Function at 0x14002e100
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x140092010]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov dword [rsp + 0x74], r9d
mov qword [rbp - 0x80], r8
mov r14, rdx
mov qword [rsp + 0x78], rdx
mov rsi, rcx
mov qword [rsp + 0x50], rcx
mov qword [rbp - 0x78], rdx
xor ebx, ebx
mov dword [rsp + 0x70], ebx
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r12, qword [r14 + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r12
cmp rax, 0x1c
jb 0x14002ea62
mov qword [rsp + 0x50], r14
cmp qword [r14 + 0x18], 0x10
jb 0x14002e19f
mov rax, qword [r14]
mov qword [rsp + 0x50], rax
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], rbx
lea r15, [r12 + 0x1c]
mov ebx, 0xf
lea rdi, [rbp - 0x70]
lea r13, [rbx - 0x10]
cmp r15, rbx
jbe 0x14002e234
mov rbx, r15
or rbx, 0xf
cmp rbx, rcx
jbe 0x14002e1d3
mov rbx, rcx
jmp 0x14002e1df
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
cmovb rcx, r13
cmp rcx, 0x1000
jb 0x14002e21f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14002ea46
mov rcx, rax
call fcn.140072778
test rax, rax
je 0x14002ea38
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14002e230
test rcx, rcx
je 0x14002e22e
call fcn.140072778
mov rdi, rax
jmp 0x14002e230
xor edi, edi
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], rbx
movups xmm0, xmmword [str.C:WindowsSystem32drivers_]
movups xmmword [rdi], xmm0
movsd xmm1, qword [0x140075cf8]
movsd qword [rdi + 0x10], xmm1
mov eax, dword [0x140075d00]
mov dword [rdi + 0x18], eax
lea rcx, [rdi + 0x1c]
mov r8, r12
mov rdx, qword [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r15], 0
mov rdi, qword [rbp - 0x60]
lea rbx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rbx, qword [rbp - 0x70]
call fcn.140071d3c
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.14002c7d0
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rbp + 0x140]
call fcn.140071fcc
mov edx, eax
test eax, eax
jne 0x14002e30d
mov eax, dword [rbp + 0x150]
bt eax, 0xa
jae 0x14002e302
mov ecx, dword [rbp + 0x154]
cmp ecx, 0xa000000c
jne 0x14002e2f3
lea eax, [rdx + 4]
jmp 0x14002e32a
cmp ecx, 0xa0000003
jne 0x14002e302
mov eax, 0xa
jmp 0x14002e32a
and eax, 0x10
or eax, 0x20
shr eax, 4
jmp 0x14002e32a
sub eax, 2
je 0x14002e325
sub eax, 1
je 0x14002e325
sub eax, 0x32
je 0x14002e325
cmp eax, 0x46
je 0x14002e325
xor eax, eax
jmp 0x14002e32a
mov eax, 1
mov dword [rsp + 0x30], edx
lea rcx, [0x140092058]
mov qword [rsp + 0x38], rcx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp - 0x30], xmm0
test eax, eax
je 0x14002e38e
cmp eax, 1
sete bl
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14002e39f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002e39a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002e39a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov bl, 1
test edx, edx
jne 0x14002ea4c
jmp 0x14002e34e
call fcn.1400727b4
test bl, bl
je 0x14002e499
xorps xmm0, xmm0
movups xmmword [rsi + 0x40], xmm0
xor r15d, r15d
mov qword [rsi], r15
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], 0xf
mov byte [rsi], r15b
mov qword [rsi + 0x20], r15
mov qword [rsi + 0x30], r15
mov qword [rsi + 0x38], 0xf
mov byte [rsi + 0x20], r15b
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x14002e412
inc rdx
mov rcx, qword [rbp - 0x70]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14002e40d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002ea38
call fcn.1400727b4
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], 0
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x14002e45c
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x14002e457
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002ea3f
mov rcx, r8
call fcn.1400727b4
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
mov rax, rsi
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.1400724c0
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x30]
call sub.VCRUNTIME140.dll_memset
lea rbx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rbx, qword [rbp - 0x70]
lea rax, [0x1400871a0]
mov qword [rbp + 0x30], rax
lea rcx, [rbp + 0xe0]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x70], 0x1e
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea r15, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x30], r15
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x2c], edx
lea rax, [rbp + 0x40]
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x40], rax
mov byte [rbp + 0xbc], 0
mov byte [rbp + 0xb1], 0
lea rcx, [rbp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
xor edi, edi
mov qword [rbp + 0xc0], rdi
mov rax, qword [0x140092c50]
mov qword [rbp + 0xb4], rax
mov qword [rbp + 0xa8], rdi
lea r8d, [rdi + 0x21]
mov rdx, rbx
lea rcx, [rbp + 0x40]
call fcn.140032cd0
test rax, rax
jne 0x14002e59a
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x30]
add rcx, rax
xor r8d, r8d
lea edx, [rdi + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x30], r15
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x2c], edx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rax
mov qword [rsp + 0x50], rdi
mov word [rsp + 0x58], 1
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
mov rax, qword [rbp + rcx + 0x78]
mov qword [rsp + 0x30], rax
test rax, rax
sete byte [rsp + 0x38]
mov byte [rsp + 0x39], 0
movdqu xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rdi
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp - 0x30], xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm1
lea rax, [rbp - 0x50]
mov qword [rsp + 0x50], rax
movzx r12d, byte [rsp + 0x39]
movzx edi, byte [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
movzx r14d, byte [rbp - 0x28]
mov r15, qword [rbp - 0x30]
test dil, dil
jne 0x14002e654
test rbx, rbx
je 0x14002e64f
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::sgetc_void____ptr64]
cmp eax, 0xffffffff
je 0x14002e64f
movzx r12d, al
jmp 0x14002e651
xor ebx, ebx
mov dil, 1
test r14b, r14b
jne 0x14002e672
test r15, r15
je 0x14002e66c
mov rcx, r15
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::sgetc_void____ptr64]
cmp eax, 0xffffffff
jne 0x14002e66f
xor r15d, r15d
mov r14b, 1
test rbx, rbx
jne 0x14002e753
test r15, r15
jne 0x14002e75c
mov eax, 0x5a4d
mov rcx, qword [rbp - 0x50]
cmp word [rcx], ax
mov r14, qword [rsp + 0x78]
je 0x14002e7cb
xorps xmm0, xmm0
movups xmmword [rsi + 0x40], xmm0
xor r15d, r15d
mov qword [rsi], r15
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], 0xf
mov byte [rsi], r15b
mov qword [rsi + 0x20], r15
mov qword [rsi + 0x30], r15
mov qword [rsi + 0x38], 0xf
mov byte [rsi + 0x20], r15b
mov rdx, qword [rbp - 0x40]
sub rdx, rcx
cmp rdx, 0x1000
mov rax, rcx
jb 0x14002e6f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002e99b
call fcn.1400727b4
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r15
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x30], rax
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x2c], edx
lea rcx, [rbp + 0x40]
call fcn.140032720
lea rcx, [rbp + 0x48]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
jmp 0x14002e3d7
test r15, r15
jne 0x14002e684
test dil, dil
jne 0x14002e77c
test rbx, rbx
je 0x14002e77a
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::sgetc_void____ptr64]
cmp eax, 0xffffffff
je 0x14002e77a
movzx r12d, al
jmp 0x14002e77c
xor ebx, ebx
mov byte [rsp + 0x20], r12b
mov rax, qword [rbp - 0x48]
cmp rax, qword [rbp - 0x40]
je 0x14002e794
mov byte [rax], r12b
inc qword [rbp - 0x48]
jmp 0x14002e7a6
lea r8, [rsp + 0x20]
mov rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x50]
call fcn.140034100
test rbx, rbx
je 0x14002e7c1
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::sbumpc_void____ptr64]
cmp eax, 0xffffffff
je 0x14002e7c1
xor dil, dil
jmp 0x14002e631
xor ebx, ebx
mov dil, 1
jmp 0x14002e631
movsxd rbx, dword [rcx + 0x3c]
add rbx, rcx
xor r15d, r15d
cmp dword [rbx], 0x4550
je 0x14002e80f
xorps xmm0, xmm0
movups xmmword [rsi + 0x40], xmm0
mov qword [rsi], r15
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], 0xf
mov byte [rsi], r15b
mov qword [rsi + 0x20], r15
mov qword [rsi + 0x30], r15
mov qword [rsi + 0x38], 0xf
mov byte [rsi + 0x20], r15b
jmp 0x14002e6cb
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov rax, qword [rbp - 0x80]
inc r13
cmp byte [rax + r13], 0
jne 0x14002e826
mov r8, r13
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14002ebd0
lea r8, [rsp + 0x30]
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.14002dfc0
mov eax, dword [rsp + 0x74]
mov rdi, qword [rbp - 0x30]
cmp rax, rdi
jbe 0x14002e89e
xorps xmm0, xmm0
movups xmmword [rsi + 0x40], xmm0
mov qword [rsi], r15
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov qword [rsi + 0x20], r15
mov qword [rsi + 0x30], r15
mov qword [rsi + 0x38], 0xf
mov byte [rsi + 0x20], 0
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x14002e708
jmp 0x14002e6cb
mov qword [rbp - 0x20], r15
movdqa xmm0, xmmword [0x140088100]
movdqa xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
mov qword [rbp], r15
movdqa xmmword [rbp + 0x10], xmm0
mov byte [rbp], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rdx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x60]
lea rcx, [rbp - 0x20]
call fcn.14002ebd0
lea rax, [rbp]
cmp rax, r14
je 0x14002e905
mov rdx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x14002e8f8
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
lea rcx, [rbp]
call fcn.14002ebd0
movzx ecx, word [rbx + 6]
mov dword [rbp + 0x28], ecx
mov rax, qword [rbp - 0x28]
mov dword [rbp + 0x20], eax
mov dword [rbp + 0x24], edi
movaps xmm0, xmmword [rbp - 0x20]
movups xmmword [rsi], xmm0
movaps xmm1, xmmword [rbp - 0x10]
movups xmmword [rsi + 0x10], xmm1
movdqa xmm0, xmmword [0x140088100]
movdqa xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
movaps xmm0, xmmword [rbp]
movups xmmword [rsi + 0x20], xmm0
movaps xmm1, xmmword [rbp + 0x10]
movups xmmword [rsi + 0x30], xmm1
movdqa xmm0, xmmword [0x140088100]
movdqa xmmword [rbp + 0x10], xmm0
mov byte [rbp], 0
mov dword [rsi + 0x40], eax
mov dword [rsi + 0x44], edi
mov dword [rsi + 0x48], ecx
lea rcx, [rbp - 0x20]
call fcn.14002eae0
nop
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x14002e9b3
mov rdx, qword [rbp - 0x40]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002e9a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002e9a2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400727b4
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r15
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x30], rax
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x2c], edx
lea rcx, [rbp + 0x40]
call fcn.140032720
lea rcx, [rbp + 0x48]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x14002e412
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002e40d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002e40d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14002bdb0
nop
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x30]
lea rcx, str.exists
call fcn.14002d170
nop
call fcn.14002be50
int3