Function at 0x1400115c0
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x320
lea rbp, [rsp + 0x70]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140024040]
xor rax, rsp
mov qword [rbp + 0x2a0], rax
mov r14, rdx
mov qword [rbp + 0x18], rdx
movsxd r12, ecx
movabs rax, 0xa495ffdb608c070a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x7e90d8b1df9c984e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x8153b7d3509e3d62
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0x9d7e8c888674cca1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0x54b7ceddfc7c84f2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0x5ac166b9a9d8bc18
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0x3a8c0b3eae5fbd9a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0x22e57924731595a9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rax, 0x1a1254ac7b41df7d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0x2ab7b38a539d25cb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0x67982e435e724b38
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rax, 0x72b2c9cc9e4a5fe6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0xcf29686a569fa943
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0xc3427fe59da63f97
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0xb8a964d3d6f2f81d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0xf846cdab88b4d366
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movabs rax, 0x76eb0c1bf06b2e40
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rax, 0xf7c9b0df1b478b8e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
movabs rax, 0x28a0f18db88d6e67
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x130], rax
movabs rax, 0x1a35947b0459010f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x138], rax
movabs rax, 0x861f9d12672db46e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0x799688e06f54d894
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs rax, 0x8e1464ec7e53a795
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
movabs rcx, 0x2ac4a5708c33715c
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
movabs rax, 0x84e6d2fb0cfe7269
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
movabs r13, 0x51bfe2c2afe8ec26
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
movabs r15, 0xe536c5fd23ee4d03
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1f0], rax
movabs rsi, 0xfe50e9e4ef12adc8
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1f8], rax
movabs rdi, 0x3bf4e1a78953e99d
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
movabs rbx, 0x3faf0fdec79dd96a
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
movabs rax, 0x14fe6e59cf31dcd7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x210], rax
movabs rax, 0x4c9216404c70edcc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x218], rax
movabs rax, 0x717d20f31f20b011
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
movabs rax, 0x1bd2d6ba60a04bae
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
movabs rax, 0x5ff94a75664b7a0b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x230], rax
movabs rax, 0x1085f9fcfa796ed0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x238], rax
movabs rax, 0xfc190b5f34f99f25
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x240], rax
movabs rax, 0xa67146d6f8c308f2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x248], rax
movabs rax, 0xdbcc50b1e0c2c97f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x250], rax
movabs rax, 0xcb27ac98bfd5e354
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x258], rax
movabs rax, 0x4e8a6d2bc30f1e79
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x260], rax
movabs rax, 0x82a69df23b25bfb6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x268], rax
movabs rax, 0x749ab2adccf81e13
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x270], rax
movabs rax, 0x4646e31460376858
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x278], rax
movabs rax, 0xef78f357025fdb2d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x280], rax
movabs rax, 0x1cf1e98e0e19bdfa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x288], rax
movabs rax, 0x8e146489063689e7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x290], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x298], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x1e0]
vmovdqa ymmword [rbp + 0xa0], ymm1
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x200]
vmovdqa ymmword [rbp + 0xc0], ymm1
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x220]
vmovdqa ymmword [rbp + 0xe0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x240]
vmovdqa ymmword [rbp + 0x100], ymm1
vmovdqu ymm0, ymmword [rbp + 0x120]
vpxor ymm1, ymm0, ymmword [rbp + 0x260]
vmovdqa ymmword [rbp + 0x120], ymm1
vmovdqu ymm0, ymmword [rbp + 0x140]
vpxor ymm1, ymm0, ymmword [rbp + 0x280]
vmovdqa ymmword [rbp + 0x140], ymm1
lea rcx, [rbp + 0xa0]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movabs rax, 0xbea5f28f7e9f061a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x22c88da6c181bb7a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x8258809851810e5f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x99318785a277c3a1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x3bf484dfec7d9bf8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x84e6d2fb0cfe7269
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x1a0]
vmovdqa ymmword [rbp + 0x20], ymm1
vmovdqa xmm0, xmmword [rbp + 0x40]
vxorps xmm0, xmm0, xmmword [rbp + 0x1c0]
vmovdqa xmmword [rbp + 0x40], xmm0
lea rcx, [rbp + 0x20]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140011270]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov r13d, 1
mov esi, r13d
mov dword [rbp + 0xc], r13d
lea rbx, [r14 + 8]
cmp r12d, r13d
jle 0x140011d1b
mov rdi, rbx
mov rcx, qword [rdi]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140011c90
cmp rax, 5
jne 0x140011cc2
add rcx, 2
lea rdx, [0x14001dde0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140011cc2
mov rax, qword [rdi]
cmp word [rax], 0x2f
je 0x140012135
mov rcx, qword [rdi]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140011cd0
cmp rax, 6
jne 0x140011d09
add rcx, 4
lea rdx, [0x14001dde0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140011d09
mov rax, qword [rdi]
cmp word [rax], 0x2d
jne 0x140011d09
cmp word [rax + 2], 0x2d
je 0x140012132
inc esi
mov dword [rbp + 0xc], esi
add rdi, 8
cmp esi, r12d
jl 0x140011c82
xor r15b, r15b
lea r8, [0x14001ddf0]
mov rdx, r14
mov ecx, r12d
call fcn.140011320
mov r14d, eax
mov edi, r13d
mov dword [rbp + 0xc], 0xffffffff
cmp r12d, r13d
jle 0x140011de4
nop word [rax + rax]
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140011d60
cmp rax, 9
jne 0x140011d8e
add rcx, 2
lea rdx, str.indPages
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140011d8e
mov rax, qword [rbx]
cmp word [rax], 0x2f
je 0x140011df2
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140011da0
cmp rax, 0xa
jne 0x140011dd5
add rcx, 4
lea rdx, str.indPages
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140011dd5
mov rax, qword [rbx]
cmp word [rax], 0x2d
jne 0x140011dd5
cmp word [rax + 2], 0x2d
je 0x140011df2
inc edi
add rbx, 8
cmp edi, r12d
jl 0x140011d50
mov edi, 0xffffffff
cmp r12d, r13d
jle 0x140011e99
mov rbx, qword [rbp + 0x18]
add rbx, 8
nop word [rax + rax]
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140011e10
cmp rax, 0x12
jne 0x140011e42
add rcx, 2
lea rdx, str.PassAllocationPtr
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140011e42
mov rax, qword [rbx]
cmp word [rax], 0x2f
je 0x140012158
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140011e50
cmp rax, 0x13
jne 0x140011e89
add rcx, 4
lea rdx, str.PassAllocationPtr
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140011e89
mov rax, qword [rbx]
cmp word [rax], 0x2d
jne 0x140011e89
cmp word [rax + 2], 0x2d
je 0x140012158
inc r13d
add rbx, 8
cmp r13d, r12d
jl 0x140011e00
xor sil, sil
mov dword [rbp + 0x10], 1
mov r13d, 0xffffffff
cmp r12d, 1
jle 0x140011f5e
mov rbx, qword [rbp + 0x18]
add rbx, 8
nop dword [rax + rax]
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140011ed0
cmp rax, 6
jne 0x140011f02
add rcx, 2
lea rdx, str.clean
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140011f02
mov rax, qword [rbx]
cmp word [rax], 0x2f
je 0x14001216b
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140011f10
cmp rax, 7
jne 0x140011f49
add rcx, 4
lea rdx, str.clean
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140011f49
mov rax, qword [rbx]
cmp word [rax], 0x2d
jne 0x140011f49
cmp word [rax + 2], 0x2d
je 0x14001216b
mov edx, dword [rbp + 0x10]
inc edx
mov dword [rbp + 0x10], edx
add rbx, 8
cmp edx, r12d
jl 0x140011ec0
mov ebx, 0xffffffff
test ebx, ebx
setg byte [rbp + 8]
cmp dword [rbp + 0xc], 0
jle 0x140011f92
lea rdx, str.___Free_pool_memory_after_usage_enabled
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14000a490
lea rdx, [0x14000a670]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
test r14d, r14d
jle 0x140011fba
lea rdx, str.___Mdl_memory_usage_enabled
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14000a490
lea rdx, [0x14000a670]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
test edi, edi
jle 0x140011fe1
lea rdx, str.___Allocate_Independent_Pages_mode_enabled
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14000a490
lea rdx, [0x14000a670]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
test r13d, r13d
jle 0x140012009
lea rdx, str.___Pass_Allocation_Ptr_as_first_param_enabled
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14000a490
lea rdx, [0x14000a670]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
test ebx, ebx
jle 0x140012030
lea rdx, str.___Clean_Valnerable_Driver_enabled
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14000a490
lea rdx, [0x14000a670]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov ecx, 1
mov dword [rbp + 0xc], ecx
cmp r12d, ecx
jle 0x140012366
mov qword [rbp + 0x60], r12
mov eax, ecx
mov qword [rbp], rcx
xor r13d, r13d
nop
mov rcx, qword [rbp + 0x18]
mov rdx, qword [rcx + rax*8]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdx + r8*2], 0
jne 0x140012060
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r13
mov qword [rbp + 0x98], r13
lea rcx, [rbp + 0x80]
call fcn.14000c980
nop
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 7
cmova rcx, qword [rbp + 0x80]
mov rax, qword [rbp + 0x90]
lea r12, [rcx + rax*2]
mov rbx, r12
mov rdx, r12
call fcn.140010860
cmp rax, r12
je 0x1400120fc
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x1400120d1
cmp cx, 0x2f
jne 0x1400120da
add rax, 2
cmp rax, r12
jne 0x1400120c2
cmp rax, r12
je 0x1400120fc
nop
lea r8, [rbx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x1400120fc
cmp cx, 0x2f
je 0x1400120fc
mov rbx, r8
cmp rax, r8
jne 0x1400120e0
mov r8d, 0x3a
mov rdx, r12
mov rcx, rbx
call fcn.140014590
cmp rbx, rax
je 0x14001218f
lea rdx, [rax - 2]
cmp rbx, rdx
je 0x14001218f
cmp word [rdx], 0x2e
jne 0x140012173
lea rcx, [rdx - 2]
cmp rbx, rcx
jne 0x140012192
cmp word [rcx], 0x2e
jne 0x140012192
jmp 0x14001218f
mov dword [rbp + 0xc], esi
test esi, esi
setg r15b
lea r8, [0x14001ddf0]
mov rdx, r14
mov ecx, r12d
call fcn.140011320
mov r14d, eax
mov edi, r13d
jmp 0x140011d50
test r13d, r13d
setg sil
mov dword [rbp + 0x10], 1
jmp 0x140011eb3
mov ebx, dword [rbp + 0x10]
jmp 0x140011f63
sub rdx, 2
cmp rbx, rdx
je 0x14001218f
nop dword [rax]
cmp word [rdx], 0x2e
je 0x140012192
sub rdx, 2
cmp rbx, rdx
jne 0x140012180
mov rdx, rax
sub rax, rdx
sar rax, 1
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], r13
mov r8, rax
lea rcx, [rbp + 0x20]
call fcn.14000c980
nop
lea rax, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova rax, qword [rbp + 0x20]
mov qword [rbp + 0x160], rax
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x168], rax
call fcn.140013ff4
movaps xmm0, xmmword [rbp + 0x160]
movdqa xmmword [rbp + 0x70], xmm0
lea r8, [rbp + 0x70]
mov edx, eax
lea rcx, [rbp + 0x1a0]
call fcn.140012970
lea rcx, [rbp + 0x1a0]
mov rbx, qword [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 0xf
cmova rcx, rbx
mov r13, qword [rbp + 0x1b0]
mov r8, r13
cmp r13, 4
mov eax, 4
cmova r8, rax
lea rdx, str..sys
call sub.VCRUNTIME140.dll_memcmp
mov r12d, eax
test eax, eax
jne 0x140012254
cmp r13, 4
jae 0x140012249
mov r12d, 0xffffffff
jmp 0x140012254
xor r12d, r12d
cmp r13, 4
seta r12b
mov rax, qword [rbp + 0x1b8]
cmp rax, 0xf
jbe 0x140012292
lea rdx, [rax + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14001228a
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400123e1
mov rcx, rbx
call fcn.140014690
xor r13d, r13d
mov qword [rbp + 0x1b0], r13
mov qword [rbp + 0x1b8], 0xf
mov byte [rbp + 0x1a0], r13b
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x1400122ee
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400122e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400123e8
call fcn.140014690
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
mov rdx, qword [rbp + 0x98]
cmp rdx, 7
jbe 0x140012345
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012340
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400123ef
call fcn.140014690
test r12d, r12d
je 0x1400123f6
inc dword [rbp + 0xc]
mov rax, qword [rbp]
inc rax
mov qword [rbp], rax
cmp rax, qword [rbp + 0x60]
jl 0x140012050
lea rdx, str._r_n_r_n____Incorrect_Usage_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14000a490
lea rdx, [0x14000a670]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.___Usage:_kdmapper.exe____free____mdl____PassAllocationPtr__driver
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14000a490
lea rdx, [0x14000a670]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x2a0]
xor rcx, rsp
call fcn.140014670
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
movsxd rax, dword [rbp + 0xc]
test eax, eax
jle 0x140012366
mov rcx, qword [rbp + 0x18]
mov rdx, qword [rcx + rax*8]
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], r13
mov qword [rbp + 0x198], r13
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140012430
lea rcx, [rbp + 0x180]
call fcn.14000c980
nop
lea rdx, [rbp + 0x180]
cmp qword [rbp + 0x198], 7
cmova rdx, qword [rbp + 0x180]
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], r13
mov r8, qword [rbp + 0x190]
lea rcx, [rbp + 0x20]
call fcn.14000c980
nop
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova rcx, qword [rbp + 0x20]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rbp + 0x1a0]
call fcn.14001420c
mov r8d, eax
test eax, eax
jne 0x1400124eb
mov edx, dword [rbp + 0x1b0]
mov ecx, edx
shr ecx, 0xa
test cl, 1
je 0x1400124de
mov eax, dword [rbp + 0x1b4]
cmp eax, 0xa000000c
jne 0x1400124d0
mov eax, 4
jmp 0x14001250e
cmp eax, 0xa0000003
jne 0x1400124de
mov eax, 0xa
jmp 0x14001250e
shr edx, 4
and edx, 1
or edx, 2
mov eax, edx
jmp 0x14001250e
mov dword [rbp + 0x64], 0xffff
sub eax, 2
je 0x140012509
sub eax, 1
je 0x140012509
sub eax, 0x32
je 0x140012509
cmp eax, 0x46
mov eax, r13d
jne 0x14001250e
mov eax, 1
mov dword [rbp + 0x160], r8d
lea rcx, [0x1400240b8]
mov qword [rbp + 0x168], rcx
movaps xmm0, xmmword [rbp + 0x160]
movdqa xmmword [rbp + 0x160], xmm0
test eax, eax
je 0x14001257a
cmp eax, 1
sete bl
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x14001258c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012587
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140012587
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov bl, 1
test r8d, r8d
jne 0x1400128bd
jmp 0x14001253c
call fcn.140014690
test bl, bl
je 0x1400125f2
lea rdx, str.____File
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14000a490
lea rdx, [rbp + 0x180]
cmp qword [rbp + 0x198], 7
cmova rdx, qword [rbp + 0x180]
mov r8, qword [rbp + 0x190]
mov rcx, rax
call fcn.14000d510
lea rdx, str._doesnt_exist
mov rcx, rax
call fcn.14000a490
lea rdx, [0x14000a670]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
call fcn.140011520
jmp 0x140012782
movzx ecx, byte [rbp + 8]
call fcn.140004610
mov qword [0x140024c18], rax
cmp rax, 0xffffffffffffffff
jne 0x140012612
call fcn.140011520
jmp 0x140012782
mov qword [0x140024c18], 0xffffffffffffffff
xorps xmm0, xmm0
xor eax, eax
mov byte [rbp + 8], al
movdqu xmmword [rbp + 0x160], xmm0
mov ecx, 1
call fcn.1400147b8
mov qword [rbp + 0x160], rax
lea rdx, [rax + 1]
mov qword [rbp + 0x170], rdx
movzx ecx, byte [rbp + 8]
mov byte [rax], cl
mov qword [rbp + 0x168], rdx
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x180]
call fcn.140013730
mov rbx, qword [rbp + 0x160]
test al, al
jne 0x14001268c
lea rdx, str.____Failed_to_read_image_to_memory
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14000a490
jmp 0x140012723
test r14d, r14d
jle 0x1400126b1
test edi, edi
jle 0x1400126aa
lea rdx, str.____Too_many_allocation_modes
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14000a490
jmp 0x140012723
mov eax, 1
jmp 0x1400126be
mov eax, r13d
mov ecx, 2
test edi, edi
cmovg eax, ecx
mov dword [rbp + 0xc], r13d
lea rcx, [rbp + 0xc]
mov qword [rsp + 0x48], rcx
mov byte [rsp + 0x38], sil
mov dword [rsp + 0x30], eax
mov byte [rsp + 0x20], r15b
mov rdx, rbx
call fcn.14000dfa0
test rax, rax
jne 0x1400127d1
lea rdx, str.____Failed_to_map
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14000a490
lea rdx, [rbp + 0x180]
cmp qword [rbp + 0x198], 7
cmova rdx, qword [rbp + 0x180]
mov r8, qword [rbp + 0x190]
mov rcx, rax
call fcn.14000d510
lea rdx, [0x14000a670]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [0x140024c18]
call fcn.140005ab0
call fcn.140011520
nop
test rbx, rbx
je 0x140012782
mov rdx, qword [rbp + 0x170]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x140012779
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001285d
mov rcx, rbx
call fcn.140014690
nop
mov rdx, qword [rbp + 0x198]
cmp rdx, 7
jbe 0x1400123ac
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov r8, rcx
cmp rdx, 0x1000
jb 0x1400127c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x1400128aa
call fcn.140014690
jmp 0x1400123ac
mov rcx, qword [0x140024c18]
call fcn.140005ab0
test al, al
jne 0x140012809
lea rdx, str.____Warning_failed_to_fully_unload_vulnerable_driver
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14000a490
lea rdx, [0x14000a670]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
call fcn.140011520
lea rdx, str.___success
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14000a490
lea rdx, [0x14000a670]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
test rbx, rbx
je 0x14001286d
mov rdx, qword [rbp + 0x170]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x140012864
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140012864
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140014690
nop
mov rdx, qword [rbp + 0x198]
cmp rdx, 7
jbe 0x1400128b6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400128b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400128b1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140014690
xor eax, eax
jmp 0x1400123b1
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x160]
call fcn.140011210
int3