Function at 0x140033900
Capabilities:
Encode data using xor
Hash data with crc32
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
mov rax, qword [0x140300040]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r12d, edx
mov r14, rcx
mov qword [rbp - 0x39], rcx
xor r13d, r13d
cmp dword [rcx + 0x54], r13d
je 0x14003396a
lea rdx, [rbp + 4]
call fcn.1400334b0
test eax, eax
je 0x140033a0a
lea rdx, [rbp + 3]
mov rcx, r14
call fcn.1400334b0
test eax, eax
je 0x140033a0a
sub r12d, 2
mov dword [r14 + 0x54], r13d
mov rbx, qword [r14 + 0x48]
mov edi, dword [r14 + 0x50]
mov r15d, dword [r14 + 0x60]
mov dword [rbp - 0x71], r15d
movzx eax, byte [r14 + 0x78]
mov byte [rbp + 4], al
mov rsi, qword [r14 + 0x80]
mov eax, dword [r14 + 0x79]
mov dword [rbp - 1], eax
mov eax, dword [r14 + 0x88]
mov dword [rbp + 7], eax
mov eax, dword [r14 + 0x64]
mov dword [rbp - 0x49], eax
mov ecx, dword [r14 + 0x40]
mov dword [rbp - 0x59], ecx
mov eax, dword [r14 + 0x44]
mov dword [rbp - 0x69], eax
mov rax, qword [r14 + 0x58]
mov qword [rbp - 0x61], rax
cmp qword [r14 + 0x90], r13
jne 0x1400339d5
movsxd rdx, dword [r14 + 0x38]
mov ecx, 1
call fcn.14020cf94
mov qword [r14 + 0x90], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], rax
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x19], rax
mov qword [rbp - 9], r13
mov qword [rbp - 0x11], r13
movsxd r13, r12d
mov rdx, r13
xor ecx, ecx
call fcn.140207160
test rax, rax
jne 0x140033a19
mov rdx, qword [rbp - 0x41]
jmp 0x140033a35
mov dword [r14 + 8], 4
xor eax, eax
jmp 0x140034772
mov rdx, rax
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x19], rax
mov qword [rbp - 9], r13
mov qword [rbp - 0x11], 0
mov eax, 1
test eax, eax
je 0x140034799
mov rcx, qword [r14]
mov qword [rbp + 0xf], 0
mov rax, qword [rcx]
lea r9, [rbp + 0xf]
mov r8, r13
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
test eax, eax
je 0x14003474d
cmp qword [rbp + 0xf], r13
jne 0x14003474d
mov r8d, r12d
mov r13, qword [rbp - 0x41]
mov rdx, r13
mov rcx, qword [r14 + 0x20]
call fcn.14003f610
test eax, eax
jne 0x14003474d
mov r8, r13
mov edx, dword [r14 + 0x1c]
test r13, r13
jne 0x140033a9c
xor edx, edx
jmp 0x140033b9f
not edx
lea r10, [0x14026d710]
cmp r12d, 8
jb 0x140033b71
mov r9d, r12d
shr r9, 3
nop word [rax + rax]
mov ecx, edx
movzx eax, byte [r8]
xor rcx, rax
movzx eax, cl
shr edx, 8
xor edx, dword [r10 + rax*4]
movzx ecx, byte [r8 + 1]
mov eax, edx
xor rcx, rax
movzx eax, cl
shr edx, 8
xor edx, dword [r10 + rax*4]
movzx ecx, byte [r8 + 2]
mov eax, edx
xor rcx, rax
movzx eax, cl
shr edx, 8
xor edx, dword [r10 + rax*4]
movzx ecx, byte [r8 + 3]
mov eax, edx
xor rcx, rax
movzx eax, cl
shr edx, 8
xor edx, dword [r10 + rax*4]
movzx ecx, byte [r8 + 4]
mov eax, edx
xor rcx, rax
movzx eax, cl
shr edx, 8
xor edx, dword [r10 + rax*4]
movzx ecx, byte [r8 + 5]
mov eax, edx
xor rcx, rax
movzx eax, cl
shr edx, 8
xor edx, dword [r10 + rax*4]
movzx ecx, byte [r8 + 6]
mov eax, edx
xor rcx, rax
movzx eax, cl
shr edx, 8
xor edx, dword [r10 + rax*4]
movzx ecx, byte [r8 + 7]
mov eax, edx
xor rcx, rax
movzx eax, cl
shr edx, 8
xor edx, dword [r10 + rax*4]
add r8, 8
add r12d, 0xfffffff8
sub r9, 1
jne 0x140033ac0
test r12d, r12d
je 0x140033b9d
nop word [rax + rax]
mov ecx, edx
movzx eax, byte [r8]
xor rcx, rax
movzx eax, cl
shr edx, 8
xor edx, dword [r10 + rax*4]
lea r8, [r8 + 1]
add r12d, 0xffffffff
jne 0x140033b80
not edx
mov dword [r14 + 0x1c], edx
mov rcx, r14
call fcn.140033560
test eax, eax
jne 0x140033bb9
mov eax, 5
jmp 0x140034752
mov rax, qword [r14 + 0x20]
mov r10, qword [rax + 0x48]
mov r11d, dword [rax + 0x54]
cmp dword [r14 + 0x98], 0
je 0x140033be7
cmp qword [r14 + 0xa0], 0
jne 0x140033be7
mov eax, 3
add r14, 8
jmp 0x14003475a
test r11d, r11d
je 0x1400341e7
lea rdx, reloc.SHELL32.dll_SHChangeNotifyRegister
lea r9, reloc.SHELL32.dll_SHChangeNotifyRegister
mov r12, qword [rbp - 0x61]
mov r13d, dword [rbp - 0x49]
mov r8d, dword [rbp - 0x59]
nop word [rax + rax]
cmp edi, r8d
jne 0x140033c4b
movzx eax, byte [r10]
mov byte [rbp + 4], al
xor ecx, ecx
mov dword [rbp - 1], ecx
mov dword [rbp + 7], ecx
mov rax, qword [r14 + 0x70]
mov rsi, rax
test rax, rax
jne 0x140033c37
mov rsi, qword [r14 + 0x90]
mov r15d, ecx
mov dword [rbp - 0x71], ecx
mov qword [r14 + 0x68], rax
mov qword [r14 + 0x70], rbx
inc r10
dec r11d
movzx ecx, byte [rbp + 4]
test ecx, ecx
je 0x1400344e8
sub ecx, 1
je 0x1400343be
sub ecx, 1
je 0x140034299
sub ecx, 1
je 0x14003421d
cmp ecx, 1
jne 0x14003475d
cmp dword [r14 + 0x98], 0
jne 0x1400341de
test rsi, rsi
je 0x140034738
mov rdx, qword [rbp - 0x61]
test r15d, r15d
jne 0x1400340e5
lea rax, reloc.SHELL32.dll_SHChangeNotifyRegister
cmp rdx, rax
jne 0x140033e85
cmp r11d, 3
jbe 0x1400340e5
movzx edx, byte [rbp + 1]
movzx r8d, byte [rbp]
movzx r9d, byte [rbp - 1]
movzx eax, byte [rbp + 9]
mov byte [rbp - 0x78], al
movzx eax, byte [rbp + 8]
mov byte [rbp - 0x79], al
movzx eax, byte [rbp + 7]
nop dword [rax]
cmp edi, 3
jle 0x1400340e1
movzx r9d, r9b
movzx r14d, byte [rsi + 2]
mov dword [rbp - 0x71], r14d
movzx r13d, al
mov eax, r14d
sub eax, r13d
lea ecx, [r9 + rax]
mov r12d, eax
neg r12d
cmovs r12d, eax
mov eax, ecx
sub eax, r14d
mov r14d, eax
neg r14d
cmovs r14d, eax
sub ecx, r13d
mov eax, ecx
neg eax
cmovs eax, ecx
mov ecx, r14d
cmp r12d, ecx
mov r14, qword [rbp - 0x39]
jg 0x140033d3d
cmp r12d, eax
jg 0x140033d3d
add r9b, byte [r10]
jmp 0x140033d56
cmp ecx, eax
jg 0x140033d4f
mov r12d, dword [rbp - 0x71]
movzx ecx, byte [r10]
lea r9d, [rcx + r12]
jmp 0x140033d5a
movzx r9d, byte [r10]
add r9b, r13b
mov r12d, dword [rbp - 0x71]
mov byte [rbx + 2], r9b
mov byte [rbp - 1], r9b
movzx eax, r12b
mov byte [rbp + 3], al
mov byte [rbp + 7], al
movzx r12d, r8b
mov dword [rbp - 0x51], r12d
movzx r8d, byte [rsi + 1]
mov dword [rbp - 0x71], r8d
movzx ecx, byte [rbp - 0x79]
mov eax, r8d
sub eax, ecx
lea ecx, [r12 + rax]
mov r12d, eax
neg r12d
cmovs r12d, eax
mov eax, ecx
sub eax, r8d
mov r13d, eax
neg r13d
cmovs r13d, eax
movzx r8d, byte [rbp - 0x79]
sub ecx, r8d
mov eax, ecx
neg eax
cmovs eax, ecx
movzx r8d, byte [r10 + 1]
cmp r12d, r13d
jg 0x140033dc7
cmp r12d, eax
jg 0x140033dc7
add r8b, byte [rbp - 0x51]
jmp 0x140033ddb
cmp r13d, eax
jg 0x140033dd4
mov eax, dword [rbp - 0x71]
add r8b, al
jmp 0x140033dde
movzx ecx, byte [rbp - 0x79]
add r8b, cl
mov eax, dword [rbp - 0x71]
mov byte [rbx + 1], r8b
mov byte [rbp], r8b
mov byte [rbp - 0x79], al
mov byte [rbp + 8], al
movzx r12d, dl
mov dword [rbp - 0x51], r12d
movzx edx, byte [rsi]
mov dword [rbp - 0x71], edx
movzx ecx, byte [rbp - 0x78]
mov eax, edx
sub eax, ecx
lea ecx, [r12 + rax]
mov r12d, eax
neg r12d
cmovs r12d, eax
mov eax, ecx
sub eax, edx
mov r13d, eax
neg r13d
cmovs r13d, eax
movzx edx, byte [rbp - 0x78]
sub ecx, edx
mov eax, ecx
neg eax
cmovs eax, ecx
movzx edx, byte [r10 + 2]
cmp r12d, r13d
jg 0x140033e3f
cmp r12d, eax
jg 0x140033e3f
add dl, byte [rbp - 0x51]
jmp 0x140033e51
cmp r13d, eax
jg 0x140033e4b
mov eax, dword [rbp - 0x71]
add dl, al
jmp 0x140033e54
movzx ecx, byte [rbp - 0x78]
add dl, cl
mov eax, dword [rbp - 0x71]
mov byte [rbx], dl
mov byte [rbp + 1], dl
mov byte [rbp - 0x78], al
mov byte [rbp + 9], al
sub edi, 3
add r11d, 0xfffffffd
add r10, 3
add rbx, 3
add rsi, 3
cmp r11d, 3
movzx eax, byte [rbp + 3]
ja 0x140033ce0
jmp 0x1400340e1
cmp rdx, r9
jne 0x1400340e5
cmp r11d, 4
jbe 0x1400340e5
movzx edx, byte [rbp + 2]
movzx r8d, byte [rbp + 1]
movzx r9d, byte [rbp]
movzx r12d, byte [rbp - 1]
movzx eax, byte [rbp + 0xa]
mov byte [rbp + 3], al
movzx eax, byte [rbp + 9]
mov byte [rbp - 0x79], al
movzx eax, byte [rbp + 8]
mov byte [rbp - 0x78], al
movzx r15d, byte [rbp + 7]
cmp edi, 4
jle 0x1400340d9
movzx r12d, r12b
movzx r14d, byte [rsi + 2]
mov dword [rbp - 0x75], r14d
movzx ecx, r15b
mov dword [rbp - 0x51], ecx
mov eax, r14d
sub eax, ecx
lea ecx, [r12 + rax]
mov r13d, eax
neg r13d
cmovs r13d, eax
mov eax, ecx
sub eax, r14d
mov r14d, eax
neg r14d
cmovs r14d, eax
mov dword [rbp + 0xf], r14d
sub ecx, dword [rbp - 0x51]
mov eax, ecx
neg eax
cmovs eax, ecx
movzx r14d, byte [r10]
mov ecx, dword [rbp + 0xf]
cmp r13d, ecx
jg 0x140033f23
cmp r13d, eax
jle 0x140033f34
cmp ecx, eax
jg 0x140033f30
mov ecx, dword [rbp - 0x75]
lea r12d, [r14 + rcx]
jmp 0x140033f3a
mov r12d, dword [rbp - 0x51]
mov ecx, dword [rbp - 0x75]
add r12b, r14b
mov byte [rbx + 2], r12b
mov byte [rbp - 1], r12b
movzx r15d, cl
mov byte [rbp + 7], cl
movzx r14d, r9b
mov dword [rbp + 0xf], r14d
movzx r9d, byte [rsi + 1]
mov dword [rbp - 0x75], r9d
movzx ecx, byte [rbp - 0x78]
mov eax, r9d
sub eax, ecx
lea ecx, [r14 + rax]
mov r14d, eax
neg r14d
cmovs r14d, eax
mov eax, ecx
sub eax, r9d
mov r13d, eax
neg r13d
cmovs r13d, eax
movzx r9d, byte [rbp - 0x78]
sub ecx, r9d
mov eax, ecx
neg eax
cmovs eax, ecx
movzx r9d, byte [r10 + 1]
cmp r14d, r13d
jg 0x140033fa4
cmp r14d, eax
jg 0x140033fa4
add r9b, byte [rbp + 0xf]
jmp 0x140033fb8
cmp r13d, eax
jg 0x140033fb1
mov eax, dword [rbp - 0x75]
add r9b, al
jmp 0x140033fbb
movzx ecx, byte [rbp - 0x78]
add r9b, cl
mov eax, dword [rbp - 0x75]
mov byte [rbx + 1], r9b
mov byte [rbp], r9b
mov byte [rbp - 0x78], al
mov byte [rbp + 8], al
movzx r14d, r8b
mov dword [rbp + 0xf], r14d
movzx r8d, byte [rsi]
mov dword [rbp - 0x75], r8d
movzx ecx, byte [rbp - 0x79]
mov eax, r8d
sub eax, ecx
lea ecx, [r14 + rax]
mov r14d, eax
neg r14d
cmovs r14d, eax
mov eax, ecx
sub eax, r8d
mov r13d, eax
neg r13d
cmovs r13d, eax
movzx r8d, byte [rbp - 0x79]
sub ecx, r8d
mov eax, ecx
neg eax
cmovs eax, ecx
movzx r8d, byte [r10 + 2]
cmp r14d, r13d
jg 0x140034023
cmp r14d, eax
jg 0x140034023
add r8b, byte [rbp + 0xf]
jmp 0x140034037
cmp r13d, eax
jg 0x140034030
mov eax, dword [rbp - 0x75]
add r8b, al
jmp 0x14003403a
movzx ecx, byte [rbp - 0x79]
add r8b, cl
mov eax, dword [rbp - 0x75]
mov byte [rbx], r8b
mov byte [rbp + 1], r8b
mov byte [rbp - 0x79], al
mov byte [rbp + 9], al
movzx r14d, dl
mov dword [rbp + 0xf], r14d
movzx edx, byte [rsi + 3]
mov dword [rbp - 0x75], edx
movzx ecx, byte [rbp + 3]
mov eax, edx
sub eax, ecx
lea ecx, [r14 + rax]
mov r14d, eax
neg r14d
cmovs r14d, eax
mov eax, ecx
sub eax, edx
mov r13d, eax
neg r13d
cmovs r13d, eax
movzx edx, byte [rbp + 3]
sub ecx, edx
mov eax, ecx
neg eax
cmovs eax, ecx
movzx edx, byte [r10 + 3]
cmp r14d, r13d
jg 0x14003409b
cmp r14d, eax
jg 0x14003409b
add dl, byte [rbp + 0xf]
jmp 0x1400340ad
cmp r13d, eax
jg 0x1400340a7
mov eax, dword [rbp - 0x75]
add dl, al
jmp 0x1400340b0
movzx ecx, byte [rbp + 3]
add dl, cl
mov eax, dword [rbp - 0x75]
mov byte [rbx + 3], dl
mov byte [rbp + 2], dl
mov byte [rbp + 3], al
mov byte [rbp + 0xa], al
sub edi, 4
add r11d, 0xfffffffc
add r10, 4
add rbx, 4
add rsi, 4
cmp r11d, 4
ja 0x140033ec5
mov r14, qword [rbp - 0x39]
mov r15d, dword [rbp - 0x71]
mov rdx, qword [rbp - 0x61]
test r11d, r11d
je 0x1400341e7
nop
movsxd rax, r15d
lea rcx, [rbp - 1]
add rcx, rax
mov qword [rbp - 0x51], rcx
movzx r8d, byte [rcx]
movsxd rdx, dword [rdx + rax*4]
movzx r13d, byte [rdx + rsi]
mov dword [rbp - 0x75], r13d
lea rax, [rbp + rax + 7]
mov qword [rbp - 0x71], rax
movzx r9d, byte [rax]
mov eax, r13d
sub eax, r9d
lea ecx, [r8 + rax]
mov r12d, eax
neg r12d
cmovs r12d, eax
mov eax, ecx
sub eax, r13d
mov r13d, eax
neg r13d
cmovs r13d, eax
sub ecx, r9d
mov eax, ecx
neg eax
cmovs eax, ecx
lea rcx, [rdx + rbx]
mov qword [rbp + 0xf], rcx
movzx ecx, byte [r10]
cmp r12d, r13d
jg 0x140034164
cmp r12d, eax
jg 0x140034164
add r8b, cl
jmp 0x140034176
cmp r13d, eax
jg 0x140034172
mov edx, dword [rbp - 0x75]
lea r8d, [rcx + rdx]
jmp 0x140034179
lea r8d, [rcx + r9]
mov edx, dword [rbp - 0x75]
mov rax, qword [rbp + 0xf]
mov byte [rax], r8b
mov rax, qword [rbp - 0x51]
mov byte [rax], r8b
mov rax, qword [rbp - 0x71]
mov byte [rax], dl
inc rsi
inc rbx
lea eax, [r15 + 1]
cdq
idiv dword [rbp - 0x49]
mov r15d, edx
mov dword [rbp - 0x71], edx
inc r10
dec r11d
sub edi, 1
je 0x1400341ba
test r11d, r11d
je 0x1400341e7
mov rdx, qword [rbp - 0x61]
jmp 0x1400340f0
mov r8d, dword [rbp - 0x59]
mov r13d, dword [rbp - 0x49]
mov r12, qword [rbp - 0x61]
lea r9, reloc.SHELL32.dll_SHChangeNotifyRegister
movsxd rax, dword [rbp - 0x69]
lea rdx, reloc.SHELL32.dll_SHChangeNotifyRegister
mov edi, r8d
add rbx, rax
test r11d, r11d
jne 0x140033c10
mov qword [r14 + 0x48], rbx
mov dword [r14 + 0x50], edi
mov dword [r14 + 0x60], r15d
movzx eax, byte [rbp + 4]
mov byte [r14 + 0x78], al
mov qword [r14 + 0x80], rsi
mov eax, dword [rbp - 1]
mov dword [r14 + 0x79], eax
mov eax, dword [rbp + 7]
mov dword [r14 + 0x88], eax
mov ebx, 1
jmp 0x14003475f
cmp dword [r14 + 0x98], 0
jne 0x1400341de
test rsi, rsi
je 0x140034738
test r11d, r11d
je 0x1400341e7
nop word [rax + rax]
movsxd rax, r15d
lea r9, [rbp - 1]
add r9, rax
movzx edx, byte [r9]
movsxd rax, dword [r12 + rax*4]
movzx r8d, byte [rax + rsi]
add r8d, edx
shr r8d, 1
add r8b, byte [r10]
mov byte [rax + rbx], r8b
mov byte [r9], r8b
inc rsi
inc rbx
lea eax, [r15 + 1]
cdq
idiv r13d
mov r15d, edx
mov dword [rbp - 0x71], edx
inc r10
dec r11d
sub edi, 1
je 0x140034290
test r11d, r11d
jne 0x140034240
jmp 0x1400341e7
mov r8d, dword [rbp - 0x59]
jmp 0x1400341c6
cmp dword [r14 + 0x98], 0
jne 0x1400341de
test rsi, rsi
je 0x140034742
mov r9, qword [rbp - 0x61]
test r15d, r15d
jne 0x14003436b
cmp r9, rdx
jne 0x140034312
cmp r11d, 3
jbe 0x14003436b
nop dword [rax]
cmp edi, 3
jle 0x14003436b
movzx eax, byte [rsi + 2]
add al, byte [r10]
mov byte [rbx + 2], al
movzx eax, byte [r10 + 1]
add al, byte [rsi + 1]
mov byte [rbx + 1], al
movzx eax, byte [r10 + 2]
add al, byte [rsi]
mov byte [rbx], al
sub edi, 3
add r11d, 0xfffffffd
add r10, 3
add rbx, 3
add rsi, 3
cmp r11d, 3
ja 0x1400342d0
jmp 0x14003436b
lea rax, reloc.SHELL32.dll_SHChangeNotifyRegister
cmp r9, rax
jne 0x14003436b
cmp r11d, 4
jbe 0x14003436b
cmp edi, 4
jle 0x14003436b
movzx eax, byte [rsi + 2]
add al, byte [r10]
mov byte [rbx + 2], al
movzx eax, byte [r10 + 1]
add al, byte [rsi + 1]
mov byte [rbx + 1], al
movzx eax, byte [r10 + 2]
add al, byte [rsi]
mov byte [rbx], al
movzx eax, byte [r10 + 3]
add al, byte [rsi + 3]
mov byte [rbx + 3], al
sub edi, 4
add r11d, 0xfffffffc
add r10, 4
add rbx, 4
add rsi, 4
cmp r11d, 4
ja 0x140034324
test r11d, r11d
je 0x1400341e7
nop dword [rax]
nop dword [rax + rax]
movsxd rax, r15d
movsxd rcx, dword [r9 + rax*4]
movzx eax, byte [rcx + rsi]
add al, byte [r10]
mov byte [rcx + rbx], al
inc rsi
inc rbx
lea eax, [r15 + 1]
cdq
idiv r13d
mov r15d, edx
mov dword [rbp - 0x71], edx
inc r10
dec r11d
sub edi, 1
je 0x1400341c2
test r11d, r11d
jne 0x140034380
jmp 0x1400341e7
cmp dword [r14 + 0x98], 0
jne 0x1400341de
mov r9, qword [rbp - 0x61]
test r15d, r15d
jne 0x140034495
cmp r9, rdx
jne 0x140034430
cmp r11d, 3
jbe 0x140034495
movzx eax, byte [rbp + 1]
movzx ecx, byte [rbp]
movzx edx, byte [rbp - 1]
cmp edi, 3
jle 0x140034495
add dl, byte [r10]
mov byte [rbx + 2], dl
mov byte [rbp - 1], dl
add cl, byte [r10 + 1]
mov byte [rbx + 1], cl
mov byte [rbp], cl
add al, byte [r10 + 2]
mov byte [rbx], al
mov byte [rbp + 1], al
sub edi, 3
add r11d, 0xfffffffd
add r10, 3
add rbx, 3
cmp r11d, 3
ja 0x1400343f4
jmp 0x140034495
lea rax, reloc.SHELL32.dll_SHChangeNotifyRegister
cmp r9, rax
jne 0x140034495
cmp r11d, 4
jbe 0x140034495
movzx eax, byte [rbp + 2]
movzx ecx, byte [rbp + 1]
movzx edx, byte [rbp]
movzx r8d, byte [rbp - 1]
cmp edi, 4
jle 0x1400344a0
add r8b, byte [r10]
mov byte [rbx + 2], r8b
mov byte [rbp - 1], r8b
add dl, byte [r10 + 1]
mov byte [rbx + 1], dl
mov byte [rbp], dl
add cl, byte [r10 + 2]
mov byte [rbx], cl
mov byte [rbp + 1], cl
add al, byte [r10 + 3]
mov byte [rbx + 3], al
mov byte [rbp + 2], al
sub edi, 4
add r11d, 0xfffffffc
add r10, 4
add rbx, 4
cmp r11d, 4
ja 0x140034453
test r11d, r11d
je 0x1400341e7
nop
movsxd rax, r15d
lea rdx, [rbp - 1]
add rdx, rax
movzx ecx, byte [r10]
add cl, byte [rdx]
movsxd rax, dword [r9 + rax*4]
mov byte [rax + rbx], cl
mov byte [rdx], cl
inc rbx
lea eax, [r15 + 1]
cdq
idiv r13d
mov r15d, edx
mov dword [rbp - 0x71], edx
inc r10
dec r11d
sub edi, 1
je 0x1400344df
test r11d, r11d
jne 0x1400344a0
jmp 0x1400341e7
mov r8d, dword [rbp - 0x59]
jmp 0x1400341c2
cmp dword [r14 + 0x98], 0
je 0x140034650
mov eax, dword [r14 + 0x3c]
cmp eax, 4
jne 0x1400345e4
cmp qword [r14 + 0xa8], 0
je 0x140034584
test r11d, r11d
je 0x1400341e7
nop word [rax + rax]
movzx r8d, byte [r10]
lea rdx, [r8 + r8*2]
mov rax, qword [r14 + 0xa0]
movzx ecx, byte [rdx + rax]
mov byte [rbx + 2], cl
mov rax, qword [r14 + 0xa0]
movzx ecx, byte [rax + rdx + 1]
mov byte [rbx + 1], cl
mov rax, qword [r14 + 0xa0]
movzx ecx, byte [rax + rdx + 2]
mov byte [rbx], cl
mov rax, qword [r14 + 0xa8]
movzx ecx, byte [r8 + rax]
mov byte [rbx + 3], cl
add rbx, 4
inc r10
dec r11d
sub edi, 4
je 0x14003457b
test r11d, r11d
jne 0x140034520
jmp 0x1400341e7
mov r8d, dword [rbp - 0x59]
jmp 0x1400341cd
test r11d, r11d
je 0x1400341e7
nop dword [rax]
movzx eax, byte [r10]
lea rdx, [rax + rax*2]
mov rax, qword [r14 + 0xa0]
movzx ecx, byte [rdx + rax]
mov byte [rbx + 2], cl
mov rax, qword [r14 + 0xa0]
movzx ecx, byte [rax + rdx + 1]
mov byte [rbx + 1], cl
mov rax, qword [r14 + 0xa0]
movzx ecx, byte [rax + rdx + 2]
mov byte [rbx], cl
mov byte [rbx + 3], 0xff
add rbx, 4
inc r10
dec r11d
sub edi, 4
je 0x1400341cd
test r11d, r11d
jne 0x140034590
jmp 0x1400341e7
cmp eax, 3
jne 0x1400341de
test r11d, r11d
je 0x1400341e7
nop word [rax + rax]
movzx eax, byte [r10]
lea rdx, [rax + rax*2]
mov rax, qword [r14 + 0xa0]
movzx ecx, byte [rdx + rax]
mov byte [rbx + 2], cl
mov rax, qword [r14 + 0xa0]
movzx ecx, byte [rax + rdx + 1]
mov byte [rbx + 1], cl
mov rax, qword [r14 + 0xa0]
movzx ecx, byte [rax + rdx + 2]
mov byte [rbx], cl
add rbx, 3
inc r10
dec r11d
sub edi, 3
je 0x1400341cd
test r11d, r11d
jne 0x140034600
jmp 0x1400341e7
mov r9, qword [rbp - 0x61]
test r15d, r15d
jne 0x1400346f0
cmp r9, rdx
jne 0x1400346a6
cmp r11d, 3
jbe 0x1400346f0
nop dword [rax]
cmp edi, 3
jle 0x140034700
movzx eax, byte [r10]
mov byte [rbx + 2], al
movzx eax, byte [r10 + 1]
mov byte [rbx + 1], al
movzx eax, byte [r10 + 2]
mov byte [rbx], al
sub edi, 3
add r11d, 0xfffffffd
add r10, 3
add rbx, 3
cmp r11d, 3
ja 0x140034670
jmp 0x1400346f0
lea rax, reloc.SHELL32.dll_SHChangeNotifyRegister
cmp r9, rax
jne 0x1400346f0
cmp r11d, 4
jbe 0x1400346f0
cmp edi, 4
jle 0x140034700
movzx eax, byte [r10]
mov byte [rbx + 2], al
movzx eax, byte [r10 + 1]
mov byte [rbx + 1], al
movzx eax, byte [r10 + 2]
mov byte [rbx], al
movzx eax, byte [r10 + 3]
mov byte [rbx + 3], al
sub edi, 4
add r11d, 0xfffffffc
add r10, 4
add rbx, 4
cmp r11d, 4
ja 0x1400346b8
test r11d, r11d
je 0x1400341e7
nop dword [rax]
movsxd rax, r15d
movsxd rcx, dword [r9 + rax*4]
movzx eax, byte [r10]
mov byte [rcx + rbx], al
inc rbx
lea eax, [r15 + 1]
cdq
idiv r13d
mov r15d, edx
mov dword [rbp - 0x71], edx
inc r10
dec r11d
sub edi, 1
je 0x1400341c2
test r11d, r11d
jne 0x140034700
jmp 0x1400341e7
mov dword [r14 + 8], 6
jmp 0x14003475d
mov eax, 6
add r14, 8
jmp 0x14003475a
mov eax, 4
mov ecx, 8
add r14, rcx
mov dword [r14], eax
xor ebx, ebx
mov rax, qword [rbp - 0x41]
test rax, rax
je 0x140034770
mov rcx, rax
call fcn.140207144
mov eax, ebx
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1401f74b0
mov rbx, qword [rsp + 0x120]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rbp - 0x31]
call fcn.14004b620
lea rdx, [0x1402fc5f8]
lea rcx, [rbp - 0x31]
call fcn.1401f9a30
int3