Function at 0x140027210
Capabilities:
Print debug messages

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x218
mov rax, qword [0x14017f8e0]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov eax, dword [0x14018f92c]
mov dword [rsp + 0x44], eax
lea rdi, [rsp + 0x50]
lea rsi, str.0x00000000_n
mov ecx, Ordinal_27
rep movsb byte [rdi], byte [rsi]
lea rcx, str._WARNING___PE_SIGNATURE_VERIFICATION_FAILED_____n_Filename:
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, str._n_Error:
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x40], 0
jmp 0x14002728e
mov eax, dword [rsp + 0x40]
add eax, 1
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 8
jge 0x140027313
mov eax, 7
sub eax, dword [rsp + 0x40]
shl eax, 2
movzx ecx, al
mov eax, dword [rsp + 0x238]
shr eax, cl
mov ecx, eax
and ecx, 0xf
mov eax, dword [rsp + 0x40]
add eax, 2
cdqe
mov word [rsp + rax*2 + 0x50], cx
mov eax, dword [rsp + 0x40]
add eax, 2
cdqe
movzx eax, word [rsp + rax*2 + 0x50]
cmp eax, 0xa
jge 0x1400272e0
mov dword [rsp + 0x1f0], gethostname
jmp 0x1400272eb
mov dword [rsp + 0x1f0], gethostname
mov eax, dword [rsp + 0x40]
add eax, 2
cdqe
movzx ecx, word [rsp + rax*2 + 0x50]
add ecx, dword [rsp + 0x1f0]
mov eax, dword [rsp + 0x40]
add eax, 2
cdqe
mov word [rsp + rax*2 + 0x50], cx
jmp 0x140027283
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [rsp + 0x44], 0
jne 0x140027706
cmp dword [reloc.WS2_32.dll_accept], 0
je 0x140027706
mov eax, 0x100
mov word [rsp + 0x78], ax
mov eax, 0x200
mov word [rsp + 0x7a], ax
xor eax, eax
mov word [rsp + 0x7c], ax
mov dword [rsp + 0x68], 0x41fcc608
mov eax, 0x8496
mov word [rsp + 0x6c], ax
mov eax, 0x4def
mov word [rsp + 0x6e], ax
mov byte [rsp + 0x70], 0xb4
mov byte [rsp + 0x71], 0x3e
mov byte [rsp + 0x72], 0x7d
mov byte [rsp + 0x73], 0x9b
mov byte [rsp + 0x74], 0xd6
mov byte [rsp + 0x75], 0x75
mov byte [rsp + 0x76], 0xa6
mov byte [rsp + 0x77], 0xff
mov dword [reloc.WS2_32.dll_accept], 0
cmp qword [0x14018f7c8], 0
jne 0x140027419
xor edx, edx
lea rcx, str.Advapi32.dll
call fcn.140024de0
mov qword [0x14018f7c8], rax
cmp qword [0x14018f7c8], 0
je 0x140027419
lea rdx, str.RegOpenKeyExW
mov rcx, qword [0x14018f7c8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14018f7d0], rax
lea rdx, str.RegEnumValueW
mov rcx, qword [0x14018f7c8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14018f7d8], rax
lea rdx, str.RegCloseKey
mov rcx, qword [0x14018f7c8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14018f7e0], rax
cmp qword [0x14018f7d0], 0
je 0x140027437
cmp qword [0x14018f7d8], 0
je 0x140027437
cmp qword [0x14018f7e0], 0
jne 0x14002743e
xor eax, eax
jmp 0x140027751
cmp qword [0x14018f7e8], 0
jne 0x140027482
xor edx, edx
lea rcx, str.Ole32.dll
call fcn.140024de0
mov qword [0x14018f7e8], rax
cmp qword [0x14018f7e8], 0
je 0x140027482
lea rdx, str.StringFromGUID2
mov rcx, qword [0x14018f7e8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14018f7f0], rax
cmp qword [0x14018f7f0], 0
jne 0x140027493
xor eax, eax
jmp 0x140027751
lea rdi, [rsp + 0x80]
xor eax, eax
mov ecx, Ordinal_79
rep stosb byte [rdi], al
mov r8d, Ordinal_41
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x68]
call qword [0x14018f7f0]
cdqe
cmp rax, 0x27
je 0x1400274cc
xor eax, eax
jmp 0x140027751
mov dword [rsp + 0x40], 0
jmp 0x1400274e1
mov eax, dword [rsp + 0x40]
add eax, 1
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x44], 0
jne 0x140027706
movsxd rax, dword [rsp + 0x40]
movzx eax, word [rsp + rax*2 + 0x78]
test eax, eax
je 0x140027706
mov qword [rsp + 0xd0], 0
movsxd rax, dword [rsp + 0x40]
movzx r9d, word [rsp + rax*2 + 0x78]
or r9d, 0x20019
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWARENVIDIA_CorporationGlobal
mov rcx, 0xffffffff80000002
call qword [0x14018f7d0]
mov dword [rsp + 0xd8], eax
cmp dword [rsp + 0xd8], 0
jne 0x140027701
mov dword [rsp + 0xe0], 0
mov dword [rsp + 0xdc], 0
mov dword [rsp + 0xe8], 0x80
mov dword [rsp + 0xe4], 4
lea rdi, [rsp + 0xf0]
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x1f4], eax
lea rax, [rsp + 0xe4]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xec]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xe8]
lea r8, [rsp + 0xf0]
mov edx, dword [rsp + 0x1f4]
mov rcx, qword [rsp + 0xd0]
call qword [0x14018f7d8]
mov dword [rsp + 0xd8], eax
mov eax, dword [rsp + 0xe0]
add eax, 1
mov dword [rsp + 0xe0], eax
cmp dword [rsp + 0xd8], 0
jne 0x1400276a9
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x80]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov eax, dword [rsp + 0xe8]
cmp rcx, rax
jne 0x1400276a9
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0xf0]
sub rcx, rdx
movzx eax, word [rdx]
cmp ax, word [rdx + rcx]
jne 0x140027667
add rdx, 2
test ax, ax
jne 0x140027651
xor eax, eax
jmp 0x14002766c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1400276a9
cmp dword [rsp + 0xec], 0
je 0x140027687
mov dword [rsp + 0x1f8], 1
jmp 0x140027692
mov dword [rsp + 0x1f8], 0
mov ecx, dword [rsp + 0x1f8]
mov eax, dword [rsp + 0xdc]
or eax, ecx
mov dword [rsp + 0xdc], eax
cmp dword [rsp + 0xd8], 0x103
jne 0x14002756b
mov rcx, qword [rsp + 0xd0]
call qword [0x14018f7e0]
cmp dword [rsp + 0xdc], 0
je 0x1400276df
mov dword [rsp + 0x1fc], 1
jmp 0x1400276ea
mov dword [rsp + 0x1fc], 0
mov eax, dword [rsp + 0x1fc]
mov dword [0x14018f92c], eax
mov eax, dword [0x14018f92c]
mov dword [rsp + 0x44], eax
jmp 0x1400274d6
cmp dword [rsp + 0x44], 0
jne 0x140027716
cmp dword [0x14018f92c], 0
je 0x140027742
lea rcx, str._Signature_override_detected..._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x238], 0
mov ecx, dword [rsp + 0x238]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 1
jmp 0x140027751
mov ecx, dword [rsp + 0x238]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.140111120
add rsp, 0x218
pop rdi
pop rsi
ret