Function at 0x140017900
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0xd0
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140044040]
xor rax, rsp
mov qword [rbp + 0x60], rax
movabs rax, 0x32a3f6827cdafbe4
mov dword [rbp], 1
mov qword [rbp], rax
movabs r14, 0xfa5c5fd3c319696d
mov rax, qword [rbp]
movabs r13, 0xfa5c5fd3af750d43
mov qword [rbp + 0x40], rax
xor esi, esi
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x59cc99ea04b59992
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r13
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x40]
mov qword [rbp + 0x28], rax
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x40], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140017a37
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140017a37
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x991394
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rbx]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140017a32
nop dword [rax]
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140017a10
cmp r8d, 0xd148de96
je 0x140017a3c
test r9d, r9d
jne 0x1400179f0
mov rax, qword [rax]
jmp 0x1400179c0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rbp + 0x40]
add rax, r10
call rax
movabs r15, 0xbca50685e640e225
movabs r12, 0x1c15409c6b6de974
test rax, rax
jne 0x140018580
movabs rax, 0x29bff08e7cdafbe4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], r14
movabs r14, 0x59cc99ea04b59992
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r13
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x40]
mov qword [rbp + 0x28], rax
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x40], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140017b57
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140017b57
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xd070568
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140017b52
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140017b30
cmp r8d, 0x7822aca
je 0x140017b5c
test r9d, r9d
jne 0x140017b10
mov rax, qword [rax]
jmp 0x140017ae0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rbp + 0x40]
add rax, r10
call rax
test rax, rax
jne 0x14001858a
movabs rax, 0x37b4eb877cdafbe4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0xfa5c5fd3af750d33
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r13
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x40]
mov qword [rbp + 0x28], rax
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x40], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140017c67
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140017c67
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x44b5d0bc
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140017c62
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140017c40
cmp r8d, 0x67d59bee
je 0x140017c6c
test r9d, r9d
jne 0x140017c20
mov rax, qword [rax]
jmp 0x140017bf0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rbp + 0x40]
add rax, r10
call rax
test rax, rax
jne 0x14001858a
movabs rax, 0x77a0fe857cdafbe4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0xfa5c5fd3af196127
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r13
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x40]
mov qword [rbp + 0x28], rax
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x40], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140017d77
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140017d77
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x593756e0
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140017d72
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140017d50
cmp r8d, 0xb3675932
je 0x140017d7c
test r9d, r9d
jne 0x140017d30
mov rax, qword [rax]
jmp 0x140017d00
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rbp + 0x40]
add rax, r10
call rax
test rax, rax
jne 0x14001858a
movabs rax, 0x38a0fe857cdafbe4
movabs r14, 0x1c15409c6b018510
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0xd4292fa0d6147f31
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x59cc99ea04b59992
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140017ec7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140017ec7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x39121ffc
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140017ec2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140017ea0
cmp r8d, 0xe9b1b2e
je 0x140017ecc
test r9d, r9d
jne 0x140017e80
mov rax, qword [rax]
jmp 0x140017e50
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rbp + 0x20]
add rax, r10
call rax
test rax, rax
jne 0x140018580
movabs rax, 0x3aa0fe857cdafbe4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x963871bfc6017831
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x1c15409c6b6de918
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x59cc99ea04b59992
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140018017
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140018017
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xdd7f6e18
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140018012
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140017ff0
cmp r8d, 0x56cc2dda
je 0x14001801c
test r9d, r9d
jne 0x140017fd0
mov rax, qword [rax]
jmp 0x140017fa0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rbp + 0x20]
add rax, r10
call rax
test rax, rax
jne 0x140018580
movabs rax, 0x3ca0fe857cdafbe4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0xd4292fa0dd1a7f31
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r14
movabs r14, 0x59cc99ea04b59992
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140018167
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140018167
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x1d7df7e4
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140018162
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140018140
cmp r8d, 0x2382edc6
je 0x14001816c
test r9d, r9d
jne 0x140018120
mov rax, qword [rax]
jmp 0x1400180f0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rbp + 0x20]
add rax, r10
call rax
test rax, rax
jne 0x14001858a
movabs rax, 0x3fa0fe857cdafbe4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x89373cb2cd116826
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x1c152cf00f439c04
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400182b7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400182b7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xa89a6400
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400182b2
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140018290
cmp r8d, 0xeb24d892
je 0x1400182bc
test r9d, r9d
jne 0x140018270
mov rax, qword [rax]
jmp 0x140018240
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rbp + 0x20]
add rax, r10
call rax
test rax, rax
jne 0x14001858a
movabs r14, 0x29a0fe857cdafbe4
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x9e722aa3dc1e6e22
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x1c15409c6b6d8518
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x59cc99ea04b59992
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140018407
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140018407
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x546ad0e9
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140018402
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1400183e0
cmp r8d, 0x4e220c43
je 0x14001840c
test r9d, r9d
jne 0x1400183c0
mov rax, qword [rax]
jmp 0x140018390
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rbp + 0x20]
add rax, r10
call rax
test rax, rax
jne 0x140018580
mov qword [rbp], r14
movabs r14, 0x59cc99ea04b59992
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x8f332dbbdb067e22
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x70716ee91b1e8113
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0xbca50685e640e249
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140018557
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140018557
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x6da02175
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140018552
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140018530
cmp r8d, 0xfe55491f
je 0x14001855c
test r9d, r9d
jne 0x140018510
mov rax, qword [rax]
jmp 0x1400184e0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rbp + 0x20]
add rax, r10
call rax
test rax, rax
je 0x14001858f
jmp 0x14001858a
movabs r14, 0x59cc99ea04b59992
mov esi, 1
movabs rbx, 0x21a3dbbc589bc5ce
lea rcx, [rbp + 0x20]
mov qword [rbp], rbx
xor edi, edi
mov rax, qword [rbp]
xor r9d, r9d
mov qword [rbp + 0x20], rax
mov edx, 0x80000000
movabs rax, 0xbe2e3b81c61b640e
mov qword [rsp + 0x30], rdi
mov qword [rbp], rax
mov r8d, 1
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x1c15409c6b6de93a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
mov dword [rsp + 0x28], 0x80
vmovdqa ymmword [rbp + 0x20], ymm1
mov dword [rsp + 0x20], 3
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x1400189d6
mov qword [rbp], rbx
lea rcx, [rbp + 0x40]
mov rax, qword [rbp]
xor r9d, r9d
mov qword [rbp + 0x40], rax
mov edx, 0x80000000
movabs rax, 0xfa5c5fa7dc107804
mov qword [rsp + 0x30], rdi
mov qword [rbp], rax
mov r8d, 1
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r13
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x40]
mov qword [rbp + 0x28], rax
xorps xmm0, xmmword [rbp + 0x20]
mov dword [rsp + 0x28], 0x80
movdqa xmmword [rbp + 0x40], xmm0
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x1400189d6
movabs rdi, 0x3cbcf09a589bc5ce
mov qword [rsp + 0x30], 0
mov qword [rbp], rdi
lea rcx, [rbp + 0x20]
mov rax, qword [rbp]
xor r9d, r9d
mov qword [rbp + 0x20], rax
mov edx, 0x80000000
movabs rax, 0x943512abc0375b1f
mov dword [rsp + 0x28], 0x80
mov qword [rbp], rax
mov r8d, 1
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x1c1540d22f09bb1d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
mov dword [rsp + 0x20], 3
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x1400189d6
mov qword [rbp], rbx
lea rcx, [rbp + 0x40]
mov rax, qword [rbp]
xor ebx, ebx
mov qword [rbp + 0x40], rax
xor r9d, r9d
movabs rax, 0xfa1f0f9ad6147f17
mov qword [rsp + 0x30], rbx
mov qword [rbp], rax
mov edx, 0x80000000
mov rax, qword [rbp]
mov r8d, 1
mov qword [rbp + 0x48], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r13
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x40]
mov qword [rbp + 0x28], rax
xorps xmm0, xmmword [rbp + 0x20]
mov dword [rsp + 0x28], 0x80
movdqa xmmword [rbp + 0x40], xmm0
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x1400189d6
mov qword [rbp], rdi
lea rcx, [rbp + 0x20]
mov rax, qword [rbp]
xor r9d, r9d
mov qword [rbp + 0x20], rax
mov edx, 0x80000000
movabs rax, 0x9b2e0babc0375b1f
mov qword [rsp + 0x30], rbx
mov qword [rbp], rax
mov r8d, 1
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x1c15409c283da00d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
mov dword [rsp + 0x28], 0x80
vmovdqa ymmword [rbp + 0x20], ymm1
mov dword [rsp + 0x20], 3
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x1400189d6
movabs rax, 0xa8adea2589bc5ce
mov qword [rsp + 0x30], rbx
mov qword [rbp], rax
lea rcx, [rbp + 0x40]
mov rax, qword [rbp]
xor r9d, r9d
mov qword [rbp + 0x40], rax
mov edx, 0x80000000
mov qword [rbp], r13
mov r8d, 1
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r13
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x40]
mov qword [rbp + 0x28], rax
xorps xmm0, xmmword [rbp + 0x20]
mov dword [rsp + 0x28], 0x80
movdqa xmmword [rbp + 0x40], xmm0
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x1400189d6
movabs rax, 0x30aff49c589bc5ce
mov qword [rsp + 0x30], rbx
mov qword [rbp], rax
lea rcx, [rbp + 0x40]
mov rax, qword [rbp]
xor r9d, r9d
mov qword [rbp + 0x40], rax
mov edx, 0x80000000
mov qword [rbp], r13
mov r8d, 1
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r13
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x40]
mov qword [rbp + 0x28], rax
xorps xmm0, xmmword [rbp + 0x20]
mov dword [rsp + 0x28], 0x80
movdqa xmmword [rbp + 0x40], xmm0
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x140018a3c
lea rdx, [0x1402bc4d8]
lea rcx, [rbp + 0x40]
call fcn.14000c110
mov r8, rax
lea rdx, [rbp + 0x20]
lea rcx, [0x1402bc324]
call fcn.14000aab0
mov rdx, qword [rbp + 0x38]
mov esi, 1
cmp rdx, 0xf
jbe 0x140018a3c
mov rcx, qword [rbp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018a37
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140018a37
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140021940
mov eax, esi
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.140021920
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret