Function at 0x1402f02e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x700
mov rax, qword [0x1404e1800]
xor rax, rsp
mov qword [rsp + 0x6f0], rax
mov rdi, rcx
mov qword [rsp + 0xf8], rcx
mov al, byte [rcx + 0x50]
test al, al
je 0x1402f112b
cmp byte [rcx + 0x60], 0
je 0x1402f112b
lea rbx, [rcx + 0x58]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockExclusive]
nop dword [rax + rax]
mov qword [rsp + 0x50], rbx
lea rcx, [rsp + 0x3e0]
call fcn.140253d64
nop
lea r8, [rdi + 0x10]
mov rdx, rax
lea rcx, [rsp + 0x250]
call fcn.140252e08
nop
lea rcx, [rsp + 0x3e0]
call fcn.14007a7c0
lea rcx, [rsp + 0x310]
call qword [sym.imp.ole32.dll_CoCreateGuid]
nop dword [rax + rax]
lea rdx, [rsp + 0x310]
lea rcx, [rsp + 0x2b0]
call fcn.14007b824
nop
lea rcx, [rsp + 0x440]
call fcn.1400f6810
nop
lea r8, str.SenseSC_
mov rdx, rax
lea rcx, [rsp + 0x420]
call fcn.140076bd4
nop
lea r8, [rsp + 0x2b0]
mov rdx, rax
lea rcx, [rsp + 0x400]
call fcn.1400f0a08
nop
lea r8, str..log
mov rdx, rax
lea rcx, [rsp + 0x270]
call fcn.140076bd4
nop
lea rcx, [rsp + 0x400]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x420]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x440]
call fcn.14007a7c0
nop
call fcn.140091ae4
cmp dword [rax], 5
jbe 0x1402f04b4
lea rcx, [rsp + 0x270]
cmp qword [rsp + 0x288], 8
cmovae rcx, qword [rsp + 0x270]
mov qword [rsp + 0xa8], rcx
lea rcx, [rsp + 0x250]
cmp qword [rsp + 0x268], 8
cmovae rcx, qword [rsp + 0x250]
mov qword [rsp + 0xb0], rcx
lea rcx, str.Running_SenseSC
mov qword [rsp + 0xb8], rcx
lea rcx, [rsp + 0xa8]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0xb8]
mov qword [rsp + 0x20], rcx
lea rdx, [0x1404580a7]
mov rcx, rax
call fcn.1400092bc
lea rdx, [rsp + 0x68]
call fcn.1402f2400
nop
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x100]
call fcn.14006a6bc
nop
lea rax, [rsp + 0x100]
mov qword [rsp + 0x110], rax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x118], rax
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x90]
call fcn.1402b03c0
nop
lea r9, [fcn.1400e4680]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8d, [rdx - 0xf]
lea rcx, [rsp + 0x100]
call fcn.140112a70
mov edx, dword [rdi + 0x90]
lea rcx, [rsp + 0x6c0]
call fcn.1400aa4c4
mov r14, rax
mov edx, dword [rdi + 0x6c]
lea rcx, [rsp + 0x6a0]
call fcn.1400aa4c4
mov rsi, rax
mov edx, dword [rdi + 0x68]
lea rcx, [rsp + 0x680]
call fcn.1400aa4c4
mov rbx, rax
movzx edx, byte [rdi + 0x65]
lea rcx, [rsp + 0x3a0]
call fcn.1400d4c30
nop
movzx edx, byte [rdi + 0x64]
lea rcx, [rsp + 0x380]
call fcn.1400d4c30
nop
movzx edx, byte [rdi + 0x63]
lea rcx, [rsp + 0x360]
call fcn.1400d4c30
nop
movzx edx, byte [rdi + 0x62]
lea rcx, [rsp + 0x340]
call fcn.1400d4c30
nop
movzx edx, byte [rdi + 0x61]
lea rcx, [rsp + 0x320]
call fcn.1400d4c30
nop
lea r8, [rsp + 0x320]
lea rdx, str._n_t_ScreenshotCaptureEnabled_:
lea rcx, [rsp + 0x660]
call fcn.1401553e4
nop
lea r8, str.__n_t_KeyboardEventEnabled_:
mov rdx, rax
lea rcx, [rsp + 0x640]
call fcn.140076bd4
nop
lea r8, [rsp + 0x340]
mov rdx, rax
lea rcx, [rsp + 0x620]
call fcn.140077658
nop
lea r8, str.__n_t_BitBltEnabled_:
mov rdx, rax
lea rcx, [rsp + 0x600]
call fcn.140076bd4
nop
lea r8, [rsp + 0x360]
mov rdx, rax
lea rcx, [rsp + 0x4e0]
call fcn.140077658
nop
lea r8, str.__n_t_BCastEnabled_:
mov rdx, rax
lea rcx, [rsp + 0x5c0]
call fcn.140076bd4
nop
lea r8, [rsp + 0x380]
mov rdx, rax
lea rcx, [rsp + 0x5a0]
call fcn.140077658
nop
lea r8, str.__n_t_CompressionEnabled_:
mov rdx, rax
lea rcx, [rsp + 0x580]
call fcn.140076bd4
nop
lea r8, [rsp + 0x3a0]
mov rdx, rax
lea rcx, [rsp + 0x560]
call fcn.140077658
nop
lea r8, str.__n_t_MaxImageSizeInPixels_:
mov rdx, rax
lea rcx, [rsp + 0x540]
call fcn.140076bd4
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x520]
call fcn.140077658
nop
lea r8, str.__n_t_CollateWindowSizeInSeconds_:
mov rdx, rax
lea rcx, [rsp + 0x500]
call fcn.140076bd4
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rsp + 0x5e0]
call fcn.140077658
nop
lea r8, str.__n_t_ImageFormat_:
mov rdx, rax
lea rcx, [rsp + 0x4c0]
call fcn.140076bd4
nop
lea r8, [rdi + 0x70]
mov rdx, rax
lea rcx, [rsp + 0x4a0]
call fcn.1400f0a08
nop
lea r8, str.__n_t_CompressionRatio_:
mov rdx, rax
lea rcx, [rsp + 0x480]
call fcn.140076bd4
nop
mov r8, r14
mov rdx, rax
lea rcx, [rsp + 0x460]
call fcn.140077658
nop
lea r8, [0x140406534]
mov rdx, rax
lea rcx, [rsp + 0x290]
call fcn.140076bd4
nop
lea rcx, [rsp + 0x460]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x480]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x4a0]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x4c0]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x5e0]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x500]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x520]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x540]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x560]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x580]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x5a0]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x5c0]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x4e0]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x600]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x620]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x640]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x660]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x320]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x340]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x360]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x380]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x3a0]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x680]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x6a0]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x6c0]
call fcn.14007a7c0
mov r14d, 3
mov edx, r14d
lea rcx, [rsp + 0x150]
call fcn.1400920a8
nop
lea rdx, [0x1403e5c6c]
lea rcx, [rsp + 0x160]
call fcn.140091e60
lea rdx, [rsp + 0x250]
cmp qword [rsp + 0x268], 8
cmovae rdx, qword [rsp + 0x250]
mov r8, qword [rsp + 0x260]
mov rcx, rax
call fcn.1400924c4
lea rdx, [0x1403ec6b8]
mov rcx, rax
call fcn.140091e60
mov rbx, rax
mov rax, qword [rsp + 0x90]
mov rdx, qword [rax]
test rdx, rdx
je 0x1402f093c
mov rdx, qword [rdx]
lea rcx, [rsp + 0x2f0]
call fcn.14008f76c
nop
lea rdx, [rsp + 0x2f0]
cmp qword [rsp + 0x308], 8
cmovae rdx, qword [rsp + 0x2f0]
mov r8, qword [rsp + 0x300]
mov rcx, rbx
call fcn.1400924c4
lea rdx, [0x1403ec6b8]
mov rcx, rax
call fcn.140091e60
lea rdx, [rsp + 0x290]
cmp qword [rsp + 0x2a8], 8
cmovae rdx, qword [rsp + 0x290]
mov r8, qword [rsp + 0x2a0]
mov rcx, rax
call fcn.1400924c4
lea rdx, [0x1403e5c6c]
mov rcx, rax
call fcn.140091e60
nop
lea rcx, [rsp + 0x2f0]
call fcn.14007a7c0
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x150]
call fcn.14010ff00
nop
lea rdx, str.LocalService
lea rcx, [rsp + 0x3c0]
call fcn.14008c350
lea rdx, [rsp + 0x3c0]
lea rcx, [rsp + 0x48]
call fcn.140261bb0
nop
lea rcx, [rsp + 0x3c0]
call fcn.14007a7c0
mov rbx, qword [rsp + 0x48]
lea rax, [rbx + 1]
test rax, 0xfffffffffffffffe
jne 0x1402f0b19
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x1402f0a44
movzx ebx, ax
or ebx, 0x80070000
call fcn.140091ae4
cmp dword [rax], r14d
jbe 0x1402f0a8b
mov dword [rsp + 0x78], ebx
lea rcx, str.Failed_to_create_local_service_token_for_running_SenseSC
mov qword [rsp + 0xc0], rcx
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0xc0]
mov qword [rsp + 0x20], rcx
xor r8d, r8d
lea rdx, [0x140456ffd]
mov rcx, rax
call fcn.14000615c
nop
lea rcx, [rsp + 0x48]
call fcn.1400f0310
nop
lea rcx, [rsp + 0x2d0]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x150]
call fcn.1400fa2f0
nop
lea rcx, [rsp + 0x290]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x90]
call fcn.14006ed00
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1402f0ade
call fcn.14007e3e0
nop
lea rcx, [rsp + 0x270]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x2b0]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x250]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x50]
call fcn.1400ccc30
mov eax, ebx
jmp 0x1402f1162
lea rsi, [rdi + 0xb8]
cmp dword [rsi], 0
jne 0x1402f0bf5
call fcn.140091ae4
cmp dword [rax], r14d
jbe 0x1402f0b5e
lea rcx, str.User_session_id_is_not_initialized._Unable_to_run_SenseSC
mov qword [rsp + 0xc8], rcx
lea rcx, [rsp + 0xc8]
mov qword [rsp + 0x20], rcx
lea rdx, [0x14044a6dd]
mov rcx, rax
call fcn.140005f40
and qword [rsp + 0x48], 0
lea rcx, [rsp + 0x48]
call fcn.1400f0310
nop
lea rcx, [rsp + 0x2d0]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x150]
call fcn.1400fa2f0
nop
lea rcx, [rsp + 0x290]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x90]
call fcn.14006ed00
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1402f0bb7
call fcn.14007e3e0
nop
lea rcx, [rsp + 0x270]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x2b0]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x250]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x50]
call fcn.1400ccc30
mov eax, 0x80070057
jmp 0x1402f1162
mov r9d, 4
mov r8, rsi
lea edx, [r9 + 8]
mov rcx, rbx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetTokenInformation]
nop dword [rax + rax]
test eax, eax
jne 0x1402f0d1c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x1402f0c34
movzx ebx, ax
or ebx, 0x80070000
call fcn.140091ae4
cmp dword [rax], r14d
jbe 0x1402f0c8e
mov dword [rsp + 0x7c], ebx
mov ecx, dword [rsi]
mov dword [rsp + 0x80], ecx
lea rcx, str.Failed_to_set_user_session_id_for_local_service_token
mov qword [rsp + 0xd0], rcx
lea rcx, [rsp + 0x7c]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0xd0]
mov qword [rsp + 0x20], rcx
lea rdx, [0x140457e52]
mov rcx, rax
call fcn.14000ad90
nop
lea rcx, [rsp + 0x48]
call fcn.1400f0310
nop
lea rcx, [rsp + 0x2d0]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x150]
call fcn.1400fa2f0
nop
lea rcx, [rsp + 0x290]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x90]
call fcn.14006ed00
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1402f0ce1
call fcn.14007e3e0
nop
lea rcx, [rsp + 0x270]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x2b0]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x250]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x50]
call fcn.1400ccc30
mov eax, ebx
jmp 0x1402f1162
lea rcx, [rsp + 0x58]
call fcn.1402ecbc8
nop
mov rax, qword [rsp + 0x58]
mov byte [rax + 0x14], 1
mov rax, qword [rsp + 0x58]
mov qword [rax + 8], rbx
mov rax, qword [rsp + 0x58]
mov byte [rax + 0x13], 1
mov rax, qword [rsp + 0x58]
mov byte [rax + 0x10], 1
mov rax, qword [rsp + 0x58]
mov byte [rax + 0x12], 1
mov rax, qword [rsp + 0x58]
mov byte [rax + 0x15], 1
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x90]
lea r8, [rsp + 0x270]
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0xd8]
call fcn.1402eccb0
mov rdx, rax
lea rcx, [rdi + 0x48]
call fcn.1402ecf7c
lea rcx, [rsp + 0xd8]
call fcn.14011b9e8
mov byte [rsp + 0x20], 1
mov r9d, dword [rdi + 0x3c]
mov r8d, dword [rdi + 0x38]
mov edx, dword [rdi + 0x34]
mov rcx, qword [rdi + 0x48]
call fcn.14033f894
mov ebx, eax
cmp eax, 0x103
je 0x1402f0f48
test eax, eax
je 0x1402f0f48
call fcn.140091ae4
cmp dword [rax], r14d
jbe 0x1402f0e7b
mov dword [rsp + 0x40], ebx
lea rcx, [rsp + 0x270]
cmp qword [rsp + 0x288], 8
cmovae rcx, qword [rsp + 0x270]
mov qword [rsp + 0xe0], rcx
lea rcx, [rsp + 0x250]
cmp qword [rsp + 0x268], 8
cmovae rcx, qword [rsp + 0x250]
mov qword [rsp + 0xe8], rcx
lea rcx, str.SenseSC_run_finished_with_non_zero_exitCode
mov qword [rsp + 0xf0], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0xe8]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0xf0]
mov qword [rsp + 0x20], rcx
xor r8d, r8d
lea rdx, [0x140457e82]
mov rcx, rax
call fcn.140001fa0
lea rcx, [0x1404e29f8]
call fcn.1402ef848
test al, al
je 0x1402f0e98
xor edx, edx
lea rcx, [rdi + 0x48]
call fcn.1402ef888
jmp 0x1402f0e9d
and qword [rdi + 0x48], 0
test ebx, ebx
jle 0x1402f0eaa
movzx ebx, bx
or ebx, 0x80070000
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1402f0eba
call fcn.14007e3e0
nop
lea rcx, [rsp + 0x48]
call fcn.1400f0310
nop
lea rcx, [rsp + 0x2d0]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x150]
call fcn.1400fa2f0
nop
lea rcx, [rsp + 0x290]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x90]
call fcn.14006ed00
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1402f0f0d
call fcn.14007e3e0
nop
lea rcx, [rsp + 0x270]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x2b0]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x250]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x50]
call fcn.1400ccc30
mov eax, ebx
jmp 0x1402f1162
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x120]
call fcn.14006a6bc
lea rdx, [rsp + 0x120]
mov rcx, rdi
call fcn.1402f27a4
mov ebx, eax
test eax, eax
jns 0x1402f102f
mov rcx, qword [rsp + 0x708]
mov r9d, eax
lea r8, str.amcorewcd_sourcedlppolicy_src_sensescrunner.cpp
mov edx, 0x20e
call fcn.140070bd4
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1402f0fa1
call fcn.14007e3e0
nop
lea rcx, [rsp + 0x48]
call fcn.1400f0310
nop
lea rcx, [rsp + 0x2d0]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x150]
call fcn.1400fa2f0
nop
lea rcx, [rsp + 0x290]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x90]
call fcn.14006ed00
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1402f0ff4
call fcn.14007e3e0
nop
lea rcx, [rsp + 0x270]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x2b0]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x250]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x50]
call fcn.1400ccc30
mov eax, ebx
jmp 0x1402f1162
test byte [0x1404e2680], 1
je 0x1402f1058
lea rax, [rsp + 0x6e0]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea rdx, [0x1403c63e8]
call fcn.140124370
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1402f1068
call fcn.14007e3e0
nop
lea rcx, [rsp + 0x48]
call fcn.1400f0310
nop
lea rcx, [rsp + 0x2d0]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x150]
call fcn.1400fa2f0
nop
lea rcx, [rsp + 0x290]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x90]
call fcn.14006ed00
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1402f10bb
call fcn.14007e3e0
nop
lea rcx, [rsp + 0x270]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x2b0]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x250]
call fcn.14007a7c0
nop
lea rcx, [rsp + 0x50]
call fcn.1400ccc30
jmp 0x1402f1160
call fcn.140091ae4
cmp dword [rax], 4
jbe 0x1402f1160
lea rcx, str.Screenshot_auditing_is_disabled._SenseSC_will_not_run.
mov qword [rsp + 0x88], rcx
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x20], rcx
lea rdx, [0x14044a4da]
mov rcx, rax
call fcn.140005f40
xor eax, eax
mov rcx, qword [rsp + 0x6f0]
xor rcx, rsp
call fcn.140112420
lea r11, [rsp + 0x700]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret