Function at 0x14000b1b0
Capabilities:
Compress data via winapi

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, rdx
mov rdi, rcx
xor esi, esi
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], rsi
lea rdx, [rbp - 0x38]
mov rcx, rax
call fcn.14000afb0
mov rbx, qword [rbp - 0x38]
test al, al
je 0x14000b63a
mov r12, qword [rbp - 0x30]
mov rax, r12
sub rax, rbx
cmp rax, 0x100
jb 0x14000b63a
cmp byte [rbx], 0x4d
jne 0x14000b5c9
cmp byte [rbx + 1], 0x41
jne 0x14000b5c9
cmp byte [rbx + 2], 0x4d
jne 0x14000b5c9
mov edi, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
mov eax, dword [rdi + rax]
cmp dword [0x14004e9e4], eax
jle 0x14000b29a
lea rcx, [0x14004e9e4]
call fcn.140033f70
cmp dword [0x14004e9e4], 0xffffffff
jne 0x14000b29a
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlGetCompressionWorkSpaceSize
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14004e9d0], rax
lea rcx, [0x14004e9e4]
call fcn.140033f04
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov eax, dword [rdi + rdx]
cmp dword [0x14004e9e0], eax
jle 0x14000b2f6
lea rcx, [0x14004e9e0]
call fcn.140033f70
cmp dword [0x14004e9e0], 0xffffffff
jne 0x14000b2f6
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlDecompressBufferEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14004e9c0], rax
lea rcx, [0x14004e9e0]
call fcn.140033f04
mov r13d, dword [rbx]
mov edi, dword [rbx + 4]
mov dword [rbp + 0x58], edi
mov eax, r13d
and eax, 0xffffff
cmp eax, 0x4d414d
je 0x14000b369
test rbx, rbx
je 0x14000b347
mov rdx, qword [rbp - 0x28]
sub rdx, rbx
cmp rdx, 0x1000
mov rax, rbx
jb 0x14000b33f
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b4b4
mov rcx, rbx
call fcn.140033ec0
mov rdi, qword [rbp + 0x40]
mov rax, rdi
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rdx, [rbx + 8]
cmp rbx, rdx
je 0x14000b387
sub r12, rdx
mov r8, r12
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
add r12, rbx
mov qword [rbp - 0x30], r12
cmp r13d, 0x10000000
jae 0x14000b30e
shr r13d, 0x18
and r13d, 0xf
mov rax, qword [0x14004e9d0]
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0x50]
movzx ecx, r13w
call rax
test eax, eax
jne 0x14000b30e
mov r14, rdi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rsi
mov r15, rsi
test edi, edi
je 0x14000b42a
cmp rdi, 0x1000
jb 0x14000b3fd
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x14000b67a
call fcn.140033fe8
test rax, rax
je 0x14000b468
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000b408
mov rcx, r14
call fcn.140033fe8
mov rdi, rax
mov qword [rbp - 0x20], rdi
lea rsi, [rdi + r14]
mov qword [rbp - 0x10], rsi
mov r8, r14
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov qword [rbp - 0x18], rsi
mov r15, rsi
jmp 0x14000b42e
mov rdi, qword [rbp - 0x20]
mov ecx, dword [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
jne 0x14000b4bb
test rdi, rdi
je 0x14000b47b
sub rsi, rdi
mov rax, rdi
cmp rsi, 0x1000
jb 0x14000b46f
add rsi, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b46f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rsi
mov rcx, rdi
call fcn.140033ec0
nop
test rbx, rbx
je 0x14000b347
mov rdx, qword [rbp - 0x28]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000b33f
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b33f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rax, qword [0x14004e9c0]
sub r12, rbx
mov qword [rsp + 0x30], r14
lea rcx, [rbp - 0x3c]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rbx
mov r8d, dword [rbp + 0x58]
mov rdx, rdi
movzx ecx, r13w
call rax
mov rcx, r14
test eax, eax
je 0x14000b573
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
test rdi, rdi
je 0x14000b533
sub r15, rdi
mov rax, rdi
cmp r15, 0x1000
jb 0x14000b527
add r15, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b5bb
mov rdx, r15
mov rcx, rdi
call fcn.140033ec0
nop
test rbx, rbx
je 0x14000b347
mov rdx, qword [rbp - 0x28]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000b33f
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b33f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, [rbp - 0x20]
mov rdi, qword [rbp + 0x40]
mov rcx, rdi
call fcn.14000d4e0
nop
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x14000b5f5
mov rdx, qword [rbp - 0x10]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b5c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b5c2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140033ec0
jmp 0x14000b5f5
cmp byte [rbx + 4], 0x53
jne 0x14000b5f1
cmp byte [rbx + 5], 0x43
jne 0x14000b5f1
cmp byte [rbx + 6], 0x43
jne 0x14000b5f1
cmp byte [rbx + 7], 0x41
jne 0x14000b5f1
lea rdx, [rbp - 0x38]
mov rcx, rdi
call fcn.14000d4e0
mov rbx, qword [rbp - 0x38]
mov rdi, qword [rbp + 0x40]
test rbx, rbx
je 0x14000b34b
mov rdx, qword [rbp - 0x28]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000b62d
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b62d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140033ec0
jmp 0x14000b34b
test rbx, rbx
je 0x14000b347
mov rdx, qword [rbp - 0x28]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000b33f
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b33f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400021f0
int3