Function at 0x100028514
Capabilities:
Compress data via winapi

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x188
mov rax, qword [0x1000882d8]
xor edi, edi
mov r12, rcx
lea rcx, [0x1000019d8]
mov qword [r11 - 0xd8], rdi
mov qword [r11 - 0xd0], rdi
mov qword [r11 - 0xc8], rdi
mov dword [rsp + 0x108], edi
mov qword [r11 - 0x110], rax
mov qword [r11 - 0x138], rax
mov rax, qword [0x100088378]
mov qword [r11 - 0x118], rcx
mov qword [r11 - 0x140], rcx
lea rcx, [0x10000bea0]
mov qword [r11 - 0xb8], rdi
mov qword [r11 - 0xe0], rax
mov qword [r11 - 0xe8], rcx
mov dword [rsp + 0xc0], edi
mov dword [rsp + 0x98], edi
mov dword [rsp + 0x118], edi
mov qword [r11 - 0xa8], rdi
mov byte [rsp + 0x128], dil
mov rbx, r9
mov qword [r11 - 0x100], rdi
mov qword [r11 - 0xf8], rdi
mov qword [r11 - 0x128], rdi
mov qword [r11 - 0x120], rdi
mov qword [r11 - 0x88], rdi
mov qword [r11 - 0x80], rdi
mov qword [r11 - 0x78], rdi
mov dword [r11 - 0x70], edi
mov qword [r11 - 0x98], rcx
mov qword [r11 - 0x90], rax
mov qword [r11 - 0x68], rdi
mov dword [r11 - 0x60], edi
mov qword [r11 - 0x58], rdi
mov byte [r11 - 0x50], dil
cmp qword [r12 + 0x68], rdi
jne 0x100028b97
cmp byte [r12 + 0x50], dil
je 0x100028b97
lea rcx, [r11 - 0x140]
call fcn.10001671c
cmp al, dil
je 0x100028b97
mov eax, dword [r12 + 0x18]
mov r8, qword [r12 + 0x10]
lea esi, [rdi + 1]
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0xe0]
mov r9, rdi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], eax
call fcn.10002d324
cmp al, dil
je 0x100028b97
cmp rbx, rdi
je 0x100028685
mov qword [rbx], rdi
mov cl, byte [r12 + 0x53]
mov ebx, dword [r12 + 0x18]
mov r15d, esi
shl r15d, cl
mov rcx, qword [r12 + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov r13d, eax
imul r13d, ebx
mov ebx, r13d
mov dword [rsp + 0x30], r13d
imul ebx, r15d
mov ecx, ebx
call fcn.100018e68
mov ecx, ebx
mov rbp, rax
mov qword [rsp + 0x40], rax
call fcn.100018e68
mov rbx, rax
mov qword [rsp + 0x48], rax
cmp rbp, rdi
je 0x100028b8a
cmp rax, rdi
je 0x100028b82
cmp qword [r12 + 0x68], rdi
je 0x1000286fc
mov eax, dword [r12 + 0x58]
mov ecx, 0xfffffff8
add eax, 7
and rax, rcx
jmp 0x10002871f
mov rcx, qword [r12 + 0x10]
mov rbx, qword [r12 + 0x70]
movsxd rbp, dword [r12 + 0x18]
mov rax, qword [rcx]
mov rbx, qword [rbx + 0x28]
call qword [rax + 0x10]
cdqe
imul rax, rbp
imul rax, rbx
mov ecx, r13d
cqo
mov r13, rdi
idiv rcx
mov rdx, rax
mov qword [rsp + 0x78], rax
cmp rax, rdi
mov qword [rsp + 0x70], r13
je 0x100028b4f
mov cl, dil
mov ebx, edi
mov r14d, edi
mov dword [rsp + 0x38], ecx
mov ecx, r15d
mov dword [rsp + 0x50], edi
cmp rdx, rcx
mov dword [rsp + 0x60], ebx
cmovb r15d, edx
mov dword [rsp + 0x34], r15d
cmp r15d, edi
jbe 0x1000288e4
mov ecx, ebx
mov edx, r14d
add rdx, rcx
mov rcx, qword [r12 + 0x70]
add rdx, r13
cmp rcx, rdi
je 0x10002896f
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x68]
call fcn.10002dab0
cmp al, dil
je 0x10002896f
mov rbp, qword [rsp + 0x68]
cmp rbp, 0xffffffffffffffff
jne 0x1000287b5
add ebx, dword [rsp + 0x58]
mov dword [rsp + 0x60], ebx
jmp 0x1000288ce
mov rbx, qword [rsp + 0x58]
lea eax, [rbx + r14]
cmp eax, r15d
jbe 0x1000287c9
mov ebx, r15d
sub ebx, r14d
lea rcx, [rsp + 0xb0]
call fcn.10001671c
cmp al, dil
je 0x100028a51
mov eax, dword [r12 + 0x18]
mov r8, qword [r12 + 0x10]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x130]
mov r9, rbp
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call fcn.10002d324
cmp al, dil
je 0x100028a51
lea rcx, [rsp + 0x130]
call fcn.100049eb8
cmp al, dil
jne 0x10002889d
cmp ebx, edi
jbe 0x100028894
movsxd rax, dword [rsp + 0x118]
mov r14, qword [rsp + 0x1e0]
mov r15d, ebx
mov r12, rax
mov r13, rax
imul r12, rbp
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x110], rbp
mov qword [rsp + 0x100], r12
call fcn.100049eb8
cmp al, dil
jne 0x100028872
mov rdx, rbp
mov rcx, r14
call fcn.100023c54
add r12, r13
add rbp, rsi
sub r15, rsi
jne 0x100028845
mov r13, qword [rsp + 0x70]
mov r12, qword [rsp + 0x1d0]
mov r14d, dword [rsp + 0x50]
mov r15d, dword [rsp + 0x34]
mov cl, sil
mov dword [rsp + 0x38], ecx
jmp 0x1000288c2
mov ecx, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x140]
mov eax, r14d
mov r8d, ebx
imul eax, ecx
imul r8d, ecx
mov ecx, eax
add rcx, qword [rsp + 0x40]
call sub.ntdll.dll_memcpy
add r14d, ebx
mov ebx, dword [rsp + 0x60]
mov dword [rsp + 0x50], r14d
lea eax, [rbx + r14]
cmp eax, r15d
jb 0x10002876c
mov ebx, dword [rsp + 0x38]
cmp bl, dil
jne 0x10002895d
movsxd rcx, dword [rsp + 0x30]
mov rbx, rcx
imul rbx, r13
cmp rbx, qword [r12 + 0x60]
jae 0x100028afb
cmp r14d, edi
je 0x100028afb
cmp r14d, r15d
je 0x100028afb
mov r9, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov r8d, ecx
imul r14d, ecx
imul r8d, r15d
lea rax, [rsp + 0xd8]
mov ecx, 2
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ntdll.dll_RtlDecompressBuffer]
cmp eax, 0xc0000002
je 0x100028af7
cmp eax, 0xc00000bb
je 0x100028af7
cmp eax, edi
jge 0x100028af7
mov ebx, edi
mov byte [r12 + 0x79], sil
xor edx, edx
mov dword [rsp + 0x38], ebx
jmp 0x100028acb
lea eax, [rbx + r14]
mov ebx, dword [rsp + 0x38]
movzx ebx, bl
cmp eax, r15d
cmovb ebx, esi
jmp 0x1000288df
mov r12, qword [rsp + 0x68]
cmp r12, 0xffffffffffffffff
jne 0x10002899b
add ebx, esi
mov dword [rsp + 0x38], ebx
jmp 0x100028ac1
mov rbp, qword [rsp + 0x80]
mov r14d, r15d
lea rax, [r14 + r13]
cmp rbp, rax
jge 0x100028b2c
mov r15, qword [rsp + 0x58]
lea rax, [r15 + rbp]
cmp rax, r13
jg 0x1000289cc
add ebx, esi
mov dword [rsp + 0x38], ebx
jmp 0x100028abc
mov edx, ebx
mov rbx, qword [rsp + 0x1d0]
xor r8d, r8d
mov rcx, qword [rbx + 0x70]
call fcn.10002d8fc
cmp rbp, r13
jge 0x100028a0c
mov rcx, qword [rbx + 0x70]
mov r9, r13
mov r8, r12
sub r9, rbp
mov rdx, rbp
call fcn.10002d860
cmp al, dil
je 0x100028a51
mov rbx, r12
sub rbx, rbp
add rbx, r13
jmp 0x100028a0f
mov rbx, r12
lea rax, [r14 + r13]
lea rcx, [r15 + rbp]
cmp rcx, rax
jle 0x100028a65
mov ecx, dword [rsp + 0x34]
sub r14, rbp
sub r15, rcx
lea rdx, [rcx + r13]
mov rcx, qword [rsp + 0x1d0]
mov rcx, qword [rcx + 0x70]
add r14, r12
sub r15, r13
add r14, r13
lea r9, [rbp + r15]
mov r8, r14
call fcn.10002d860
cmp al, dil
jne 0x100028a69
mov rcx, qword [rsp + 0x40]
call fcn.100018fa4
mov rcx, qword [rsp + 0x48]
jmp 0x100028b92
lea r14, [r15 + r12]
cmp rbx, r14
jge 0x100028ab8
mov r13, qword [rsp + 0x1d8]
mov rcx, qword [rsp + 0x1e0]
mov r8, rsi
mov rdx, rbx
call fcn.100024228
cmp al, dil
jne 0x100028aab
cmp rbx, rdi
jl 0x100028aab
lea rax, [rbx + 1]
cmp rax, qword [r13 + 0x10]
jg 0x100028aab
lea rcx, [r13 + 0x30]
mov r8d, esi
mov edx, ebx
call fcn.100042bf8
add rbx, rsi
cmp rbx, r14
jl 0x100028a76
mov r13, qword [rsp + 0x70]
mov ebx, dword [rsp + 0x38]
mov r15d, dword [rsp + 0x34]
mov r12, qword [rsp + 0x1d0]
mov edx, ebx
mov rcx, qword [r12 + 0x70]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call fcn.10002da50
cmp al, dil
jne 0x100028985
jmp 0x100028b34
mov ecx, dword [rsp + 0x30]
mov r8, qword [rsp + 0x1e8]
cmp r8, rdi
je 0x100028b34
mov rax, qword [r12 + 0x58]
cmp rbx, rax
jge 0x100028b34
imul ecx, r15d
lea rdx, [rcx + rbx]
cmp rdx, rax
jle 0x100028b27
sub rax, rbx
add qword [r8], rax
jmp 0x100028b34
add qword [r8], rcx
jmp 0x100028b34
mov r12, qword [rsp + 0x1d0]
mov rdx, qword [rsp + 0x78]
mov eax, r15d
sub rdx, rax
add r13, rax
mov qword [rsp + 0x78], rdx
cmp rdx, rdi
jmp 0x100028735
mov rcx, qword [rsp + 0x40]
call fcn.100018fa4
mov rcx, qword [rsp + 0x48]
call fcn.100018fa4
lea rcx, [rsp + 0x88]
call fcn.1000166d4
lea rcx, [rsp + 0xb0]
call fcn.1000166d4
mov al, sil
jmp 0x100028bb3
mov rcx, rbp
call fcn.100018fa4
cmp rbx, rdi
je 0x100028b97
mov rcx, rbx
call fcn.100018fa4
lea rcx, [rsp + 0x88]
call fcn.1000166d4
lea rcx, [rsp + 0xb0]
call fcn.1000166d4
xor al, al
add rsp, 0x188
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret