Function at 0x140033870
Capabilities:
Encode data using xor
Hash data with crc32
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
mov rax, qword [0x1402fa010]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r14d, edx
mov r15, rcx
mov qword [rbp - 0x39], rcx
xor r12d, r12d
cmp dword [rcx + 0x54], r12d
je 0x1400338da
lea rdx, [rbp + 0xb]
call fcn.140033420
test eax, eax
je 0x14003397a
lea rdx, [rbp + 3]
mov rcx, r15
call fcn.140033420
test eax, eax
je 0x14003397a
sub r14d, 2
mov dword [r15 + 0x54], r12d
mov rbx, qword [r15 + 0x48]
mov edi, dword [r15 + 0x50]
mov r13d, dword [r15 + 0x60]
mov dword [rbp - 0x71], r13d
movzx eax, byte [r15 + 0x78]
mov byte [rbp + 3], al
mov rsi, qword [r15 + 0x80]
mov eax, dword [r15 + 0x79]
mov dword [rbp - 1], eax
mov eax, dword [r15 + 0x88]
mov dword [rbp + 7], eax
mov eax, dword [r15 + 0x64]
mov dword [rbp - 0x49], eax
mov ecx, dword [r15 + 0x40]
mov dword [rbp - 0x59], ecx
mov eax, dword [r15 + 0x44]
mov dword [rbp - 0x6d], eax
mov rax, qword [r15 + 0x58]
mov qword [rbp - 0x61], rax
cmp qword [r15 + 0x90], r12
jne 0x140033945
movsxd rdx, dword [r15 + 0x38]
mov ecx, 1
call fcn.1402090a4
mov qword [r15 + 0x90], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], rax
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x19], rax
mov qword [rbp - 9], r12
mov qword [rbp - 0x11], r12
movsxd r12, r14d
mov rdx, r12
xor ecx, ecx
call fcn.140203270
test rax, rax
jne 0x140033989
mov rdx, qword [rbp - 0x41]
jmp 0x1400339a5
mov dword [r15 + 8], 4
xor eax, eax
jmp 0x14003464c
mov rdx, rax
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x19], rax
mov qword [rbp - 9], r12
mov qword [rbp - 0x11], 0
mov eax, 1
test eax, eax
je 0x140034673
mov rcx, qword [r15]
mov qword [rbp + 0xf], 0
mov rax, qword [rcx]
lea r9, [rbp + 0xf]
mov r8, r12
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
test eax, eax
je 0x140034627
cmp qword [rbp + 0xf], r12
jne 0x140034627
mov r8d, r14d
mov r12, qword [rbp - 0x41]
mov rdx, r12
mov rcx, qword [r15 + 0x20]
call fcn.14003f250
test eax, eax
jne 0x140034627
mov r8, r12
mov edx, dword [r15 + 0x1c]
test r12, r12
jne 0x140033a0c
xor edx, edx
jmp 0x140033b0f
not edx
lea r10, [0x1402686d0]
cmp r14d, 8
jb 0x140033ae1
mov r9d, r14d
shr r9, 3
nop word [rax + rax]
mov ecx, edx
movzx eax, byte [r8]
xor rcx, rax
movzx eax, cl
shr edx, 8
xor edx, dword [r10 + rax*4]
movzx ecx, byte [r8 + 1]
mov eax, edx
xor rcx, rax
movzx eax, cl
shr edx, 8
xor edx, dword [r10 + rax*4]
movzx ecx, byte [r8 + 2]
mov eax, edx
xor rcx, rax
movzx eax, cl
shr edx, 8
xor edx, dword [r10 + rax*4]
movzx ecx, byte [r8 + 3]
mov eax, edx
xor rcx, rax
movzx eax, cl
shr edx, 8
xor edx, dword [r10 + rax*4]
movzx ecx, byte [r8 + 4]
mov eax, edx
xor rcx, rax
movzx eax, cl
shr edx, 8
xor edx, dword [r10 + rax*4]
movzx ecx, byte [r8 + 5]
mov eax, edx
xor rcx, rax
movzx eax, cl
shr edx, 8
xor edx, dword [r10 + rax*4]
movzx ecx, byte [r8 + 6]
mov eax, edx
xor rcx, rax
movzx eax, cl
shr edx, 8
xor edx, dword [r10 + rax*4]
movzx ecx, byte [r8 + 7]
mov eax, edx
xor rcx, rax
movzx eax, cl
shr edx, 8
xor edx, dword [r10 + rax*4]
add r8, 8
add r14d, 0xfffffff8
sub r9, 1
jne 0x140033a30
test r14d, r14d
je 0x140033b0d
nop word [rax + rax]
mov ecx, edx
movzx eax, byte [r8]
xor rcx, rax
movzx eax, cl
shr edx, 8
xor edx, dword [r10 + rax*4]
lea r8, [r8 + 1]
add r14d, 0xffffffff
jne 0x140033af0
not edx
mov dword [r15 + 0x1c], edx
mov rcx, r15
call fcn.1400334d0
test eax, eax
jne 0x140033b29
mov eax, 5
jmp 0x14003462c
mov rax, qword [r15 + 0x20]
mov r10, qword [rax + 0x48]
mov r11d, dword [rax + 0x54]
cmp dword [r15 + 0x98], 0
je 0x140033b57
cmp qword [r15 + 0xa0], 0
jne 0x140033b57
mov eax, 3
add r15, 8
jmp 0x140034634
test r11d, r11d
je 0x1400345df
lea rdx, reloc.SHELL32.dll_SHChangeNotifyRegister
lea r9, reloc.SHELL32.dll_SHChangeNotifyRegister
mov r14, qword [rbp - 0x61]
mov r12d, dword [rbp - 0x49]
mov r8d, dword [rbp - 0x59]
nop word [rax + rax]
cmp edi, r8d
jne 0x140033bbb
movzx eax, byte [r10]
mov byte [rbp + 3], al
xor ecx, ecx
mov dword [rbp - 1], ecx
mov dword [rbp + 7], ecx
mov rax, qword [r15 + 0x70]
mov rsi, rax
test rax, rax
jne 0x140033ba7
mov rsi, qword [r15 + 0x90]
mov r13d, ecx
mov dword [rbp - 0x71], ecx
mov qword [r15 + 0x68], rax
mov qword [r15 + 0x70], rbx
inc r10
dec r11d
movzx ecx, byte [rbp + 3]
test ecx, ecx
je 0x140034399
sub ecx, 1
je 0x14003427a
sub ecx, 1
je 0x14003416e
sub ecx, 1
je 0x1400340ff
cmp ecx, 1
jne 0x140034637
cmp dword [r15 + 0x98], 0
jne 0x1400345d6
test rsi, rsi
je 0x140034612
mov r8, qword [rbp - 0x61]
test r13d, r13d
jne 0x140034020
cmp r8, rdx
jne 0x140033dd7
cmp r11d, 3
jbe 0x140034020
movzx r8d, byte [rbp + 1]
movzx r9d, byte [rbp]
movzx r14d, byte [rbp - 1]
movzx eax, byte [rbp + 9]
mov byte [rbp - 0x78], al
movzx eax, byte [rbp + 8]
mov byte [rbp - 0x79], al
movzx ecx, byte [rbp + 7]
cmp edi, 3
jle 0x14003401c
movzx r14d, r14b
movzx eax, byte [rsi + 2]
mov dword [rbp - 0x71], eax
movzx r12d, cl
sub eax, r12d
lea ecx, [rax + r14]
cdq
xor eax, edx
sub eax, edx
mov dword [rbp - 0x69], eax
mov eax, ecx
sub eax, dword [rbp - 0x71]
cdq
xor eax, edx
sub eax, edx
mov dword [rbp - 0x75], eax
sub ecx, r12d
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
mov ecx, dword [rbp - 0x69]
mov edx, dword [rbp - 0x75]
cmp ecx, edx
jg 0x140033c94
cmp ecx, eax
jg 0x140033c94
add r14b, byte [r10]
jmp 0x140033ca9
cmp edx, eax
jg 0x140033ca2
movzx r14d, byte [rbp - 0x71]
add r14b, byte [r10]
jmp 0x140033ca9
movzx r14d, byte [r10]
add r14b, r12b
mov byte [rbx + 2], r14b
mov byte [rbp - 1], r14b
movzx eax, byte [rbp - 0x71]
mov byte [rbp + 0xb], al
mov byte [rbp + 7], al
movzx edx, r9b
mov dword [rbp - 0x75], edx
movzx r9d, byte [rsi + 1]
mov dword [rbp - 0x71], r9d
movzx ecx, byte [rbp - 0x79]
mov eax, r9d
sub eax, ecx
lea ecx, [rax + rdx]
cdq
mov r12d, eax
xor r12d, edx
sub r12d, edx
mov eax, ecx
sub eax, r9d
cdq
xor eax, edx
sub eax, edx
mov dword [rbp - 0x69], eax
movzx edx, byte [rbp - 0x79]
sub ecx, edx
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
movzx r9d, byte [r10 + 1]
mov ecx, dword [rbp - 0x69]
cmp r12d, ecx
jg 0x140033d13
cmp r12d, eax
jg 0x140033d13
add r9b, byte [rbp - 0x75]
jmp 0x140033d26
cmp ecx, eax
jg 0x140033d1f
mov eax, dword [rbp - 0x71]
add r9b, al
jmp 0x140033d29
movzx ecx, byte [rbp - 0x79]
add r9b, cl
mov eax, dword [rbp - 0x71]
mov byte [rbx + 1], r9b
mov byte [rbp], r9b
mov byte [rbp - 0x79], al
mov byte [rbp + 8], al
movzx edx, r8b
mov dword [rbp - 0x75], edx
movzx r8d, byte [rsi]
mov dword [rbp - 0x71], r8d
movzx ecx, byte [rbp - 0x78]
mov eax, r8d
sub eax, ecx
lea ecx, [rax + rdx]
cdq
mov r12d, eax
xor r12d, edx
sub r12d, edx
mov eax, ecx
sub eax, r8d
cdq
xor eax, edx
sub eax, edx
mov dword [rbp - 0x69], eax
movzx edx, byte [rbp - 0x78]
sub ecx, edx
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
movzx r8d, byte [r10 + 2]
mov ecx, dword [rbp - 0x69]
cmp r12d, ecx
jg 0x140033d8e
cmp r12d, eax
jg 0x140033d8e
add r8b, byte [rbp - 0x75]
jmp 0x140033da1
cmp ecx, eax
jg 0x140033d9a
mov eax, dword [rbp - 0x71]
add r8b, al
jmp 0x140033da4
movzx ecx, byte [rbp - 0x78]
add r8b, cl
mov eax, dword [rbp - 0x71]
mov byte [rbx], r8b
mov byte [rbp + 1], r8b
mov byte [rbp - 0x78], al
mov byte [rbp + 9], al
sub edi, 3
add r11d, 0xfffffffd
add r10, 3
add rbx, 3
add rsi, 3
cmp r11d, 3
movzx ecx, byte [rbp + 0xb]
ja 0x140033c43
jmp 0x14003401c
cmp r8, r9
jne 0x140034020
cmp r11d, 4
jbe 0x140034020
movzx r8d, byte [rbp + 2]
movzx r9d, byte [rbp + 1]
movzx r14d, byte [rbp]
movzx r12d, byte [rbp - 1]
movzx eax, byte [rbp + 0xa]
mov byte [rbp - 0x79], al
movzx r13d, byte [rbp + 9]
movzx eax, byte [rbp + 8]
mov byte [rbp - 0x78], al
movzx r15d, byte [rbp + 7]
cmp edi, 4
jle 0x140034014
movzx r12d, r12b
movzx eax, byte [rsi + 2]
mov dword [rbp - 0x75], eax
movzx ecx, r15b
mov dword [rbp - 0x69], ecx
sub eax, ecx
lea ecx, [rax + r12]
cdq
xor eax, edx
sub eax, edx
mov dword [rbp - 0x51], eax
mov eax, ecx
sub eax, dword [rbp - 0x75]
cdq
xor eax, edx
sub eax, edx
mov dword [rbp + 0xf], eax
sub ecx, dword [rbp - 0x69]
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
mov ecx, dword [rbp - 0x51]
mov edx, dword [rbp + 0xf]
cmp ecx, edx
jg 0x140033e64
cmp ecx, eax
jle 0x140033e73
cmp edx, eax
jg 0x140033e6f
movzx r12d, byte [rbp - 0x75]
jmp 0x140033e73
mov r12d, dword [rbp - 0x69]
add r12b, byte [r10]
mov byte [rbx + 2], r12b
mov byte [rbp - 1], r12b
movzx r15d, byte [rbp - 0x75]
mov byte [rbp + 7], r15b
movzx edx, r14b
mov dword [rbp - 0x69], edx
movzx r14d, byte [rsi + 1]
mov dword [rbp - 0x75], r14d
movzx ecx, byte [rbp - 0x78]
mov eax, r14d
sub eax, ecx
lea ecx, [rax + rdx]
cdq
xor eax, edx
sub eax, edx
mov dword [rbp + 0xf], eax
mov eax, ecx
sub eax, r14d
cdq
xor eax, edx
sub eax, edx
mov dword [rbp - 0x51], eax
movzx edx, byte [rbp - 0x78]
sub ecx, edx
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
movzx r14d, byte [r10 + 1]
mov ecx, dword [rbp + 0xf]
mov edx, dword [rbp - 0x51]
cmp ecx, edx
jg 0x140033ede
cmp ecx, eax
jg 0x140033ede
add r14b, byte [rbp - 0x69]
jmp 0x140033ef1
cmp edx, eax
jg 0x140033eea
mov eax, dword [rbp - 0x75]
add r14b, al
jmp 0x140033ef4
movzx ecx, byte [rbp - 0x78]
add r14b, cl
mov eax, dword [rbp - 0x75]
mov byte [rbx + 1], r14b
mov byte [rbp], r14b
mov byte [rbp - 0x78], al
mov byte [rbp + 8], al
movzx edx, r9b
mov dword [rbp - 0x69], edx
movzx r9d, byte [rsi]
mov dword [rbp - 0x75], r9d
movzx ecx, r13b
mov eax, r9d
sub eax, ecx
lea ecx, [rax + rdx]
cdq
xor eax, edx
sub eax, edx
mov dword [rbp + 0xf], eax
mov eax, ecx
sub eax, r9d
cdq
xor eax, edx
sub eax, edx
mov dword [rbp - 0x51], eax
movzx eax, r13b
sub ecx, eax
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
movzx r9d, byte [r10 + 2]
mov ecx, dword [rbp + 0xf]
mov edx, dword [rbp - 0x51]
cmp ecx, edx
jg 0x140033f58
cmp ecx, eax
jg 0x140033f58
add r9b, byte [rbp - 0x69]
jmp 0x140033f6b
cmp edx, eax
jg 0x140033f64
mov eax, dword [rbp - 0x75]
add r9b, al
jmp 0x140033f6e
movzx eax, r13b
add r9b, al
mov eax, dword [rbp - 0x75]
mov byte [rbx], r9b
mov byte [rbp + 1], r9b
movzx r13d, al
mov byte [rbp + 9], al
movzx edx, r8b
mov dword [rbp - 0x69], edx
movzx r8d, byte [rsi + 3]
mov dword [rbp - 0x75], r8d
movzx ecx, byte [rbp - 0x79]
mov eax, r8d
sub eax, ecx
lea ecx, [rax + rdx]
cdq
xor eax, edx
sub eax, edx
mov dword [rbp + 0xf], eax
mov eax, ecx
sub eax, r8d
cdq
xor eax, edx
sub eax, edx
mov dword [rbp - 0x51], eax
movzx edx, byte [rbp - 0x79]
sub ecx, edx
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
movzx r8d, byte [r10 + 3]
mov ecx, dword [rbp + 0xf]
mov edx, dword [rbp - 0x51]
cmp ecx, edx
jg 0x140033fd3
cmp ecx, eax
jg 0x140033fd3
add r8b, byte [rbp - 0x69]
jmp 0x140033fe6
cmp edx, eax
jg 0x140033fdf
mov eax, dword [rbp - 0x75]
add r8b, al
jmp 0x140033fe9
movzx ecx, byte [rbp - 0x79]
add r8b, cl
mov eax, dword [rbp - 0x75]
mov byte [rbx + 3], r8b
mov byte [rbp + 2], r8b
mov byte [rbp - 0x79], al
mov byte [rbp + 0xa], al
sub edi, 4
add r11d, 0xfffffffc
add r10, 4
add rbx, 4
add rsi, 4
cmp r11d, 4
ja 0x140033e16
mov r15, qword [rbp - 0x39]
mov r13d, dword [rbp - 0x71]
mov r8, qword [rbp - 0x61]
test r11d, r11d
je 0x1400345df
nop dword [rax]
movsxd rax, r13d
lea rcx, [rbp - 1]
add rcx, rax
mov qword [rbp - 0x51], rcx
movzx r9d, byte [rcx]
movsxd r8, dword [r8 + rax*4]
movzx ecx, byte [r8 + rsi]
mov dword [rbp - 0x75], ecx
lea rax, [rbp + rax + 7]
mov qword [rbp - 0x69], rax
movzx r14d, byte [rax]
mov eax, ecx
sub eax, r14d
lea ecx, [rax + r9]
cdq
mov r12d, eax
xor r12d, edx
sub r12d, edx
mov eax, ecx
sub eax, dword [rbp - 0x75]
cdq
xor eax, edx
sub eax, edx
mov dword [rbp + 0xf], eax
sub ecx, r14d
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
movzx edx, byte [r10]
mov ecx, dword [rbp + 0xf]
cmp r12d, ecx
jg 0x14003409b
cmp r12d, eax
jg 0x14003409b
add r9b, dl
jmp 0x1400340ad
cmp ecx, eax
jg 0x1400340a9
movzx r9d, byte [rbp - 0x75]
add r9b, dl
jmp 0x1400340ad
lea r9d, [rdx + r14]
mov byte [r8 + rbx], r9b
mov rax, qword [rbp - 0x51]
mov byte [rax], r9b
mov eax, dword [rbp - 0x75]
mov rcx, qword [rbp - 0x69]
mov byte [rcx], al
inc rsi
inc rbx
lea eax, [r13 + 1]
cdq
idiv dword [rbp - 0x49]
mov r13d, edx
mov dword [rbp - 0x71], edx
inc r10
dec r11d
sub edi, 1
je 0x1400340f2
test r11d, r11d
je 0x1400345df
mov r8, qword [rbp - 0x61]
jmp 0x140034030
mov r8d, dword [rbp - 0x59]
mov r12d, dword [rbp - 0x49]
jmp 0x1400345ba
cmp dword [r15 + 0x98], 0
jne 0x1400345d6
test rsi, rsi
je 0x140034612
test r11d, r11d
je 0x1400345df
movsxd rax, r13d
lea r9, [rbp - 1]
add r9, rax
movzx edx, byte [r9]
movsxd rax, dword [r14 + rax*4]
movzx r8d, byte [rax + rsi]
add r8d, edx
shr r8d, 1
add r8b, byte [r10]
mov byte [rax + rbx], r8b
mov byte [r9], r8b
inc rsi
inc rbx
lea eax, [r13 + 1]
cdq
idiv r12d
mov r13d, edx
mov dword [rbp - 0x71], edx
inc r10
dec r11d
sub edi, 1
jne 0x140034116
mov r8d, dword [rbp - 0x59]
jmp 0x1400345be
cmp dword [r15 + 0x98], 0
jne 0x1400345d6
test rsi, rsi
je 0x14003461c
mov r9, qword [rbp - 0x61]
test r13d, r13d
jne 0x14003423c
cmp r9, rdx
jne 0x1400341e3
cmp r11d, 3
jbe 0x14003423c
cmp edi, 3
jle 0x14003423c
movzx eax, byte [rsi + 2]
add al, byte [r10]
mov byte [rbx + 2], al
movzx eax, byte [r10 + 1]
add al, byte [rsi + 1]
mov byte [rbx + 1], al
movzx eax, byte [r10 + 2]
add al, byte [rsi]
mov byte [rbx], al
sub edi, 3
add r11d, 0xfffffffd
add r10, 3
add rbx, 3
add rsi, 3
cmp r11d, 3
ja 0x1400341a1
jmp 0x14003423c
lea rax, reloc.SHELL32.dll_SHChangeNotifyRegister
cmp r9, rax
jne 0x14003423c
cmp r11d, 4
jbe 0x14003423c
cmp edi, 4
jle 0x14003423c
movzx eax, byte [rsi + 2]
add al, byte [r10]
mov byte [rbx + 2], al
movzx eax, byte [r10 + 1]
add al, byte [rsi + 1]
mov byte [rbx + 1], al
movzx eax, byte [r10 + 2]
add al, byte [rsi]
mov byte [rbx], al
movzx eax, byte [r10 + 3]
add al, byte [rsi + 3]
mov byte [rbx + 3], al
sub edi, 4
add r11d, 0xfffffffc
add r10, 4
add rbx, 4
add rsi, 4
cmp r11d, 4
ja 0x1400341f5
test r11d, r11d
je 0x1400345df
movsxd rax, r13d
movsxd rcx, dword [r9 + rax*4]
movzx eax, byte [rcx + rsi]
add al, byte [r10]
mov byte [rcx + rbx], al
inc rsi
inc rbx
lea eax, [r13 + 1]
cdq
idiv r12d
mov r13d, edx
mov dword [rbp - 0x71], edx
inc r10
dec r11d
sub edi, 1
jne 0x14003423c
jmp 0x1400345ba
cmp dword [r15 + 0x98], 0
jne 0x1400345d6
mov r9, qword [rbp - 0x61]
test r13d, r13d
jne 0x140034356
cmp r9, rdx
jne 0x1400342ec
cmp r11d, 3
jbe 0x140034356
movzx eax, byte [rbp + 1]
movzx ecx, byte [rbp]
movzx edx, byte [rbp - 1]
cmp edi, 3
jle 0x140034356
add dl, byte [r10]
mov byte [rbx + 2], dl
mov byte [rbp - 1], dl
add cl, byte [r10 + 1]
mov byte [rbx + 1], cl
mov byte [rbp], cl
add al, byte [r10 + 2]
mov byte [rbx], al
mov byte [rbp + 1], al
sub edi, 3
add r11d, 0xfffffffd
add r10, 3
add rbx, 3
cmp r11d, 3
ja 0x1400342b0
jmp 0x140034356
lea rax, reloc.SHELL32.dll_SHChangeNotifyRegister
cmp r9, rax
jne 0x140034356
cmp r11d, 4
jbe 0x140034356
movzx eax, byte [rbp + 2]
movzx ecx, byte [rbp + 1]
movzx edx, byte [rbp]
movzx r8d, byte [rbp - 1]
nop
cmp edi, 4
jle 0x140034352
add r8b, byte [r10]
mov byte [rbx + 2], r8b
mov byte [rbp - 1], r8b
add dl, byte [r10 + 1]
mov byte [rbx + 1], dl
mov byte [rbp], dl
add cl, byte [r10 + 2]
mov byte [rbx], cl
mov byte [rbp + 1], cl
add al, byte [r10 + 3]
mov byte [rbx + 3], al
mov byte [rbp + 2], al
sub edi, 4
add r11d, 0xfffffffc
add r10, 4
add rbx, 4
cmp r11d, 4
ja 0x140034310
mov r8d, dword [rbp - 0x59]
test r11d, r11d
je 0x1400345df
movsxd rax, r13d
lea rdx, [rbp - 1]
add rdx, rax
movzx ecx, byte [r10]
add cl, byte [rdx]
movsxd rax, dword [r9 + rax*4]
mov byte [rax + rbx], cl
mov byte [rdx], cl
inc rbx
lea eax, [r13 + 1]
cdq
idiv r12d
mov r13d, edx
mov dword [rbp - 0x71], edx
inc r10
dec r11d
sub edi, 1
jne 0x140034356
jmp 0x1400345ba
cmp dword [r15 + 0x98], 0
je 0x1400344dc
mov eax, dword [r15 + 0x3c]
cmp eax, 4
jne 0x140034483
cmp qword [r15 + 0xa8], 0
je 0x140034428
test r11d, r11d
je 0x1400345df
mov r9, r10
movzx r8d, byte [r10]
lea rdx, [r8 + r8*2]
mov rax, qword [r15 + 0xa0]
movzx ecx, byte [rdx + rax]
mov byte [rbx + 2], cl
mov rax, qword [r15 + 0xa0]
movzx ecx, byte [rax + rdx + 1]
mov byte [rbx + 1], cl
mov rax, qword [r15 + 0xa0]
movzx ecx, byte [rax + rdx + 2]
mov byte [rbx], cl
mov rax, qword [r15 + 0xa8]
movzx ecx, byte [r8 + rax]
mov byte [rbx + 3], cl
add rbx, 4
inc r10
dec r11d
sub edi, 4
jne 0x1400343be
mov r8d, dword [rbp - 0x59]
lea r10, [r9 + 1]
jmp 0x1400345be
test r11d, r11d
je 0x1400345df
mov r9, r10
movzx eax, byte [r10]
lea rdx, [rax + rax*2]
mov rax, qword [r15 + 0xa0]
movzx ecx, byte [rdx + rax]
mov byte [rbx + 2], cl
mov rax, qword [r15 + 0xa0]
movzx ecx, byte [rax + rdx + 1]
mov byte [rbx + 1], cl
mov rax, qword [r15 + 0xa0]
movzx ecx, byte [rax + rdx + 2]
mov byte [rbx], cl
mov byte [rbx + 3], 0xff
add rbx, 4
inc r10
dec r11d
sub edi, 4
jne 0x140034428
lea r10, [r9 + 1]
jmp 0x1400345be
cmp eax, 3
jne 0x1400345d6
test r11d, r11d
je 0x1400345df
movzx eax, byte [r10]
lea rdx, [rax + rax*2]
mov rax, qword [r15 + 0xa0]
movzx ecx, byte [rdx + rax]
mov byte [rbx + 2], cl
mov rax, qword [r15 + 0xa0]
movzx ecx, byte [rax + rdx + 1]
mov byte [rbx + 1], cl
mov rax, qword [r15 + 0xa0]
movzx ecx, byte [rax + rdx + 2]
mov byte [rbx], cl
add rbx, 3
inc r10
dec r11d
sub edi, 3
jne 0x14003448c
jmp 0x1400345c5
mov r9, qword [rbp - 0x61]
test r13d, r13d
jne 0x140034580
cmp r9, rdx
jne 0x140034536
cmp r11d, 3
jbe 0x140034580
nop dword [rax + rax]
cmp edi, 3
jle 0x140034590
movzx eax, byte [r10]
mov byte [rbx + 2], al
movzx eax, byte [r10 + 1]
mov byte [rbx + 1], al
movzx eax, byte [r10 + 2]
mov byte [rbx], al
sub edi, 3
add r11d, 0xfffffffd
add r10, 3
add rbx, 3
cmp r11d, 3
ja 0x140034500
jmp 0x140034580
lea rax, reloc.SHELL32.dll_SHChangeNotifyRegister
cmp r9, rax
jne 0x140034580
cmp r11d, 4
jbe 0x140034580
cmp edi, 4
jle 0x140034590
movzx eax, byte [r10]
mov byte [rbx + 2], al
movzx eax, byte [r10 + 1]
mov byte [rbx + 1], al
movzx eax, byte [r10 + 2]
mov byte [rbx], al
movzx eax, byte [r10 + 3]
mov byte [rbx + 3], al
sub edi, 4
add r11d, 0xfffffffc
add r10, 4
add rbx, 4
cmp r11d, 4
ja 0x140034548
test r11d, r11d
je 0x1400345df
nop word [rax + rax]
movsxd rax, r13d
movsxd rcx, dword [r9 + rax*4]
movzx eax, byte [r10]
mov byte [rcx + rbx], al
inc rbx
lea eax, [r13 + 1]
cdq
idiv r12d
mov r13d, edx
mov dword [rbp - 0x71], edx
inc r10
dec r11d
sub edi, 1
jne 0x140034580
mov r14, qword [rbp - 0x61]
lea r9, reloc.SHELL32.dll_SHChangeNotifyRegister
movsxd rax, dword [rbp - 0x6d]
add rbx, rax
mov edi, r8d
lea rdx, reloc.SHELL32.dll_SHChangeNotifyRegister
test r11d, r11d
jne 0x140033b80
mov qword [r15 + 0x48], rbx
mov dword [r15 + 0x50], edi
mov dword [r15 + 0x60], r13d
movzx eax, byte [rbp + 3]
mov byte [r15 + 0x78], al
mov qword [r15 + 0x80], rsi
mov eax, dword [rbp - 1]
mov dword [r15 + 0x79], eax
mov eax, dword [rbp + 7]
mov dword [r15 + 0x88], eax
mov ebx, 1
jmp 0x140034639
mov dword [r15 + 8], 6
jmp 0x140034637
mov eax, 6
add r15, 8
jmp 0x140034634
mov eax, 4
mov ecx, 8
add r15, rcx
mov dword [r15], eax
xor ebx, ebx
mov rax, qword [rbp - 0x41]
test rax, rax
je 0x14003464a
mov rcx, rax
call fcn.140203254
mov eax, ebx
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1401f3bf0
mov rbx, qword [rsp + 0x120]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rbp - 0x31]
call fcn.14004b210
lea rdx, [0x1402f60b8]
lea rcx, [rbp - 0x31]
call fcn.1401f6bc8
int3