Function at 0x1400020c0
Capabilities:
Delete registry value
Enumerate device drivers on windows
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov rax, qword [0x140019040]
xor rax, rsp
mov qword [rbp + 0x250], rax
xor r14d, r14d
lea rcx, [rbp - 0x18]
call fcn.140001ee0
nop
lea rax, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore
mov qword [rbp + 8], rax
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppSwitched
mov qword [rbp + 0x10], rax
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppBadgeUpdated
mov qword [rbp + 0x18], rax
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageShowJumpView
mov qword [rbp + 0x20], rax
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistCEBFF5CD_ACE2_4F4F_9178_9926F41749EACount
mov qword [rbp + 0x28], rax
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppLaunch
mov qword [rbp + 0x30], rax
lea rax, str.SOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
mov qword [rbp + 0x38], rax
lea rbx, [0x140019b00]
mov rdi, qword [0x140019b10]
cmp qword [0x140019b18], 0xf
jbe 0x140002171
mov rbx, qword [0x140019b00]
add rdi, rbx
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
movabs rax, 0x7ffffffffffffffe
movabs rdx, 0x7fffffffffffffff
mov ecx, 0xa
mov qword [rbp - 0x68], r14
cmp rbx, rdi
jne 0x1400021b4
mov r12, r14
mov r15d, 7
mov qword [rbp - 0x60], r15
mov word [rbp - 0x78], r14w
jmp 0x1400022a5
sub rdi, rbx
mov qword [rbp - 0x60], 7
cmp rdi, rax
ja 0x140002cec
mov esi, 7
cmp rdi, rsi
jbe 0x140002263
mov rsi, rdi
or rsi, 7
cmp rsi, rax
jbe 0x1400021eb
mov rsi, rax
lea rcx, [rdx + rdx]
jmp 0x14000220b
cmp rsi, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, rdx
ja 0x140002cf2
add rcx, rcx
cmp rcx, 0x1000
jb 0x140002242
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002cf2
mov rcx, rax
call fcn.140010768
mov rcx, rax
test rax, rax
je 0x140002c6a
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x60], rsi
jmp 0x140002267
test rcx, rcx
je 0x140002256
call fcn.140010768
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x60], rsi
jmp 0x140002267
mov rax, r14
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x60], rsi
jmp 0x140002267
mov rax, qword [rbp - 0x78]
lea r8, [rbp - 0x78]
cmp rsi, 7
cmova r8, rax
mov rcx, r8
mov rdx, rdi
test rdi, rdi
je 0x140002294
nop
movsx eax, byte [rbx]
mov word [rcx], ax
lea rcx, [rcx + 2]
lea rbx, [rbx + 1]
sub rdx, 1
jne 0x140002280
mov qword [rbp - 0x68], rdi
mov word [r8 + rdi*2], r14w
mov r12, qword [rbp - 0x68]
mov r15, qword [rbp - 0x60]
lea rdi, [rbp + 8]
mov qword [rsp + 0x48], rdi
mov esi, 1
mov dword [rsp + 0x40], esi
nop word [rax + rax]
mov rbx, qword [rdi]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000266e
lea rdx, str.Registry_key_found:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14000e550
mov rcx, rax
mov rdx, rbx
call fcn.14000e550
lea rdx, [0x14000e730]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rsp + 0x60], 0x104
mov r13d, esi
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x60]
lea r8, [rbp + 0x40]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x140002658
nop dword [rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], r14
lea rax, [rbp + 0x40]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140002380
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x58]
call fcn.14000ed20
lea rcx, [rbp - 0x58]
mov rsi, qword [rbp - 0x40]
cmp rsi, 7
seta bl
mov rdi, qword [rbp - 0x58]
cmova rcx, rdi
mov qword [rsp + 0x20], 0xd
lea r9, str.gldriverquery
mov r14, qword [rbp - 0x48]
mov rdx, r14
call fcn.14000ec40
cmp rax, 0xffffffffffffffff
jne 0x1400025b0
lea rcx, [rbp - 0x58]
test bl, bl
cmovne rcx, rdi
mov qword [rsp + 0x20], 0x11
lea r9, str.tyqeviredhrel.rkr
mov rdx, r14
call fcn.14000ec40
cmp rax, 0xffffffffffffffff
jne 0x1400025b0
mov rax, qword [0x140019af0]
lea r9, [0x140019ae0]
cmp qword [0x140019af8], 7
cmova r9, qword [0x140019ae0]
lea rcx, [rbp - 0x58]
cmp rsi, 7
cmova rcx, rdi
mov qword [rsp + 0x20], rax
mov rdx, r14
call fcn.14000ec40
cmp rax, 0xffffffffffffffff
jne 0x1400025b0
lea r11, [rbp - 0x78]
cmp r15, 7
cmova r11, qword [rbp - 0x78]
lea rbx, [rbp - 0x58]
cmp rsi, 7
cmova rbx, rdi
cmp r12, r14
ja 0x140002508
mov rax, r14
sub rax, r12
test r12, r12
je 0x1400025b0
inc rax
lea r15, [rbx + rax*2]
mov rax, rbx
movzx r10d, word [r11]
nop dword [rax]
nop word [rax + rax]
mov rcx, r15
sub rcx, rax
sar rcx, 1
mov edx, 0
je 0x1400024bc
cmp word [rax], r10w
je 0x1400024b9
cmp rcx, 1
je 0x1400024bc
dec rcx
add rax, 2
cmp word [rax], r10w
jne 0x1400024a6
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x140002508
mov r8, r12
mov rdx, r11
test r12, r12
je 0x1400024f8
mov r9, rax
sub r9, r11
nop word [rax + rax]
movzx ecx, word [rdx + r9]
cmp cx, word [rdx]
jne 0x140002665
add rdx, 2
sub r8, 1
jne 0x1400024e0
sub rax, rbx
sar rax, 1
cmp rax, 0xffffffffffffffff
jne 0x1400025b0
lea rcx, [rbp - 0x58]
cmp rsi, 7
cmova rcx, rdi
mov qword [rsp + 0x20], 6
lea r9, str.msmain
mov rdx, r14
call fcn.14000ec40
cmp rax, 0xffffffffffffffff
jne 0x1400025b0
lea rcx, [rbp - 0x58]
cmp rsi, 7
cmova rcx, rdi
mov qword [rsp + 0x20], 7
lea r9, str.pzq.rkr
mov rdx, r14
call fcn.14000ec40
cmp rax, 0xffffffffffffffff
jne 0x1400025b0
lea rcx, [rbp - 0x58]
cmp rsi, 7
cmova rcx, rdi
mov qword [rsp + 0x20], 0x11
lea r9, str.gldriverquery.exe
mov rdx, r14
call fcn.14000ec40
cmp rax, 0xffffffffffffffff
jne 0x1400025b0
lea rcx, [rbp - 0x58]
cmp rsi, 7
cmova rcx, rdi
mov qword [rsp + 0x20], 0x11
lea r9, str.vulkandriverquery
mov rdx, r14
call fcn.14000ec40
cmp rax, 0xffffffffffffffff
je 0x1400025cf
lea rdx, [rbp - 0x58]
cmp rsi, 7
cmova rdx, rdi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rsi, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x58]
mov dword [rsp + 0x60], 0x104
cmp rsi, 7
jbe 0x140002612
lea rdx, [rsi*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000260a
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400026b7
mov rcx, rdi
call fcn.140010760
mov edx, r13d
inc r13d
xor r14d, r14d
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x60]
lea r8, [rbp + 0x40]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
mov r15, qword [rbp - 0x60]
je 0x140002360
mov rdi, qword [rsp + 0x48]
lea esi, [r14 + 1]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000269c
add rax, 2
jmp 0x140002490
lea rdx, str.Registry_key_not_found:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14000e550
mov rcx, rax
mov rdx, rbx
call fcn.14000e550
lea rdx, [0x14000e730]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
add rdi, 8
mov qword [rsp + 0x48], rdi
lea rax, [rbp + 0x40]
cmp rdi, rax
je 0x1400026be
mov r15, qword [rbp - 0x60]
jmp 0x1400022c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
mov rsi, qword [rbp - 8]
sub rax, rsi
cmp rax, 0x39
jb 0x140002cf8
lea r15, [rbp - 0x18]
mov r12, qword [rbp - 0x18]
mov r13, qword [rbp]
cmp r13, 7
cmova r15, r12
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
lea r14, [rsi + 0x39]
mov edi, 7
lea rbx, [rbp - 0x38]
cmp r14, rdi
jbe 0x1400027a5
mov rdi, r14
or rdi, 7
cmp rdi, rcx
jbe 0x140002734
mov rdi, rcx
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x140002764
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
lea rcx, [rdi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140002ce6
add rcx, rcx
cmp rcx, 0x1000
jb 0x140002790
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002ce6
mov rcx, rax
call fcn.140010768
test rax, rax
je 0x140002c02
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1400027a1
test rcx, rcx
je 0x14000279c
call fcn.140010768
jmp 0x14000279e
xor eax, eax
mov rbx, rax
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x20], rdi
movaps xmm0, xmmword [str.SYSTEMCurrentControlSetServices_bamStateUserSettings_]
movups xmmword [rbx], xmm0
movaps xmm1, xmmword [0x140013e70]
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [0x140013e80]
movups xmmword [rbx + 0x20], xmm0
movaps xmm1, xmmword [0x140013e90]
movups xmmword [rbx + 0x30], xmm1
movaps xmm0, xmmword [0x140013ea0]
movups xmmword [rbx + 0x40], xmm0
movaps xmm1, xmmword [0x140013eb0]
movups xmmword [rbx + 0x50], xmm1
movaps xmm0, xmmword [0x140013ec0]
movups xmmword [rbx + 0x60], xmm0
movzx eax, word [0x140013ed0]
mov word [rbx + 0x70], ax
lea rcx, [rbx + 0x72]
lea r8, [rsi + rsi]
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
xor edi, edi
mov word [rbx + r14*2], di
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova rdx, qword [rbp - 0x38]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002bcb
mov dword [rsp + 0x60], 0x104
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x60]
lea r8, [rbp + 0x40]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x140002bbf
nop dword [rax + rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rdi
lea rax, [rbp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400028b0
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.14000ed20
nop
lea rcx, [rsp + 0x68]
mov rsi, qword [rbp - 0x80]
cmp rsi, 7
seta bl
mov rdi, qword [rsp + 0x68]
cmova rcx, rdi
mov qword [rsp + 0x20], 0xd
lea r9, str.gldriverquery
mov r14, qword [rsp + 0x78]
mov rdx, r14
call fcn.14000ec40
cmp rax, 0xffffffffffffffff
jne 0x140002ada
lea rcx, [rsp + 0x68]
test bl, bl
cmovne rcx, rdi
mov qword [rsp + 0x20], 0x11
lea r9, str.tyqeviredhrel.rkr
mov rdx, r14
call fcn.14000ec40
cmp rax, 0xffffffffffffffff
jne 0x140002ada
mov rax, qword [0x140019af0]
lea r9, [0x140019ae0]
cmp qword [0x140019af8], 7
cmova r9, qword [0x140019ae0]
lea rcx, [rsp + 0x68]
cmp rsi, 7
cmova rcx, rdi
mov qword [rsp + 0x20], rax
mov rdx, r14
call fcn.14000ec40
cmp rax, 0xffffffffffffffff
jne 0x140002ada
lea r11, [rbp - 0x78]
cmp qword [rbp - 0x60], 7
cmova r11, qword [rbp - 0x78]
lea rbx, [rsp + 0x68]
cmp rsi, 7
cmova rbx, rdi
mov r8, qword [rbp - 0x68]
cmp r8, r14
ja 0x140002a2a
mov rax, r14
sub rax, r8
test r8, r8
je 0x140002ada
lea r15, [rax + 1]
lea r15, [rbx + r15*2]
mov rcx, rbx
movzx r10d, word [r11]
nop
mov rax, r15
sub rax, rcx
sar rax, 1
mov edx, 0
je 0x1400029ec
cmp word [rcx], r10w
je 0x1400029e9
cmp rax, 1
je 0x1400029ec
dec rax
add rcx, 2
cmp word [rcx], r10w
jne 0x1400029d6
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x140002a2a
mov rdx, r11
test r8, r8
je 0x140002a1a
mov r9, rcx
sub r9, r11
movzx eax, word [rdx + r9]
cmp ax, word [rdx]
jne 0x140002c09
add rdx, 2
sub r8, 1
jne 0x140002a02
sub rcx, rbx
sar rcx, 1
cmp rcx, 0xffffffffffffffff
jne 0x140002ada
lea rcx, [rsp + 0x68]
cmp rsi, 7
cmova rcx, rdi
mov qword [rsp + 0x20], 6
lea r9, str.msmain
mov rdx, r14
call fcn.14000ec40
cmp rax, 0xffffffffffffffff
jne 0x140002ada
lea rcx, [rsp + 0x68]
cmp rsi, 7
cmova rcx, rdi
mov qword [rsp + 0x20], 7
lea r9, str.pzq.rkr
mov rdx, r14
call fcn.14000ec40
cmp rax, 0xffffffffffffffff
jne 0x140002ada
lea rcx, [rsp + 0x68]
cmp rsi, 7
cmova rcx, rdi
mov qword [rsp + 0x20], 0x11
lea r9, str.gldriverquery.exe
mov rdx, r14
call fcn.14000ec40
cmp rax, 0xffffffffffffffff
jne 0x140002ada
lea rcx, [rsp + 0x68]
cmp rsi, 7
cmova rcx, rdi
mov qword [rsp + 0x20], 0x11
lea r9, str.vulkandriverquery
mov rdx, r14
call fcn.14000ec40
cmp rax, 0xffffffffffffffff
je 0x140002b3e
lea rdx, str.Deleting_value:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14000e550
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 7
cmova rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x78]
mov rcx, rax
call fcn.14000faf0
lea rdx, [0x14000e730]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 7
cmova rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rsi, qword [rbp - 0x80]
mov rdi, qword [rsp + 0x68]
mov dword [rsp + 0x60], 0x104
cmp rsi, 7
jbe 0x140002b81
lea rdx, [rsi*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140002b79
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002c16
mov rcx, rdi
call fcn.140010760
mov eax, dword [rsp + 0x40]
mov edx, eax
inc eax
mov dword [rsp + 0x40], eax
xor edi, edi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x60]
lea r8, [rbp + 0x40]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x140002890
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 7
jbe 0x140002c22
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002c1d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
add rcx, 2
mov r8, qword [rbp - 0x68]
jmp 0x1400029c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140010760
movdqa xmm0, xmmword [0x140014660]
movdqu xmmword [rbp - 0x28], xmm0
mov word [rbp - 0x38], di
mov rax, qword [rbp - 0x60]
cmp rax, 7
jbe 0x140002c77
lea rdx, [rax*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c71
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002c71
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010760
nop
cmp r13, 7
jbe 0x140002cb6
lea rdx, [r13*2 + 2]
mov rax, r12
cmp rdx, 0x1000
jb 0x140002cae
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002cae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call fcn.140010760
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.140010740
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001190
nop
call fcn.140001230
int3
call fcn.140001190
nop
call fcn.140001230
int3