Function at 0x1400010a0
Capabilities:
Access peb ldr_data
Check os version
Encode data using xor
Execute anti-debugging instructions
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r13
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x14000b010]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov dword [rcx + 0x1c], 8
xor al, al
mov byte [rbp - 0x19], al
mov r8d, 1
mov qword [rbp - 9], r8
xor r14d, r14d
mov rax, qword gs:[0x60]
mov r13, rcx
mov dword [0x14000cc88], 8
mov rdx, qword [rax + 0x18]
mov rax, qword [rdx + 0x10]
mov rdx, qword [rax]
mov rax, qword [0x14000cc18]
mov r10, qword [rdx + 0x30]
test rax, rax
jne 0x1400011ad
movsxd rax, dword [r10 + 0x3c]
mov r11d, r14d
mov edi, dword [rax + r10 + 0x88]
mov esi, dword [rdi + r10 + 0x20]
nop dword [rax + rax]
mov ebx, r11d
mov r9d, 0x881e0b35
lea rax, [rsi + rbx*4]
mov r8d, dword [rax + r10]
add r8, r10
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140001181
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x140001150
cmp r9d, 0x7c90f0fa
je 0x140001186
inc r11d
jmp 0x140001130
mov ecx, dword [rdi + r10 + 0x24]
mov r8d, 1
add rcx, r10
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rdi + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x14000cc18], rax
mov qword [r13 + 8], rax
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov al, byte [0x7ffe026c]
movzx edx, word [rcx + 0x120]
cmp al, 0xa
jne 0x1400011f9
mov eax, dword [0x7ffe0260]
cmp eax, 0x55f0
je 0x1400011ef
cmp eax, 0x585d
je 0x1400011ef
mov ecx, 0x40
jmp 0x14000127e
mov ecx, 0x80
jmp 0x14000127e
cmp al, 5
jne 0x140001204
mov ecx, 2
jmp 0x14000127e
cmp al, 6
jne 0x140001234
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x14000122d
sub ecx, 1
je 0x140001226
cmp ecx, 1
jne 0x140001234
mov ecx, 0x20
jmp 0x14000127e
mov ecx, 0x10
jmp 0x14000127e
mov ecx, 8
jmp 0x14000127e
mov ecx, 0xed9
movzx eax, dx
sub ax, cx
mov ecx, 0xed6
cmp ax, cx
ja 0x140001250
mov ecx, 4
jmp 0x14000127e
mov eax, 0x893
cmp dx, ax
ja 0x14000125f
mov ecx, r8d
jmp 0x14000127e
mov eax, 0x2800
mov ecx, 0x40
sub dx, ax
mov r8d, 0x305d
cmp dx, r8w
mov eax, r14d
cmovbe eax, ecx
mov ecx, eax
mov dword [r13 + 0x18], ecx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x14000ccd0]
mov r10, qword [rcx + 0x30]
test rax, rax
jne 0x140001337
movsxd rax, dword [r10 + 0x3c]
mov r11d, r14d
mov edi, dword [rax + r10 + 0x88]
mov esi, dword [rdi + r10 + 0x20]
nop
mov ebx, r11d
mov r9d, 0x832d0de0
lea rax, [rsi + rbx*4]
mov r8d, dword [rax + r10]
add r8, r10
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140001311
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x1400012e0
cmp r9d, 0xdea20866
je 0x140001316
inc r11d
jmp 0x1400012c0
mov ecx, dword [rdi + r10 + 0x24]
add rcx, r10
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rdi + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x14000ccd0], rax
mov qword [r13], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x14000cca8]
mov r10, qword [rcx + 0x30]
test rax, rax
jne 0x1400013f7
movsxd rax, dword [r10 + 0x3c]
mov r11d, r14d
mov edi, dword [rax + r10 + 0x88]
mov esi, dword [rdi + r10 + 0x20]
nop word [rax + rax]
mov ebx, r11d
mov r9d, 0x1425a35e
lea rax, [rsi + rbx*4]
mov r8d, dword [rax + r10]
add r8, r10
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x1400013d1
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x1400013a0
cmp r9d, 0xaa0323e9
je 0x1400013d6
inc r11d
jmp 0x140001380
mov ecx, dword [rdi + r10 + 0x24]
add rcx, r10
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rdi + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x14000cca8], rax
mov qword [r13 + 0x10], rax
cmp qword [r13], r14
je 0x140001d9b
cmp qword [r13 + 8], r14
je 0x140001d9b
test rax, rax
je 0x140001d9b
mov qword [rsp + 0x30], r14
lea rcx, str..TitanHide
mov dword [rsp + 0x28], r14d
xor r9d, r9d
mov qword [rsp + 0xc8], r12
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
mov qword [rsp + 0xd0], r15
mov dword [rbp + 0x1f], r14d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400014a3
mov dword [rbp + 7], 2
lea r9, [rbp + 0x1f]
mov rcx, qword gs:[0x30]
mov r8d, 0x10
mov qword [rsp + 0x20], r14
mov rdx, qword [rcx + 0x40]
mov rcx, rax
mov qword [rbp + 0xf], rdx
lea rdx, [rbp + 7]
mov dword [rbp + 0xb], 0x3ff
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [r13 + 0x10]
lea r9, [rbp - 1]
xor r8d, r8d
mov dword [rbp - 1], r14d
lea rdx, [rbp - 1]
mov qword [rbp - 0x11], r14
mov rbx, r14
mov rsi, r14
lea ecx, [r8 + 0x10]
call rdi
cmp eax, 0xc0000004
jne 0x140001517
nop dword [rax]
test rbx, rbx
je 0x1400014e6
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 1]
xor ecx, ecx
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rbp - 1]
lea r9, [rbp - 1]
mov rdx, rax
mov ecx, 0x10
mov rbx, rax
call rdi
cmp eax, 0xc0000004
je 0x1400014d0
test eax, eax
jns 0x140001537
test rbx, rbx
je 0x140001531
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov qword [rbp - 0x11], r14
jmp 0x140001588
mov eax, dword [rbx]
test eax, eax
je 0x140001577
lea rdx, [rbx + 8]
mov r8d, eax
nop dword [rax]
nop dword [rax + rax]
movups xmm1, xmmword [rdx]
mov rcx, qword gs:[0x30]
movd eax, xmm1
cmp ax, word [rcx + 0x40]
jne 0x140001569
inc rsi
add rdx, 0x18
sub r8, 1
jne 0x140001550
mov qword [rbp - 0x11], rsi
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
rdtsc
mov rcx, qword gs:[0x30]
shl rdx, 0x20
or rax, rdx
xor edx, edx
mov r12, rax
movabs rax, 0xffffffffff
mov r8d, dword [rcx + 0x40]
and r12, rax
movabs rax, 0x80000000000
mov ecx, 0x200
sub r12, rax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
je 0x14000165a
mov rcx, qword gs:[0x30]
lea r8, [rbp - 9]
mov r9d, 8
mov qword [rsp + 0x20], r14
mov rdi, qword [rcx + 0x40]
mov rcx, qword gs:[0x30]
lea edx, [r9 + 0x16]
mov rsi, qword [rcx + 0x48]
mov rcx, qword gs:[0x30]
mov qword [rcx + 0x40], r14
mov rcx, qword gs:[0x30]
mov qword [rcx + 0x48], r14
mov rcx, rax
mov r10, qword [r13 + 8]
call r10
mov rcx, qword gs:[0x30]
mov ebx, eax
mov qword [rcx + 0x40], rdi
mov rcx, qword gs:[0x30]
mov qword [rcx + 0x48], rsi
mov rcx, r15
call qword [r13]
cmp ebx, 0xc0000022
jne 0x140001656
cmp dword [rbp - 9], 1
je 0x14000165a
mov byte [rbp - 0x19], 1
mov rax, qword gs:[0x30]
xor edx, edx
mov ecx, 0x400
mov r8d, dword [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, 0x10
movabs rbx, 0xfffffffff
mov rsi, rax
test rax, rax
je 0x1400019c0
mov rcx, qword gs:[0x30]
mov r15, qword [rcx + 0x40]
mov rcx, qword gs:[0x30]
mov qword [rbp + 0x1f], r15
mov rax, qword [rcx + 0x48]
mov rcx, qword gs:[0x30]
mov qword [rbp + 7], rax
mov qword [rcx + 0x40], r14
mov rcx, qword gs:[0x30]
mov qword [rcx + 0x48], r14
nop dword [rax + rax]
mov r9d, 8
mov qword [rsp + 0x20], r14
mov r8, r12
mov rcx, rsi
lea edx, [r9 + 0x16]
call qword [r13 + 8]
xor r9d, r9d
mov qword [rsp + 0x20], r14
mov r8, r12
mov rcx, rsi
lea edx, [r9 + 0x1e]
call qword [r13 + 8]
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
mov rcx, rsi
lea edx, [r9 + 0x1e]
call qword [r13 + 8]
mov r9d, 8
lea rax, [rbp - 9]
lea r8, [rbp - 9]
mov qword [rsp + 0x20], rax
mov rcx, rsi
lea edx, [r9 + 0x16]
call qword [r13 + 8]
rdtsc
shl rdx, 0x20
or rax, rdx
and rax, rbx
add rax, 0x10000000
add r12, rax
sub rdi, 1
jne 0x1400016d0
mov rax, qword [r13 + 8]
lea r9d, [rdi + 8]
lea r8, [rbp - 9]
mov qword [rbp - 9], r14
lea edx, [rdi + 0x1e]
mov qword [rsp + 0x20], r14
mov rcx, rsi
call rax
cmp eax, 0xc0000353
jne 0x14000177c
cmp dword [rbp - 9], r14d
je 0x14000184c
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x14000cbe0]
mov r11, qword [rcx + 0x30]
test rax, rax
jne 0x14000183b
movsxd rax, dword [r11 + 0x3c]
mov r10d, r14d
mov edi, dword [rax + r11 + 0x88]
mov r15d, dword [rdi + r11 + 0x20]
nop dword [rax + rax]
mov ebx, r10d
mov r9d, 0xf402ab11
lea rax, [r15 + rbx*4]
mov r8d, dword [rax + r11]
add r8, r11
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140001811
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x1400017e0
cmp r9d, 0x61ecd093
je 0x140001816
inc r10d
jmp 0x1400017c0
mov ecx, dword [rdi + r11 + 0x24]
mov r15, qword [rbp + 0x1f]
add rcx, r11
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rdi + r11 + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
mov qword [0x14000cbe0], rax
mov rdx, qword [rbp - 9]
mov rcx, 0xffffffffffffffff
call rax
mov bl, 1
jmp 0x140001850
movzx ebx, byte [rbp - 0x19]
mov rax, qword [r13 + 8]
lea rcx, [rbp - 9]
mov r9d, 8
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 9]
mov rcx, rsi
lea edx, [r9 + 0x16]
call rax
cmp eax, 0xc0000353
jne 0x14000187e
cmp qword [rbp - 9], 8
je 0x140001880
mov bl, 1
mov rax, qword [r13 + 8]
mov edi, 1
mov qword [rbp - 9], rdi
mov qword [rsp + 0x20], r14
lea edx, [rdi + 0x1d]
lea rcx, [rdi - 2]
lea r9d, [rdi + 7]
lea r8d, [rdi + 4]
call rax
cmp eax, 0x80000002
je 0x1400018b1
cmp eax, 0xc0000003
jne 0x1400018b7
cmp qword [rbp - 9], rdi
je 0x1400018bb
movzx ebx, dil
mov rax, qword [r13 + 8]
lea r8, [rbp - 9]
mov r9d, edi
mov qword [rsp + 0x20], r14
mov edx, 0x1e
mov rcx, rsi
call rax
cmp eax, 0xc0000004
movzx edi, bl
mov r9d, 8
lea r8, [rbp - 9]
mov eax, 1
mov rcx, rsi
cmovne edi, eax
mov rax, qword [r13 + 8]
and r12d, 0xfff
lea edx, [r9 + 0x16]
mov qword [rsp + 0x20], r12
call rax
cmp eax, 0xc0000005
je 0x140001916
cmp eax, 0x80000002
jne 0x14000191d
cmp qword [rbp - 9], 1
je 0x140001920
mov dil, 1
mov rax, qword [r13 + 8]
lea r8, [rbp - 9]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov rcx, rsi
lea edx, [r9 + 0x1e]
call rax
cmp eax, 0xc0000005
je 0x140001947
cmp eax, 0x80000002
jne 0x14000194e
cmp qword [rbp - 9], 1
je 0x140001951
mov dil, 1
mov rax, qword [r13 + 8]
lea r8, [rbp - 9]
mov r9d, 8
mov qword [rsp + 0x20], r12
xor ecx, ecx
lea edx, [r9 + 0x16]
call rax
cmp eax, 0xc0000005
je 0x14000197a
cmp eax, 0x80000002
jne 0x140001981
cmp qword [rbp - 9], 1
je 0x140001984
mov dil, 1
mov rcx, rsi
call qword [r13]
mov rax, qword gs:[0x30]
mov qword [rax + 0x40], r15
mov r15d, 1
mov rax, qword gs:[0x30]
mov rcx, qword [rbp + 7]
mov qword [rax + 0x48], rcx
jmp 0x140001c95
mov r9d, 8
mov qword [rsp + 0x20], r14
mov r8, r12
mov rcx, 0xffffffffffffffff
lea edx, [r9 + 0x16]
call qword [r13 + 8]
xor r9d, r9d
mov qword [rsp + 0x20], r14
mov r8, r12
lea edx, [r9 + 0x1e]
lea rcx, [r9 - 1]
call qword [r13 + 8]
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
lea edx, [r9 + 0x1e]
lea rcx, [r9 - 1]
call qword [r13 + 8]
mov r9d, 8
lea rax, [rbp - 9]
lea r8, [rbp - 9]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
lea edx, [r9 + 0x16]
call qword [r13 + 8]
rdtsc
shl rdx, 0x20
or rax, rdx
and rax, rbx
add rax, 0x10000000
add r12, rax
sub rdi, 1
jne 0x1400019c0
mov rax, qword [r13 + 8]
lea r9d, [rdi + 8]
lea r8, [rbp - 9]
mov qword [rbp - 9], r14
lea edx, [rdi + 0x1e]
mov qword [rsp + 0x20], r14
lea rcx, [rdi - 1]
call rax
cmp eax, 0xc0000353
jne 0x140001a7b
cmp qword [rbp - 9], r14
je 0x140001b48
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x14000cc00]
mov r11, qword [rcx + 0x30]
test rax, rax
jne 0x140001b37
movsxd rax, dword [r11 + 0x3c]
mov r10d, r14d
mov edi, dword [rax + r11 + 0x88]
mov esi, dword [rdi + r11 + 0x20]
nop word [rax + rax]
mov ebx, r10d
mov r9d, 0x56b088c8
lea rax, [r11 + rbx*4]
mov r8d, dword [rax + rsi]
add r8, r11
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140001b11
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x140001ae0
cmp r9d, 0x183133a2
je 0x140001b16
inc r10d
jmp 0x140001ac0
mov ecx, dword [rdi + r11 + 0x24]
add rcx, r11
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rdi + r11 + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
mov qword [0x14000cc00], rax
mov rdx, qword [rbp - 9]
mov rcx, 0xffffffffffffffff
call rax
mov bl, 1
jmp 0x140001b4c
movzx ebx, byte [rbp - 0x19]
mov rax, qword [r13 + 8]
lea rcx, [rbp - 9]
mov r9d, 8
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 9]
mov rcx, 0xffffffffffffffff
lea edx, [r9 + 0x16]
call rax
cmp eax, 0xc0000353
jne 0x140001d97
cmp qword [rbp - 9], 8
jne 0x140001d97
mov rax, qword [r13 + 8]
mov r15d, 1
mov qword [rbp - 9], r15
mov qword [rsp + 0x20], r14
lea edx, [r15 + 0x1d]
lea rcx, [r15 - 2]
lea r9d, [r15 + 7]
lea r8d, [r15 + 4]
call rax
cmp eax, 0x80000002
je 0x140001bb9
cmp eax, 0xc0000003
jne 0x140001bbf
cmp qword [rbp - 9], r15
je 0x140001bc3
movzx ebx, r15b
mov rax, qword [r13 + 8]
lea r8, [rbp - 9]
mov r9d, r15d
mov qword [rsp + 0x20], r14
mov edx, 0x1e
mov rcx, 0xffffffffffffffff
call rax
cmp eax, 0xc0000004
movzx edi, bl
mov rax, qword [r13 + 8]
lea r8, [rbp - 9]
mov r9d, 8
mov qword [rbp - 9], r15
cmovne edi, r15d
mov rcx, 0xffffffffffffffff
and r12d, 0xfff
mov qword [rsp + 0x20], r12
lea edx, [r9 + 0x16]
call rax
cmp eax, 0xc0000005
je 0x140001c26
cmp eax, 0x80000002
jne 0x140001c2c
cmp qword [rbp - 9], r15
je 0x140001c30
movzx edi, r15b
mov rax, qword [r13 + 8]
lea r8, [rbp - 9]
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea edx, [r9 + 0x1e]
lea rcx, [r9 - 1]
call rax
cmp eax, 0xc0000005
je 0x140001c58
cmp eax, 0x80000002
jne 0x140001c5e
cmp qword [rbp - 9], r15
je 0x140001c62
movzx edi, r15b
mov rax, qword [r13 + 8]
lea r8, [rbp - 9]
mov r9d, 8
mov qword [rsp + 0x20], r12
xor ecx, ecx
lea edx, [r9 + 0x16]
call rax
cmp eax, 0xc0000005
je 0x140001c8b
cmp eax, 0x80000002
jne 0x140001c91
cmp qword [rbp - 9], r15
je 0x140001c95
movzx edi, r15b
mov rsi, qword [r13 + 0x10]
lea r9, [rbp + 0x1f]
xor r8d, r8d
mov dword [rbp + 0x1f], r14d
lea rdx, [rbp + 0x1f]
mov rbx, r14
lea ecx, [r8 + 0x10]
call rsi
cmp eax, 0xc0000004
jne 0x140001cff
test rbx, rbx
je 0x140001cce
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x1f]
xor ecx, ecx
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rbp + 0x1f]
lea r9, [rbp + 0x1f]
mov rdx, rax
mov ecx, 0x10
mov rbx, rax
call rsi
cmp eax, 0xc0000004
je 0x140001cb8
test eax, eax
jns 0x140001d0a
test rbx, rbx
je 0x140001d54
jmp 0x140001d43
mov eax, dword [rbx]
test eax, eax
je 0x140001d43
lea rdx, [rbx + 8]
mov r8d, eax
nop word [rax + rax]
movups xmm1, xmmword [rdx]
mov rcx, qword gs:[0x30]
movd eax, xmm1
cmp ax, word [rcx + 0x40]
jne 0x140001d39
inc r14
add rdx, 0x18
sub r8, 1
jne 0x140001d20
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
sub r14, qword [rbp - 0x11]
cmp r14, 0x10
movzx eax, dil
cmova eax, r15d
mov r12, qword [rsp + 0xc8]
mov r15, qword [rsp + 0xd0]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140007a30
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
mov al, 1
jmp 0x140001d64
xor al, al
jmp 0x140001d74