Function at 0x48f7c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov ebx, dword [rcx + 0xa8]
mov r14, rcx
and ebx, 0x7f
test r8, r8
je 0x490e48
mov qword [rsp + 0x88], rdx
mov qword [rsp + 0x90], r8
jmp 0x490ded
mov rdx, qword [rsp + 0x88]
mov r8, r15
call sub.msvcrt.dll_memcpy
add qword [rsp + 0x88], r15
sub qword [rsp + 0x90], r15
mov edx, dword [r14 + 0x9c]
mov eax, dword [r14 + 0x80]
and eax, dword [r14 + 0x98]
mov edi, dword [r14 + 0x94]
ror edx, 0xb
add edx, dword [r14]
mov r9d, dword [r14 + 0x84]
ror edi, 0xb
mov ecx, edx
mov edx, dword [r14 + 0x84]
and edx, dword [r14 + 0x94]
xor eax, edx
mov edx, dword [r14 + 0x8c]
xor eax, dword [r14 + 0x90]
xor edx, dword [r14 + 0x90]
and edx, dword [r14 + 0x88]
xor edx, eax
mov eax, dword [r14 + 0x98]
ror edx, 7
add edx, ecx
ror eax, 0xb
add eax, dword [r14 + 4]
mov ecx, eax
mov eax, dword [r14 + 0x88]
xor eax, dword [r14 + 0x8c]
and eax, dword [r14 + 0x84]
mov r8d, eax
mov eax, dword [r14 + 0x80]
and eax, dword [r14 + 0x90]
xor eax, dword [r14 + 0x8c]
xor eax, r8d
mov r8d, dword [r14 + 0x94]
and r8d, edx
xor eax, r8d
ror eax, 7
add eax, ecx
mov ecx, dword [r14 + 8]
add ecx, edi
mov edi, dword [r14 + 0x84]
xor edi, dword [r14 + 0x88]
and edi, dword [r14 + 0x80]
xor edi, dword [r14 + 0x88]
mov r8d, edi
mov edi, dword [r14 + 0x8c]
and edi, edx
xor edi, r8d
mov r8d, dword [r14 + 0x90]
and r8d, eax
xor edi, r8d
mov r8d, dword [r14 + 0x90]
ror edi, 7
add edi, ecx
mov ecx, dword [r14 + 0xc]
ror r8d, 0xb
add ecx, r8d
mov r8d, dword [r14 + 0x80]
xor r8d, dword [r14 + 0x84]
and r8d, edx
xor r9d, r8d
mov r8d, dword [r14 + 0x88]
mov r10d, dword [r14 + 0x80]
mov r11d, dword [r14 + 0x88]
and r8d, eax
xor r8d, r9d
mov r9d, dword [r14 + 0x8c]
ror r11d, 0xb
and r9d, edi
xor r8d, r9d
mov r9d, dword [r14 + 0x8c]
ror r8d, 7
add r8d, ecx
mov ecx, dword [r14 + 0x10]
ror r9d, 0xb
add ecx, r9d
mov r9d, dword [r14 + 0x80]
xor r9d, edx
and r9d, eax
xor r10d, r9d
mov r9d, dword [r14 + 0x84]
and r9d, edi
xor r9d, r10d
mov r10d, dword [r14 + 0x88]
and r10d, r8d
xor r9d, r10d
ror r9d, 7
add r9d, ecx
mov ecx, dword [r14 + 0x14]
add ecx, r11d
mov r11d, edx
xor r11d, eax
and r11d, edi
xor r11d, edx
mov r10d, r11d
mov r11d, dword [r14 + 0x80]
and r11d, r8d
xor r11d, r10d
mov r10d, dword [r14 + 0x84]
and r10d, r9d
xor r11d, r10d
mov r10d, dword [r14 + 0x84]
ror r11d, 7
add r11d, ecx
mov ecx, dword [r14 + 0x18]
ror r10d, 0xb
add ecx, r10d
mov r10d, eax
xor r10d, edi
and r10d, r8d
mov ebx, r10d
mov r10d, edx
xor ebx, eax
and r10d, r9d
xor r10d, ebx
mov ebx, dword [r14 + 0x80]
and ebx, r11d
xor r10d, ebx
mov ebx, dword [r14 + 0x80]
ror r10d, 7
add r10d, ecx
mov ecx, dword [r14 + 0x1c]
ror ebx, 0xb
add ecx, ebx
mov ebx, edi
xor ebx, r8d
and ebx, r9d
xor ebx, edi
mov esi, ebx
mov ebx, eax
and ebx, r11d
xor ebx, esi
mov esi, edx
ror edx, 0xb
add edx, dword [r14 + 0x20]
and esi, r10d
xor ebx, esi
mov esi, r8d
xor esi, r9d
ror ebx, 7
and esi, r11d
add ebx, ecx
mov ecx, esi
mov esi, edi
xor ecx, r8d
and esi, r10d
xor esi, ecx
mov ecx, eax
and ecx, ebx
xor esi, ecx
mov ecx, r9d
ror eax, 0xb
add eax, dword [r14 + 0x24]
xor ecx, r11d
ror esi, 7
and ecx, r10d
add esi, edx
mov edx, ecx
mov ecx, r8d
xor edx, r9d
and ecx, ebx
xor ecx, edx
mov edx, edi
ror edi, 0xb
add edi, dword [r14 + 0x28]
and edx, esi
xor ecx, edx
mov edx, r11d
xor edx, r10d
ror ecx, 7
and edx, ebx
add ecx, eax
mov eax, edx
mov edx, r9d
xor eax, r11d
and edx, esi
xor edx, eax
mov eax, r8d
ror r8d, 0xb
and eax, ecx
xor edx, eax
mov eax, dword [r14 + 0x2c]
ror edx, 7
add edx, edi
add eax, r8d
mov r8d, r10d
xor r8d, ebx
and r8d, esi
mov edi, r8d
mov r8d, r11d
xor edi, r10d
and r8d, ecx
xor r8d, edi
mov edi, r9d
and edi, edx
ror r9d, 0xb
xor r8d, edi
ror r8d, 7
add r8d, eax
mov eax, dword [r14 + 0x30]
add eax, r9d
mov r9d, ebx
xor r9d, esi
and r9d, ecx
mov edi, r9d
mov r9d, r10d
xor edi, ebx
and r9d, edx
xor r9d, edi
mov edi, r11d
ror r11d, 0xb
and edi, r8d
xor r9d, edi
ror r9d, 7
add r9d, eax
mov eax, dword [r14 + 0x34]
add eax, r11d
mov r11d, esi
xor r11d, ecx
and r11d, edx
mov edi, r11d
mov r11d, ebx
xor edi, esi
and r11d, r8d
xor r11d, edi
mov edi, r10d
ror r10d, 0xb
and edi, r9d
xor r11d, edi
ror r11d, 7
add r11d, eax
mov eax, dword [r14 + 0x38]
add eax, r10d
mov r10d, ecx
xor r10d, edx
and r10d, r8d
mov edi, r10d
mov r10d, esi
xor edi, ecx
and r10d, r9d
xor r10d, edi
mov edi, ebx
ror ebx, 0xb
and edi, r11d
xor r10d, edi
ror r10d, 7
add r10d, eax
mov eax, dword [r14 + 0x3c]
add eax, ebx
mov ebx, edx
xor ebx, r8d
and ebx, r9d
xor ebx, edx
mov edi, ebx
mov ebx, ecx
and ebx, r11d
xor ebx, edi
mov edi, esi
ror esi, 0xb
add esi, dword [r14 + 0x40]
and edi, r10d
xor ebx, edi
ror ebx, 7
add ebx, eax
mov eax, r8d
xor eax, r9d
and eax, r11d
xor eax, r8d
mov edi, eax
mov eax, edx
and eax, r10d
xor eax, edi
mov edi, ecx
ror ecx, 0xb
add ecx, dword [r14 + 0x44]
and edi, ebx
xor eax, edi
ror eax, 7
add eax, esi
mov esi, ecx
mov ecx, r9d
xor ecx, r11d
and ecx, r10d
xor ecx, r9d
mov edi, ecx
mov ecx, r8d
and ecx, ebx
xor ecx, edi
mov edi, edx
ror edx, 0xb
add edx, dword [r14 + 0x48]
and edi, eax
xor ecx, edi
ror ecx, 7
add ecx, esi
mov esi, edx
mov edx, r11d
xor edx, r10d
and edx, ebx
xor edx, r11d
mov edi, edx
mov edx, r9d
and edx, eax
xor edx, edi
mov edi, r8d
ror r8d, 0xb
and edi, ecx
xor edx, edi
ror edx, 7
add edx, esi
mov esi, dword [r14 + 0x4c]
add esi, r8d
mov r8d, r10d
xor r8d, ebx
and r8d, eax
mov edi, r8d
mov r8d, r11d
xor edi, r10d
and r8d, ecx
xor r8d, edi
mov edi, r9d
ror r9d, 0xb
and edi, edx
xor r8d, edi
ror r8d, 7
add r8d, esi
mov esi, dword [r14 + 0x50]
add esi, r9d
mov r9d, ebx
xor r9d, eax
and r9d, ecx
mov edi, r9d
mov r9d, r10d
xor edi, ebx
and r9d, edx
xor r9d, edi
mov edi, r11d
ror r11d, 0xb
and edi, r8d
xor r9d, edi
ror r9d, 7
add r9d, esi
mov esi, dword [r14 + 0x54]
add esi, r11d
mov r11d, eax
xor r11d, ecx
and r11d, edx
mov edi, r11d
mov r11d, ebx
xor edi, eax
and r11d, r8d
xor r11d, edi
mov edi, r10d
ror r10d, 0xb
and edi, r9d
xor r11d, edi
ror r11d, 7
add r11d, esi
mov esi, dword [r14 + 0x58]
add esi, r10d
mov r10d, ecx
xor r10d, edx
and r10d, r8d
mov edi, r10d
mov r10d, eax
xor edi, ecx
and r10d, r9d
xor r10d, edi
mov edi, ebx
ror ebx, 0xb
add ebx, dword [r14 + 0x5c]
and edi, r11d
xor r10d, edi
ror r10d, 7
add r10d, esi
mov esi, ebx
mov ebx, edx
xor ebx, r8d
and ebx, r9d
xor ebx, edx
mov edi, ebx
mov ebx, ecx
and ebx, r11d
xor ebx, edi
mov edi, eax
ror eax, 0xb
add eax, dword [r14 + 0x60]
and edi, r10d
xor ebx, edi
ror ebx, 7
add ebx, esi
mov esi, eax
mov eax, r8d
xor eax, r9d
and eax, r11d
xor eax, r8d
mov edi, eax
mov eax, edx
and eax, r10d
xor eax, edi
mov edi, ecx
ror ecx, 0xb
add ecx, dword [r14 + 0x64]
and edi, ebx
xor eax, edi
ror eax, 7
add eax, esi
mov esi, ecx
mov ecx, r9d
xor ecx, r11d
and ecx, r10d
xor ecx, r9d
mov edi, ecx
mov ecx, r8d
and ecx, ebx
xor ecx, edi
mov edi, edx
ror edx, 0xb
add edx, dword [r14 + 0x68]
and edi, eax
xor ecx, edi
ror ecx, 7
add ecx, esi
mov esi, edx
mov edx, r11d
xor edx, r10d
and edx, ebx
xor edx, r11d
mov edi, edx
mov edx, r9d
and edx, eax
xor edx, edi
mov edi, r8d
ror r8d, 0xb
and edi, ecx
xor edx, edi
ror edx, 7
add edx, esi
mov esi, dword [r14 + 0x6c]
add esi, r8d
mov r8d, r10d
xor r8d, ebx
and r8d, eax
mov edi, r8d
mov r8d, r11d
xor edi, r10d
and r8d, ecx
xor r8d, edi
mov edi, r9d
ror r9d, 0xb
and edi, edx
xor r8d, edi
ror r8d, 7
add r8d, esi
mov esi, dword [r14 + 0x70]
add esi, r9d
mov r9d, ebx
xor r9d, eax
and r9d, ecx
mov edi, r9d
mov r9d, r10d
xor edi, ebx
and r9d, edx
xor r9d, edi
mov edi, r11d
ror r11d, 0xb
and edi, r8d
xor r9d, edi
ror r9d, 7
add r9d, esi
mov esi, dword [r14 + 0x74]
add esi, r11d
mov r11d, eax
xor r11d, ecx
and r11d, edx
mov edi, r11d
mov r11d, ebx
xor edi, eax
and r11d, r8d
xor r11d, edi
mov edi, r10d
ror r10d, 0xb
and edi, r9d
xor r11d, edi
ror r11d, 7
add r11d, esi
mov esi, dword [r14 + 0x78]
add esi, r10d
mov r10d, ecx
xor r10d, edx
and r10d, r8d
mov edi, r10d
mov r10d, eax
xor edi, ecx
and r10d, r9d
xor r10d, edi
mov edi, ebx
ror ebx, 0xb
add ebx, dword [r14 + 0x7c]
and edi, r11d
xor r10d, edi
ror r10d, 7
add r10d, esi
mov esi, ebx
mov ebx, edx
xor ebx, r8d
and ebx, r9d
xor ebx, edx
mov edi, ebx
mov ebx, ecx
and ebx, r11d
xor ebx, edi
mov edi, eax
and edi, r10d
xor ebx, edi
mov edi, r9d
ror ebx, 7
add ebx, esi
mov esi, dword [r14 + 0x14]
ror eax, 0xb
xor edi, r11d
and edi, r10d
xor edi, ecx
lea ebp, [rsi + rax + 0x452821e6]
mov esi, r11d
mov eax, ecx
xor eax, r8d
and esi, r10d
ror ecx, 0xb
xor esi, eax
mov eax, ebx
not eax
and eax, r9d
xor esi, eax
mov eax, r11d
and esi, edx
and eax, ebx
xor edi, eax
mov eax, esi
mov esi, dword [r14 + 0x38]
xor eax, edi
mov edi, r11d
ror eax, 7
xor edi, r10d
add eax, ebp
and edi, ebx
lea ebp, [rsi + rcx + 0x38d01377]
mov esi, r10d
mov ecx, edx
xor ecx, r9d
and esi, ebx
xor edi, edx
xor esi, ecx
mov ecx, eax
ror edx, 0xb
not ecx
and ecx, r11d
xor esi, ecx
mov ecx, r10d
and esi, r8d
and ecx, eax
xor edi, ecx
mov ecx, esi
mov esi, dword [r14 + 0x68]
xor ecx, edi
mov edi, r10d
ror ecx, 7
add ecx, ebp
lea ebp, [rsi + rdx - 0x41ab9931]
mov esi, ebx
mov edx, r8d
and esi, eax
xor edx, r11d
xor edi, ebx
xor esi, edx
mov edx, ecx
and edi, eax
not edx
xor edi, r8d
ror r8d, 0xb
and edx, r10d
xor esi, edx
mov edx, ebx
and esi, r9d
and edx, ecx
xor edi, edx
mov edx, esi
mov esi, dword [r14 + 0x48]
xor edx, edi
mov edi, ebx
ror edx, 7
xor edi, eax
add edx, ebp
and edi, ecx
lea ebp, [rsi + r8 + 0x34e90c6c]
mov esi, eax
mov r8d, r9d
xor r8d, r10d
and esi, ecx
xor edi, r9d
xor esi, r8d
mov r8d, edx
ror r9d, 0xb
not r8d
and r8d, ebx
xor esi, r8d
mov r8d, eax
and r8d, edx
and esi, r11d
xor edi, r8d
xor esi, edi
mov edi, eax
mov r8d, esi
mov esi, dword [r14 + 0x2c]
ror r8d, 7
add r8d, ebp
lea ebp, [rsi + r9 - 0x3f53d649]
mov esi, ecx
mov r9d, r11d
xor r9d, ebx
and esi, edx
xor esi, r9d
mov r9d, r8d
not r9d
and r9d, eax
xor edi, ecx
xor esi, r9d
and edi, edx
mov r9d, ecx
and r9d, r8d
xor edi, r11d
and esi, r10d
xor edi, r9d
ror r11d, 0xb
xor esi, edi
mov edi, ecx
mov r9d, esi
mov esi, dword [r14 + 0x70]
xor edi, edx
ror r9d, 7
and edi, r8d
add r9d, ebp
xor edi, r10d
lea ebp, [rsi + r11 - 0x3683af23]
mov esi, edx
mov r11d, r10d
xor r11d, eax
and esi, r8d
ror r10d, 0xb
xor esi, r11d
mov r11d, r9d
not r11d
and r11d, ecx
xor esi, r11d
mov r11d, edx
and r11d, r9d
and esi, ebx
xor edi, r11d
xor esi, edi
mov edi, edx
mov r11d, esi
mov esi, dword [r14 + 0x1c]
ror r11d, 7
add r11d, ebp
lea ebp, [rsi + r10 + 0x3f84d5b5]
mov esi, r8d
mov r10d, ebx
xor r10d, ecx
and esi, r9d
xor esi, r10d
mov r10d, r11d
not r10d
and r10d, edx
xor esi, r10d
mov r10d, r8d
and esi, eax
xor edi, r8d
and r10d, r11d
and edi, r9d
xor edi, ebx
ror ebx, 0xb
xor edi, r10d
xor esi, edi
mov edi, r8d
mov r10d, esi
mov esi, dword [r14 + 0x40]
xor edi, r9d
ror r10d, 7
and edi, r11d
add r10d, ebp
xor edi, eax
lea ebp, [rsi + rbx - 0x4ab8f6e9]
mov esi, r9d
mov ebx, eax
xor ebx, edx
and esi, r11d
ror eax, 0xb
xor esi, ebx
mov ebx, r10d
not ebx
and ebx, r8d
xor esi, ebx
mov ebx, r9d
and esi, ecx
and ebx, r10d
xor edi, ebx
mov ebx, esi
mov esi, dword [r14]
xor ebx, edi
mov edi, r9d
ror ebx, 7
xor edi, r11d
add ebx, ebp
lea ebp, [rsi + rax - 0x6de92a27]
mov esi, r11d
mov eax, ecx
xor eax, r8d
and esi, r10d
xor esi, eax
mov eax, ebx
not eax
and eax, r9d
xor esi, eax
mov eax, r11d
and esi, edx
and edi, r10d
and eax, ebx
xor edi, ecx
ror ecx, 0xb
xor edi, eax
mov eax, esi
mov esi, dword [r14 + 0x5c]
xor eax, edi
mov edi, r11d
ror eax, 7
xor edi, r10d
add eax, ebp
and edi, ebx
lea ebp, [rsi + rcx - 0x768604e5]
mov esi, r10d
mov ecx, edx
xor ecx, r9d
and esi, ebx
xor edi, edx
xor esi, ecx
mov ecx, eax
ror edx, 0xb
not ecx
and ecx, r11d
xor esi, ecx
mov ecx, r10d
and esi, r8d
and ecx, eax
xor edi, ecx
mov ecx, esi
mov esi, dword [r14 + 0x50]
xor ecx, edi
mov edi, r10d
ror ecx, 7
xor edi, ebx
add ecx, ebp
and edi, eax
lea ebp, [rsi + rdx - 0x2ecef45a]
mov esi, ebx
mov edx, r8d
xor edx, r11d
and esi, eax
xor edi, r8d
xor esi, edx
mov edx, ecx
not edx
and edx, r10d
xor esi, edx
mov edx, ebx
and esi, r9d
and edx, ecx
ror r8d, 0xb
xor edi, edx
mov edx, esi
mov esi, dword [r14 + 0x58]
xor edx, edi
mov edi, ebx
ror edx, 7
xor edi, eax
add edx, ebp
and edi, ecx
lea ebp, [rsi + r8 - 0x67204a54]
mov esi, eax
mov r8d, r9d
xor r8d, r10d
and esi, ecx
xor edi, r9d
xor esi, r8d
mov r8d, edx
ror r9d, 0xb
not r8d
and r8d, ebx
xor esi, r8d
mov r8d, eax
and r8d, edx
and esi, r11d
xor edi, r8d
xor esi, edi
mov edi, eax
mov r8d, esi
mov esi, dword [r14 + 4]
xor edi, ecx
ror r8d, 7
and edi, edx
add r8d, ebp
xor edi, r11d
lea ebp, [rsi + r9 + 0x2ffd72db]
mov esi, ecx
mov r9d, r11d
xor r9d, ebx
and esi, edx
xor esi, r9d
mov r9d, r8d
not r9d
and r9d, eax
xor esi, r9d
mov r9d, ecx
and r9d, r8d
and esi, r10d
xor edi, r9d
xor esi, edi
ror r11d, 0xb
mov edi, ecx
mov r9d, esi
mov esi, dword [r14 + 0x28]
xor edi, edx
ror r9d, 7
and edi, r8d
add r9d, ebp
xor edi, r10d
lea ebp, [rsi + r11 - 0x2fe52049]
mov esi, edx
mov r11d, r10d
xor r11d, eax
and esi, r8d
ror r10d, 0xb
xor esi, r11d
mov r11d, r9d
not r11d
and r11d, ecx
xor esi, r11d
mov r11d, edx
and r11d, r9d
and esi, ebx
xor edi, r11d
xor esi, edi
mov edi, edx
mov r11d, esi
mov esi, dword [r14 + 0x10]
xor edi, r8d
ror r11d, 7
and edi, r9d
add r11d, ebp
xor edi, ebx
lea ebp, [rsi + r10 - 0x471e5013]
mov esi, r8d
mov r10d, ebx
xor r10d, ecx
and esi, r9d
xor esi, r10d
mov r10d, r11d
not r10d
and r10d, edx
xor esi, r10d
mov r10d, r8d
and r10d, r11d
and esi, eax
xor edi, r10d
xor esi, edi
mov edi, r8d
mov r10d, esi
mov esi, dword [r14 + 0x20]
ror r10d, 7
add r10d, ebp
ror ebx, 0xb
xor edi, r9d
and edi, r11d
lea ebp, [rsi + rbx + 0x6a267e96]
mov esi, r9d
mov ebx, eax
xor ebx, edx
and esi, r11d
xor edi, eax
xor esi, ebx
mov ebx, r10d
ror eax, 0xb
not ebx
and ebx, r8d
xor esi, ebx
mov ebx, r9d
and esi, ecx
and ebx, r10d
xor edi, ebx
mov ebx, esi
mov esi, dword [r14 + 0x78]
xor ebx, edi
mov edi, r9d
ror ebx, 7
xor edi, r11d
add ebx, ebp
and edi, r10d
lea ebp, [rsi + rax - 0x45836fbb]
mov esi, r11d
mov eax, ecx
xor eax, r8d
and esi, r10d
xor edi, ecx
xor esi, eax
mov eax, ebx
ror ecx, 0xb
not eax
and eax, r9d
xor esi, eax
mov eax, r11d
and esi, edx
and eax, ebx
xor edi, eax
mov eax, esi
mov esi, dword [r14 + 0xc]
xor eax, edi
mov edi, r11d
ror eax, 7
add eax, ebp
lea ebp, [rsi + rcx - 0xed38067]
mov esi, r10d
mov ecx, edx
and esi, ebx
xor ecx, r9d
xor edi, r10d
xor esi, ecx
mov ecx, eax
and edi, ebx
not ecx
xor edi, edx
ror edx, 0xb
and ecx, r11d
xor esi, ecx
mov ecx, r10d
and esi, r8d
and ecx, eax
xor edi, ecx
mov ecx, esi
mov esi, dword [r14 + 0x54]
xor ecx, edi
mov edi, r10d
ror ecx, 7
xor edi, ebx
add ecx, ebp
and edi, eax
lea ebp, [rsi + rdx + 0x24a19947]
mov esi, ebx
mov edx, r8d
xor edx, r11d
and esi, eax
xor edi, r8d
xor esi, edx
mov edx, ecx
ror r8d, 0xb
not edx
and edx, r10d
xor esi, edx
mov edx, ebx
and esi, r9d
and edx, ecx
xor edi, edx
mov edx, esi
mov esi, dword [r14 + 0x24]
xor edx, edi
mov edi, ebx
ror edx, 7
add edx, ebp
lea ebp, [rsi + r8 - 0x4c6e9309]
mov esi, eax
mov r8d, r9d
xor r8d, r10d
and esi, ecx
xor esi, r8d
mov r8d, edx
xor edi, eax
not r8d
and edi, ecx
and r8d, ebx
xor edi, r9d
ror r9d, 0xb
xor esi, r8d
mov r8d, eax
and r8d, edx
and esi, r11d
xor edi, r8d
xor esi, edi
mov edi, eax
mov r8d, esi
mov esi, dword [r14 + 0x44]
xor edi, ecx
ror r8d, 7
and edi, edx
add r8d, ebp
xor edi, r11d
lea ebp, [rsi + r9 + 0x801f2e2]
mov esi, ecx
mov r9d, r11d
xor r9d, ebx
and esi, edx
ror r11d, 0xb
xor esi, r9d
mov r9d, r8d
not r9d
and r9d, eax
xor esi, r9d
mov r9d, ecx
and r9d, r8d
and esi, r10d
xor edi, r9d
xor esi, edi
mov edi, ecx
mov r9d, esi
mov esi, dword [r14 + 0x60]
ror r9d, 7
add r9d, ebp
lea ebp, [rsi + r11 - 0x7a7103ea]
mov esi, edx
mov r11d, r10d
xor r11d, eax
and esi, r8d
xor esi, r11d
mov r11d, r9d
not r11d
and r11d, ecx
xor esi, r11d
xor edi, edx
mov r11d, edx
and edi, r8d
and r11d, r9d
and esi, ebx
xor edi, r10d
ror r10d, 0xb
xor edi, r11d
xor esi, edi
mov edi, edx
mov r11d, esi
mov esi, dword [r14 + 0x74]
xor edi, r8d
ror r11d, 7
and edi, r9d
add r11d, ebp
xor edi, ebx
lea ebp, [rsi + r10 + 0x636920d8]
mov esi, r8d
mov r10d, ebx
xor r10d, ecx
and esi, r9d
ror ebx, 0xb
xor esi, r10d
mov r10d, r11d
not r10d
and r10d, edx
xor esi, r10d
mov r10d, r8d
and r10d, r11d
and esi, eax
xor edi, r10d
xor esi, edi
mov edi, r9d
mov r10d, esi
mov esi, dword [r14 + 0x18]
and edi, r11d
ror r10d, 7
add r10d, ebp
lea ebp, [rsi + rbx + 0x71574e69]
mov ebx, eax
mov esi, r8d
xor ebx, edx
xor ebx, edi
mov edi, r10d
not edi
and edi, r8d
xor ebx, edi
mov edi, r9d
and ebx, ecx
xor esi, r9d
and edi, r10d
and esi, r11d
xor esi, eax
ror eax, 0xb
xor esi, edi
xor ebx, esi
mov esi, r9d
mov edi, ebx
mov ebx, dword [r14 + 0x4c]
xor esi, r11d
ror edi, 7
and esi, r10d
add edi, ebp
xor esi, ecx
lea ebp, [rbx + rax - 0x5ba7015d]
mov ebx, r11d
mov eax, ecx
xor eax, r8d
and ebx, r10d
ror ecx, 0xb
xor ebx, eax
mov eax, edi
not eax
and eax, r9d
xor ebx, eax
mov eax, r11d
and ebx, edx
and eax, edi
xor esi, eax
mov eax, ebx
mov ebx, dword [r14 + 0x30]
xor eax, esi
mov esi, r11d
ror eax, 7
xor esi, r10d
add eax, ebp
and esi, edi
lea ebp, [rbx + rcx - 0xb6cc282]
mov ebx, r10d
mov ecx, edx
xor ecx, r9d
and ebx, edi
xor ebx, ecx
mov ecx, eax
not ecx
and ecx, r11d
xor ebx, ecx
mov ecx, r10d
and ebx, r8d
xor esi, edx
and ecx, eax
xor esi, ecx
mov ecx, ebx
mov ebx, dword [r14 + 0x3c]
ror edx, 0xb
xor ecx, esi
mov esi, r10d
ror ecx, 7
xor esi, edi
add ecx, ebp
and esi, eax
lea ebp, [rbx + rdx + 0xd95748f]
mov ebx, edi
mov edx, r8d
xor edx, r11d
and ebx, eax
xor esi, r8d
xor ebx, edx
mov edx, ecx
ror r8d, 0xb
not edx
and edx, r10d
xor ebx, edx
mov edx, edi
and ebx, r9d
and edx, ecx
xor esi, edx
mov edx, ebx
mov ebx, dword [r14 + 0x34]
xor edx, esi
mov esi, edi
ror edx, 7
xor esi, eax
add edx, ebp
and esi, ecx
lea ebp, [rbx + r8 + 0x728eb658]
mov ebx, eax
mov r8d, r9d
xor r8d, r10d
and ebx, ecx
xor esi, r9d
xor ebx, r8d
mov r8d, edx
not r8d
and r8d, edi
xor ebx, r8d
mov r8d, eax
and r8d, edx
and ebx, r11d
xor esi, r8d
ror r9d, 0xb
xor ebx, esi
mov esi, eax
mov r8d, ebx
mov ebx, dword [r14 + 8]
xor esi, ecx
ror r8d, 7
and esi, edx
add r8d, ebp
xor esi, r11d
lea ebp, [rbx + r9 + 0x718bcd58]
mov ebx, ecx
mov r9d, r11d
xor r9d, edi
and ebx, edx
ror r11d, 0xb
xor ebx, r9d
mov r9d, r8d
not r9d
and r9d, eax
xor ebx, r9d
mov r9d, ecx
and r9d, r8d
and ebx, r10d
xor esi, r9d
xor ebx, esi
mov esi, dword [r14 + 0x64]
mov r9d, ebx
mov ebx, edx
ror r9d, 7
and ebx, r8d
add r9d, ebp
mov ebp, ecx
lea r12d, [rsi + r11 - 0x7deab512]
mov r11d, r9d
mov esi, r10d
xor esi, eax
not r11d
xor ebp, edx
xor esi, ebx
and r11d, ecx
and ebp, r8d
xor r11d, esi
mov esi, edx
xor ebp, r10d
and r11d, edi
and esi, r9d
xor ebp, esi
mov esi, r11d
mov r11d, r8d
xor esi, ebp
mov ebp, dword [r14 + 0x7c]
ror esi, 7
ror r10d, 0xb
and r11d, r9d
add esi, r12d
mov r12d, edx
xor r12d, r8d
lea r13d, [rbp + r10 + 0x7b54a41d]
mov r10d, esi
mov ebp, edi
xor ebp, ecx
not r10d
and r12d, r9d
xor ebp, r11d
and r10d, edx
xor r12d, edi
xor r10d, ebp
mov ebp, r8d
ror edi, 0xb
and ebp, esi
and r10d, eax
xor r12d, ebp
xor r10d, r12d
mov r12d, eax
mov ebp, r10d
mov r10d, r9d
xor r12d, edx
ror ebp, 7
and r10d, esi
add ebp, r13d
mov r13d, dword [r14 + 0x6c]
xor r12d, r10d
lea r13d, [r13 + rdi - 0x3da5a64b]
mov edi, ebp
not edi
and edi, r8d
xor edi, r12d
mov r12d, r8d
and edi, ecx
xor r12d, r9d
mov dword [rsp + 0x2c], edi
and r12d, esi
mov edi, r9d
and edi, ebp
xor r12d, eax
xor r12d, edi
xor r12d, dword [rsp + 0x2c]
mov edi, r12d
mov r12d, dword [r14 + 0x4c]
ror edi, 7
add r13d, edi
mov edi, r8d
and edi, ebp
ror eax, 0xb
xor ebx, ecx
lea eax, [r12 + rax - 0x63cf2ac7]
mov r12d, edx
xor ebx, r13d
and r12d, esi
and ebx, r9d
xor r11d, edx
xor r12d, edi
ror ecx, 0xb
xor r10d, r8d
ror edx, 0xb
xor r12d, r13d
ror r8d, 0xb
xor ebx, r12d
mov r12d, dword [r14 + 0x24]
ror ebx, 7
add eax, ebx
mov ebx, r9d
and ebx, r13d
xor r11d, eax
lea ecx, [r12 + rcx + 0x2af26013]
xor edi, ebx
and r11d, esi
xor edi, eax
xor r11d, edi
mov edi, dword [r14 + 0x10]
ror r11d, 7
add ecx, r11d
mov r11d, esi
and r11d, eax
xor r10d, ecx
lea edi, [rdi + rdx - 0x3a2e4fdd]
xor ebx, r11d
and r10d, ebp
xor ebx, ecx
xor r10d, ebx
mov ebx, ebp
ror r10d, 7
and ebx, ecx
lea edx, [r10 + rdi]
mov r10d, esi
mov edi, dword [r14 + 0x50]
and r10d, ebp
xor r11d, ebx
mov r12d, edx
xor r10d, r9d
xor r11d, edx
ror r9d, 0xb
xor r10d, edx
lea edi, [rdi + r8 + 0x286085f0]
and r10d, r13d
xor r10d, r11d
mov r11d, r13d
ror r10d, 7
and r11d, edx
lea r8d, [r10 + rdi]
mov r10d, ebp
mov edi, dword [r14 + 0x70]
xor ebx, r11d
and r10d, r13d
xor ebx, r8d
xor r10d, esi
ror esi, 0xb
xor r10d, r8d
lea edi, [rdi + r9 - 0x35be86e8]
and r10d, eax
xor r10d, ebx
mov ebx, eax
ror r10d, 7
and ebx, r8d
lea r9d, [r10 + rdi]
mov edi, dword [r14 + 0x44]
xor r11d, ebx
xor r11d, r9d
lea edi, [rdi + rsi - 0x4724c711]
mov esi, r13d
and esi, eax
xor esi, ebp
ror ebp, 0xb
xor esi, r9d
and esi, ecx
xor esi, r11d
mov r11d, ecx
ror esi, 7
and r11d, r9d
lea r10d, [rsi + rdi]
mov esi, dword [r14 + 0x20]
lea edi, [rsi + rbp - 0x71862350]
mov esi, eax
and esi, ecx
xor esi, r13d
xor esi, r10d
xor ebx, r11d
ror r13d, 0xb
xor ebx, r10d
and esi, edx
and r12d, r10d
xor esi, ebx
mov ebx, dword [r14 + 0x58]
xor r11d, r12d
ror esi, 7
lea ebp, [rsi + rdi]
xor r11d, ebp
lea edi, [rbx + r13 + 0x603a180e]
mov ebx, ecx
mov r13d, r8d
and ebx, edx
and r13d, ebp
xor ebx, eax
ror eax, 0xb
xor ebx, ebp
and ebx, r8d
xor ebx, r11d
ror ebx, 7
lea esi, [rbx + rdi]
mov ebx, dword [r14 + 0x74]
mov edi, r10d
lea r11d, [rbx + rax + 0x6c9e0e8b]
mov eax, edx
mov ebx, r12d
and eax, r8d
xor ebx, r13d
mov r12d, r9d
xor eax, ecx
xor ebx, esi
ror ecx, 0xb
xor eax, esi
and r12d, esi
and eax, r9d
xor eax, ebx
ror eax, 7
lea ebx, [rax + r11]
mov eax, dword [r14 + 0x38]
lea r11d, [rax + rcx - 0x4fe175c2]
mov ecx, r8d
and ecx, r9d
xor ecx, edx
xor ecx, ebx
and ecx, r10d
xor r13d, r12d
ror edx, 0xb
xor r13d, ebx
and edi, ebx
xor ecx, r13d
xor r12d, edi
ror ecx, 7
lea eax, [rcx + r11]
mov ecx, dword [r14 + 0x64]
xor r12d, eax
mov r13d, eax
lea r11d, [rcx + rdx - 0x28ea883f]
mov ecx, r9d
and ecx, r10d
xor ecx, r8d
ror r8d, 0xb
xor ecx, eax
and ecx, ebp
xor ecx, r12d
mov r12d, ebp
ror ecx, 7
and r12d, eax
lea edx, [rcx + r11]
mov ecx, dword [r14 + 0x30]
xor edi, r12d
xor edi, edx
lea r11d, [rcx + r8 - 0x42ceb4d9]
mov r8d, r10d
and r8d, ebp
xor r8d, r9d
ror r9d, 0xb
xor r8d, edx
and r8d, esi
xor r8d, edi
mov edi, dword [r14 + 0x60]
ror r8d, 7
lea ecx, [r8 + r11]
mov r8d, esi
and r8d, edx
lea edi, [rdi + r9 + 0x78af2fda]
mov r9d, ebp
xor r12d, r8d
and r9d, esi
xor r12d, ecx
xor r9d, r10d
xor r9d, ecx
and r9d, ebx
xor r9d, r12d
mov r12d, ebx
ror r10d, 0xb
ror r9d, 7
and r12d, ecx
lea r11d, [r9 + rdi]
mov r9d, esi
mov edi, dword [r14 + 0x78]
xor r8d, r12d
and r9d, ebx
xor r8d, r11d
and r13d, r11d
xor r9d, ebp
xor r12d, r13d
ror ebp, 0xb
xor r9d, r11d
lea r10d, [rdi + r10 + 0x55605c60]
and r9d, eax
xor r9d, r8d
mov r8d, ebx
ror r9d, 7
and r8d, eax
lea edi, [r9 + r10]
xor r8d, esi
mov r9d, dword [r14 + 0x40]
ror esi, 0xb
xor r8d, edi
xor r12d, edi
and r8d, edx
xor r8d, r12d
mov r12d, ecx
lea r9d, [r9 + rbp - 0x19aada0d]
ror r8d, 7
mov ebp, edx
lea r10d, [r8 + r9]
mov r8d, eax
and ebp, edi
mov r9d, dword [r14 + 0x68]
and r8d, edx
xor r13d, ebp
xor r8d, ebx
xor r13d, r10d
xor r8d, r10d
lea esi, [r9 + rsi - 0x55aa546c]
and r8d, ecx
xor r8d, r13d
mov r13d, r11d
ror r8d, 7
and r12d, r10d
ror ebx, 0xb
lea r9d, [r8 + rsi]
mov esi, dword [r14 + 0x7c]
xor ebp, r12d
xor ebp, r9d
and r13d, r9d
xor r12d, r13d
lea esi, [rsi + rbx + 0x57489862]
mov ebx, edx
and ebx, ecx
xor ebx, eax
ror eax, 0xb
xor ebx, r9d
and ebx, r11d
xor ebx, ebp
ror ebx, 7
lea r8d, [rbx + rsi]
mov ebx, dword [r14 + 0x3c]
xor r12d, r8d
lea esi, [rbx + rax + 0x63e81440]
mov eax, ecx
and eax, r11d
xor eax, edx
ror edx, 0xb
xor eax, r8d
and eax, edi
xor eax, r12d
ror eax, 7
lea ebx, [rax + rsi]
mov esi, dword [r14 + 0x1c]
mov eax, edi
and eax, r8d
xor r13d, eax
xor r13d, ebx
lea ebp, [rsi + rdx + 0x55ca396a]
mov edx, r11d
and edx, edi
xor edx, ecx
ror ecx, 0xb
xor edx, ebx
and edx, r10d
xor edx, r13d
ror edx, 7
lea esi, [rdx + rbp]
mov ebp, dword [r14 + 0xc]
mov edx, r10d
and edx, ebx
lea r12d, [rbp + rcx + 0x2aab10b6]
mov ecx, edi
and ecx, r10d
xor eax, edx
xor ecx, r11d
xor eax, esi
ror r11d, 0xb
xor ecx, esi
and ecx, r9d
xor ecx, eax
mov eax, r9d
ror ecx, 7
and eax, esi
lea ebp, [rcx + r12]
mov ecx, dword [r14 + 4]
xor edx, eax
xor edx, ebp
lea r12d, [rcx + r11 - 0x4b33a3cc]
mov ecx, r10d
and ecx, r9d
xor ecx, edi
ror edi, 0xb
xor ecx, ebp
and ecx, r8d
xor ecx, edx
mov edx, dword [r14]
ror ecx, 7
lea r11d, [rcx + r12]
mov r12d, r8d
and r12d, ebp
lea edi, [rdx + rdi + 0x1141e8ce]
mov edx, r9d
xor eax, r12d
and edx, r8d
xor eax, r11d
xor edx, r10d
ror r10d, 0xb
xor edx, r11d
and edx, ebx
xor edx, eax
mov eax, dword [r14 + 0x48]
ror edx, 7
lea ecx, [rdx + rdi]
mov edi, ebx
and edi, r11d
lea r10d, [rax + r10 - 0x5eab7951]
mov eax, r8d
and eax, ebx
xor eax, r9d
xor eax, ecx
xor r12d, edi
ror r9d, 0xb
xor r12d, ecx
and eax, esi
xor eax, r12d
ror eax, 7
lea edx, [rax + r10]
mov eax, dword [r14 + 0x6c]
mov r10d, esi
and r10d, ecx
xor edi, r10d
xor edi, edx
lea r12d, [rax + r9 + 0x7c72e993]
mov r9d, ebx
and r9d, esi
xor r9d, r8d
ror r8d, 0xb
xor r9d, edx
and r9d, ebp
xor r9d, edi
mov edi, ebp
ror r9d, 7
and edi, edx
lea eax, [r9 + r12]
mov r9d, dword [r14 + 0x34]
xor r10d, edi
xor r10d, eax
lea r12d, [r9 + r8 - 0x4c11ebef]
mov r9d, esi
and r9d, ebp
xor r9d, ebx
ror ebx, 0xb
xor r9d, eax
and r9d, r11d
xor r9d, r10d
mov r10d, dword [r14 + 0x18]
ror r9d, 7
lea r8d, [r9 + r12]
mov r12d, r11d
and r12d, eax
lea ebx, [r10 + rbx + 0x636fbc2a]
mov r10d, ebp
and r10d, r11d
xor r10d, esi
xor r10d, r8d
and r10d, ecx
xor edi, r12d
ror esi, 0xb
xor edi, r8d
xor r10d, edi
mov edi, ecx
ror r10d, 7
and edi, r8d
lea r9d, [r10 + rbx]
mov ebx, dword [r14 + 0x54]
xor r12d, edi
xor r12d, r9d
lea esi, [rbx + rsi + 0x2ba9c55d]
mov ebx, r11d
and ebx, ecx
xor ebx, ebp
ror ebp, 0xb
xor ebx, r9d
and ebx, edx
xor ebx, r12d
ror ebx, 7
lea r10d, [rbx + rsi]
mov ebx, dword [r14 + 0x28]
mov esi, edx
and esi, r9d
xor edi, esi
xor edi, r10d
lea r12d, [rbx + rbp + 0x741831f6]
mov ebp, ecx
and ebp, edx
xor ebp, r11d
ror r11d, 0xb
xor ebp, r10d
and ebp, eax
xor ebp, edi
mov edi, eax
ror ebp, 7
and edi, r10d
lea ebx, [rbp + r12]
mov ebp, dword [r14 + 0x5c]
xor esi, edi
xor esi, ebx
lea r12d, [rbp + r11 - 0x31a3c1ea]
mov ebp, edx
and ebp, eax
xor ebp, ecx
xor ebp, ebx
and ebp, r8d
xor ebp, esi
ror ecx, 0xb
mov esi, r8d
ror ebp, 7
and esi, ebx
lea r11d, [rbp + r12]
mov ebp, dword [r14 + 0x2c]
xor edi, esi
xor edi, r11d
lea r12d, [rbp + rcx - 0x64786ce2]
mov ebp, eax
and ebp, r8d
xor ebp, edx
ror edx, 0xb
xor ebp, r11d
and ebp, r9d
xor ebp, edi
mov edi, r9d
ror ebp, 7
and edi, r11d
lea ecx, [rbp + r12]
mov ebp, dword [r14 + 0x14]
xor esi, edi
xor esi, ecx
lea ebp, [rbp + rdx - 0x502945cd]
mov edx, r8d
and edx, r9d
xor edx, eax
ror eax, 0xb
xor edx, ecx
and edx, r10d
xor edx, esi
mov esi, dword [r14 + 8]
ror edx, 7
add ebp, edx
mov edx, dword [r14 + 0x80]
lea r12d, [rdx + rsi + 0x6c24cf5c]
mov edx, r10d
add eax, r12d
mov r12d, r9d
and edx, ecx
and r12d, r10d
xor edx, edi
xor r12d, r8d
xor edx, ebp
xor r12d, ebp
and r12d, ebx
xor r12d, edx
add ebx, dword [r14 + 0x90]
add ebp, dword [r14 + 0x84]
ror r12d, 7
add ecx, dword [r14 + 0x88]
add eax, r12d
add r11d, dword [r14 + 0x8c]
mov dword [r14 + 0x80], eax
add r10d, dword [r14 + 0x94]
mov dword [r14 + 0x90], ebx
xor ebx, ebx
add r9d, dword [r14 + 0x98]
mov dword [r14 + 0x84], ebp
add r8d, dword [r14 + 0x9c]
mov dword [r14 + 0x88], ecx
mov dword [r14 + 0x8c], r11d
mov dword [r14 + 0x94], r10d
mov dword [r14 + 0x98], r9d
mov dword [r14 + 0x9c], r8d
add qword [r14 + 0xa8], r15
cmp qword [rsp + 0x90], 0
je 0x490e48
mov r15d, pe_nt_image_headers64
mov ecx, ebx
sub r15d, ebx
add rcx, r14
cmp r15, qword [rsp + 0x90]
jbe 0x48f800
mov r15d, dword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov r8, r15
call sub.msvcrt.dll_memcpy
add ebx, dword [rsp + 0x90]
add qword [rsp + 0x88], r15
sub qword [rsp + 0x90], r15
cmp ebx, 0x80
jne 0x490ddb
jmp 0x48f820
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret