Function at 0x7ff7e1520760
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x200
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov r15, rcx
movabs rax, 0xfa6040178c79d70e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x5058779a5cad1b8d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x8809217fcf25ed4d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0x50582bea31d947fe
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movdqa xmm0, xmmword [rbp + 0x30]
pxor xmm0, xmmword [rbp + 0x100]
movdqa xmmword [rbp + 0x30], xmm0
xor r13d, r13d
mov qword [rbp + 0x120], r13
mov qword [rbp + 0x130], r13
mov qword [rbp + 0x138], 0xf
lea rax, [rbp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r13b
jne 0x7ff7e1520827
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x120]
call fcn.7ff7e14c5e30
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x50]
call fcn.7ff7e14c4df0
nop
mov rbx, qword [rbp + 0x50]
mov r12, qword [rbp + 0x58]
cmp rbx, r12
je 0x7ff7e1520e80
movabs rax, 0x7fffffffffffffff
mov qword [rbp + 8], r13
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x20], r13
mov rsi, qword [rbx + 0x10]
mov r14, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x7ff7e1520889
mov r14, qword [rbx]
cmp rsi, 0x10
jae 0x7ff7e152089e
movups xmm0, xmmword [r14]
movups xmmword [rbp + 8], xmm0
mov edi, 0xf
jmp 0x7ff7e152090a
mov rdi, rsi
or rdi, 0xf
cmp rdi, rax
cmova rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x7ff7e15208e8
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x7ff7e1520fc0
mov rcx, rax
call fcn.7ff7e1566ca8
mov rcx, rax
test rax, rax
je 0x7ff7e1520f31
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x7ff7e15208f7
test rcx, rcx
je 0x7ff7e15208f4
call fcn.7ff7e1566ca8
jmp 0x7ff7e15208f7
mov rax, r13
mov qword [rbp + 8], rax
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy_1
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x18], rsi
lea rdx, [rbp + 8]
cmp rdi, 0x10
cmovae rdx, qword [rbp + 8]
lea rcx, [0x7ff7e1604d8c]
call fcn.7ff7e152d940
lea rax, [rbp + 0x140]
mov qword [rbp + 0x28], rax
movabs rax, 0xed274f10ab418c21
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x50582bea31d92286
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x8809217fcf25ed4d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0x50582bea31d947fe
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movdqa xmm0, xmmword [rbp + 0x40]
pxor xmm0, xmmword [rbp + 0x110]
movdqa xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x140], r13
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], 0xf
lea rax, [rbp + 0x40]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x7ff7e15209d0
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x140]
call fcn.7ff7e14c5e30
nop
mov qword [rbp + 0x68], r13
mov qword [rbp + 0x78], r13
mov qword [rbp + 0x80], r13
mov rsi, qword [rbp + 0x18]
lea r14, [rbp + 8]
cmp qword [rbp + 0x20], 0x10
cmovae r14, qword [rbp + 8]
cmp rsi, 0x10
jae 0x7ff7e1520a27
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x80], 0xf
jmp 0x7ff7e1520aa4
mov rdi, rsi
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmova rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x7ff7e1520a7b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x7ff7e1520fc6
mov rcx, rax
call fcn.7ff7e1566ca8
mov rcx, rax
test rax, rax
je 0x7ff7e1520f15
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x7ff7e1520a8a
test rcx, rcx
je 0x7ff7e1520a87
call fcn.7ff7e1566ca8
jmp 0x7ff7e1520a8a
mov rax, r13
mov qword [rbp + 0x68], rax
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy_1
mov qword [rbp + 0x80], rdi
mov qword [rbp + 0x78], rsi
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x68]
call fcn.7ff7e14c5a40
test al, al
je 0x7ff7e1520e30
lea rax, [rbp + 0x88]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x88], r13
mov qword [rbp + 0x98], r13
mov qword [rbp + 0xa0], r13
mov rsi, qword [r15 + 0x10]
mov r14, r15
cmp qword [r15 + 0x18], 0x10
jb 0x7ff7e1520af1
mov r14, qword [r15]
cmp rsi, 0x10
jae 0x7ff7e1520b12
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x88], xmm0
mov qword [rbp + 0xa0], 0xf
jmp 0x7ff7e1520b92
mov rdi, rsi
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmova rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x7ff7e1520b66
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x7ff7e1520fcc
mov rcx, rax
call fcn.7ff7e1566ca8
mov rcx, rax
test rax, rax
je 0x7ff7e1520f1c
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x7ff7e1520b75
test rcx, rcx
je 0x7ff7e1520b72
call fcn.7ff7e1566ca8
jmp 0x7ff7e1520b75
mov rax, r13
mov qword [rbp + 0x88], rax
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy_1
mov qword [rbp + 0xa0], rdi
mov qword [rbp + 0x98], rsi
mov qword [rbp + 0xa8], r13
mov qword [rbp + 0xb8], r13
mov qword [rbp + 0xc0], r13
mov rsi, qword [rbp + 0x18]
lea r14, [rbp + 8]
cmp qword [rbp + 0x20], 0x10
cmovae r14, qword [rbp + 8]
cmp rsi, 0x10
jae 0x7ff7e1520be1
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0xa8], xmm0
mov qword [rbp + 0xc0], 0xf
jmp 0x7ff7e1520c61
mov rdi, rsi
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmova rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x7ff7e1520c35
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x7ff7e1520fba
mov rcx, rax
call fcn.7ff7e1566ca8
mov rcx, rax
test rax, rax
je 0x7ff7e1520f23
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x7ff7e1520c44
test rcx, rcx
je 0x7ff7e1520c41
call fcn.7ff7e1566ca8
jmp 0x7ff7e1520c44
mov rax, r13
mov qword [rbp + 0xa8], rax
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy_1
mov qword [rbp + 0xc0], rdi
mov qword [rbp + 0xb8], rsi
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0xa8]
call fcn.7ff7e14c5a40
test al, al
jne 0x7ff7e1520e30
lea rdi, [rbp + 8]
cmp qword [rbp + 0x20], 0x10
cmovae rdi, qword [rbp + 8]
movabs rax, 0xfa6040178c0ad70e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0x237d049a5cad688d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rcx, 0x65674554eda042f
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rdx, 0x821a121859224488
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0x8809217fcf25ed4d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
movabs rax, 0x50582bea31d947fe
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x1a0]
vmovdqa ymmword [rbp + 0xe0], ymm1
mov qword [rbp + 0x160], r13
mov qword [rbp + 0x170], r13
mov qword [rbp + 0x178], 0xf
lea rax, [rbp + 0xe0]
mov r8, 0xffffffffffffffff
vzeroupper
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x7ff7e1520d90
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x160]
call fcn.7ff7e14c5e30
mov r8, rdi
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x180]
call fcn.7ff7e152dbc0
cmp qword [rax + 0x18], 0x10
jb 0x7ff7e1520dcd
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.ucrtbase.dll_remove]
mov rdx, qword [rbp + 0x198]
cmp rdx, 0x10
jb 0x7ff7e1520e17
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff7e1520e12
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff7e1520f2a
call fcn.7ff7e1566ce4
mov qword [rbp + 0x190], r13
mov qword [rbp + 0x198], 0xf
mov byte [rbp + 0x180], 0
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x7ff7e1520e6b
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff7e1520e66
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff7e1520f31
call fcn.7ff7e1566ce4
add rbx, 0x20
cmp rbx, r12
jne 0x7ff7e1520862
mov r12, qword [rbp + 0x58]
mov rbx, qword [rbp + 0x50]
test rbx, rbx
je 0x7ff7e1520f4c
cmp rbx, r12
je 0x7ff7e1520ee2
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x7ff7e1520ec6
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x7ff7e1520ec1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x7ff7e1520f0e
mov rcx, r8
call fcn.7ff7e1566ce4
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
add rbx, 0x20
cmp rbx, r12
jne 0x7ff7e1520e90
mov rbx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x60]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x7ff7e1520f38
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff7e1520f38
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, rbx
call fcn.7ff7e1566ce4
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r13
mov rdx, qword [r15 + 0x18]
cmp rdx, 0x10
jb 0x7ff7e1520f82
inc rdx
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x7ff7e1520f7d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x7ff7e1520fb3
mov rcx, r8
call fcn.7ff7e1566ce4
mov qword [r15 + 0x10], r13
mov qword [r15 + 0x18], 0xf
mov byte [r15], 0
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.7ff7e14c5d50
nop
call fcn.7ff7e14c5d50
nop
call fcn.7ff7e14c5d50
nop
call fcn.7ff7e14c5d50
int3