Function at 0x140001ee0
Capabilities:
Delete registry value
Enumerate device drivers on windows
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov rax, qword [0x140015040]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov esi, 1
mov dword [rsp + 0x60], esi
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x38], xmm1
lea r8d, [rsi + 0x2f]
lea rdx, str.wmic_useraccount_where_name_username__get_sid
lea rcx, [rbp + 0x28]
call fcn.14000a1f0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xor r12d, r12d
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], 7
mov word [rbp - 0x38], r12w
mov dword [rsp + 0x60], esi
lea rcx, [rbp + 0x28]
cmp qword [rbp + 0x40], 7
cmova rcx, qword [rbp + 0x28]
lea rdx, [0x14000e950]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wpopen]
mov rbx, rax
test rax, rax
je 0x140001fe1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
test eax, eax
jne 0x140001fd7
nop dword [rax]
nop dword [rax + rax]
mov r8, rbx
mov edx, 0x80
lea rcx, [rbp + 0x180]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetws]
test rax, rax
je 0x140001fca
lea rdx, [rbp + 0x180]
lea rcx, [rbp - 0x38]
call fcn.140008ca0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
test eax, eax
je 0x140001fa0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__pclose]
nop
xor edx, edx
mov r8d, 0xf0
lea rcx, [rbp + 0x50]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x14000f9c8]
mov qword [rbp + 0x50], rax
lea rcx, [rbp + 0xe0]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
nop
mov dword [rsp + 0x60], 2
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x50]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__::constructor_class_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx + 0x50], rax
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x90]
mov dword [rbp + rcx + 0x4c], edx
lea rax, [rbp + 0x60]
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
nop
lea rax, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + 0x60], rax
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova rdx, qword [rbp - 0x38]
mov r9d, 2
mov r8, qword [rbp - 0x28]
lea rcx, [rbp + 0x60]
call fcn.140008db0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
movdqa xmm1, xmmword [0x14000fb10]
movdqu xmmword [rbp + 0x18], xmm1
mov word [rbp + 8], r12w
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x50]
call fcn.140008f20
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x50]
call fcn.140008f20
lea rax, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore
mov qword [rbp + 0x140], rax
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppSwitched
mov qword [rbp + 0x148], rax
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppBadgeUpdated
mov qword [rbp + 0x150], rax
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageShowJumpView
mov qword [rbp + 0x158], rax
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistCEBFF5CD_ACE2_4F4F_9178_9926F41749EACount
mov qword [rbp + 0x160], rax
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppLaunch
mov qword [rbp + 0x168], rax
lea rax, str.SOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
mov qword [rbp + 0x170], rax
lea rbx, [0x140015c98]
mov rdi, qword [0x140015ca8]
cmp qword [0x140015cb0], 0xf
jbe 0x140002143
mov rbx, qword [0x140015c98]
add rdi, rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r12
cmp rbx, rdi
jne 0x140002170
mov r13, r12
mov r14d, 7
mov qword [rbp - 0x80], r14
mov word [rsp + 0x68], r12w
jmp 0x14000228e
sub rdi, rbx
mov qword [rbp - 0x80], 7
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
ja 0x140002a8a
mov esi, 7
cmp rdi, rsi
jbe 0x140002245
mov rsi, rdi
or rsi, 7
cmp rsi, rax
jbe 0x1400021bb
mov rsi, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x1400021ea
mov eax, 0xa
cmp rsi, rax
cmovb rsi, rax
lea rcx, [rsi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140002a84
add rcx, rcx
cmp rcx, 0x1000
jb 0x140002222
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002a84
mov rcx, rax
call fcn.14000bd30
mov rcx, rax
test rax, rax
je 0x140002922
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov qword [rsp + 0x68], rax
mov qword [rbp - 0x80], rsi
jmp 0x14000224a
test rcx, rcx
je 0x140002237
call fcn.14000bd30
mov qword [rsp + 0x68], rax
mov qword [rbp - 0x80], rsi
jmp 0x14000224a
mov rax, r12
mov qword [rsp + 0x68], rax
mov qword [rbp - 0x80], rsi
jmp 0x14000224a
mov rax, qword [rsp + 0x68]
lea r8, [rsp + 0x68]
cmp rsi, 7
cmova r8, rax
mov rcx, r8
mov rdx, rdi
test rdi, rdi
je 0x140002276
movsx eax, byte [rbx]
mov word [rcx], ax
lea rcx, [rcx + 2]
lea rbx, [rbx + 1]
sub rdx, 1
jne 0x140002262
mov qword [rsp + 0x78], rdi
mov word [r8 + rdi*2], r12w
mov r13, qword [rsp + 0x78]
mov r14, qword [rbp - 0x80]
mov esi, 1
lea rdi, [rbp + 0x140]
mov qword [rsp + 0x48], rdi
mov r15, qword [rsp + 0x68]
nop
mov rbx, qword [rdi]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002658
lea rdx, str.Registry_key_found:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140009130
mov rcx, rax
mov rdx, rbx
call fcn.140009130
lea rdx, [0x140009310]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rsp + 0x60], 0x104
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x60]
lea r8, [rbp + 0x180]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x140002642
nop dword [rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], r12
lea rax, [rbp + 0x180]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140002360
lea rdx, [rbp + 0x180]
lea rcx, [rbp - 0x78]
call fcn.14000a1f0
lea rcx, [rbp - 0x78]
mov r12, qword [rbp - 0x60]
cmp r12, 7
seta sil
mov rbx, qword [rbp - 0x78]
cmova rcx, rbx
mov qword [rsp + 0x20], 0xd
lea r9, str.gldriverquery
mov rdi, qword [rbp - 0x68]
mov rdx, rdi
call fcn.140009d90
cmp rax, 0xffffffffffffffff
jne 0x14000258c
lea rcx, [rbp - 0x78]
test sil, sil
cmovne rcx, rbx
mov qword [rsp + 0x20], 0x11
lea r9, str.tyqeviredhrel.rkr
mov rdx, rdi
call fcn.140009d90
cmp rax, 0xffffffffffffffff
jne 0x14000258c
mov rax, qword [0x140015c88]
lea r9, [0x140015c78]
cmp qword [0x140015c90], 7
cmova r9, qword [0x140015c78]
lea rcx, [rbp - 0x78]
test sil, sil
cmovne rcx, rbx
mov qword [rsp + 0x20], rax
mov rdx, rdi
call fcn.140009d90
cmp rax, 0xffffffffffffffff
jne 0x14000258c
lea r11, [rsp + 0x68]
cmp r14, 7
cmova r11, r15
lea r14, [rbp - 0x78]
test sil, sil
cmovne r14, rbx
cmp r13, rdi
ja 0x1400024e8
mov rax, rdi
sub rax, r13
test r13, r13
je 0x14000258c
inc rax
lea r15, [r14 + rax*2]
mov rax, r14
movzx r10d, word [r11]
nop dword [rax]
nop dword [rax + rax]
mov rcx, r15
sub rcx, rax
sar rcx, 1
mov edx, 0
je 0x14000249c
cmp word [rax], r10w
je 0x140002499
cmp rcx, 1
je 0x14000249c
dec rcx
add rax, 2
cmp word [rax], r10w
jne 0x140002486
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x1400024e8
mov r8, r13
mov rdx, r11
test r13, r13
je 0x1400024d8
mov r9, rax
sub r9, r11
nop word [rax + rax]
movzx ecx, word [r9 + rdx]
cmp cx, word [rdx]
jne 0x14000264f
add rdx, 2
sub r8, 1
jne 0x1400024c0
sub rax, r14
sar rax, 1
cmp rax, 0xffffffffffffffff
jne 0x14000258c
lea rcx, [rbp - 0x78]
test sil, sil
cmovne rcx, rbx
mov qword [rsp + 0x20], 6
lea r9, str.msmain
mov rdx, rdi
call fcn.140009d90
cmp rax, 0xffffffffffffffff
jne 0x14000258c
lea rcx, [rbp - 0x78]
test sil, sil
cmovne rcx, rbx
mov qword [rsp + 0x20], 7
lea r9, str.pzq.rkr
mov rdx, rdi
call fcn.140009d90
cmp rax, 0xffffffffffffffff
jne 0x14000258c
lea rcx, [rbp - 0x78]
test sil, sil
cmovne rcx, rbx
mov qword [rsp + 0x20], 0x11
lea r9, str.gldriverquery.exe
mov rdx, rdi
call fcn.140009d90
cmp rax, 0xffffffffffffffff
jne 0x14000258c
lea rcx, [rbp - 0x78]
test sil, sil
cmovne rcx, rbx
mov qword [rsp + 0x20], 0x11
lea r9, str.vulkandriverquery
mov rdx, rdi
call fcn.140009d90
cmp rax, 0xffffffffffffffff
je 0x1400025aa
lea rdx, [rbp - 0x78]
test sil, sil
cmovne rdx, rbx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r12, qword [rbp - 0x60]
mov rbx, qword [rbp - 0x78]
mov dword [rsp + 0x60], 0x104
cmp r12, 7
jbe 0x1400025ed
lea rdx, [r12*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400025e5
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400026a4
mov rcx, rbx
call fcn.14000bfac
mov ebx, dword [rsp + 0x40]
mov edx, ebx
inc ebx
mov dword [rsp + 0x40], ebx
xor r12d, r12d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x60]
lea r8, [rbp + 0x180]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
mov r14, qword [rbp - 0x80]
mov r15, qword [rsp + 0x68]
je 0x140002340
mov rdi, qword [rsp + 0x48]
lea esi, [r12 + 1]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140002686
add rax, 2
jmp 0x140002470
lea rdx, str.Registry_key_not_found:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140009130
mov rcx, rax
mov rdx, rbx
call fcn.140009130
lea rdx, [0x140009310]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
add rdi, 8
mov qword [rsp + 0x48], rdi
lea rax, [rbp + 0x178]
cmp rdi, rax
je 0x1400026ab
mov r14, qword [rbp - 0x80]
jmp 0x1400022a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea r8, [rbp + 8]
lea rdx, str.SYSTEMCurrentControlSetServices_bamStateUserSettings_
lea rcx, [rbp - 0x18]
call fcn.140009350
nop
lea rdx, [rbp - 0x18]
cmp qword [rbp], 7
cmova rdx, qword [rbp - 0x18]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002893
mov dword [rsp + 0x60], 0x104
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x60]
lea r8, [rbp + 0x180]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x140002887
nop dword [rax]
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], r12
lea rax, [rbp + 0x180]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140002760
lea rdx, [rbp + 0x180]
lea rcx, [rbp - 0x58]
call fcn.14000a1f0
nop
lea rcx, [rbp - 0x58]
mov rbx, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x40]
cmp rdi, 7
cmova rcx, rbx
mov qword [rsp + 0x20], 0xd
lea r9, str.gldriverquery
mov rdx, qword [rbp - 0x48]
call fcn.140009d90
cmp rax, 0xffffffffffffffff
je 0x14000280d
lea rdx, str.Deleting_value:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140009130
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rdx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x48]
mov rcx, rax
call fcn.14000aed0
lea rdx, [0x140009310]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rdx, qword [rbp - 0x58]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rdi, qword [rbp - 0x40]
mov rbx, qword [rbp - 0x58]
mov dword [rsp + 0x60], 0x104
cmp rdi, 7
jbe 0x140002850
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140002848
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400028d1
mov rcx, rbx
call fcn.14000bfac
mov edx, esi
inc esi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x60]
lea r8, [rbp + 0x180]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x140002740
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp]
cmp rdx, 7
jbe 0x1400028dd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400028d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400028d8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14000bfac
movdqa xmm0, xmmword [0x14000fb10]
movdqu xmmword [rbp - 8], xmm0
mov word [rbp - 0x18], r12w
mov rdx, qword [rbp - 0x80]
cmp rdx, 7
jbe 0x140002932
lea rdx, [rdx*2 + 2]
mov rax, r15
cmp rdx, 0x1000
jb 0x140002929
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002929
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.14000bfac
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 7
jbe 0x140002976
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002970
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002970
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bfac
nop
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx + 0x50], rax
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x90]
mov dword [rbp + rcx + 0x4c], edx
lea rcx, [rbp + 0x60]
call fcn.140008240
lea rcx, [rbp + 0x68]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 7
jbe 0x140002a00
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400029fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400029fb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bfac
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], 7
mov word [rbp - 0x38], r12w
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x140002a54
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a4f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bfac
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.14000bd10
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011a0
nop
call fcn.140001240
int3