Function at 0x14001d2c0
Capabilities:
Print debug messages

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x218
mov rax, qword [0x140027468]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov eax, dword [0x1400287ec]
mov dword [rsp + 0x44], eax
lea rdi, [rsp + 0x50]
lea rsi, str.0x00000000_n
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rcx, str._WARNING___PE_SIGNATURE_VERIFICATION_FAILED_____n_Filename:
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, str._n_Error:
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x40], 0
jmp 0x14001d33e
mov eax, dword [rsp + 0x40]
add eax, 1
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 8
jge 0x14001d3c3
mov eax, 7
sub eax, dword [rsp + 0x40]
shl eax, 2
movzx ecx, al
mov eax, dword [rsp + 0x238]
shr eax, cl
mov ecx, eax
and ecx, 0xf
mov eax, dword [rsp + 0x40]
add eax, 2
cdqe
mov word [rsp + rax*2 + 0x50], cx
mov eax, dword [rsp + 0x40]
add eax, 2
cdqe
movzx eax, word [rsp + rax*2 + 0x50]
cmp eax, 0xa
jge 0x14001d390
mov dword [rsp + 0x1f0], 0x30
jmp 0x14001d39b
mov dword [rsp + 0x1f0], 0x37
mov eax, dword [rsp + 0x40]
add eax, 2
cdqe
movzx ecx, word [rsp + rax*2 + 0x50]
add ecx, dword [rsp + 0x1f0]
mov eax, dword [rsp + 0x40]
add eax, 2
cdqe
mov word [rsp + rax*2 + 0x50], cx
jmp 0x14001d333
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [rsp + 0x44], 0
jne 0x14001d7b6
cmp dword [0x1400270ac], 0
je 0x14001d7b6
mov eax, 0x100
mov word [rsp + 0x78], ax
mov eax, 0x200
mov word [rsp + 0x7a], ax
xor eax, eax
mov word [rsp + 0x7c], ax
mov dword [rsp + 0x68], 0x41fcc608
mov eax, 0x8496
mov word [rsp + 0x6c], ax
mov eax, 0x4def
mov word [rsp + 0x6e], ax
mov byte [rsp + 0x70], 0xb4
mov byte [rsp + 0x71], 0x3e
mov byte [rsp + 0x72], 0x7d
mov byte [rsp + 0x73], 0x9b
mov byte [rsp + 0x74], 0xd6
mov byte [rsp + 0x75], 0x75
mov byte [rsp + 0x76], 0xa6
mov byte [rsp + 0x77], 0xff
mov dword [0x1400270ac], 0
cmp qword [0x140028688], 0
jne 0x14001d4c9
xor edx, edx
lea rcx, str.Advapi32.dll
call fcn.14001ae90
mov qword [0x140028688], rax
cmp qword [0x140028688], 0
je 0x14001d4c9
lea rdx, str.RegOpenKeyExW
mov rcx, qword [0x140028688]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028690], rax
lea rdx, str.RegEnumValueW
mov rcx, qword [0x140028688]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028698], rax
lea rdx, str.RegCloseKey
mov rcx, qword [0x140028688]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400286a0], rax
cmp qword [0x140028690], 0
je 0x14001d4e7
cmp qword [0x140028698], 0
je 0x14001d4e7
cmp qword [0x1400286a0], 0
jne 0x14001d4ee
xor eax, eax
jmp 0x14001d801
cmp qword [0x1400286a8], 0
jne 0x14001d532
xor edx, edx
lea rcx, str.Ole32.dll
call fcn.14001ae90
mov qword [0x1400286a8], rax
cmp qword [0x1400286a8], 0
je 0x14001d532
lea rdx, str.StringFromGUID2
mov rcx, qword [0x1400286a8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400286b0], rax
cmp qword [0x1400286b0], 0
jne 0x14001d543
xor eax, eax
jmp 0x14001d801
lea rdi, [rsp + 0x80]
xor eax, eax
mov ecx, 0x4e
rep stosb byte [rdi], al
mov r8d, 0x27
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x68]
call qword [0x1400286b0]
cdqe
cmp rax, 0x27
je 0x14001d57c
xor eax, eax
jmp 0x14001d801
mov dword [rsp + 0x40], 0
jmp 0x14001d591
mov eax, dword [rsp + 0x40]
add eax, 1
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x44], 0
jne 0x14001d7b6
movsxd rax, dword [rsp + 0x40]
movzx eax, word [rsp + rax*2 + 0x78]
test eax, eax
je 0x14001d7b6
mov qword [rsp + 0xd0], 0
movsxd rax, dword [rsp + 0x40]
movzx r9d, word [rsp + rax*2 + 0x78]
or r9d, 0x20019
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWARENVIDIA_CorporationGlobal
mov rcx, 0xffffffff80000002
call qword [0x140028690]
mov dword [rsp + 0xd8], eax
cmp dword [rsp + 0xd8], 0
jne 0x14001d7b1
mov dword [rsp + 0xe0], 0
mov dword [rsp + 0xdc], 0
mov dword [rsp + 0xe8], 0x80
mov dword [rsp + 0xe4], 4
lea rdi, [rsp + 0xf0]
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x1f4], eax
lea rax, [rsp + 0xe4]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xec]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xe8]
lea r8, [rsp + 0xf0]
mov edx, dword [rsp + 0x1f4]
mov rcx, qword [rsp + 0xd0]
call qword [0x140028698]
mov dword [rsp + 0xd8], eax
mov eax, dword [rsp + 0xe0]
add eax, 1
mov dword [rsp + 0xe0], eax
cmp dword [rsp + 0xd8], 0
jne 0x14001d759
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x80]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov eax, dword [rsp + 0xe8]
cmp rcx, rax
jne 0x14001d759
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0xf0]
sub rcx, rdx
movzx eax, word [rdx]
cmp ax, word [rdx + rcx]
jne 0x14001d717
add rdx, 2
test ax, ax
jne 0x14001d701
xor eax, eax
jmp 0x14001d71c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x14001d759
cmp dword [rsp + 0xec], 0
je 0x14001d737
mov dword [rsp + 0x1f8], 1
jmp 0x14001d742
mov dword [rsp + 0x1f8], 0
mov ecx, dword [rsp + 0x1f8]
mov eax, dword [rsp + 0xdc]
or eax, ecx
mov dword [rsp + 0xdc], eax
cmp dword [rsp + 0xd8], 0x103
jne 0x14001d61b
mov rcx, qword [rsp + 0xd0]
call qword [0x1400286a0]
cmp dword [rsp + 0xdc], 0
je 0x14001d78f
mov dword [rsp + 0x1fc], 1
jmp 0x14001d79a
mov dword [rsp + 0x1fc], 0
mov eax, dword [rsp + 0x1fc]
mov dword [0x1400287ec], eax
mov eax, dword [0x1400287ec]
mov dword [rsp + 0x44], eax
jmp 0x14001d586
cmp dword [rsp + 0x44], 0
jne 0x14001d7c6
cmp dword [0x1400287ec], 0
je 0x14001d7f2
lea rcx, str._Signature_override_detected..._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x238], 0
mov ecx, dword [rsp + 0x238]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 1
jmp 0x14001d801
mov ecx, dword [rsp + 0x238]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.1400217b0
add rsp, 0x218
pop rdi
pop rsi
ret