Function at 0x14021c000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
push rbp
mov rbp, rsp
sub rsp, 0x20
and rsp, 0xfffffffffffffff0
lea rbx, [0x14018fc00]
movabs rdx, 0
push rbx
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x273c0043
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x3bcb2dd2
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x90479b9
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x627d6f5e
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x546f29a4
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x30e66ed7
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x28556fc
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x35d13a7b
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x6ff82cfe
add dword [rbx + 0xe8], reloc.ADVAPI32.dll_TraceEvent
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x239b34cb
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x1e9a6ac2
sub dword [rbx + 0x5c], reloc.ADVAPI32.dll_TraceEvent
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x69c37e7
xor dword [rbx + 0x24], reloc.ADVAPI32.dll_TraceEvent
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x42c453ea
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x35f30495
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x77c958a2
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x1ec8411d
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x70734bbf
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0xb030538
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0xcb774d0
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x19a81d1d
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x3a1828aa
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x7b59622d
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x4d252f95
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x7302eba
sub dword [rbx + 0x64], reloc.ADVAPI32.dll_TraceEvent
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x609d73f1
sub dword [rbx + 0x18], reloc.ADVAPI32.dll_TraceEvent
not dword [rbx + 0xa8]
not dword [rbx + 0x78]
add dword [rbx + 0xc4], reloc.ADVAPI32.dll_TraceEvent
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x60361dca
xor dword [rbx + 0xd4], reloc.ADVAPI32.dll_TraceEvent
sub dword [rbx + 8], reloc.ADVAPI32.dll_TraceEvent
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x3fd20912
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x16a61a81
not dword [rbx + 0x8c]
not dword [rbx + 0x2c]
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x1a5043c9
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x55f27f28
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x47a7210
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x3b6073fb
not dword [rbx + 0xb0]
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x44a32134
xor dword [rbx + 0x1c], reloc.ADVAPI32.dll_TraceEvent
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0xcfa6bb1
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x4dfd63eb
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x37813c9c
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x48b6196
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0xd2a1edf
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x7e4204ba
not dword [rbx + 0xd8]
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x54eb63e0
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x175733ad
xor dword [rbx + 0xb4], reloc.ADVAPI32.dll_TraceEvent
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x185b7f3f
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
add dword [rbx + 0xfc], reloc.ADVAPI32.dll_TraceEvent
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x37a343f8
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x1b664454
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x24f87d4b
sub dword [rbx + 0x40], reloc.ADVAPI32.dll_TraceEvent
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x26850acd
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x45593512
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x608d3150
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x7036de
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x5fd4169a
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x188d4ebf
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x21c7578e
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x959172b
add dword [rbx + 0xb8], reloc.ADVAPI32.dll_TraceEvent
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x3ae31b16
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x7f4d534a
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x1bbb5d31
xor dword [rbx + 0x90], reloc.ADVAPI32.dll_TraceEvent
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x697a0a7b
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x410c65de
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x40e31e85
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x2b821aa3
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
not dword [rbx + 0x7c]
add dword [rbx + 0x38], reloc.ADVAPI32.dll_TraceEvent
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x7fe351db
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x3ba02deb
sub dword [rbx + 0xe4], reloc.ADVAPI32.dll_TraceEvent
sub dword [rbx + 0x54], reloc.ADVAPI32.dll_TraceEvent
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x36a6546a
add dword [rbx + 0xbc], reloc.ADVAPI32.dll_TraceEvent
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
add dword [rbx + 0x48], reloc.ADVAPI32.dll_TraceEvent
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x2f32686e
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x7252677a
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x3ae50c08
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x28c52257
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x174809cd
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x2e2b0e9a
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x5cc72e63
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x6f0b3534
not dword [rbx + 0xd0]
add dword [rbx + 0x74], reloc.ADVAPI32.dll_TraceEvent
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x75c00dc8
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x4ef846dc
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x8312297
add dword [rbx + 0x94], reloc.ADVAPI32.dll_TraceEvent
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x19f567db
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x73be1cc9
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x31d03d2e
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x3b32739
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
xor dword [rbx + 0x44], reloc.ADVAPI32.dll_TraceEvent
xor dword [rbx + 0x9c], reloc.ADVAPI32.dll_TraceEvent
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x43cf5efb
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x64a941c3
not dword [rbx + 0xec]
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x2a2e345b
sub dword [rbx + 0x4c], reloc.ADVAPI32.dll_TraceEvent
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x70ff4279
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x2a104488
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x2dd047fa
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x33a978d6
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x308f5027
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x4acd31f5
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x35ea397b
xor dword [rbx + 0x3c], reloc.ADVAPI32.dll_TraceEvent
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x78ea23c2
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x52b221d9
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x56cb2024
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x467b29b4
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x269d62b5
sub dword [rbx + 0xac], reloc.ADVAPI32.dll_TraceEvent
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x2ad54abd
not dword [rbx + 0xf0]
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x6ccf2678
sub dword [rbx + 0xcc], reloc.ADVAPI32.dll_TraceEvent
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x105e1067
xor dword [rbx + 0x30], reloc.ADVAPI32.dll_TraceEvent
add dword [rbx + 0x60], reloc.ADVAPI32.dll_TraceEvent
sub dword [rbx + 0xdc], reloc.ADVAPI32.dll_TraceEvent
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
xor dword [rbx + 0x34], reloc.ADVAPI32.dll_TraceEvent
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x2b2320cf
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x325379ef
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x747e63ea
sub dword [rbx + 0x70], reloc.ADVAPI32.dll_TraceEvent
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x77244e2d
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x7c322bd1
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x6bfd0f26
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
not dword [rbx + 0xf4]
add dword [rbx + 0x14], reloc.ADVAPI32.dll_TraceEvent
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x769071f2
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x51135fcc
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x42c14a6d
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
not dword [rbx + 0x80]
not dword [rbx + 0xc8]
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x127365b
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x5d2327dc
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x6fb156dd
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0xc722910
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x22b1146f
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x5148080c
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x7a3c4e74
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x26495c0a
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x3a7d6337
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x496619a6
not dword [rbx + 0x84]
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x4d5b0573
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x6c907a26
not dword [rbx + 0xa0]
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x283e5e66
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x425815de
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
sub dword [rbx + 0xe0], reloc.ADVAPI32.dll_TraceEvent
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x38246bb5
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x49d651e2
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x207f2939
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x31ac060d
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x58260cf7
xor dword [rbx + 0x6c], reloc.ADVAPI32.dll_TraceEvent
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x6c950cd5
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
xor dword [rbx + 0x68], reloc.ADVAPI32.dll_TraceEvent
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
add dword [rbx + 0x50], reloc.ADVAPI32.dll_TraceEvent
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x551c787a
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x216c4f1e
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x58be6e45
add dword [rbx + 0xf8], reloc.ADVAPI32.dll_TraceEvent
add dword [rbx], reloc.ADVAPI32.dll_TraceEvent
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x31a24307
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x33131c92
xor dword [rbx + 0x98], reloc.ADVAPI32.dll_TraceEvent
not dword [rbx + 0x28]
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x1083687b
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x7942203
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x2a04568
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x69a0462f
sub dword [rbx + 0x20], reloc.ADVAPI32.dll_TraceEvent
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x678c28e2
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x4c1b1788
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x411e607c
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0xb5f69b6
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x39e122c2
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
sub dword [rbx + 0xc], reloc.ADVAPI32.dll_TraceEvent
not dword [rbx + 0xa4]
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x607207f
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x23823ff0
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x664334af
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x60232d5
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x28466b3d
add dword [rbx + 0x10], reloc.ADVAPI32.dll_TraceEvent
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x6bc405eb
xor dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x62d0af1
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x11d41397
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
sub dword [rbx + 0xc0], reloc.ADVAPI32.dll_TraceEvent
add dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x6e1f14a4
xor dword [rbx + 4], reloc.ADVAPI32.dll_TraceEvent
xor dword [rbx + 0x88], reloc.ADVAPI32.dll_TraceEvent
not dword [rbx + reloc.ADVAPI32.dll_TraceEvent]
xor dword [rbx + 0x58], reloc.ADVAPI32.dll_TraceEvent
sub dword [rbx + reloc.ADVAPI32.dll_TraceEvent], 0x750e661c
add rdx, 0x400
add rbx, 0x400
cmp rdx, 0x8c000
je 0x14021c900
jmp 0x14021c035
pop rcx
call fcn.14021b506
mov rsp, rbp
pop rbp
pop r15
pop r14
pop r13
pop r12
pop r11
pop r10
pop r9
pop r8
pop rdi
pop rsi
pop rbp
pop rbx
pop rdx
pop rcx
pop rax