Function at 0x1400cdbd0
Capabilities:
Compress data via zlib inflate or deflate
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov r14d, edx
mov r12, rcx
test rcx, rcx
je case.0x1400cdccb.16211
cmp qword [rcx + 0x30], 0
je case.0x1400cdccb.16211
cmp qword [rcx + 0x38], 0
je case.0x1400cdccb.16211
mov r13, qword [rcx + 0x28]
test r13, r13
je case.0x1400cdccb.16211
cmp qword [r13], rcx
jne case.0x1400cdccb.16211
mov edx, dword [r13 + 8]
lea eax, [rdx - 0x3f34]
cmp eax, 0x1f
ja case.0x1400cdccb.16211
mov r9, qword [rcx + 0x10]
mov qword [rsp + 0x40], r9
test r9, r9
je case.0x1400cdccb.16211
mov rsi, qword [rcx]
test rsi, rsi
jne 0x1400cdc56
cmp dword [rcx + 8], esi
jne case.0x1400cdccb.16211
cmp edx, 0x3f3f
jne 0x1400cdc77
mov dword [r13 + 8], 0x3f40
mov edx, 0x3f40
mov r9, qword [rcx + 0x10]
mov rsi, qword [rcx]
mov qword [rsp + 0x40], r9
mov r10d, dword [rcx + 0x18]
lea eax, [rdx - 0x3f34]
mov edi, dword [rcx + 8]
xor r15d, r15d
mov ebp, dword [r13 + 0x48]
mov r8d, r10d
mov ebx, dword [r13 + 0x4c]
mov dword [rsp + 0xb8], r10d
mov dword [rsp + 0x38], edi
mov dword [rsp + 0xa0], r10d
mov dword [rsp + 0xb0], r15d
cmp eax, 0x1f
ja case.0x1400cdccb.16211
lea r11, [0x140000000]
cdqe
mov ecx, dword [r11 + rax*4 + 0xcf398]
add rcx, r11
jmp rcx
mov edx, dword [r13 + 0x10]
test edx, edx
jne 0x1400cdce2
mov dword [r13 + 8], 0x3f40
jmp 0x1400ce371
cmp ebx, 0x10
jae 0x1400cdd05
test edi, edi
je 0x1400ce50f
movzx eax, byte [rsi]
mov ecx, ebx
shl eax, cl
dec edi
add ebp, eax
inc rsi
add ebx, 8
cmp ebx, 0x10
jb 0x1400cdce7
test dl, 2
je 0x1400cdd61
cmp ebp, 0x8b1f
jne 0x1400cdd61
cmp dword [r13 + 0x30], 0
jne 0x1400cdd21
mov dword [r13 + 0x30], setsockopt
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sym.winvnc.exe_crc32_z
mov r8d, 2
mov dword [r13 + 0x20], eax
lea rdx, [rsp + 0x30]
mov word [rsp + 0x30], 0x8b1f
mov ecx, eax
call sym.winvnc.exe_crc32_z
mov dword [r13 + 0x20], eax
mov ebp, r15d
mov ebx, r15d
mov dword [r13 + 8], 0x3f35
jmp 0x1400ce364
mov rax, qword [r13 + 0x28]
test rax, rax
je 0x1400cdd75
mov dword [rax + 0x40], 0xffffffff
mov edx, dword [r13 + 0x10]
test dl, 1
je 0x1400cde49
movzx ecx, bpl
mov eax, ebp
shr eax, 8
shl ecx, 8
add ecx, eax
mov eax, 0x8421085
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
imul eax, eax, 0x1f
cmp ecx, eax
jne 0x1400cde49
mov eax, ebp
and al, 0xf
cmp al, 8
je 0x1400cddca
lea rax, str.unknown_compression_method
mov qword [r12 + 0x20], rax
mov dword [r13 + 8], 0x3f51
jmp 0x1400ce371
mov eax, dword [r13 + 0x30]
add ebx, 0xfffffffc
shr ebp, 4
mov ecx, ebp
and ecx, 0xf
add ecx, 8
test eax, eax
jne 0x1400cdde6
mov dword [r13 + 0x30], ecx
mov eax, ecx
cmp ecx, 0xf
ja 0x1400cde30
cmp ecx, eax
ja 0x1400cde30
mov eax, 1
mov dword [r13 + 0x18], r15d
shl eax, cl
xor r8d, r8d
xor ecx, ecx
mov dword [r13 + 0x1c], eax
xor edx, edx
call sym.winvnc.exe_adler32_z
shr ebp, 8
mov ebx, r15d
not ebp
mov dword [r13 + 0x20], eax
and ebp, 2
mov dword [r12 + 0x4c], eax
or ebp, 0x3f3d
mov dword [r13 + 8], ebp
mov ebp, r15d
jmp 0x1400ce364
lea rax, str.invalid_window_size
mov qword [r12 + 0x20], rax
mov dword [r13 + 8], 0x3f51
jmp 0x1400ce371
lea rax, str.incorrect_header_check
mov qword [r12 + 0x20], rax
mov dword [r13 + 8], 0x3f51
jmp 0x1400ce371
cmp ebx, 0x10
jae 0x1400cde85
test edi, edi
je 0x1400ce50f
movzx eax, byte [rsi]
mov ecx, ebx
shl eax, cl
dec edi
add ebp, eax
inc rsi
add ebx, 8
cmp ebx, 0x10
jb 0x1400cde67
mov dword [r13 + 0x18], ebp
cmp bpl, 8
je 0x1400cdea8
lea rax, str.unknown_compression_method
mov qword [r12 + 0x20], rax
mov dword [r13 + 8], 0x3f51
jmp 0x1400ce371
test ebp, 0xe000
je 0x1400cdec9
lea rax, str.unknown_header_flags_set
mov qword [r12 + 0x20], rax
mov dword [r13 + 8], 0x3f51
jmp 0x1400ce371
mov rdx, qword [r13 + 0x28]
mov ecx, ebp
shr ecx, 8
mov eax, ebp
test rdx, rdx
je 0x1400cdee4
mov eax, ecx
and eax, 1
mov dword [rdx], eax
mov eax, dword [r13 + 0x18]
bt eax, 9
jae 0x1400cdf12
test byte [r13 + 0x10], 4
je 0x1400cdf12
mov byte [rsp + 0x31], cl
lea rdx, [rsp + 0x30]
mov ecx, dword [r13 + 0x20]
mov r8d, 2
mov byte [rsp + 0x30], bpl
call sym.winvnc.exe_crc32_z
mov dword [r13 + 0x20], eax
mov ebp, r15d
mov dword [r13 + 8], 0x3f36
mov ebx, r15d
jmp 0x1400cdf27
cmp ebx, 0x20
jae 0x1400cdf45
test edi, edi
je 0x1400ce50f
movzx eax, byte [rsi]
mov ecx, ebx
shl eax, cl
dec edi
add ebp, eax
inc rsi
add ebx, 8
cmp ebx, 0x20
jb 0x1400cdf27
mov rax, qword [r13 + 0x28]
test rax, rax
je 0x1400cdf51
mov dword [rax + 4], ebp
test dword [r13 + 0x18], 0x200
je 0x1400cdf99
test byte [r13 + 0x10], 4
je 0x1400cdf99
mov ecx, dword [r13 + 0x20]
lea rdx, [rsp + 0x30]
mov eax, ebp
mov byte [rsp + 0x30], bpl
shr eax, 8
mov r8d, 4
mov byte [rsp + 0x31], al
mov eax, ebp
shr eax, 0x10
shr ebp, 0x18
mov byte [rsp + 0x32], al
mov byte [rsp + 0x33], bpl
call sym.winvnc.exe_crc32_z
mov dword [r13 + 0x20], eax
mov ebp, r15d
mov dword [r13 + 8], 0x3f37
mov ebx, r15d
jmp 0x1400cdfb0
cmp ebx, 0x10
jae 0x1400cdfce
nop
test edi, edi
je 0x1400ce50f
movzx eax, byte [rsi]
mov ecx, ebx
shl eax, cl
dec edi
add ebp, eax
inc rsi
add ebx, 8
cmp ebx, 0x10
jb 0x1400cdfb0
mov rcx, qword [r13 + 0x28]
test rcx, rcx
je 0x1400cdfec
movzx eax, bpl
mov dword [rcx + 8], eax
mov ecx, ebp
mov rax, qword [r13 + 0x28]
shr ecx, 8
mov dword [rax + 0xc], ecx
jmp 0x1400cdff1
mov ecx, ebp
shr ecx, 8
test dword [r13 + 0x18], 0x200
je 0x1400ce023
test byte [r13 + 0x10], 4
je 0x1400ce023
mov byte [rsp + 0x31], cl
lea rdx, [rsp + 0x30]
mov ecx, dword [r13 + 0x20]
mov r8d, 2
mov byte [rsp + 0x30], bpl
call sym.winvnc.exe_crc32_z
mov dword [r13 + 0x20], eax
mov ebp, r15d
mov dword [r13 + 8], 0x3f38
mov ebx, r15d
test dword [r13 + 0x18], 0x400
je 0x1400ce0ac
cmp ebx, 0x10
jae 0x1400ce05e
test edi, edi
je 0x1400ce50f
movzx eax, byte [rsi]
mov ecx, ebx
shl eax, cl
dec edi
add ebp, eax
inc rsi
add ebx, 8
cmp ebx, 0x10
jb 0x1400ce040
mov rax, qword [r13 + 0x28]
mov dword [r13 + 0x50], ebp
test rax, rax
je 0x1400ce06e
mov dword [rax + 0x18], ebp
test dword [r13 + 0x18], 0x200
je 0x1400ce0a4
test byte [r13 + 0x10], 4
je 0x1400ce0a4
mov ecx, dword [r13 + 0x20]
lea rdx, [rsp + 0x30]
mov byte [rsp + 0x30], bpl
mov r8d, 2
shr ebp, 8
mov byte [rsp + 0x31], bpl
call sym.winvnc.exe_crc32_z
mov dword [r13 + 0x20], eax
mov ebp, r15d
mov ebx, r15d
jmp 0x1400ce0b9
mov rax, qword [r13 + 0x28]
test rax, rax
je 0x1400ce0b9
mov qword [rax + 0x10], r15
mov dword [r13 + 8], 0x3f39
mov ecx, dword [r13 + 0x18]
bt ecx, 0xa
jae 0x1400ce176
mov eax, dword [r13 + 0x50]
mov r14d, edi
cmp eax, edi
cmovbe r14d, eax
test r14d, r14d
je 0x1400ce16e
mov rdx, qword [r13 + 0x28]
mov r8d, ecx
mov r15d, eax
test rdx, rdx
je 0x1400ce137
mov r11, qword [rdx + 0x10]
test r11, r11
je 0x1400ce137
mov r9d, dword [rdx + 0x18]
mov r10d, dword [rdx + 0x1c]
sub r9d, eax
cmp r9d, r10d
jae 0x1400ce137
mov edx, r10d
lea ecx, [r14 + r9]
sub edx, r9d
mov r8d, r14d
cmp ecx, r10d
mov ecx, r9d
cmova r8d, edx
add rcx, r11
mov rdx, rsi
call fcn.140134960
mov r8d, dword [r13 + 0x18]
mov r15d, dword [r13 + 0x50]
bt r8d, 9
jae 0x1400ce158
test byte [r13 + 0x10], 4
je 0x1400ce158
mov ecx, dword [r13 + 0x20]
mov rdx, rsi
mov r8d, r14d
call sym.winvnc.exe_crc32_z
mov dword [r13 + 0x20], eax
mov eax, r14d
sub edi, r14d
add rsi, rax
mov eax, r15d
sub eax, r14d
mov dword [r13 + 0x50], eax
xor r15d, r15d
test eax, eax
jne 0x1400ce50f
mov dword [r13 + 0x50], r15d
mov dword [r13 + 8], 0x3f3a
test dword [r13 + 0x18], 0x800
je 0x1400ce213
test edi, edi
je 0x1400ce50f
mov r14d, r15d
nop dword [rax + rax]
mov eax, r14d
inc r14d
movzx r15d, byte [rax + rsi]
mov rax, qword [r13 + 0x28]
test rax, rax
je 0x1400ce1ce
mov rdx, qword [rax + 0x20]
test rdx, rdx
je 0x1400ce1ce
mov ecx, dword [r13 + 0x50]
cmp ecx, dword [rax + 0x28]
jae 0x1400ce1ce
mov byte [rcx + rdx], r15b
inc dword [r13 + 0x50]
test r15b, r15b
je 0x1400ce1d8
cmp r14d, edi
jb 0x1400ce1a0
test dword [r13 + 0x18], 0x200
je 0x1400ce1fc
test byte [r13 + 0x10], 4
je 0x1400ce1fc
mov ecx, dword [r13 + 0x20]
mov rdx, rsi
mov r8d, r14d
call sym.winvnc.exe_crc32_z
mov dword [r13 + 0x20], eax
mov eax, r14d
sub edi, r14d
add rsi, rax
test r15b, r15b
jne 0x1400ce50f
xor r15d, r15d
jmp 0x1400ce220
mov rax, qword [r13 + 0x28]
test rax, rax
je 0x1400ce220
mov qword [rax + 0x20], r15
mov dword [r13 + 0x50], r15d
mov dword [r13 + 8], 0x3f3b
test dword [r13 + 0x18], 0x1000
je 0x1400ce2b4
test edi, edi
je 0x1400ce50f
mov r14d, r15d
mov eax, r14d
inc r14d
movzx r15d, byte [rax + rsi]
mov rax, qword [r13 + 0x28]
test rax, rax
je 0x1400ce26f
mov rdx, qword [rax + 0x30]
test rdx, rdx
je 0x1400ce26f
mov ecx, dword [r13 + 0x50]
cmp ecx, dword [rax + 0x38]
jae 0x1400ce26f
mov byte [rcx + rdx], r15b
inc dword [r13 + 0x50]
test r15b, r15b
je 0x1400ce279
cmp r14d, edi
jb 0x1400ce241
test dword [r13 + 0x18], 0x200
je 0x1400ce29d
test byte [r13 + 0x10], 4
je 0x1400ce29d
mov ecx, dword [r13 + 0x20]
mov rdx, rsi
mov r8d, r14d
call sym.winvnc.exe_crc32_z
mov dword [r13 + 0x20], eax
mov eax, r14d
sub edi, r14d
add rsi, rax
test r15b, r15b
jne 0x1400ce50f
xor r15d, r15d
jmp 0x1400ce2c1
mov rax, qword [r13 + 0x28]
test rax, rax
je 0x1400ce2c1
mov qword [rax + 0x30], r15
mov r10d, dword [rsp + 0xb8]
mov dword [r13 + 8], 0x3f3c
mov edx, dword [r13 + 0x18]
bt edx, 9
jae 0x1400ce32a
cmp ebx, 0x10
jae 0x1400ce2fe
test edi, edi
je 0x1400ce50f
movzx eax, byte [rsi]
mov ecx, ebx
shl eax, cl
dec edi
add ebp, eax
inc rsi
add ebx, 8
cmp ebx, 0x10
jb 0x1400ce2e0
test byte [r13 + 0x10], 4
je 0x1400ce324
movzx eax, word [r13 + 0x20]
cmp ebp, eax
je 0x1400ce324
lea rax, str.header_crc_mismatch
mov qword [r12 + 0x20], rax
mov dword [r13 + 8], 0x3f51
jmp 0x1400ce36c
mov ebp, r15d
mov ebx, r15d
mov rax, qword [r13 + 0x28]
test rax, rax
je 0x1400ce347
sar edx, 9
and edx, 1
mov dword [rax + 0x3c], edx
mov rax, qword [r13 + 0x28]
mov dword [rax + 0x40], 1
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sym.winvnc.exe_crc32_z
mov dword [r13 + 0x20], eax
mov dword [r12 + 0x4c], eax
mov dword [r13 + 8], 0x3f3f
mov r10d, dword [rsp + 0xb8]
mov r9, qword [rsp + 0x40]
mov edx, dword [r13 + 8]
lea eax, [rdx - 0x3f34]
cmp eax, 0x1f
ja case.0x1400cdccb.16211
mov r8d, dword [rsp + 0xa0]
xor r15d, r15d
mov r14d, dword [rsp + 0xa8]
jmp 0x1400cdcb7
cmp ebx, 0x20
jae 0x1400ce3bf
test edi, edi
je 0x1400ce50f
movzx eax, byte [rsi]
mov ecx, ebx
shl eax, cl
dec edi
add ebp, eax
inc rsi
add ebx, 8
cmp ebx, 0x20
jb 0x1400ce3a1
mov ecx, ebp
mov eax, ebp
shl eax, 0x10
and ecx, 0xff00
add ecx, eax
mov ebx, r15d
mov eax, ebp
shl ecx, 8
shr eax, 8
and eax, 0xff00
shr ebp, 0x18
add eax, ecx
add eax, ebp
mov ebp, r15d
mov dword [r13 + 0x20], eax
mov dword [r12 + 0x4c], eax
mov dword [r13 + 8], 0x3f3e
cmp dword [r13 + 0x14], 0
je 0x1400cf233
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sym.winvnc.exe_adler32_z
mov r10d, dword [rsp + 0xb8]
mov dword [r13 + 0x20], eax
mov dword [r12 + 0x4c], eax
mov dword [r13 + 8], 0x3f3f
lea eax, [r14 - 5]
cmp eax, 1
jbe 0x1400ce50f
cmp dword [r13 + 0xc], 0
je 0x1400ce453
mov ecx, ebx
mov dword [r13 + 8], 0x3f4e
and ecx, 7
shr ebp, cl
sub ebx, ecx
jmp 0x1400ce36c
cmp ebx, 3
jae 0x1400ce476
test edi, edi
je 0x1400ce50f
movzx eax, byte [rsi]
mov ecx, ebx
shl eax, cl
dec edi
add ebp, eax
inc rsi
add ebx, 8
cmp ebx, 3
jb 0x1400ce458
mov eax, ebp
shr ebp, 1
and eax, 1
mov dword [r13 + 0xc], eax
mov eax, ebp
and eax, 3
je 0x1400ce5ad
sub eax, 1
je 0x1400ce4d1
sub eax, 1
je 0x1400ce4be
cmp eax, 1
jne 0x1400ce5b5
lea rax, str.invalid_block_type
shr ebp, 2
mov qword [r12 + 0x20], rax
add ebx, 0xfffffffd
mov dword [r13 + 8], 0x3f51
jmp 0x1400ce36c
shr ebp, 2
add ebx, 0xfffffffd
mov dword [r13 + 8], 0x3f44
jmp 0x1400ce36c
mov dword [r13 + 0x70], 9
lea rax, [0x1401bdf00]
mov qword [r13 + 0x60], rax
lea rax, [0x1401be700]
mov qword [r13 + 0x68], rax
mov dword [r13 + 0x74], 5
mov dword [r13 + 8], 0x3f47
cmp r14d, 6
jne 0x1400ce5b5
shr ebp, 2
add ebx, 0xfffffffd
mov r15d, dword [rsp + 0xb0]
mov edx, dword [rsp + 0xa8]
mov r14d, dword [rsp + 0xa0]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0xb8]
mov qword [r12 + 0x10], rcx
mov dword [r12 + 0x18], eax
mov qword [r12], rsi
mov dword [r12 + 8], edi
cmp dword [r13 + 0x34], 0
mov dword [r13 + 0x48], ebp
mov dword [r13 + 0x4c], ebx
jne 0x1400ce57e
cmp r14d, dword [r12 + 0x18]
je 0x1400cf2b1
mov eax, dword [r13 + 8]
cmp eax, 0x3f51
jge 0x1400cf2b1
cmp eax, 0x3f4e
jl 0x1400ce57e
cmp edx, 4
je 0x1400cf2b1
mov rdx, qword [r12 + 0x10]
mov r8d, r14d
sub r8d, dword [r12 + 0x18]
mov rcx, r12
call fcn.1400cdac0
test eax, eax
je 0x1400cf2b1
mov dword [r13 + 8], 0x3f52
mov eax, 0xfffffffc
jmp 0x1400cf387
mov dword [r13 + 8], 0x3f41
shr ebp, 2
add ebx, 0xfffffffd
jmp 0x1400ce36c
mov ecx, ebx
and ecx, 7
shr ebp, cl
sub ebx, ecx
cmp ebx, 0x20
jae 0x1400ce5ee
nop
test edi, edi
je 0x1400ce50f
movzx eax, byte [rsi]
mov ecx, ebx
shl eax, cl
dec edi
add ebp, eax
inc rsi
add ebx, 8
cmp ebx, 0x20
jb 0x1400ce5d0
mov eax, ebp
movzx ecx, bp
not eax
shr eax, 0x10
cmp ecx, eax
je 0x1400ce615
lea rax, str.invalid_stored_block_lengths
mov qword [r12 + 0x20], rax
mov dword [r13 + 8], 0x3f51
jmp 0x1400ce371
mov dword [r13 + 0x50], ecx
mov ebp, r15d
mov dword [r13 + 8], 0x3f42
mov ebx, r15d
cmp r14d, 6
je 0x1400ce50f
mov dword [r13 + 8], 0x3f43
mov ecx, dword [r13 + 0x50]
test ecx, ecx
je 0x1400ce69b
cmp ecx, edi
mov eax, edi
mov r14d, r10d
cmovbe eax, ecx
cmp eax, r10d
cmovbe r14d, eax
test r14d, r14d
je 0x1400ce50f
mov r8d, r14d
mov rdx, rsi
mov rcx, r9
call fcn.140134960
mov r10d, dword [rsp + 0xb8]
sub edi, r14d
mov r9, qword [rsp + 0x40]
sub r10d, r14d
mov eax, r14d
add r9, rax
mov dword [rsp + 0xb8], r10d
add rsi, rax
mov qword [rsp + 0x40], r9
sub dword [r13 + 0x50], r14d
jmp 0x1400ce371
mov dword [r13 + 8], 0x3f3f
jmp 0x1400ce371
cmp ebx, 0xe
jae 0x1400ce6ce
nop dword [rax]
test edi, edi
je 0x1400ce50f
movzx eax, byte [rsi]
mov ecx, ebx
shl eax, cl
dec edi
add ebp, eax
inc rsi
add ebx, 8
cmp ebx, 0xe
jb 0x1400ce6b0
mov ecx, ebp
add ebx, 0xfffffff2
shr ebp, 5
and ecx, 0x1f
mov edx, ebp
add ecx, 0x101
shr ebp, 5
and edx, 0x1f
mov eax, ebp
mov dword [r13 + 0x7c], ecx
and eax, 0xf
shr ebp, 4
add eax, 4
inc edx
mov dword [r13 + 0x80], edx
mov dword [r13 + 0x78], eax
cmp ecx, 0x11e
ja 0x1400ce830
cmp edx, 0x1e
ja 0x1400ce830
mov dword [r13 + 0x84], r15d
mov dword [r13 + 8], 0x3f45
mov eax, dword [r13 + 0x84]
cmp eax, dword [r13 + 0x78]
jae 0x1400ce798
cmp ebx, 3
jae 0x1400ce75e
nop dword [rax]
test edi, edi
je 0x1400ce50f
movzx eax, byte [rsi]
mov ecx, ebx
shl eax, cl
dec edi
add ebp, eax
inc rsi
add ebx, 8
cmp ebx, 3
jb 0x1400ce740
mov eax, dword [r13 + 0x84]
movzx ecx, bp
and cx, 7
shr ebp, 3
add ebx, 0xfffffffd
movzx eax, word [r11 + rax*2 + 0x1bb658]
mov word [r13 + rax*2 + 0x90], cx
inc dword [r13 + 0x84]
mov eax, dword [r13 + 0x84]
cmp eax, dword [r13 + 0x78]
jb 0x1400ce734
cmp eax, 0x13
jae 0x1400ce7ca
nop dword [rax]
mov eax, dword [r13 + 0x84]
movzx eax, word [r11 + rax*2 + 0x1bb658]
mov word [r13 + rax*2 + 0x90], r15w
inc dword [r13 + 0x84]
cmp dword [r13 + 0x84], 0x13
jb 0x1400ce7a0
lea rcx, [r13 + 0x70]
lea rax, [r13 + 0x550]
mov dword [rcx], 7
lea r9, [r13 + 0x88]
mov qword [r13 + 0x60], rax
mov qword [r9], rax
lea rdx, [r13 + 0x90]
lea rax, [r13 + 0x310]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
xor ecx, ecx
lea r8d, [rcx + 0x13]
call fcn.1400d3ab0
mov dword [rsp + 0xb0], eax
test eax, eax
je 0x1400ce849
lea rax, str.invalid_code_lengths_set
mov qword [r12 + 0x20], rax
mov dword [r13 + 8], 0x3f51
jmp 0x1400ce364
lea rax, str.too_many_length_or_distance_symbols
mov qword [r12 + 0x20], rax
mov dword [r13 + 8], 0x3f51
jmp 0x1400ce371
mov dword [r13 + 0x84], r15d
mov edx, 0x3f46
mov dword [r13 + 8], 0x3f46
mov ecx, dword [r13 + 0x80]
mov r10d, dword [r13 + 0x7c]
add ecx, r10d
cmp dword [r13 + 0x84], ecx
jae 0x1400cea72
nop dword [rax + rax]
mov ecx, dword [r13 + 0x70]
mov r9d, 1
mov r10, qword [r13 + 0x60]
shl r9d, cl
dec r9d
mov eax, ebp
mov ecx, r9d
and rcx, rax
mov eax, dword [r10 + rcx*4]
mov edx, eax
shr edx, 8
mov r8d, eax
movzx ecx, dl
shr r8d, 0x10
mov dword [rsp + 0x34], eax
cmp ecx, ebx
jbe 0x1400ce8f3
test edi, edi
je 0x1400ce50f
movzx eax, byte [rsi]
mov ecx, ebx
shl eax, cl
dec edi
add ebp, eax
inc rsi
mov eax, r9d
add ebx, 8
mov ecx, ebp
and rcx, rax
mov eax, dword [r10 + rcx*4]
mov edx, eax
shr edx, 8
mov r8d, eax
movzx ecx, dl
shr r8d, 0x10
mov dword [rsp + 0x34], eax
cmp ecx, ebx
ja 0x1400ce8b7
cmp r8w, 0x10
jae 0x1400ce92a
movzx ecx, dl
shr eax, 0x10
shr ebp, cl
movzx ecx, dl
sub ebx, ecx
mov ecx, dword [r13 + 0x84]
mov word [r13 + rcx*2 + 0x90], ax
inc dword [r13 + 0x84]
mov r8d, dword [r13 + 0x84]
jmp 0x1400cea57
movzx edx, dl
jne 0x1400ce989
add edx, 2
cmp ebx, edx
jae 0x1400ce953
test edi, edi
je 0x1400ce50f
movzx eax, byte [rsi]
mov ecx, ebx
shl eax, cl
dec edi
add ebp, eax
inc rsi
add ebx, 8
cmp ebx, edx
jb 0x1400ce936
movzx ecx, byte [rsp + 0x35]
mov eax, dword [r13 + 0x84]
sub ebx, ecx
shr ebp, cl
test eax, eax
je 0x1400ceaa2
mov edx, ebp
add ebx, 0xfffffffe
and edx, 3
shr ebp, 2
add edx, 3
dec eax
movzx r9d, word [r13 + rax*2 + 0x90]
jmp 0x1400cea13
cmp r8w, 0x11
jne 0x1400ce9d0
add edx, 3
cmp ebx, edx
jae 0x1400ce9b4
test edi, edi
je 0x1400ce50f
movzx eax, byte [rsi]
mov ecx, ebx
shl eax, cl
dec edi
add ebp, eax
inc rsi
add ebx, 8
cmp ebx, edx
jb 0x1400ce997
movzx ecx, byte [rsp + 0x35]
mov eax, 0xfffffffd
shr ebp, cl
mov r9d, r15d
mov edx, ebp
and edx, 7
add edx, 3
shr ebp, 3
jmp 0x1400cea0f
add edx, 7
cmp ebx, edx
jae 0x1400ce9f4
test edi, edi
je 0x1400ce50f
movzx eax, byte [rsi]
mov ecx, ebx
shl eax, cl
dec edi
add ebp, eax
inc rsi
add ebx, 8
cmp ebx, edx
jb 0x1400ce9d7
movzx ecx, byte [rsp + 0x35]
mov eax, 0xfffffff9
shr ebp, cl
movzx r9d, r15w
mov edx, ebp
and edx, 0x7f
add edx, 0xb
shr ebp, 7
sub eax, ecx
add ebx, eax
mov ecx, dword [r13 + 0x84]
mov eax, dword [r13 + 0x80]
add ecx, edx
add eax, dword [r13 + 0x7c]
cmp ecx, eax
ja 0x1400ceaa2
nop dword [rax + rax]
mov eax, dword [r13 + 0x84]
mov word [r13 + rax*2 + 0x90], r9w
mov r8d, dword [r13 + 0x84]
lea r8d, [r8 + 1]
mov dword [r13 + 0x84], r8d
add edx, 0xffffffff
jne 0x1400cea30
mov ecx, dword [r13 + 0x80]
mov r10d, dword [r13 + 0x7c]
add ecx, r10d
cmp r8d, ecx
jb 0x1400ce880
mov edx, dword [r13 + 8]
cmp edx, 0x3f51
je 0x1400ce364
cmp word [r13 + 0x290], 0
jne 0x1400ceabb
lea rax, str.invalid_code____missing_end_of_block
mov qword [r12 + 0x20], rax
mov dword [r13 + 8], 0x3f51
jmp 0x1400ce364
lea rax, str.invalid_bit_length_repeat
mov qword [r12 + 0x20], rax
mov dword [r13 + 8], 0x3f51
jmp 0x1400ce364
lea rax, [r13 + 0x550]
mov dword [r13 + 0x70], 9
mov qword [r13 + 0x88], rax
lea r15, [r13 + 0x310]
mov qword [r13 + 0x60], rax
lea rdx, [r13 + 0x90]
lea rax, [r13 + 0x70]
mov qword [rsp + 0x28], r15
lea r9, [r13 + 0x88]
mov qword [rsp + 0x20], rax
mov r8d, r10d
mov ecx, 1
call fcn.1400d3ab0
mov dword [rsp + 0xb0], eax
test eax, eax
je 0x1400ceb29
lea rax, str.invalid_literal_lengths_set
mov qword [r12 + 0x20], rax
mov dword [r13 + 8], 0x3f51
jmp 0x1400ce364
mov rax, qword [r13 + 0x88]
lea rcx, [r13 + 0x74]
mov r8d, dword [r13 + 0x80]
lea r9, [r13 + 0x88]
mov qword [r13 + 0x68], rax
mov eax, dword [r13 + 0x7c]
mov dword [rcx], 6
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rcx
mov ecx, 2
lea rdx, [rax*2 + 0x90]
add rdx, r13
call fcn.1400d3ab0
mov dword [rsp + 0xb0], eax
mov r15d, eax
test eax, eax
je 0x1400ceb96
lea rax, str.invalid_distances_set
mov qword [r12 + 0x20], rax
mov dword [r13 + 8], 0x3f51
jmp 0x1400ce364
mov edx, dword [rsp + 0xa8]
mov dword [r13 + 8], 0x3f47
cmp edx, 6
je 0x1400ce51e
mov r8d, dword [rsp + 0xa0]
xor r15d, r15d
mov r10d, dword [rsp + 0xb8]
mov dword [r13 + 8], 0x3f48
cmp edi, 6
jb 0x1400cec48
cmp r10d, 0x102
jb 0x1400cec48
mov rcx, qword [rsp + 0x40]
mov edx, r8d
mov qword [r12 + 0x10], rcx
mov rcx, r12
mov dword [r12 + 0x18], r10d
mov qword [r12], rsi
mov dword [r12 + 8], edi
mov dword [r13 + 0x48], ebp
mov dword [r13 + 0x4c], ebx
call fcn.1400d4070
cmp dword [r13 + 8], 0x3f3f
mov r9, qword [r12 + 0x10]
mov r10d, dword [r12 + 0x18]
mov rsi, qword [r12]
mov edi, dword [r12 + 8]
mov ebp, dword [r13 + 0x48]
mov ebx, dword [r13 + 0x4c]
mov qword [rsp + 0x40], r9
mov dword [rsp + 0xb8], r10d
jne 0x1400ce371
mov dword [r13 + 0x1be4], 0xffffffff
jmp 0x1400ce371
mov ecx, dword [r13 + 0x70]
mov edx, 1
mov r10, qword [r13 + 0x60]
shl edx, cl
dec edx
mov eax, ebp
mov ecx, edx
and rcx, rax
mov dword [r13 + 0x1be4], r15d
mov eax, dword [r10 + rcx*4]
mov ecx, eax
shr ecx, 8
movzx ecx, cl
cmp ecx, ebx
jbe 0x1400ceca7
test edi, edi
je 0x1400ce50f
movzx eax, byte [rsi]
mov ecx, ebx
shl eax, cl
dec edi
add ebp, eax
inc rsi
mov eax, edx
add ebx, 8
mov ecx, ebp
and rcx, rax
mov eax, dword [r10 + rcx*4]
mov ecx, eax
shr ecx, 8
movzx ecx, cl
cmp ecx, ebx
ja 0x1400cec77
test al, al
je 0x1400ced63
test al, 0xf0
jne 0x1400ced63
mov ecx, eax
mov dword [rsp + 0x34], eax
movzx r14d, byte [rsp + 0x35]
mov r8d, 1
shr ecx, 8
mov edx, eax
movzx r9d, cl
movzx ecx, al
add ecx, r9d
shr eax, 0x10
shl r8d, cl
mov ecx, r9d
dec r8d
and r8d, ebp
shr r8d, cl
add r8d, eax
mov eax, dword [r10 + r8*4]
mov ecx, eax
shr ecx, 8
movzx r8d, cl
add r8d, r9d
cmp r8d, ebx
jbe 0x1400ced54
movzx r11d, word [rsp + 0x36]
test edi, edi
je 0x1400ce50f
movzx eax, byte [rsi]
mov ecx, ebx
shl eax, cl
mov r8d, 1
add ebp, eax
movzx ecx, dl
add ecx, r14d
dec edi
shl r8d, cl
inc rsi
dec r8d
mov ecx, r14d
and r8d, ebp
add ebx, 8
shr r8d, cl
add r8d, r11d
mov eax, dword [r10 + r8*4]
mov ecx, eax
shr ecx, 8
movzx r8d, cl
add r8d, r14d
cmp r8d, ebx
ja 0x1400ced08
mov ecx, r14d
shr ebp, cl
sub ebx, r14d
mov dword [r13 + 0x1be4], ecx
mov ecx, eax
shr ecx, 8
movzx ecx, cl
add dword [r13 + 0x1be4], ecx
sub ebx, ecx
shr ebp, cl
mov ecx, eax
shr ecx, 0x10
mov dword [r13 + 0x50], ecx
test al, al
jne 0x1400ced90
mov dword [r13 + 8], 0x3f4d
jmp 0x1400ce364
test al, 0x20
je 0x1400ceda4
mov dword [r13 + 0x1be4], 0xffffffff
jmp 0x1400ce35c
test al, 0x40
je 0x1400cedc1
lea rax, str.invalid_literal_length_code
mov qword [r12 + 0x20], rax
mov dword [r13 + 8], 0x3f51
jmp 0x1400ce364
movzx ecx, al
and ecx, 0xf
mov dword [r13 + 8], 0x3f49
mov dword [r13 + 0x58], ecx
mov edx, dword [r13 + 0x58]
test edx, edx
je 0x1400cee19
cmp ebx, edx
jae 0x1400cedfd
nop
test edi, edi
je 0x1400ce50f
movzx eax, byte [rsi]
mov ecx, ebx
shl eax, cl
dec edi
add ebp, eax
inc rsi
add ebx, 8
cmp ebx, edx
jb 0x1400cede0
mov ecx, edx
mov eax, 1
shl eax, cl
sub ebx, edx
dec eax
and eax, ebp
shr ebp, cl
add dword [r13 + 0x50], eax
add dword [r13 + 0x1be4], edx
mov eax, dword [r13 + 0x50]
mov dword [r13 + 0x1be8], eax
mov dword [r13 + 8], 0x3f4a
mov ecx, dword [r13 + 0x74]
mov edx, 1
mov r10, qword [r13 + 0x68]
shl edx, cl
dec edx
mov eax, ebp
mov ecx, edx
and rcx, rax
mov eax, dword [r10 + rcx*4]
mov ecx, eax
shr ecx, 8
movzx ecx, cl
cmp ecx, ebx
jbe 0x1400cee84
test edi, edi
je 0x1400ce50f
movzx eax, byte [rsi]
mov ecx, ebx
shl eax, cl
dec edi
add ebp, eax
inc rsi
mov eax, edx
add ebx, 8
mov ecx, ebp
and rcx, rax
mov eax, dword [r10 + rcx*4]
mov ecx, eax
shr ecx, 8
movzx ecx, cl
cmp ecx, ebx
ja 0x1400cee54
test al, 0xf0
jne 0x1400cef3b
mov ecx, eax
mov dword [rsp + 0x34], eax
movzx r14d, byte [rsp + 0x35]
mov r8d, 1
shr ecx, 8
mov edx, eax
movzx r9d, cl
movzx ecx, al
add ecx, r9d
shr eax, 0x10
shl r8d, cl
mov ecx, r9d
dec r8d
and r8d, ebp
shr r8d, cl
add r8d, eax
mov eax, dword [r10 + r8*4]
mov ecx, eax
shr ecx, 8
movzx r8d, cl
add r8d, r9d
cmp r8d, ebx
jbe 0x1400cef2c
movzx r11d, word [rsp + 0x36]
nop dword [rax]
test edi, edi
je 0x1400ce50f
movzx eax, byte [rsi]
mov ecx, ebx
shl eax, cl
mov r8d, 1
add ebp, eax
movzx ecx, dl
add ecx, r14d
dec edi
shl r8d, cl
inc rsi
dec r8d
mov ecx, r14d
and r8d, ebp
add ebx, 8
shr r8d, cl
add r8d, r11d
mov eax, dword [r10 + r8*4]
mov ecx, eax
shr ecx, 8
movzx r8d, cl
add r8d, r14d
cmp r8d, ebx
ja 0x1400ceee0
mov ecx, r14d
sub ebx, r14d
shr ebp, cl
add dword [r13 + 0x1be4], ecx
mov r10d, dword [rsp + 0xb8]
mov ecx, eax
shr ecx, 8
movzx ecx, cl
add dword [r13 + 0x1be4], ecx
sub ebx, ecx
shr ebp, cl
test al, 0x40
je 0x1400cef73
lea rax, str.invalid_distance_code
mov qword [r12 + 0x20], rax
mov dword [r13 + 8], 0x3f51
jmp 0x1400ce36c
mov r8d, dword [rsp + 0xa0]
mov ecx, eax
shr ecx, 0x10
mov dword [r13 + 0x54], ecx
movzx ecx, al
and ecx, 0xf
mov dword [r13 + 8], 0x3f4b
mov dword [r13 + 0x58], ecx
mov edx, dword [r13 + 0x58]
test edx, edx
je 0x1400cefdb
cmp ebx, edx
jae 0x1400cefbf
test edi, edi
je 0x1400ce50f
movzx eax, byte [rsi]
mov ecx, ebx
shl eax, cl
dec edi
add ebp, eax
inc rsi
add ebx, 8
cmp ebx, edx
jb 0x1400cefa2
mov ecx, edx
mov eax, 1
shl eax, cl
sub ebx, edx
dec eax
and eax, ebp
shr ebp, cl
add dword [r13 + 0x54], eax
add dword [r13 + 0x1be4], edx
mov dword [r13 + 8], 0x3f4c
test r10d, r10d
je 0x1400ce50f
mov eax, dword [r13 + 0x54]
mov ecx, r8d
sub ecx, r10d
cmp eax, ecx
jbe 0x1400cf04b
sub eax, ecx
cmp eax, dword [r13 + 0x38]
jbe 0x1400cf025
cmp dword [r13 + 0x1be0], 0
je 0x1400cf025
lea rax, str.invalid_distance_too_far_back
mov qword [r12 + 0x20], rax
mov dword [r13 + 8], 0x3f51
jmp 0x1400ce36c
mov ecx, dword [r13 + 0x3c]
cmp eax, ecx
jbe 0x1400cf033
sub eax, ecx
mov ecx, dword [r13 + 0x34]
mov r8d, dword [r13 + 0x50]
sub ecx, eax
mov edx, ecx
mov r9d, r8d
add rdx, qword [r13 + 0x40]
cmp eax, r8d
cmovbe r9d, eax
jmp 0x1400cf05a
mov rdx, qword [rsp + 0x40]
mov r8d, dword [r13 + 0x50]
sub rdx, rax
mov r9d, r8d
cmp r9d, r10d
mov ecx, r10d
cmovbe ecx, r9d
mov r9, qword [rsp + 0x40]
sub r10d, ecx
sub r8d, ecx
mov dword [rsp + 0xb8], r10d
sub rdx, r9
mov dword [r13 + 0x50], r8d
nop
movzx eax, byte [rdx + r9]
mov byte [r9], al
inc r9
add ecx, 0xffffffff
jne 0x1400cf080
mov qword [rsp + 0x40], r9
cmp dword [r13 + 0x50], ecx
jne 0x1400ce371
mov dword [r13 + 8], 0x3f48
jmp 0x1400ce371
test r10d, r10d
je 0x1400ce50f
movzx eax, byte [r13 + 0x50]
mov byte [r9], al
inc r9
dec r10d
mov qword [rsp + 0x40], r9
mov dword [rsp + 0xb8], r10d
mov dword [r13 + 8], 0x3f48
jmp 0x1400ce371
cmp dword [r13 + 0x10], 0
je 0x1400cf1c3
cmp ebx, 0x20
jae 0x1400cf10e
nop dword [rax]
test edi, edi
je 0x1400ce50f
movzx eax, byte [rsi]
mov ecx, ebx
shl eax, cl
dec edi
add ebp, eax
inc rsi
add ebx, 8
cmp ebx, 0x20
jb 0x1400cf0f0
sub r8d, r10d
add dword [r12 + 0x1c], r8d
add dword [r13 + 0x24], r8d
mov eax, dword [r13 + 0x10]
test al, 4
je 0x1400cf159
test r8d, r8d
je 0x1400cf159
mov ecx, dword [r13 + 0x20]
mov rdx, r9
sub rdx, r8
cmp dword [r13 + 0x18], 0
je 0x1400cf13f
call sym.winvnc.exe_crc32_z
jmp 0x1400cf144
call sym.winvnc.exe_adler32_z
mov r10d, dword [rsp + 0xb8]
mov dword [r13 + 0x20], eax
mov dword [r12 + 0x4c], eax
mov eax, dword [r13 + 0x10]
mov dword [rsp + 0xa0], r10d
mov r14d, r10d
test al, 4
je 0x1400cf1b3
cmp dword [r13 + 0x18], 0
mov ecx, ebp
jne 0x1400cf194
and ecx, 0xff00
mov eax, ebp
shl eax, 0x10
add ecx, eax
mov eax, ebp
shr eax, 8
and eax, 0xff00
shl ecx, 8
add ecx, eax
mov eax, ebp
shr eax, 0x18
add ecx, eax
cmp ecx, dword [r13 + 0x20]
je 0x1400cf1b3
lea rax, str.incorrect_data_check
mov qword [r12 + 0x20], rax
mov dword [r13 + 8], 0x3f51
jmp 0x1400ce36c
mov ebp, r15d
mov dword [r13 + 8], 0x3f4f
mov ebx, r15d
jmp 0x1400cf1dd
mov r14d, dword [rsp + 0xa0]
mov dword [r13 + 8], 0x3f4f
jmp 0x1400cf1dd
mov r14d, dword [rsp + 0xa0]
mov edx, dword [r13 + 0x10]
test edx, edx
je 0x1400cf25e
cmp dword [r13 + 0x18], 0
je 0x1400cf25e
cmp ebx, 0x20
jae 0x1400cf20f
test edi, edi
je 0x1400cf29d
movzx eax, byte [rsi]
mov ecx, ebx
shl eax, cl
dec edi
add ebp, eax
inc rsi
add ebx, 8
cmp ebx, 0x20
jb 0x1400cf1f1
test dl, 4
je 0x1400cf258
cmp ebp, dword [r13 + 0x24]
je 0x1400cf258
lea rax, str.incorrect_length_check
mov qword [r12 + 0x20], rax
mov dword [r13 + 8], 0x3f51
jmp 0x1400ce36c
mov qword [r12 + 0x10], r9
mov eax, 2
mov dword [r12 + 0x18], r10d
mov qword [r12], rsi
mov dword [r12 + 8], edi
mov dword [r13 + 0x48], ebp
mov dword [r13 + 0x4c], ebx
jmp 0x1400cf387
mov ebp, r15d
mov ebx, r15d
mov edx, dword [rsp + 0xa8]
mov r15d, 1
mov dword [r13 + 8], 0x3f50
jmp 0x1400ce526
mov r14d, dword [rsp + 0xa0]
mov r15d, 1
mov edx, dword [rsp + 0xa8]
jmp 0x1400ce526
mov r15d, 0xfffffffd
jmp 0x1400ce517
mov r15d, dword [rsp + 0xb0]
mov edx, dword [rsp + 0xa8]
jmp 0x1400ce526
sub r14d, dword [r12 + 0x18]
mov r10d, dword [rsp + 0x38]
sub r10d, dword [r12 + 8]
add dword [r12 + 0xc], r10d
add dword [r12 + 0x1c], r14d
add dword [r13 + 0x24], r14d
test byte [r13 + 0x10], 4
mov dword [rsp + 0x38], r10d
je 0x1400cf30f
test r14d, r14d
je 0x1400cf30f
mov rdx, qword [r12 + 0x10]
mov ecx, dword [r13 + 0x20]
mov r8d, r14d
sub rdx, r8
cmp dword [r13 + 0x18], 0
je 0x1400cf2fc
call sym.winvnc.exe_crc32_z
jmp 0x1400cf301
call sym.winvnc.exe_adler32_z
mov r10d, dword [rsp + 0x38]
mov dword [r13 + 0x20], eax
mov dword [r12 + 0x4c], eax
mov edx, dword [r13 + 8]
cmp edx, 0x3f47
je 0x1400cf32b
cmp edx, 0x3f42
je 0x1400cf32b
xor r9d, r9d
mov r8d, r9d
jmp 0x1400cf334
mov r8d, 0x100
xor r9d, r9d
mov eax, dword [r13 + 0xc]
neg eax
mov eax, 0x80
sbb ecx, ecx
and ecx, 0x40
cmp edx, 0x3f3f
cmove r9d, eax
add ecx, r9d
add ecx, dword [r13 + 0x4c]
add ecx, r8d
mov dword [r12 + 0x48], ecx
test r10d, r10d
jne 0x1400cf367
test r14d, r14d
je 0x1400cf371
cmp dword [rsp + 0xa8], 4
jne 0x1400cf37d
test r15d, r15d
mov eax, 0xfffffffb
cmove r15d, eax
mov eax, r15d
jmp 0x1400cf387
mov eax, 0xfffffffe
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret