Function at 0x14000e480
Capabilities:
Compress data via winapi

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, rdx
mov r15, rcx
xor edi, edi
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rdi
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.14000e2e0
mov rbx, qword [rbp - 0x30]
test al, al
je 0x14000e931
mov r14, qword [rbp - 0x28]
mov r8, r14
sub r8, rbx
cmp r8, 0x100
jb 0x14000e931
cmp byte [rbx], 0x4d
jne 0x14000e8c2
cmp byte ds:[rbx + 1], 0x41
jne 0x14000e8c2
cmp byte [rbx + 2], 0x4d
jne 0x14000e8c2
mov esi, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
mov eax, dword [rsi + rax]
cmp dword [0x140074adc], eax
jle 0x14000e572
lea rcx, [0x140074adc]
call fcn.140048434
cmp dword [0x140074adc], 0xffffffff
nop
jne 0x14000e572
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlGetCompressionWorkSpaceSize
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140074ad0], rax
lea rcx, [0x140074adc]
call fcn.1400483c8
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov eax, dword [rsi + rdx]
cmp dword [0x140074ad8], eax
jle 0x14000e5ce
lea rcx, [0x140074ad8]
call fcn.140048434
cmp dword [0x140074ad8], 0xffffffff
jne 0x14000e5ce
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlDecompressBufferEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140074ac8], rax
lea rcx, [0x140074ad8]
call fcn.1400483c8
mov r12d, dword ds:[rbx]
mov esi, dword [rbx + 4]
mov dword [rbp - 0x40], esi
mov eax, r12d
and eax, 0xffffff
cmp eax, 0x4d414d
je 0x14000e644
test rbx, rbx
je 0x14000e626
mov rdx, qword [rbp - 0x20]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000e618
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e78a
mov rcx, rbx
call fcn.140048300
nop
mov rax, r15
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rdx, [rbx + 8]
cmp rbx, rdx
je 0x14000e662
sub r14, rdx
mov r8, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
add r14, rbx
mov qword [rbp - 0x28], r14
cmp r12d, 0x10000000
jae 0x14000e5e7
shr r12d, 0x18
and r12d, 0xf
mov dword [rbp + 0x50], edi
mov dword [rbp + 0x58], edi
lea r8, [rbp + 0x58]
lea rdx, [rbp + 0x50]
movzx ecx, r12w
mov rax, qword [0x140074ad0]
call qword [0x14004ed88]
test eax, eax
jne 0x14000e5e7
mov r13, rsi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rdi
test esi, esi
je 0x14000e6e9
lfence
mov rcx, rsi
call fcn.1400069a0
mov rsi, rax
mov qword [rbp - 0x18], rax
lea rdi, [rax + r13]
mov qword [rbp - 8], rdi
mov r8, r13
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov r13, rdi
mov qword [rbp - 0x10], rdi
mov r14, qword [rbp - 0x28]
mov rbx, qword [rbp - 0x30]
jmp 0x14000e6f1
mov r13, qword [rbp - 0x10]
mov rsi, qword [rbp - 0x18]
mov ecx, dword [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword ds:[rbp - 0x38], rax
test rax, rax
jne 0x14000e791
test rsi, rsi
je 0x14000e746
sub rdi, rsi
mov rax, rsi
cmp rdi, 0x1000
jb 0x14000e739
add rdi, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000e739
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rdi
mov rcx, rsi
call fcn.140048300
nop
test rbx, rbx
je 0x14000e626
mov rdx, qword ds:[rbp - 0x20]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000e618
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000e618
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
sub r14, rbx
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
mov r9, rbx
mov r8d, dword [rbp - 0x40]
mov rdx, rsi
movzx ecx, r12w
mov rax, qword [0x140074ac8]
call qword [0x14004ed88]
mov rcx, qword [rbp - 0x38]
test eax, eax
je 0x14000e856
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
test rsi, rsi
je 0x14000e816
sub rdi, rsi
mov rax, rsi
cmp rdi, 0x1000
jb 0x14000e80a
add rdi, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e8ad
mov rdx, rdi
mov rcx, rsi
call fcn.140048300
nop
test rbx, rbx
je 0x14000e626
mov rdx, qword [rbp - 0x20]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000e618
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000e618
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rax, [rbp - 0x18]
cmp r15, rax
je 0x14000e877
sub r13, rsi
mov r8, r13
mov rdx, rsi
mov rcx, r15
call fcn.1400101c0
nop
nop word [rax + rax]
test rsi, rsi
je 0x14000e8f1
sub rdi, rsi
mov rax, rsi
cmp rdi, 0x1000
jb 0x14000e8b4
add rdi, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000e8b4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rdi
mov rcx, rsi
call fcn.140048300
nop
jmp 0x14000e8f1
cmp byte [rbx + 4], 0x53
jne 0x14000e8f1
cmp byte [rbx + 5], 0x43
jne 0x14000e8f1
cmp byte [rbx + 6], 0x43
jne 0x14000e8f1
cmp byte [rbx + 7], 0x41
jne 0x14000e8f1
lea rax, ds:[rbp - 0x30]
cmp r15, rax
je 0x14000e8f1
mov rdx, rbx
mov rcx, r15
call fcn.1400101c0
nop
test rbx, rbx
je 0x14000e626
mov rdx, qword [rbp - 0x20]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000e618
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000e618
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rbx, rbx
je 0x14000e626
mov rdx, qword [rbp - 0x20]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000e618
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000e618
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3