Function at 0x14004ce40
Capabilities:
Encode data using xor
Get disk size
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x88
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov r15, rdx
mov r14, rcx
xor ebx, ebx
mov dword [rbp - 0x29], ebx
mov rcx, qword [rdx]
or rdi, 0xffffffffffffffff
cmp dword [rcx - 0x10], ebx
jl 0x14004d30e
lea rdx, str.chrome
call fcn.1400cefc8
test rax, rax
je 0x14004d30e
mov rcx, qword [r15]
sub rax, rcx
sar rax, 1
test eax, eax
jle 0x14004d30e
lea edx, [rbx + 0x5c]
call fcn.1400d0bb8
mov rdx, rax
test rax, rax
je 0x14004d2c7
sub rdx, qword [r15]
sar rdx, 1
test edx, edx
jle 0x14004d2c7
mov r8d, dword [0x1401c4d60]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
and ecx, 0x8000000f
jge 0x14004cef2
dec ecx
or ecx, 0xfffffff0
inc ecx
cmp ecx, 1
jne 0x14004cf9e
mov r9d, ebx
nop
mov ecx, r9d
and ecx, 1
dec ecx
not ecx
and ecx, r8d
mov eax, r9d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r8d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r8d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r8d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
add r8d, eax
inc r9d
cmp r9d, 0x100
jl 0x14004cf00
mov dword [0x1401c4d60], r8d
lea r8d, [rdx + 1]
lea rdx, [rbp - 0x21]
mov rcx, r15
call fcn.14001a680
nop
lea r8, str.VisualElementsManifest.xml
lea rdx, [rbp - 0x21]
lea rcx, [rbp + 0x7f]
call fcn.14001a720
nop
mov rcx, qword [rbp + 0x7f]
mov edx, 1
sub edx, dword [rcx - 8]
mov eax, dword [rcx - 0xc]
or eax, edx
jge 0x14004cfe6
xor edx, edx
lea rcx, [rbp + 0x7f]
call fcn.1400023a0
mov rcx, qword [rbp + 0x7f]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
mov r9d, dword [0x1401c4d60]
lea r8d, [r9 + 1]
imul r8d, r9d
mov eax, 0x38e38e39
imul r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
cmp r8d, 0xe
jne 0x14004d07c
mov eax, 0x51eb851f
imul r9d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r9d, edx
add r9d, 0x2f4
movsxd rcx, r9d
mov eax, 4
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.1400cd918
mov rcx, rax
call fcn.1400cf37c
test rsi, rsi
je 0x14004d295
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r13d, eax
lea ecx, [rax + 0xa]
call fcn.1400ced40
mov r12, rax
call fcn.14004b3d0
test al, al
jne 0x14004d0e9
mov r8d, dword [0x1401c4d60]
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x7b
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.1400cd918
mov rcx, rax
call fcn.1400cf37c
mov r9d, dword [0x1401c4d60]
mov r8d, r9d
imul r8d, r9d
imul r8d, r9d
mov eax, 0x38e38e39
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*8]
sub r8d, ecx
cmp r8d, 3
jne 0x14004d156
mov eax, 0x51eb851f
imul r9d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x64
sub r9d, edx
add r9d, 0x2f4
movsxd rcx, r9d
mov eax, 4
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.1400cd918
mov rcx, rax
call fcn.1400cf37c
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x77]
mov r8d, r13d
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x77]
mov byte [rax + r12], 0
mov r8d, dword [0x1401c4d60]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0x10
jne 0x14004d1d5
mov ecx, 1
cmp r8d, ecx
jle 0x14004d1cf
nop dword [rax]
mov eax, r8d
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, r8d
jl 0x14004d1c0
mov dword [0x1401c4d60], ecx
lea rdx, str.SplashScreen_Image
mov rcx, r12
call fcn.1400d1d50
mov rsi, rax
test rax, rax
je 0x14004d295
mov edx, 0x5c
lea rcx, [rax + 0x14]
call fcn.1400d19d4
test rax, rax
je 0x14004d295
mov byte [rax], 0
lea rax, [rbp - 9]
mov qword [rbp - 0x11], rax
mov qword [rbp + 0xf], 0xf
mov qword [rbp + 7], rbx
mov byte [rbp - 9], 0
cmp byte [rsi + 0x14], 0
je 0x14004d23a
mov rbx, rdi
nop dword [rax + rax]
inc rbx
cmp byte [rsi + rbx + 0x14], 0
jne 0x14004d230
mov r8, rbx
lea rdx, [rsi + 0x14]
lea rcx, [rbp - 9]
call fcn.1400013f0
nop
lea rdx, [rbp - 9]
mov rcx, r14
call fcn.1400204f0
mov dword [rbp - 0x29], 1
mov rdx, qword [rbp + 0x7f]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004d277
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004d290
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x14004d36b
mov rdx, qword [rbp + 0x7f]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004d2ae
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004d2c7
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov ecx, dword [0x1401c4d60]
mov r8d, ecx
imul r8d, ecx
imul r8d, ecx
mov eax, 0x2aaaaaab
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
cmp r8d, 0x16
jne 0x14004d30e
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [r14], rax
lea rdx, [0x140152530]
test rdx, 0xffffffffffff0000
jne 0x14004d355
movzx ebx, dx
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x14004d364
mov r8d, ebx
mov rdx, rax
mov rcx, r14
call fcn.1400025a0
jmp 0x14004d364
mov r8d, 3
mov rcx, r14
call fcn.1400022b0
nop
mov dword [rbp - 0x29], 1
mov rdx, qword [r15]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004d382
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, r14
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret