Function at 0x408420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xe8
movabs rdi, 0x32336c656e72656b
mov qword [rsp + 0x130], rcx
mov ecx, 0x100
lea rsi, [rsp + 0xc0]
lea rbx, [rsp + 0xa0]
call sub.msvcrt.dll_malloc
mov qword [rsp + 0xd0], rdi
xor r8d, r8d
mov rcx, rbx
mov r13, rax
lea rax, [rsi + 0x10]
lea rdi, [rsp + 0x98]
mov qword [rsp + 0x98], 0x19
mov qword [rsp + 0xc0], rax
mov rdx, rdi
lea rax, [rbx + 0x10]
mov dword [rsi + 0x18], 0x6c6c642e
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xc8], 0xc
mov byte [rsp + 0xdc], 0
call fcn.0049c8c0
mov rdx, qword [rsp + 0x98]
mov qword [rsp + 0xa0], rax
movabs rcx, 0x6e656d6e6f726976
mov qword [rsp + 0xb0], rdx
movabs rdx, 0x6e45646e61707845
mov qword [rax], rdx
movabs rdx, 0x73676e6972745374
mov qword [rax + 8], rcx
mov rcx, rbx
mov qword [rax + 0x10], rdx
mov byte [rax + 0x18], 0x41
mov rax, qword [rsp + 0x98]
mov rdx, qword [rsp + 0xa0]
mov qword [rsp + 0xa8], rax
mov byte [rdx + rax], 0
mov rdx, rsi
call fcn.00405db0
mov r8d, 0x100
mov rdx, r13
lea rcx, str._SYSTEMROOT__system32_ntdll.dll
call rax
mov rcx, qword [rsp + 0xa0]
lea rax, [rbx + 0x10]
cmp rcx, rax
je 0x408553
call fcn.004afa90
mov rcx, qword [rsp + 0xc0]
lea rax, [rsi + 0x10]
cmp rcx, rax
je 0x408569
call fcn.004afa90
lea rax, [rsi + 0x10]
mov r10d, 0x656c
mov rcx, rbx
movabs rdx, 0x32336c656e72656b
mov qword [rsp + 0xc0], rax
lea rax, [rbx + 0x10]
mov qword [rsp + 0xd0], rdx
movabs rdx, 0x6946657461657243
mov qword [rsp + 0xb0], rdx
mov rdx, rsi
mov dword [rsi + 0x18], 0x6c6c642e
mov qword [rsp + 0xa0], rax
mov word [rbx + 0x18], r10w
mov byte [rbx + 0x1a], 0x41
mov qword [rsp + 0xc8], 0xc
mov byte [rsp + 0xdc], 0
mov qword [rsp + 0xa8], 0xb
mov byte [rsp + 0xbb], 0
call fcn.00405db0
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov r8d, 5
mov rcx, r13
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call rax
mov rcx, qword [rsp + 0xa0]
mov r14, rax
lea rax, [rbx + 0x10]
cmp rcx, rax
je 0x408633
call fcn.004afa90
mov rcx, qword [rsp + 0xc0]
lea rax, [rsi + 0x10]
cmp rcx, rax
je 0x408649
call fcn.004afa90
lea rax, [rsi + 0x10]
mov r9d, 0x7a69
mov rcx, rbx
movabs rdx, 0x32336c656e72656b
mov qword [rsp + 0xc0], rax
lea rax, [rbx + 0x10]
mov qword [rsp + 0xd0], rdx
movabs rdx, 0x53656c6946746547
mov qword [rsp + 0xb0], rdx
mov rdx, rsi
mov dword [rsi + 0x18], 0x6c6c642e
mov qword [rsp + 0xa0], rax
mov word [rbx + 0x18], r9w
mov byte [rbx + 0x1a], 0x65
mov qword [rsp + 0xc8], 0xc
mov byte [rsp + 0xdc], 0
mov qword [rsp + 0xa8], 0xb
mov byte [rsp + 0xbb], 0
call fcn.00405db0
xor edx, edx
mov rcx, r14
call rax
mov rcx, qword [rsp + 0xa0]
mov r12d, eax
lea rax, [rbx + 0x10]
cmp rcx, rax
je 0x4086ee
call fcn.004afa90
mov rcx, qword [rsp + 0xc0]
lea rax, [rsi + 0x10]
cmp rcx, rax
je 0x408704
call fcn.004afa90
lea rax, [rsi + 0x10]
xor r8d, r8d
mov rcx, rbx
movabs rdx, 0x32336c656e72656b
mov qword [rsp + 0xc0], rax
lea rax, [rbx + 0x10]
mov qword [rsp + 0xd0], rdx
mov rdx, rdi
mov dword [rsi + 0x18], 0x6c6c642e
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xc8], 0xc
mov byte [rsp + 0xdc], 0
mov qword [rsp + 0x98], 0x12
call fcn.0049c8c0
mov rdx, qword [rsp + 0x98]
mov r8d, 0x4167
mov rcx, rbx
movabs rdi, 0x6946657461657243
movabs rbp, 0x6e697070614d656c
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xb0], rdx
mov qword [rax], rdi
mov qword [rax + 8], rbp
mov word [rax + 0x10], r8w
mov rax, qword [rsp + 0x98]
mov rdx, qword [rsp + 0xa0]
mov qword [rsp + 0xa8], rax
mov byte [rdx + rax], 0
mov rdx, rsi
call fcn.00405db0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
mov rcx, r14
mov qword [rsp + 0x28], 0
mov r8d, 2
call rax
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x40], rax
lea rax, [rbx + 0x10]
cmp rcx, rax
je 0x408804
call fcn.004afa90
mov rcx, qword [rsp + 0xc0]
lea rax, [rsi + 0x10]
cmp rcx, rax
je 0x40881a
call fcn.004afa90
lea rax, [rsi + 0x10]
mov rdx, rsi
mov rcx, rbx
movabs rdi, 0x32336c656e72656b
mov qword [rsp + 0xc0], rax
lea rax, [rbx + 0x10]
mov qword [rsp + 0xd0], rdi
movabs rdi, 0x4f7765695670614d
mov dword [rsi + 0x18], 0x6c6c642e
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xb0], rdi
mov dword [rbx + 0x18], 0x6c694666
mov byte [rbx + 0x1c], 0x65
mov qword [rsp + 0xc8], 0xc
mov byte [rsp + 0xdc], 0
mov qword [rsp + 0xa8], 0xd
mov byte [rsp + 0xbd], 0
call fcn.00405db0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], 0
call rax
mov rcx, qword [rsp + 0xa0]
mov rdi, rax
lea rax, [rbx + 0x10]
cmp rcx, rax
je 0x4088cf
call fcn.004afa90
mov rcx, qword [rsp + 0xc0]
lea rax, [rsi + 0x10]
cmp rcx, rax
je 0x4088e5
call fcn.004afa90
cmp word [rdi], 0x5a4d
je 0x408910
xor r15d, r15d
mov eax, r15d
add rsp, 0xe8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
movsxd rax, dword [rdi + 0x3c]
mov r8d, r12d
add rax, rdi
mov r15d, dword [rax + 0x88]
movzx edx, word [rax + 6]
lea rcx, [rax + 0x108]
mov ebp, dword [rax + 0x8c]
mov qword [rsp + 0x60], rcx
mov r9d, r15d
mov dword [rsp + 0x6c], edx
call fcn.0040d6e0
test r15d, r15d
sete cl
test ebp, ebp
sete dl
or cl, dl
jne 0x4088ec
test eax, eax
je 0x4088ec
mov eax, eax
mov r15d, dword [rsp + 0x6c]
mov rcx, qword [rsp + 0x60]
mov r8d, r12d
lea rbp, [rax + rdi]
mov r9d, dword [rbp + 0x1c]
mov edx, r15d
call fcn.0040d6e0
mov r9d, dword [rbp + 0x24]
mov r8d, r12d
mov edx, r15d
mov rcx, qword [rsp + 0x60]
mov eax, eax
add rax, rdi
mov qword [rsp + 0x48], rax
call fcn.0040d6e0
mov r9d, dword [rbp + 0x20]
mov r8d, r12d
mov edx, r15d
mov eax, eax
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x6c], r15d
add rax, rdi
mov qword [rsp + 0x50], rax
call fcn.0040d6e0
mov eax, eax
add rax, rdi
mov qword [rsp + 0x58], rax
mov eax, dword [rbp + 0x18]
test eax, eax
je 0x408ce0
xor r15d, r15d
mov qword [rsp + 0x78], r14
mov r14d, eax
mov rbp, qword [rsp + 0x60]
mov qword [rsp + 0x88], rsi
mov esi, dword [rsp + 0x6c]
mov qword [rsp + 0x70], r13
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x80], rbx
jmp 0x408a13
mov eax, dword [rbx + 4]
mov r15d, r14d
mov dword [rsp + 0x60], eax
add r15d, 1
cmp r14d, r15d
jbe 0x408a82
mov rbx, qword [rsp + 0x58]
mov eax, r15d
mov r8d, r12d
mov edx, esi
mov rcx, rbp
mov r13d, dword [rbx + rax*4]
mov rbx, qword [rsp + 0x50]
movzx eax, word [rbx + rax*2]
mov rbx, qword [rsp + 0x48]
mov r9d, dword [rbx + rax*4]
call fcn.0040d6e0
mov edx, esi
mov rcx, rbp
mov r9d, r13d
mov r8d, r12d
mov ebx, eax
call fcn.0040d6e0
mov rcx, qword [rsp + 0x130]
mov edx, eax
add rdx, rdi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x408a0a
add rbx, rdi
cmp dword [rbx], 0xb8d18b4c
je 0x408a00
cmp byte [rbx], 0xb8
jne 0x408a0a
mov eax, dword [rbx + 1]
mov r15d, r14d
mov dword [rsp + 0x60], eax
jmp 0x408a0a
mov r13, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
mov r15d, dword [rsp + 0x60]
mov rbx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
lea rax, [rsi + 0x10]
mov ecx, 0x6c64
movabs rdx, 0x32336c656e72656b
mov qword [rsp + 0xc0], rax
lea rax, [rbx + 0x10]
mov qword [rsp + 0xd0], rdx
movabs rdx, 0x6e614865736f6c43
mov qword [rsp + 0xb0], rdx
mov rdx, rsi
mov dword [rsi + 0x18], 0x6c6c642e
mov qword [rsp + 0xa0], rax
mov word [rbx + 0x18], cx
mov rcx, rbx
mov byte [rbx + 0x1a], 0x65
mov qword [rsp + 0xc8], 0xc
mov byte [rsp + 0xdc], 0
mov qword [rsp + 0xa8], 0xb
mov byte [rsp + 0xbb], 0
call fcn.00405db0
mov rcx, r14
call rax
mov rcx, qword [rsp + 0xa0]
lea rax, [rbx + 0x10]
cmp rcx, rax
je 0x408b3f
call fcn.004afa90
mov rcx, qword [rsp + 0xc0]
lea rax, [rsi + 0x10]
cmp rcx, rax
je 0x408b55
call fcn.004afa90
movabs rdx, 0x32336c656e72656b
lea rax, [rsi + 0x10]
mov rcx, rbx
mov qword [rsp + 0xd0], rdx
movabs rdx, 0x6e614865736f6c43
mov qword [rsp + 0xb0], rdx
mov edx, 0x6c64
mov qword [rsp + 0xc0], rax
lea rax, [rbx + 0x10]
mov dword [rsi + 0x18], 0x6c6c642e
mov qword [rsp + 0xa0], rax
mov word [rbx + 0x18], dx
mov rdx, rsi
mov byte [rbx + 0x1a], 0x65
mov qword [rsp + 0xc8], 0xc
mov byte [rsp + 0xdc], 0
mov qword [rsp + 0xa8], 0xb
mov byte [rsp + 0xbb], 0
call fcn.00405db0
mov rcx, qword [rsp + 0x40]
call rax
mov rcx, qword [rsp + 0xa0]
lea rax, [rbx + 0x10]
cmp rcx, rax
je 0x408bf5
call fcn.004afa90
mov rcx, qword [rsp + 0xc0]
lea rax, [rsi + 0x10]
cmp rcx, rax
je 0x408c0b
call fcn.004afa90
lea rax, [rsi + 0x10]
mov rcx, rbx
movabs rdx, 0x32336c656e72656b
mov qword [rsp + 0xc0], rax
lea rax, [rbx + 0x10]
mov qword [rsp + 0xa0], rax
mov eax, 0x6c69
mov qword [rsp + 0xd0], rdx
movabs rdx, 0x65695670616d6e55
mov qword [rsp + 0xb0], rdx
mov rdx, rsi
mov dword [rsi + 0x18], 0x6c6c642e
mov dword [rbx + 0x18], 0x46664f77
mov word [rbx + 0x1c], ax
mov byte [rbx + 0x1e], 0x65
mov qword [rsp + 0xc8], 0xc
mov byte [rsp + 0xdc], 0
mov qword [rsp + 0xa8], 0xf
mov byte [rsp + 0xbf], 0
call fcn.00405db0
mov rcx, rdi
call rax
mov rcx, qword [rsp + 0xa0]
add rbx, 0x10
cmp rcx, rbx
je 0x408cb0
call fcn.004afa90
mov rcx, qword [rsp + 0xc0]
add rsi, 0x10
cmp rcx, rsi
je 0x408cc6
call fcn.004afa90
mov rcx, r13
call fcn.00423138
mov dword [0x00515308], r15d
jmp 0x4088ef
xor r15d, r15d
jmp 0x408aa1