Function at 0x14000ff90
Capabilities:
Access peb ldr_data
Check os version
Encode data using xor
Execute anti-debugging instructions
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r13
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x14011b8b0]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov dword [0x140123ebc], 8
xor r13b, r13b
mov r8d, 1
mov byte [rbp - 0x29], r13b
mov qword [rbp - 9], r8
xor r14d, r14d
mov rax, qword gs:[0x60]
mov dword [0x140123e4c], 8
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x140124058]
mov r10, qword [rcx + 0x30]
test rax, rax
jne 0x14001009d
movsxd rax, dword [r10 + 0x3c]
mov r11d, r14d
mov edi, dword [rax + r10 + 0x88]
mov esi, dword [rdi + r10 + 0x20]
nop word [rax + rax]
mov ebx, r11d
mov r9d, 0xc920c1de
lea rax, [rsi + rbx*4]
mov r8d, dword [rax + r10]
add r8, r10
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140010071
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x140010040
cmp r9d, 0x180460eb
je 0x140010076
inc r11d
jmp 0x140010020
mov ecx, dword [rdi + r10 + 0x24]
mov r8d, 1
add rcx, r10
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rdi + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x140124058], rax
mov qword [0x140123ea8], rax
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov al, byte [0x7ffe026c]
movzx edx, word [rcx + 0x120]
cmp al, 0xa
jne 0x1400100ec
mov eax, dword [0x7ffe0260]
cmp eax, 0x55f0
je 0x1400100e2
cmp eax, 0x585d
je 0x1400100e2
mov ecx, 0x40
jmp 0x140010171
mov ecx, 0x80
jmp 0x140010171
cmp al, 5
jne 0x1400100f7
mov ecx, 2
jmp 0x140010171
cmp al, 6
jne 0x140010127
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x140010120
sub ecx, 1
je 0x140010119
cmp ecx, 1
jne 0x140010127
mov ecx, 0x20
jmp 0x140010171
mov ecx, reloc.WS2_32.dll_recv
jmp 0x140010171
mov ecx, 8
jmp 0x140010171
mov ecx, 0xed9
movzx eax, dx
sub ax, cx
mov ecx, 0xed6
cmp ax, cx
ja 0x140010143
mov ecx, 4
jmp 0x140010171
mov eax, 0x893
cmp dx, ax
ja 0x140010152
mov ecx, r8d
jmp 0x140010171
mov eax, 0x2800
mov ecx, 0x40
sub dx, ax
mov r8d, 0x305d
cmp dx, r8w
mov eax, r14d
cmovbe eax, ecx
mov ecx, eax
mov dword [0x140123eb8], ecx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x140123fc8]
mov r10, qword [rcx + 0x30]
test rax, rax
jne 0x140010237
movsxd rax, dword [r10 + 0x3c]
mov r11d, r14d
mov edi, dword [rax + r10 + 0x88]
mov esi, dword [rdi + r10 + 0x20]
mov ebx, r11d
mov r9d, 0xd2254d37
lea rax, [rsi + rbx*4]
mov r8d, dword [rax + r10]
add r8, r10
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140010211
nop dword [rax]
nop word [rax + rax]
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x1400101e0
cmp r9d, 0xa749b4cb
je 0x140010216
inc r11d
jmp 0x1400101b3
mov ecx, dword [rdi + r10 + 0x24]
add rcx, r10
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rdi + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x140123fc8], rax
mov qword [0x140123ea0], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x1401240f0]
mov r10, qword [rcx + 0x30]
test rax, rax
jne 0x1400102f7
movsxd rax, dword [r10 + 0x3c]
mov r11d, r14d
mov edi, dword [rax + r10 + 0x88]
mov esi, dword [rdi + r10 + 0x20]
nop word [rax + rax]
mov ebx, r11d
mov r9d, 0x3d28343f
lea rax, [rsi + rbx*4]
mov r8d, dword [rax + r10]
add r8, r10
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x1400102d1
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x1400102a0
cmp r9d, 0xe5f4c64c
je 0x1400102d6
inc r11d
jmp 0x140010280
mov ecx, dword [rdi + r10 + 0x24]
add rcx, r10
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rdi + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x1401240f0], rax
cmp qword [0x140123ea0], r14
mov qword [0x140123eb0], rax
je 0x140010cdb
cmp qword [0x140123ea8], r14
je 0x140010cdb
test rax, rax
je 0x140010cdb
mov qword [rsp + 0x30], r14
lea rcx, str..TitanHide
mov dword [rsp + 0x28], r14d
xor r9d, r9d
mov qword [rsp + 0xd0], r12
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
mov qword [rsp + 0xd8], r15
mov dword [rbp + 0x1f], r14d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400103ac
mov dword [rbp + 7], 2
lea r9, [rbp + 0x1f]
mov rcx, qword gs:[0x30]
mov r8d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], r14
mov rdx, qword [rcx + 0x40]
mov rcx, rax
mov qword [rbp + 0xf], rdx
lea rdx, [rbp + 7]
mov dword [rbp + 0xb], 0x3ff
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [0x140123eb0]
lea r9, [rbp - 1]
xor r8d, r8d
mov dword [rbp - 1], r14d
lea rdx, [rbp - 1]
mov qword [rbp + 7], r14
mov rbx, r14
mov rsi, r14
lea ecx, [r8 + 0x10]
call rdi
cmp eax, 0xc0000004
jne 0x140010427
nop dword [rax]
test rbx, rbx
je 0x1400103f6
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 1]
xor ecx, ecx
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rbp - 1]
lea r9, [rbp - 1]
mov rdx, rax
mov ecx, reloc.WS2_32.dll_recv
mov rbx, rax
call rdi
cmp eax, 0xc0000004
je 0x1400103e0
test eax, eax
jns 0x140010447
test rbx, rbx
je 0x140010441
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov qword [rbp + 7], r14
jmp 0x140010498
mov eax, dword [rbx]
test eax, eax
je 0x140010487
lea rdx, [rbx + 8]
mov r8d, eax
nop dword [rax]
nop dword [rax + rax]
movups xmm1, xmmword [rdx]
mov rcx, qword gs:[0x30]
movd eax, xmm1
cmp ax, word [rcx + 0x40]
jne 0x140010479
inc rsi
add rdx, 0x18
sub r8, 1
jne 0x140010460
mov qword [rbp + 7], rsi
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
rdtsc
mov rcx, qword gs:[0x30]
shl rdx, 0x20
or rax, rdx
xor edx, edx
mov r12, rax
movabs rax, 0xffffffffff
mov r8d, dword [rcx + 0x40]
and r12, rax
movabs rax, 0x80000000000
mov ecx, 0x200
sub r12, rax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
je 0x140010572
mov rcx, qword gs:[0x30]
lea r8, [rbp - 9]
mov r9d, 8
mov qword [rsp + 0x20], r14
mov rdi, qword [rcx + 0x40]
mov rcx, qword gs:[0x30]
lea edx, [r9 + 0x16]
mov rsi, qword [rcx + 0x48]
mov rcx, qword gs:[0x30]
mov qword [rcx + 0x40], r14
mov rcx, qword gs:[0x30]
mov qword [rcx + 0x48], r14
mov rcx, rax
mov r10, qword [0x140123ea8]
call r10
mov rcx, qword gs:[0x30]
mov ebx, eax
mov qword [rcx + 0x40], rdi
mov rcx, qword gs:[0x30]
mov qword [rcx + 0x48], rsi
mov rcx, r15
call qword [0x140123ea0]
cmp ebx, 0xc0000022
jne 0x14001056b
cmp dword [rbp - 9], 1
je 0x140010572
mov r13b, 1
mov byte [rbp - 0x29], r13b
mov rax, qword gs:[0x30]
xor edx, edx
mov ecx, 0x400
mov r8d, dword [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, reloc.WS2_32.dll_recv
movabs rbx, 0xfffffffff
mov rsi, rax
test rax, rax
je 0x1400108f0
mov rcx, qword gs:[0x30]
mov r13, qword [rcx + 0x40]
mov rcx, qword gs:[0x30]
mov r15, qword [rcx + 0x48]
mov rcx, qword gs:[0x30]
mov qword [rbp + 0x1f], r15
mov qword [rcx + 0x40], r14
mov rcx, qword gs:[0x30]
mov qword [rcx + 0x48], r14
nop
mov r9d, 8
mov qword [rsp + 0x20], r14
mov r8, r12
mov rcx, rsi
lea edx, [r9 + 0x16]
call qword [0x140123ea8]
xor r9d, r9d
mov qword [rsp + 0x20], r14
mov r8, r12
mov rcx, rsi
lea edx, [r9 + 0x1e]
call qword [0x140123ea8]
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
mov rcx, rsi
lea edx, [r9 + 0x1e]
call qword [0x140123ea8]
mov r9d, 8
lea rax, [rbp - 9]
lea r8, [rbp - 9]
mov qword [rsp + 0x20], rax
mov rcx, rsi
lea edx, [r9 + 0x16]
call qword [0x140123ea8]
rdtsc
shl rdx, 0x20
or rax, rdx
and rax, rbx
add rax, 0x10000000
add r12, rax
sub rdi, 1
jne 0x1400105e0
mov rax, qword [0x140123ea8]
lea r9d, [rdi + 8]
lea r8, [rbp - 9]
mov qword [rbp - 9], r14
lea edx, [rdi + 0x1e]
mov qword [rsp + 0x20], r14
mov rcx, rsi
call rax
cmp eax, 0xc0000353
jne 0x14001069b
cmp dword [rbp - 9], r14d
je 0x14001076c
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x140124018]
mov r11, qword [rcx + 0x30]
test rax, rax
jne 0x14001075b
movsxd rax, dword [r11 + 0x3c]
mov r10d, r14d
mov edi, dword [rax + r11 + 0x88]
mov r15d, dword [rdi + r11 + 0x20]
nop word [rax + rax]
mov ebx, r10d
mov r9d, 0xc1dbebd0
lea rax, [r11 + rbx*4]
mov r8d, dword [rax + r15]
add r8, r11
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140010731
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x140010700
cmp r9d, 0xa2236dca
je 0x140010736
inc r10d
jmp 0x1400106e0
mov ecx, dword [rdi + r11 + 0x24]
mov r15, qword [rbp + 0x1f]
add rcx, r11
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rdi + r11 + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
mov qword [0x140124018], rax
mov rdx, qword [rbp - 9]
mov rcx, 0xffffffffffffffff
call rax
mov bl, 1
jmp 0x140010770
movzx ebx, byte [rbp - 0x29]
mov rax, qword [0x140123ea8]
lea rcx, [rbp - 9]
mov r9d, 8
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 9]
mov rcx, rsi
lea edx, [r9 + 0x16]
call rax
cmp eax, 0xc0000353
jne 0x1400107a1
cmp qword [rbp - 9], 8
je 0x1400107a3
mov bl, 1
mov rax, qword [0x140123ea8]
mov edi, 1
mov qword [rbp - 9], rdi
mov qword [rsp + 0x20], r14
lea edx, [rdi + 0x1d]
lea rcx, [rdi - 2]
lea r9d, [rdi + 7]
lea r8d, [rdi + 4]
call rax
cmp eax, 0x80000002
je 0x1400107d7
cmp eax, 0xc0000003
jne 0x1400107dd
cmp qword [rbp - 9], rdi
je 0x1400107e1
movzx ebx, dil
mov rax, qword [0x140123ea8]
lea r8, [rbp - 9]
mov r9d, edi
mov qword [rsp + 0x20], r14
mov edx, 0x1e
mov rcx, rsi
call rax
cmp eax, 0xc0000004
movzx edi, bl
mov r9d, 8
lea r8, [rbp - 9]
mov eax, 1
mov rcx, rsi
cmovne edi, eax
mov rax, qword [0x140123ea8]
and r12d, 0xfff
lea edx, [r9 + 0x16]
mov qword [rsp + 0x20], r12
call rax
cmp eax, 0xc0000005
je 0x140010842
cmp eax, 0x80000002
jne 0x140010849
cmp qword [rbp - 9], 1
je 0x14001084c
mov dil, 1
mov rax, qword [0x140123ea8]
lea r8, [rbp - 9]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov rcx, rsi
lea edx, [r9 + 0x1e]
call rax
cmp eax, 0xc0000005
je 0x140010876
cmp eax, 0x80000002
jne 0x14001087d
cmp qword [rbp - 9], 1
je 0x140010880
mov dil, 1
mov rax, qword [0x140123ea8]
lea r8, [rbp - 9]
mov r9d, 8
mov qword [rsp + 0x20], r12
xor ecx, ecx
lea edx, [r9 + 0x16]
call rax
cmp eax, 0xc0000005
je 0x1400108ac
cmp eax, 0x80000002
jne 0x1400108b3
cmp qword [rbp - 9], 1
je 0x1400108b6
mov dil, 1
mov rcx, rsi
call qword [0x140123ea0]
mov rax, qword gs:[0x30]
mov qword [rax + 0x40], r13
mov rax, qword gs:[0x30]
mov qword [rax + 0x48], r15
mov r15d, 1
jmp 0x140010bd4
mov r9d, 8
mov qword [rsp + 0x20], r14
mov r8, r12
mov rcx, 0xffffffffffffffff
lea edx, [r9 + 0x16]
call qword [0x140123ea8]
xor r9d, r9d
mov qword [rsp + 0x20], r14
mov r8, r12
lea edx, [r9 + 0x1e]
lea rcx, [r9 - 1]
call qword [0x140123ea8]
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
lea edx, [r9 + 0x1e]
lea rcx, [r9 - 1]
call qword [0x140123ea8]
mov r9d, 8
lea rax, [rbp - 9]
lea r8, [rbp - 9]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
lea edx, [r9 + 0x16]
call qword [0x140123ea8]
rdtsc
shl rdx, 0x20
or rax, rdx
and rax, rbx
add rax, 0x10000000
add r12, rax
sub rdi, 1
jne 0x1400108f0
mov rax, qword [0x140123ea8]
lea r9d, [rdi + 8]
lea r8, [rbp - 9]
mov qword [rbp - 9], r14
lea edx, [rdi + 0x1e]
mov qword [rsp + 0x20], r14
lea rcx, [rdi - 1]
call rax
cmp eax, 0xc0000353
jne 0x1400109b6
cmp qword [rbp - 9], r14
je 0x140010a78
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x140124048]
mov r11, qword [rcx + 0x30]
test rax, rax
jne 0x140010a68
movsxd rax, dword [r11 + 0x3c]
mov r10d, r14d
mov edi, dword [rax + r11 + 0x88]
mov esi, dword [rdi + r11 + 0x20]
mov ebx, r10d
mov r9d, 0xc8f57c63
lea rax, [r11 + rbx*4]
mov r8d, dword [rax + rsi]
add r8, r11
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140010a42
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x140010a11
cmp r9d, 0xb50a0fd1
je 0x140010a47
inc r10d
jmp 0x1400109f2
mov ecx, dword [rdi + r11 + 0x24]
add rcx, r11
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rdi + r11 + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
mov qword [0x140124048], rax
mov rdx, qword [rbp - 9]
mov rcx, 0xffffffffffffffff
call rax
mov r13b, 1
mov rax, qword [0x140123ea8]
lea rcx, [rbp - 9]
mov r9d, 8
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 9]
mov rcx, 0xffffffffffffffff
lea edx, [r9 + 0x16]
call rax
cmp eax, 0xc0000353
jne 0x140010cd7
cmp qword [rbp - 9], 8
jne 0x140010cd7
mov rax, qword [0x140123ea8]
mov r15d, 1
mov qword [rbp - 9], r15
mov qword [rsp + 0x20], r14
lea edx, [r15 + 0x1d]
lea rcx, [r15 - 2]
lea r9d, [r15 + 7]
lea r8d, [r15 + 4]
call rax
cmp eax, 0x80000002
je 0x140010aeb
cmp eax, 0xc0000003
jne 0x140010af1
cmp qword [rbp - 9], r15
je 0x140010af5
movzx r13d, r15b
mov rax, qword [0x140123ea8]
lea r8, [rbp - 9]
mov r9d, r15d
mov qword [rsp + 0x20], r14
mov edx, 0x1e
mov rcx, 0xffffffffffffffff
call rax
cmp eax, 0xc0000004
movzx edi, r13b
mov rax, qword [0x140123ea8]
lea r8, [rbp - 9]
mov r9d, 8
mov qword [rbp - 9], r15
cmovne edi, r15d
mov rcx, 0xffffffffffffffff
and r12d, 0xfff
mov qword [rsp + 0x20], r12
lea edx, [r9 + 0x16]
call rax
cmp eax, 0xc0000005
je 0x140010b5f
cmp eax, 0x80000002
jne 0x140010b65
cmp qword [rbp - 9], r15
je 0x140010b69
movzx edi, r15b
mov rax, qword [0x140123ea8]
lea r8, [rbp - 9]
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea edx, [r9 + 0x1e]
lea rcx, [r9 - 1]
call rax
cmp eax, 0xc0000005
je 0x140010b94
cmp eax, 0x80000002
jne 0x140010b9a
cmp qword [rbp - 9], r15
je 0x140010b9e
movzx edi, r15b
mov rax, qword [0x140123ea8]
lea r8, [rbp - 9]
mov r9d, 8
mov qword [rsp + 0x20], r12
xor ecx, ecx
lea edx, [r9 + 0x16]
call rax
cmp eax, 0xc0000005
je 0x140010bca
cmp eax, 0x80000002
jne 0x140010bd0
cmp qword [rbp - 9], r15
je 0x140010bd4
movzx edi, r15b
mov rsi, qword [0x140123eb0]
lea r9, [rbp + 0x1f]
xor r8d, r8d
mov dword [rbp + 0x1f], r14d
lea rdx, [rbp + 0x1f]
mov rbx, r14
lea ecx, [r8 + 0x10]
call rsi
cmp eax, 0xc0000004
jne 0x140010c47
nop word [rax + rax]
test rbx, rbx
je 0x140010c16
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x1f]
xor ecx, ecx
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rbp + 0x1f]
lea r9, [rbp + 0x1f]
mov rdx, rax
mov ecx, reloc.WS2_32.dll_recv
mov rbx, rax
call rsi
cmp eax, 0xc0000004
je 0x140010c00
test eax, eax
jns 0x140010c52
test rbx, rbx
je 0x140010c94
jmp 0x140010c83
mov eax, dword [rbx]
test eax, eax
je 0x140010c83
lea rdx, [rbx + 8]
mov r8d, eax
nop
movups xmm1, xmmword [rdx]
mov rcx, qword gs:[0x30]
movd eax, xmm1
cmp ax, word [rcx + 0x40]
jne 0x140010c79
inc r14
add rdx, 0x18
sub r8, 1
jne 0x140010c60
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
sub r14, qword [rbp + 7]
cmp r14, 0x10
movzx eax, dil
cmova eax, r15d
mov r12, qword [rsp + 0xd0]
mov r15, qword [rsp + 0xd8]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14009bc50
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
mov al, 1
jmp 0x140010ca4
xor al, al
jmp 0x140010cb4