Function at 0x1401efcc0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov word [rsp + 0x18], r8w
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov qword [rsp + 0x60], 0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1401efd87
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1401efd87
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x3f34d045
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1401efd82
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1401efd60
cmp r8d, 0x33affc25
je 0x1401efd8c
test r9d, r9d
jne 0x1401efd40
mov rax, qword [rax]
jmp 0x1401efd10
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
mov rcx, qword gs:[0x60]
mov rsi, rax
mov qword [rbp - 0x58], rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1401efe37
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1401efe37
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xec91435f
lea rax, [rbx + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x1401efe32
nop
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x1401efe10
cmp r8d, 0xbf255bbd
je 0x1401efe3c
test r9d, r9d
jne 0x1401efdf0
mov rcx, qword [rcx]
jmp 0x1401efdc0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, 0x4c
add rax, r10
call rax
mov rcx, qword gs:[0x60]
mov r12d, eax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1401efee7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1401efee7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xe81a63c7
lea rax, [rbx + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x1401efee2
nop
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x1401efec0
cmp r8d, 0xd3cb50c5
je 0x1401efeec
test r9d, r9d
jne 0x1401efea0
mov rcx, qword [rcx]
jmp 0x1401efe70
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, 0x4e
add rax, r10
call rax
mov rcx, qword gs:[0x60]
add eax, r12d
mov dword [rbp + 0x70], eax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1401effa7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1401effa7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x146aa2df
lea rax, [rbx + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x1401effa2
nop
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x1401eff80
cmp r8d, 0x32559b3d
je 0x1401effac
test r9d, r9d
jne 0x1401eff60
mov rcx, qword [rcx]
jmp 0x1401eff30
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, 0x4d
add rax, r10
call rax
mov rcx, qword gs:[0x60]
mov r15d, eax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1401f0057
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1401f0057
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x80f57def
lea rax, [rbx + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x1401f0052
nop
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x1401f0030
cmp r8d, 0xa9b8f64d
je 0x1401f005c
test r9d, r9d
jne 0x1401f0010
mov rcx, qword [rcx]
jmp 0x1401effe0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, 0x4f
add rax, r10
call rax
mov rcx, qword gs:[0x60]
lea r14d, [r15 + rax]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1401f0107
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1401f0107
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xafcee874
lea rax, [rbx + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x1401f0102
nop
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x1401f00e0
cmp r8d, 0x14e5ca6d
je 0x1401f010c
test r9d, r9d
jne 0x1401f00c0
mov rcx, qword [rcx]
jmp 0x1401f0090
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rsi
add rax, r10
call rax
mov rcx, qword gs:[0x60]
mov r13, rax
mov qword [rbp + 0x60], rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1401f01b7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1401f01b7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x28a274f9
lea rax, [rbx + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x1401f01b2
nop
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x1401f0190
cmp r8d, 0x56869b04
je 0x1401f01bc
test r9d, r9d
jne 0x1401f0170
mov rcx, qword [rcx]
jmp 0x1401f0140
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov edx, 0xa
add rax, r10
mov rcx, r13
call rax
mov rcx, qword gs:[0x60]
mov esi, eax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1401f0267
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1401f0267
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x3a186043
lea rax, [rbx + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x1401f0262
nop
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x1401f0240
cmp r8d, 0xc18705a6
je 0x1401f026c
test r9d, r9d
jne 0x1401f0220
mov rcx, qword [rcx]
jmp 0x1401f01f0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov edx, 0x75
add rax, r10
mov rcx, r13
call rax
movd xmm0, esi
xor ecx, ecx
cvtdq2ps xmm0, xmm0
mov dword [rbp - 0x28], ecx
mov dword [rbp - 0x50], 0x28
mov qword [rbp - 0x44], 0x180001
mov qword [rbp - 0x70], rcx
movd xmm2, eax
cvtdq2ps xmm2, xmm2
movd xmm1, r12d
divss xmm2, xmm0
cvtdq2ps xmm1, xmm1
movd xmm0, r15d
cvtdq2ps xmm0, xmm0
mulss xmm1, xmm2
mulss xmm0, xmm2
cvttss2si r12d, xmm1
movd xmm1, dword [rbp + 0x70]
cvttss2si r13d, xmm0
movd xmm0, r14d
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
mulss xmm0, xmm2
mulss xmm1, xmm2
cvttss2si r14d, xmm0
cvttss2si r15d, xmm1
sub r14d, r13d
mov dword [rbp - 0x48], r14d
xorps xmm0, xmm0
sub r15d, r12d
movdqu xmmword [rbp - 0x38], xmm0
mov dword [rbp - 0x4c], r15d
mov eax, r15d
imul eax, r14d
lea eax, [rax + rax*2]
mov dword [rbp - 0x3c], eax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1401f03a7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1401f03a7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xdb2b622a
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1401f03a2
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1401f0380
cmp r8d, 0x3a22f88d
je 0x1401f03ac
test r9d, r9d
jne 0x1401f0360
mov rax, qword [rax]
jmp 0x1401f0330
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, qword [rbp + 0x60]
add rax, r10
call rax
mov rcx, qword [rbp + 0x60]
lea r9, [rbp - 0x70]
mov rsi, rax
mov qword [rbp - 0x68], rax
xor eax, eax
lea rdx, [rbp - 0x50]
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.gdi32.dll_CreateDIBSection]
mov rcx, qword gs:[0x60]
mov qword [rbp - 0x78], rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop word [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1401f0487
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1401f0487
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x32502ed2
lea rax, [r10 + r9*4]
mov edx, dword [rax + rbx]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x1401f0482
nop dword [rax]
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x1401f0460
cmp r8d, 0x5af5c181
je 0x1401f048c
test r9d, r9d
jne 0x1401f0440
mov rcx, qword [rcx]
jmp 0x1401f0410
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rsi
mov rdx, qword [rbp - 0x78]
add rax, r10
call rax
mov rcx, qword gs:[0x60]
mov rsi, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1401f0537
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1401f0537
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x33503065
lea rax, [r10 + r9*4]
mov edx, dword [rax + rbx]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x1401f0532
nop dword [rax]
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x1401f0510
cmp r8d, 0x17b0a321
je 0x1401f053c
test r9d, r9d
jne 0x1401f04f0
mov rcx, qword [rcx]
jmp 0x1401f04c0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rsi
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1401f05e7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1401f05e7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x5e4c0110
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1401f05e2
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1401f05c0
cmp r8d, 0x9db22bb3
je 0x1401f05ec
test r9d, r9d
jne 0x1401f05a0
mov rax, qword [rax]
jmp 0x1401f0570
mov ecx, dword [rdi + 0x24]
xor r8d, r8d
mov rsi, qword [rbp - 0x68]
add rcx, r10
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r12d
movzx edx, word [rcx + r9*2]
mov r9d, r15d
mov ecx, dword [rdi + 0x1c]
mov r12, qword [rbp + 0x60]
add rcx, r10
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r14d
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r10
mov rcx, rsi
call rax
test eax, eax
jne 0x1401f06e5
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1401f06c7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1401f06c7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x9b9fba40
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1401f06c2
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1401f06a0
cmp r8d, 0xd71184fa
je 0x1401f06cc
test r9d, r9d
jne 0x1401f0680
mov rax, qword [rax]
jmp 0x1401f0650
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1401f0777
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1401f0777
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xe817d610
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1401f0772
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1401f0750
cmp r8d, 0x38c9595a
je 0x1401f077c
test r9d, r9d
jne 0x1401f0730
mov rax, qword [rax]
jmp 0x1401f0700
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rsi
add rax, r10
call rax
xor r13d, r13d
mov dword [rbp - 0x20], 1
xor r8d, r8d
mov qword [rbp - 0x18], r13
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x10], r13
lea rcx, [rbp - 0x60]
call qword [sym.imp.GdiPlus.dll_GdiplusStartup]
mov r15, qword [rbp - 0x78]
lea r8, [rbp + 0x60]
mov rcx, r15
mov qword [rbp + 0x60], r13
xor edx, edx
call qword [sym.imp.GdiPlus.dll_GdipCreateBitmapFromHBITMAP]
lea r8, [rbp - 0x80]
mov qword [rbp - 0x80], r13
lea edx, [r13 + 1]
xor ecx, ecx
call qword [sym.imp.combase.dll_CreateStreamOnHGlobal]
test eax, eax
je 0x1401f0856
mov rcx, qword [rbp + 0x60]
mov rbx, qword [rbp + 0x68]
mov qword [rbx], r13
mov qword [rbx + 8], r13
mov qword [rbx + 0x10], r13
call qword [sym.imp.GdiPlus.dll_GdipDisposeImage]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1401f083f
mov rdx, qword [rsp + 0x60]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1401f083a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401f0b62
call fcn.1403cad84
mov rax, rbx
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov dword [rsp + 0x68], 0x6c0069
mov ecx, r13d
mov dword [rsp + 0x6c], 0x640063
mov dword [rsp + 0x70], 0x2a0061
mov dword [rsp + 0x74], 0x690076
mov dword [rsp + 0x78], 0x6f
movsxd rax, ecx
xor word [rsp + rax*2 + 0x68], cx
inc ecx
cmp ecx, 9
jb 0x1401f0881
lea rdx, [rbp - 8]
mov word [rsp + 0x7a], r13w
lea rcx, [rsp + 0x68]
call fcn.1401efbf0
mov rsi, qword [rbp + 0x60]
lea r8, [rbp - 8]
mov rdx, qword [rbp - 0x80]
mov rcx, rsi
xor r9d, r9d
call qword [sym.imp.GdiPlus.dll_GdipSaveImageToStream]
test eax, eax
je 0x1401f08c8
mov rcx, rsi
jmp 0x1401f07ee
mov rcx, qword [rbp - 0x80]
lea rdx, [rbp + 0x78]
mov qword [rbp + 0x78], r13
call qword [sym.imp.combase.dll_GetHGlobalFromStream]
test eax, eax
jne 0x1401f08c0
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.kernel32.dll_GlobalSize]
mov r14, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rcx, r14
sub rcx, rdx
movsxd rdi, eax
cmp rdi, rcx
jae 0x1401f0906
lea rax, [rdx + rdi]
jmp 0x1401f093b
jbe 0x1401f0940
mov rax, qword [rsp + 0x60]
sub rax, rdx
cmp rdi, rax
jbe 0x1401f0924
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.1401de400
jmp 0x1401f0940
mov rbx, rdi
xor edx, edx
sub rbx, rcx
mov rcx, r14
mov r8, rbx
call fcn.1403ccc50
lea rax, [rbx + r14]
mov qword [rsp + 0x58], rax
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.kernel32.dll_GlobalLock]
test rax, rax
je 0x1401f08c0
mov rcx, qword [rsp + 0x50]
mov r8, rdi
mov rdx, rax
call fcn.1403cc5a0
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.kernel32.dll_GlobalUnlock]
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.GdiPlus.dll_GdiplusShutdown]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1401f0a17
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1401f0a17
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x1e0d69e1
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1401f0a12
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1401f09f0
cmp r8d, 0x8be9c4f5
je 0x1401f0a1c
test r9d, r9d
jne 0x1401f09d0
mov rax, qword [rax]
jmp 0x1401f09a0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, r15
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1401f0ac7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1401f0ac7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x30c4ad5e
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1401f0ac2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1401f0aa0
cmp r8d, 0x2828588e
je 0x1401f0acc
test r9d, r9d
jne 0x1401f0a80
mov rax, qword [rax]
jmp 0x1401f0a50
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rdx, r12
mov rcx, qword [rbp - 0x58]
add rax, r10
call rax
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rbp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x60], r13
mov qword [rbx + 8], rcx
mov rcx, qword [rbp + 0x60]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rbx], rax
mov qword [rbx + 0x10], rdx
call qword [sym.imp.GdiPlus.dll_GdipDisposeImage]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1401f083f
mov rdx, qword [rsp + 0x60]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1401f083a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401f083a
call fcn.1403d7020
int3