Function at 0x140027b70
Capabilities:
Access peb ldr_data
Check mutex on windows
Encode data using xor
Hash data using fnv
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x520
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov dword [rbp + 0x180], 0x348
xor r12d, r12d
mov ebx, r12d
xor r9d, r9d
lea r8, [rbp + 0x180]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplayDevicesW]
test eax, eax
je 0x140027ca0
nop dword [rax]
nop dword [rax + rax]
test byte [rbp + 0x2c4], 1
je 0x140027c82
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], r12
lea rax, [rbp + 0x1c4]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], r12w
jne 0x140027c00
lea rdx, [rbp + 0x1c4]
lea rcx, [rbp + 0x40]
call fcn.14002c700
cmp qword [rbp + 0x50], r12
je 0x140027c31
lea rcx, [rbp + 0x40]
call fcn.140027010
test al, al
jne 0x140027dbd
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x140027c71
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027c6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002925f
call fcn.140042ba8
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r12w
inc ebx
xor r9d, r9d
lea r8, [rbp + 0x180]
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplayDevicesW]
test eax, eax
jne 0x140027bd0
movabs rax, 0xa6cab5d65a5aa693
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0xd598d7605aa39a6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
movabs r15, 0x8ef095bb2c7ac9fd
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs r14, 0xd598d7605aa3986
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0xa0]
movdqa xmmword [rbp + 0x10], xmm0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140027db8
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140027db8
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0xeb26051b
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x140027db3
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140027d90
cmp edx, 0xf3967aff
je 0x1400290bd
test r9d, r9d
jne 0x140027d70
mov rax, qword [rax]
jmp 0x140027d40
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x140027dfd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027df8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002925f
call fcn.140042ba8
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r12w
movups xmm0, xmmword [0x1400fd0a0]
movups xmmword [rbp + 0x10], xmm0
lea rcx, [rbp + 0x10]
call fcn.140022a40
nop
mov rcx, qword [rbp + 0x18]
movabs rdx, 0x20000000000000
and rcx, rdx
mov ecx, 0x12c
jne 0x140027e40
mov ecx, 0x96
cmp ax, cx
setae al
test al, al
je 0x14002802f
movabs rax, 0xa6cab5d65a5aa693
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0xd598d7605aa39a6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
movabs r15, 0x8ef095bb2c7ac9fd
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs r14, 0xd598d7605aa3986
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0xa0]
movdqa xmmword [rbp + 0x10], xmm0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140027f54
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140027f54
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0x4a5db71
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x140027f4f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140027f30
cmp edx, 0xf1404be
je 0x140027f59
test r9d, r9d
jne 0x140027f10
mov rax, qword [rax]
jmp 0x140027ee0
mov eax, dword [r11 + 0x24]
add rax, r10
movzx edx, word [rax + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov ecx, 1
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140028004
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140028004
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0x15cc14db
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x140027fff
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140027fe0
cmp edx, 0x6ef8d9ab
je 0x140028009
test r9d, r9d
jne 0x140027fc0
mov rax, qword [rax]
jmp 0x140027f90
mov edx, dword [r11 + 0x24]
add rdx, r10
movzx r9d, word [rdx + r9*2]
mov r8d, dword [r11 + 0x1c]
add r8, r10
mov edx, dword [r8 + r9*4]
add rdx, r10
mov ecx, 1
call rdx
jmp 0x140029239
movabs r13, 0x8ea795e72c40c9be
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0xd368d1205c439ef
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x3eb67fe5d35abe68
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0x8d232c381bf15cf9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0xf687bffdc23f56dc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0x668762ae193361ae
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0xa8deb89946e971ea
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0xd15c196c126ededa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rsi, 0xaf04eb350975ba5
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rdi, 0xd228ca8e384744ce
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs r15, 0x8ef095bb2c7ac9fd
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs r14, 0xd598d7605aa3986
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x3ee57fb9d329be1f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x8d462c4c1b825c80
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
movabs rax, 0xf6dbbfcfc20c56b1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0x66ff62ca190061ca
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0xa8edb8ad46b671d3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0xd1301900120adef4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0xa0], ymm1
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0xc0], ymm1
vmovdqa xmm0, xmmword [rbp + 0xe0]
vxorps xmm0, xmm0, xmmword [rbp + 0x80]
vmovdqa xmmword [rbp + 0xe0], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x1400282c4
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x1400282c4
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0xe2091e75
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x1400282bf
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x1400282a0
cmp edx, 0x6cb5f7d5
je 0x1400282c9
test r9d, r9d
jne 0x140028280
mov rax, qword [rax]
jmp 0x140028250
mov edx, dword [r11 + 0x1c]
add rdx, r10
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
lea rcx, [rbp + 0xa0]
call rax
test eax, eax
je 0x140028dfd
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0xd368d1205c439ef
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x3eb67fe5d35abe68
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0x8d232c381bf15cf9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0xf687bffdc23f56dc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0x668762ae193361ae
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0xa8d9b8f2468771e2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0xd15c19641224dec7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rax, 0xaf04eb350975bc9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs r13, 0x3ee57fb9d329be1f
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x8d462c4c1b825c80
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
movabs rax, 0xf6dbbfcfc20c56b1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0x66ff62ca190061ca
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0xa8edb8ad46b671d3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0xd1301900120adef4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0xa0], ymm1
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0xc0], ymm1
vmovdqa xmm0, xmmword [rbp + 0xe0]
vxorps xmm0, xmm0, xmmword [rbp + 0x80]
vmovdqa xmmword [rbp + 0xe0], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140028564
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140028564
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0x7793906a
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14002855f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140028540
cmp edx, 0x68e35f18
je 0x140028569
test r9d, r9d
jne 0x140028520
mov rax, qword [rax]
jmp 0x1400284f0
mov edx, dword [r11 + 0x1c]
add rdx, r10
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
lea rcx, [rbp + 0xa0]
call rax
test eax, eax
je 0x140028b3f
call fcn.140025e50
movabs rax, 0x8e9c95d42c15c989
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0xd2a8d0605c339f2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x3e847fd5d34abe40
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0x8d742c7f1bf15cf3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rcx, 0xf6dbbfcfc20c56b1
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rdx, 0x66ff62ca190061ca
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x8d462c4c1b825c80
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0xa0], ymm1
vmovdqa xmm0, xmmword [rbp + 0xc0]
vxorps xmm0, xmm0, xmmword [rbp + 0x60]
vmovdqa xmmword [rbp + 0xc0], xmm0
lea r8, [rbp + 0xa0]
xor edx, edx
xor ecx, ecx
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140028837
mov byte [0x1400fd079], 1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140028764
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140028764
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0x367d2f4
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14002875f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140028740
cmp edx, 0x70ea6ec7
je 0x140028769
test r9d, r9d
jne 0x140028720
mov rax, qword [rax]
jmp 0x1400286f0
mov edx, dword [r11 + 0x1c]
add rdx, r10
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov edx, 0x7f00
xor ecx, ecx
call rax
mov rdi, rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov r11d, dword [rdx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140028814
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140028814
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0x31bc2639
movzx eax, byte [r8]
inc r8
test al, al
je 0x14002880f
nop
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [r8]
lea r8, [r8 + 1]
test al, al
jne 0x1400287f0
cmp edx, 0x832032ed
je 0x140028819
test r9d, r9d
jne 0x1400287d0
mov rcx, qword [rcx]
jmp 0x1400287a0
mov edx, dword [r11 + 0x1c]
add rdx, r10
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
mov rcx, rdi
call rax
mov ecx, 8
call fcn.140042c24
lea rcx, [0x140026740]
mov qword [rax], rcx
lea rcx, [rbp + 0x108]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x1400328a0]
xor edx, edx
xor ecx, ecx
call fcn.14004904c
mov qword [rbp + 0x100], rax
test rax, rax
je 0x14002927c
cmp dword [rbp + 0x108], 0
je 0x140029271
movaps xmm0, xmmword [rbp + 0x100]
movdqa xmmword [rbp + 0xa0], xmm0
lea rcx, [rbp + 0xa0]
call fcn.14003ebd8
test eax, eax
jne 0x140029271
xorps xmm0, xmm0
movaps xmmword [rbp + 0xa0], xmm0
movdqa xmmword [rbp + 0x100], xmm0
cmp byte [0x1400fd079], al
jne 0x140028a73
mov ecx, 0x7bc27
call fcn.140042c24
test rax, rax
je 0x140029265
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
lea rsi, [rdi + 0x7bc00]
mov qword [rbp + 0xb0], rsi
mov r8d, 0x7bc00
lea rdx, [0x14007ed10]
mov rcx, rdi
call fcn.14005ce70
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], rax
xorps xmm1, xmm1
movups xmmword [rbp + 0x110], xmm1
movups xmmword [rbp + 0x120], xmm1
movups xmmword [rbp + 0x130], xmm1
movups xmmword [rbp + 0x140], xmm1
movups xmmword [rbp + 0x150], xmm1
movups xmmword [rbp + 0x160], xmm1
mov qword [rbp + 0x170], rax
mov word [rbp + 0x20], r12w
mov r8d, 0x104
lea rdx, [rbp + 0x180]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
movabs rax, 0x8ef0958e1849fbcc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0xa0]
movdqa xmmword [rbp + 0x10], xmm0
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
xor r9d, r9d
xor edx, edx
mov rcx, 0xffffffffffffffff
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
lea rbx, [rbp + 0x180]
mov qword [rsp + 0x20], 0x104
xor r9d, r9d
xor r8d, r8d
mov edx, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
lea rcx, [rbp + 0x180]
sub rax, rcx
movzx ecx, byte [rbx]
mov byte [rax + rbx], cl
lea rbx, [rbx + 1]
test cl, cl
jne 0x140028a12
mov qword [rsp + 0x20], 2
lea r9, [rbp + 0x20]
mov r8, rdi
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x40]
call fcn.140023660
sub rsi, rdi
cmp rsi, 0x1000
jb 0x140028a68
add rsi, 0x27
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x140029265
mov rdi, rcx
mov rdx, rsi
mov rcx, rdi
call fcn.140042ba8
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140028b06
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140028b06
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov ecx, dword [rdx + rbx]
add rcx, r10
mov r8d, 0x9cf44caa
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140028b01
nop dword [rax]
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140028ae0
cmp r8d, 0xda0a23ed
je 0x140028b0b
test r9d, r9d
jne 0x140028ac0
mov rax, qword [rax]
jmp 0x140028a90
mov eax, dword [r11 + 0x24]
add rax, r10
movzx edx, word [rax + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov ecx, 0x4e20
call rax
cmp dword [rbp + 0x108], 0
jne 0x14002926b
xor eax, eax
jmp 0x14002923e
movabs rax, 0xe7d0f0c84d1fa5ad
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x4979e11a64de4ae8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x5ac527cdb04ccc76
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x8d685f3e7ef435f2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0x8d462c4c1b825c80
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x40], ymm1
mov r9d, 0x10
xor r8d, r8d
lea rdx, [rbp + 0x40]
xor ecx, ecx
vzeroupper
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140028c94
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140028c94
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + rbx]
add r8, r10
mov edx, 0x262de45f
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x140028c8f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140028c70
cmp edx, 0x12a48983
je 0x140028c99
test r9d, r9d
jne 0x140028c50
mov rax, qword [rax]
jmp 0x140028c20
mov eax, dword [r11 + 0x24]
add rax, r10
movzx edx, word [rax + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
xor ecx, ecx
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140028d44
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140028d44
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + rbx]
add r8, r10
mov edx, 0x232908fd
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x140028d3f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140028d20
cmp edx, 0xae59b61d
je 0x140028d49
test r9d, r9d
jne 0x140028d00
mov rax, qword [rax]
jmp 0x140028cd0
mov eax, dword [r11 + 0x24]
add rax, r10
movzx edx, word [rax + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov ecx, 1
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140028df8
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140028df8
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + rbx]
add r8, r10
mov edx, 0xbdd4b01a
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x140028df3
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140028dd0
cmp edx, 0x5dce557f
je 0x140029219
test r9d, r9d
jne 0x140028db0
mov rax, qword [rax]
jmp 0x140028d80
movabs rax, 0xe7d0f0c84d1fa5ad
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x4979e11a64de4ae8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x5ac527cdb04ccc76
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x8d685f3e7ef435f2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs r13, 0x3ee57fb9d329be1f
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0x8d462c4c1b825c80
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x40], ymm1
mov r9d, 0x10
xor r8d, r8d
lea rdx, [rbp + 0x40]
xor ecx, ecx
vzeroupper
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140028f54
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140028f54
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0x276eb79c
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x140028f4f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140028f30
cmp edx, 0x845a3d3c
je 0x140028f59
test r9d, r9d
jne 0x140028f10
mov rax, qword [rax]
jmp 0x140028ee0
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx r8d, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + r8*4]
add rax, r10
xor ecx, ecx
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140029004
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140029004
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0x4479e06a
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x140028fff
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140028fe0
cmp edx, 0xaae1be2
je 0x140029009
test r9d, r9d
jne 0x140028fc0
mov rax, qword [rax]
jmp 0x140028f90
mov eax, dword [r11 + 0x24]
add rax, r10
movzx edx, word [rax + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov ecx, 1
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x1400290b8
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x1400290b8
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0x2e166c34
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x1400290b3
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140029090
cmp edx, 0xa6926899
je 0x140029219
test r9d, r9d
jne 0x140029070
mov rax, qword [rax]
jmp 0x140029040
mov eax, dword [r11 + 0x24]
add rax, r10
movzx edx, word [rax + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
xor ecx, ecx
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140029164
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140029164
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0x447cdef
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14002915f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x140029140
cmp edx, 0x69acbe6f
je 0x140029169
test r9d, r9d
jne 0x140029120
mov rax, qword [rax]
jmp 0x1400290f0
mov eax, dword [r11 + 0x24]
add rax, r10
movzx edx, word [rax + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov ecx, 1
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140029214
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140029214
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
add r8, r10
mov edx, 0xf1e40a98
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14002920f
nop
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
jne 0x1400291f0
cmp edx, 0xb5a69045
je 0x140029219
test r9d, r9d
jne 0x1400291d0
mov rax, qword [rax]
jmp 0x1400291a0
mov eax, dword [r11 + 0x24]
add rax, r10
mov ecx, dword [r11 + 0x1c]
movzx edx, word [rax + r9*2]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, 1
add rax, r10
call rax
mov eax, 0xffffffff
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14004a14c
int3
call fcn.14004a14c
int3
call fcn.1400494a8
int3
mov ecx, 1
call fcn.14003f2bc
int3
mov dword [rbp + 0x108], r12d
mov ecx, 6
call fcn.14003f2bc
int3