mov r9d, 0x690
lea r8, str.gnutls_handshake.c
lea rdx, [0x00780d93]
mov ecx, 2
call fcn.0051c740
mov eax, 0xfffffff7
jmp 0x517d2e
mov edx, dword [0x007f0400]
cmp edx, 1
jle 0x517c5f
mov r9d, 0x206
jmp 0x517b71
mov edx, dword [0x007f0400]
cmp edx, 1
jle 0x517c5f
mov r9d, 0x1f3
jmp 0x517b71
mov edx, dword [0x007f0400]
cmp edx, 1
jle 0x517c5f
mov r9d, 0x20a
jmp 0x517b71
mov edx, dword [0x007f0400]
cmp edx, 1
jle 0x517c5f
mov r9d, 0x20f
jmp 0x517b71
mov edx, dword [0x007f0400]
cmp edx, 1
jle 0x517c5f
mov r9d, 0x1f5
jmp 0x517b71
mov edx, dword [0x007f0400]
cmp edx, 1
jle 0x517c5f
mov r9d, 0x20d
jmp 0x517b71
mov edx, dword [0x007f0400]
mov eax, 0xfffffff7
cmp edx, 1
jle 0x517bf0
mov dword [rsp + 0x34], eax
mov r9d, 0x22a
lea rdx, [0x00780d93]
lea r8, str.gnutls_handshake.c
mov ecx, 2
call fcn.0051c740
mov edx, dword [0x007f0400]
mov eax, dword [rsp + 0x34]
jmp 0x517bf0
mov edx, dword [0x007f0400]
mov eax, 0xfffffff7
cmp edx, 1
jle 0x517bf0
mov dword [rsp + 0x34], eax
mov r9d, 0x22e
jmp 0x518288
mov rcx, rbx
call fcn.00515a00
or byte [rbx + 0x600], 1
mov edx, esi
mov rcx, rbx
call fcn.005161d0
test eax, eax
jns 0x517fe8
mov edx, dword [0x007f0400]
jmp 0x517bf0
cmp dword [0x007f0400], 1
mov r9d, 0x699
jle 0x517c21
jmp 0x518193
and byte [rbx + 0x600], 0xfe
lea rcx, [rbx + 0x88]
mov rdx, r13
mov byte [rbx + 0xa8], bpl
mov r8, r12
call sub.msvcrt.dll_memcpy
cmp edi, 1
lea edx, [rsi + 0x23]
jle 0x5183f9
movsxd rdx, edx
mov rcx, rbx
add rdx, r14
call fcn.00515060
test eax, eax
js 0x5184ec
sub edi, 3
cmp edi, 0xffffffff
je 0x5184d4
lea eax, [rsi + 0x25]
cdqe
movzx ebp, byte [r14 + rax]
movzx r13d, bpl
mov ecx, r13d
call fcn.005203a0
cmp dword [0x007f0400], 2
mov r12d, eax
jg 0x5186b3
lea r13, [rsp + 0x40]
mov r8d, 0x20
mov rcx, rbx
mov rdx, r13
call fcn.00520440
test eax, eax
js 0x51852d
je 0x51855d
cmp bpl, byte [rsp + 0x40]
je 0x51855d
lea rdx, [r13 + 1]
sub eax, 1
add rax, rdx
jmp 0x5183d0
add rdx, 1
cmp bpl, byte [rdx - 1]
je 0x51855d
cmp rdx, rax
jne 0x5183c2
cmp dword [0x007f0400], 1
jg 0x518685
cmp dword [0x007f0400], 1
jg 0x51865d
mov eax, 0xfffffffd
jmp 0x517c00
cmp dword [0x007f0400], 1
mov r9d, 0x6ab
jle 0x517c21
jmp 0x518193
mov edx, dword [0x007f0400]
mov eax, 0xfffffff7
cmp edx, 1
jle 0x517bf0
mov dword [rsp + 0x34], eax
mov r9d, 0x237
jmp 0x518288
mov edx, dword [0x007f0400]
mov eax, 0xfffffff7
cmp edx, 1
jle 0x517bf0
mov dword [rsp + 0x34], eax
mov r9d, 0x234
jmp 0x518288
mov edx, dword [0x007f0400]
cmp edx, 1
jle 0x517bf0
mov dword [rsp + 0x34], eax
mov r9d, 0x245
jmp 0x518288
cmp dword [0x007f0400], 1
jle 0x517c00
mov dword [rsp + 0x34], eax
mov r9d, 0x69f
jmp 0x517ea7
mov edx, dword [0x007f0400]
cmp edx, 1
jle 0x517bf0
mov dword [rsp + 0x34], eax
mov r9d, 0x24c
jmp 0x518288
movzx eax, byte [rdx + 1]
movzx r9d, byte [rdx]
lea rdx, str.HSK__p_:_Clients_version:__d._d_n
mov r8, rcx
mov ecx, 3
mov dword [rsp + 0x20], eax
call fcn.0051c740
jmp 0x517acc
cmp dword [0x007f0400], 1
jle 0x517c21
mov r9d, 0x6b6
jmp 0x518193
cmp dword [0x007f0400], 1
jle 0x517c00
mov dword [rsp + 0x34], eax
mov r9d, 0x6af
jmp 0x517ea7
movzx eax, byte [rdx + 1]
movzx r9d, byte [rdx]
lea rdx, str.HSK__p_:_Servers_version:__d._d_n
mov r8, rcx
mov ecx, 3
mov dword [rsp + 0x20], eax
call fcn.0051c740
jmp 0x517ba7
cmp dword [0x007f0400], 1
jle 0x5183e2
lea r8, str.gnutls_handshake.c
lea rdx, [0x00780d93]
mov r9d, 0x608
mov ecx, 2
call fcn.0051c740
jmp 0x5183e2
mov r8d, r12d
mov edx, 0x11172
mov rcx, rbx
mov dword [rbx + 0x14], r12d
call fcn.00531a90
lea eax, [rsi + 0x26]
xor edx, edx
mov r9d, edi
mov rcx, rbx
cdqe
lea r8, [r14 + rax]
call fcn.0053d280
test eax, eax
jns 0x517fe8
cmp dword [0x007f0400], 1
jle 0x517c00
mov dword [rsp + 0x34], eax
mov r9d, 0x6c4
jmp 0x517ea7
mov r9d, 0x669
jmp 0x518193
lea r8, str.gnutls_handshake.c
lea rdx, [0x00780d93]
mov r9d, 0x878
mov ecx, 2
call fcn.0051c740
mov eax, ebx
jmp 0x517c00
mov dword [rsp + 0x34], eax
mov r9d, 0x870
jmp 0x517d45
mov dword [rsp + 0x34], eax
mov r9d, 0x1ce
jmp 0x518288
mov r9d, 0x1c2
jmp 0x517b71
mov edx, dword [0x007f0400]
cmp edx, 1
jle 0x517bf0
mov dword [rsp + 0x34], eax
mov r9d, 0x254
jmp 0x518288
mov edx, dword [0x007f0400]
cmp edx, 1
jle 0x517bf0
lea rdx, [0x00780d93]
lea r8, str.gnutls_handshake.c
mov r9d, 0x25b
mov ecx, 2
call fcn.0051c740
mov edx, dword [0x007f0400]
mov eax, r13d
jmp 0x517bf0
lea r8, str.gnutls_handshake.c
lea rdx, [0x00780d93]
mov r9d, 0x6bb
mov ecx, 2
call fcn.0051c740
mov eax, 0xfffffffd
jmp 0x517d2e
lea r8, str.gnutls_handshake.c
lea rdx, [0x00780d93]
mov r9d, 0x617
mov ecx, 2
call fcn.0051c740
jmp 0x5183e2
mov r9d, 0x674
jmp 0x517d11
mov ecx, eax
call fcn.00520290
lea rdx, str.HSK__p_:_Selected_compression_method:__s___d__n
mov r9, rax
mov dword [rsp + 0x20], r13d
mov r8, rbx
mov ecx, 3
call fcn.0051c740
jmp 0x518387
lea rdx, str.HSK__p_:_SessionID_length:__d_n
mov r9d, esi
mov r8, rbx
mov ecx, 3
movzx r12d, bpl
call fcn.0051c740
cmp dword [0x007f0400], 2
jle 0x517eed
lea r8, [rsp + 0x40]
mov rdx, r12
mov rcx, r13
mov qword [rsp + 0x20], 0
mov r9d, 0x41
call fcn.00537890
lea rdx, str.HSK__p_:_SessionID:__s_n
mov r9, rax
mov r8, rbx
mov ecx, 3
call fcn.0051c740
jmp 0x517eed
movzx ecx, dl
call fcn.005203a0
mov edx, 0x11172
mov r8d, eax
mov rcx, rbx
mov esi, eax
call fcn.00531a90
cmp dword [0x007f0400], 2
mov dword [rbx + 0x14], esi
jle 0x517fe8
mov ecx, esi
call fcn.00520290
lea rdx, str.HSK__p_:_Selected_Compression_Method:__s_n
mov r9, rax
mov r8, rbx
mov ecx, 3
call fcn.0051c740
jmp 0x517fe8
cmp dword [0x007f0400], 1
mov eax, 0xfffffffd
jg 0x518836
mov edx, dword [0x007f0400]
cmp edx, 1
jle 0x517bf0
mov dword [rsp + 0x34], eax
mov r9d, 0x27f
jmp 0x518288
add rcx, 1
cmp eax, ecx
jle 0x51878b
xor r8d, r8d
jmp 0x5187db
movzx edx, byte [rsi + rcx]
add r8, 1
cmp dl, byte [r10 + r8 - 1]
je 0x51873e
cmp dword [rsp + 0x34], r8d
jg 0x5187c8
jmp 0x5187bb
mov edx, dword [0x007f0400]
cmp edx, 1
jle 0x517bf0
mov dword [rsp + 0x34], eax
mov r9d, 0x277
jmp 0x518288
cmp dword [0x007f0400], 1
jle 0x51879d
mov dword [rsp + 0x34], eax
mov r9d, 0x41d
lea r8, str.gnutls_handshake.c
lea rdx, [0x00780d93]
mov ecx, 2
call fcn.0051c740
mov eax, dword [rsp + 0x34]
jmp 0x51879d
mov dword [rsp + 0x34], eax
mov r9d, 0x451
jmp 0x518815
lea rcx, [rbx + 0x690]
mov rdx, rdi
movzx r8d, r12b
call sub.msvcrt.dll_memcpy
movzx eax, word [rbx + 0xbc]
mov rcx, rbx
mov byte [rbx + 0x6b0], r12b
mov word [rbx + 0x6c4], ax
movzx eax, word [rbx + 0xba]
mov word [rbx + 0x6c2], ax
call fcn.00515a00
mov edx, esi
mov rcx, rbx
call fcn.005161d0
jmp 0x5182e8