Function at 0x14000ce60
Capabilities:
Check if file exists
Compare security identifiers
Get file attributes
Get file size
Print debug messages
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x108]
sub rsp, 0x1e0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1402e3910]
xor rax, rsp
mov qword [rbp + 0xd8], rax
mov r14, rcx
lea r12, [0x1402f7520]
mov qword [rsp + 0x68], r12
mov rcx, r12
call fcn.1401cd944
test eax, eax
je 0x14000cebe
mov ecx, eax
call fcn.1401cd56c
nop
mov qword [rbp + 0x88], SafeArrayGetDim
mov byte [rbp + 0x70], 0
mov qword [rbp + 0x80], 9
mov r8d, 9
lea rdx, str.EnableLog
lea rcx, [rbp + 0x70]
call fcn.1401cf720
mov byte [rbp + 0x79], 0
mov ebx, dword [0x1402e45d0]
mov dword [rbp], 4
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SOFTWAREASUSARMOURY_CRATE_Diagnosis
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000cf62
lea rdx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae rdx, qword [rbp + 0x70]
lea rax, [rbp]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
cmove ebx, dword [rbp + 0x28]
mov rax, qword [rbp + 0x88]
cmp rax, 0x10
jb 0x14000cfa9
inc rax
mov rcx, qword [rbp + 0x70]
cmp rax, 0x1000
jb 0x14000cfa4
test cl, 0x1f
jne 0x14000cf9e
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000cf9e
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x14000cf9e
mov rcx, rax
jmp 0x14000cfa4
call fcn.1401d24e0
int3
call fcn.140015ca0
mov dword [0x1402e45d0], ebx
lea rcx, [rbp + 8]
call fcn.14000dda0
mov rbx, rax
lea rcx, [0x1402e4658]
xor r15d, r15d
cmp rcx, rax
je 0x14000cff3
call fcn.140010b00
movups xmm0, xmmword [rbx]
movups xmmword [0x1402e4658], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x1402e4668], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], SafeArrayGetDim
mov byte [rbx], r15b
mov rax, qword [rbp + 0x20]
cmp rax, 0x10
jb 0x14000d037
inc rax
mov rcx, qword [rbp + 8]
cmp rax, 0x1000
jb 0x14000d032
test cl, 0x1f
jne 0x14000d02c
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000d02c
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x14000d02c
mov rcx, rax
jmp 0x14000d032
call fcn.1401d24e0
int3
call fcn.140015ca0
lea rcx, [rbp + 8]
call fcn.14000e130
mov rbx, rax
lea rdi, [0x1402e4678]
cmp rdi, rax
je 0x14000d07b
mov rcx, rdi
call fcn.140010b00
movups xmm0, xmmword [rbx]
movups xmmword [0x1402e4678], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x1402e4688], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], SafeArrayGetDim
mov byte [rbx], r15b
mov rax, qword [rbp + 0x20]
cmp rax, 0x10
jb 0x14000d0bf
inc rax
mov rcx, qword [rbp + 8]
cmp rax, 0x1000
jb 0x14000d0ba
test cl, 0x1f
jne 0x14000d0b4
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000d0b4
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x14000d0b4
mov rcx, rax
jmp 0x14000d0ba
call fcn.1401d24e0
int3
call fcn.140015ca0
mov dword [r14], r15d
cmp qword [0x1402e4688], r15
jbe 0x14000dd59
mov qword [rbp + 0x48], SafeArrayGetDim
mov byte [rbp + 0x30], r15b
mov qword [rbp + 0x40], 1
mov r8d, 1
lea rdx, [0x14029a358]
lea rcx, [rbp + 0x30]
call fcn.1401cf720
mov byte [rbp + 0x31], r15b
cmp qword [0x1402e4690], 0x10
cmovae rdi, qword [0x1402e4678]
mov r9, qword [0x1402e4688]
mov r8, rdi
lea rcx, [rbp + 0x30]
call fcn.140014610
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], SafeArrayGetDim
mov byte [rax], 0
mov r8d, 9
lea rdx, str.OptionHAL
lea rcx, [rbp + 0x50]
call fcn.140012530
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x80], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x80], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], SafeArrayGetDim
mov byte [rax], 0
mov rax, qword [rbp + 0x68]
cmp rax, 0x10
jb 0x14000d1cc
inc rax
mov rcx, qword [rbp + 0x50]
cmp rax, 0x1000
jb 0x14000d1c7
test cl, 0x1f
jne 0x14000d1c1
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000d1c1
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x14000d1c1
mov rcx, rax
jmp 0x14000d1c7
call fcn.1401d24e0
int3
call fcn.140015ca0
movdqa xmm0, xmmword [0x14029a950]
movdqu xmmword [rbp + 0x60], xmm0
mov byte [rbp + 0x50], 0
mov rax, qword [rbp + 0x48]
cmp rax, 0x10
jb 0x14000d221
inc rax
mov rcx, qword [rbp + 0x30]
cmp rax, 0x1000
jb 0x14000d21c
test cl, 0x1f
jne 0x14000d216
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000d216
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x14000d216
mov rcx, rax
jmp 0x14000d21c
call fcn.1401d24e0
int3
call fcn.140015ca0
movdqa xmm0, xmmword [0x14029a950]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], 0
lea rbx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae rbx, qword [rbp + 0x70]
add rbx, qword [rbp + 0x80]
lea rdi, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae rdi, qword [rbp + 0x70]
movdqa xmm0, xmmword [0x14029a940]
movdqu xmmword [rbp + 0xa0], xmm0
mov word [rbp + 0x90], r15w
mov rdx, rbx
sub rdx, rdi
lea rcx, [rbp + 0x90]
call fcn.140013fe0
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp + 0x90]
call fcn.140015010
nop
lea rdx, [rbp + 8]
call fcn.14000e3f0
nop
mov r8d, 0x67
lea rdx, str._Logger__Logger::GetParametersFromRegistry____Log_folder_security_checking_...__by_OutputDebugString___
mov rcx, rax
call fcn.140012530
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x40], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], SafeArrayGetDim
mov byte [rax], 0
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rcx, qword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rax, qword [rbp + 0x48]
cmp rax, 0x10
jb 0x14000d335
inc rax
mov rcx, qword [rbp + 0x30]
cmp rax, 0x1000
jb 0x14000d330
test cl, 0x1f
jne 0x14000d32a
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000d32a
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x14000d32a
mov rcx, rax
jmp 0x14000d330
call fcn.1401d24e0
int3
call fcn.140015ca0
movdqa xmm0, xmmword [0x14029a950]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], 0
mov rax, qword [rbp + 0x20]
cmp rax, 0x10
jb 0x14000d38a
inc rax
mov rcx, qword [rbp + 8]
cmp rax, 0x1000
jb 0x14000d385
test cl, 0x1f
jne 0x14000d37f
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000d37f
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x14000d37f
mov rcx, rax
jmp 0x14000d385
call fcn.1401d24e0
int3
call fcn.140015ca0
lea rdx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 8
cmovae rdx, qword [rbp + 0x90]
lea rcx, [rbp + 8]
call fcn.140013220
call fcn.14000af60
call fcn.14000af60
lea rcx, [rbp + 8]
cmp qword [rbp + 0x20], 8
cmovae rcx, qword [rbp + 8]
lea rdx, [rbp + 0x28]
call fcn.1401cdbfc
cmp eax, 0xffffffff
je 0x14000d532
cmp eax, 8
je 0x14000d532
lea rdi, [rbp + 0x90]
cmp qword [rbp + 0xa8], 8
cmovae rdi, qword [rbp + 0x90]
mov ebx, r15d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000d52e
test al, 0x10
je 0x14000d52e
mov qword [rbp], r15
mov qword [rbp + 0x30], r15
lea rax, [rbp + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp]
mov edx, 1
mov r8d, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
test eax, eax
jne 0x14000d52e
mov dword [rbp + 0x28], ebx
mov word [rbp + 0x2c], 0x500
mov qword [rbp + 0xb0], r15
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14000d4c4
mov rdx, qword [rbp + 0xb0]
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov ebx, eax
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov qword [rbp + 0x50], r15
lea rax, [rbp + 0x50]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8d, [r9 + 0x12]
mov dl, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14000d520
mov rdx, qword [rbp + 0x50]
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
or ebx, eax
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
jne 0x14000d532
mov bl, 1
jmp 0x14000d534
xor bl, bl
lea rcx, [rbp + 8]
call fcn.140012270
test bl, bl
je 0x14000d7ee
lea rdx, [rbp + 8]
call fcn.14000e3f0
nop
mov r8d, 0x57
lea rdx, str._Logger__Logger::GetParametersFromRegistry____remove_all___...__by_OutputDebugString___
mov rcx, rax
call fcn.140012530
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x40], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], SafeArrayGetDim
mov byte [rax], 0
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rcx, qword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rax, qword [rbp + 0x48]
cmp rax, 0x10
jb 0x14000d5e2
inc rax
mov rcx, qword [rbp + 0x30]
cmp rax, 0x1000
jb 0x14000d5dd
test cl, 0x1f
jne 0x14000d5d7
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000d5d7
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x14000d5d7
mov rcx, rax
jmp 0x14000d5dd
call fcn.1401d24e0
int3
call fcn.140015ca0
movdqa xmm0, xmmword [0x14029a950]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], 0
mov rax, qword [rbp + 0x20]
cmp rax, 0x10
jb 0x14000d637
inc rax
mov rcx, qword [rbp + 8]
cmp rax, 0x1000
jb 0x14000d632
test cl, 0x1f
jne 0x14000d62c
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000d62c
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x14000d62c
mov rcx, rax
jmp 0x14000d632
call fcn.1401d24e0
int3
call fcn.140015ca0
lea rdx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 8
cmovae rdx, qword [rbp + 0x90]
lea rcx, [rbp + 8]
call fcn.140013220
nop
xor eax, eax
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rax
mov dword [rbp + 0x50], r15d
call fcn.14000af60
mov qword [rbp + 0x58], rax
mov qword [rbp + 0x30], r15
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 8]
call fcn.14000b5d0
call fcn.14000af60
mov rcx, qword [rax + 8]
mov rax, qword [rbp + 0x58]
cmp qword [rax + 8], rcx
jne 0x14000d7a6
cmp dword [rbp + 0x50], 0
jne 0x14000d7a6
lea rcx, [rbp + 8]
call fcn.140012270
lea rdx, [rbp + 8]
call fcn.14000e3f0
nop
mov r8d, 0x5d
lea rdx, str._Logger__Logger::GetParametersFromRegistry____remove_all___..._Done.__by_OutputDebugString___
mov rcx, rax
call fcn.140012530
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x40], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], SafeArrayGetDim
mov byte [rax], 0
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rcx, qword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rax, qword [rbp + 0x48]
cmp rax, 0x10
jb 0x14000d74b
inc rax
mov rcx, qword [rbp + 0x30]
cmp rax, 0x1000
jb 0x14000d746
test cl, 0x1f
jne 0x14000d740
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000d740
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x14000d740
mov rcx, rax
jmp 0x14000d746
call fcn.1401d24e0
int3
call fcn.140015ca0
movdqa xmm0, xmmword [0x14029a950]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], 0
mov rax, qword [rbp + 0x20]
cmp rax, 0x10
jb 0x14000d7ee
inc rax
mov rcx, qword [rbp + 8]
cmp rax, 0x1000
jb 0x14000d79f
test cl, 0x1f
jne 0x14000d799
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000d799
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x14000d799
mov rcx, rax
jmp 0x14000d79f
call fcn.1401d24e0
int3
call fcn.140015ca0
jmp 0x14000d7ee
lea rdx, str.remove_all_p_:_invalid_argument
lea rcx, [rsp + 0x70]
call fcn.140010b70
nop
lea rcx, [rbp + 0xb0]
call fcn.14000a820
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x30], xmm0
lea r8, [rbp + 0x30]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x70]
call fcn.14000b440
lea rdx, [0x1402dd448]
lea rcx, [rbp - 0x70]
call fcn.1401d0318
nop
lea rdi, [rbp + 0x90]
cmp qword [rbp + 0xa8], 8
cmovae rdi, qword [rbp + 0x90]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000d973
test al, 0x10
je 0x14000d973
mov qword [rbp + 0xb0], r15
mov dword [rbp + 0x28], 0
mov word [rbp + 0x2c], 0x100
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov dl, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14000d973
xor eax, eax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], rax
mov rdx, qword [rbp + 0xb0]
lea rcx, [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_BuildTrusteeWithSidW]
mov qword [rbp], r15
mov qword [rbp + 0x50], r15
lea rax, [rbp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
lea rax, [rbp]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea edx, [r9 + 1]
lea r8d, [r9 + 4]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
test eax, eax
jne 0x14000d966
mov ebx, r15d
mov rcx, qword [rbp]
cmp r15w, word [rcx + 4]
jae 0x14000d937
nop dword [rax + rax]
mov qword [rbp + 0x30], r15
lea r8, [rbp + 0x30]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x14000d929
mov rdx, qword [rbp + 0x30]
add rdx, 8
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x14000d929
mov edx, ebx
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_DeleteAce]
inc ebx
mov rcx, qword [rbp]
movzx eax, word [rcx + 4]
cmp ebx, eax
jl 0x14000d8f0
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea edx, [r9 + 1]
mov r8d, 0x80000004
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
lea rdx, [rbp + 8]
call fcn.14000e3f0
nop
mov r8d, 0x6c
lea rdx, str._Logger__Logger::GetParametersFromRegistry____Log_folder_security_checking_..._Done._by_OutputDebugString___
mov rcx, rax
call fcn.140012530
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x40], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], SafeArrayGetDim
mov byte [rax], 0
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rcx, qword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rax, qword [rbp + 0x48]
cmp rax, 0x10
jb 0x14000da10
inc rax
mov rcx, qword [rbp + 0x30]
cmp rax, 0x1000
jb 0x14000da0b
test cl, 0x1f
jne 0x14000da05
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000da05
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x14000da05
mov rcx, rax
jmp 0x14000da0b
call fcn.1401d24e0
int3
call fcn.140015ca0
movdqa xmm0, xmmword [0x14029a950]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], 0
mov rax, qword [rbp + 0x20]
cmp rax, 0x10
jb 0x14000da65
inc rax
mov rcx, qword [rbp + 8]
cmp rax, 0x1000
jb 0x14000da60
test cl, 0x1f
jne 0x14000da5a
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000da5a
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x14000da5a
mov rcx, rax
jmp 0x14000da60
call fcn.1401d24e0
int3
call fcn.140015ca0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x40], xmm0
mov rdi, qword [rbp + 0xa0]
lea rsi, [rbp + 0x90]
cmp qword [rbp + 0xa8], 8
cmovae rsi, qword [rbp + 0x90]
cmp rdi, 8
jae 0x14000da9f
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x30], xmm0
mov ebx, 7
jmp 0x14000dadb
movabs rax, 0x7ffffffffffffffe
mov rbx, rdi
or rbx, 7
cmp rax, rbx
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x30]
call fcn.140012b00
mov qword [rbp + 0x30], rax
lea r8, [rdi*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.1401cf720
mov qword [rbp + 0x48], rbx
mov qword [rbp + 0x40], rdi
lea rcx, [rbp + 0x30]
cmp rbx, 8
cmovae rcx, qword [rbp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
mov ebx, eax
lea rcx, [rbp + 0x30]
call fcn.140012270
test ebx, ebx
je 0x14000dd04
mov qword [rbp + 0x68], SafeArrayGetDim
mov byte [rbp + 0x50], 0
mov qword [rbp + 0x60], 1
mov r8d, 1
lea rdx, [0x14029a358]
lea rcx, [rbp + 0x50]
call fcn.1401cf720
mov byte [rbp + 0x51], 0
lea r8, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae r8, qword [rbp + 0x70]
mov r9, qword [rbp + 0x80]
lea rcx, [rbp + 0x50]
call fcn.140014610
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x40], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], SafeArrayGetDim
mov byte [rax], 0
mov r8d, SafeArrayGetDim
lea rdx, str.AacVgaHal.log
lea rcx, [rbp + 0x30]
call fcn.140012530
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xc0], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xb0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], SafeArrayGetDim
mov byte [rax], 0
mov rax, qword [rbp + 0x48]
cmp rax, 0x10
jb 0x14000dc07
inc rax
mov rcx, qword [rbp + 0x30]
cmp rax, 0x1000
jb 0x14000dc02
test cl, 0x1f
jne 0x14000dbfc
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000dbfc
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x14000dbfc
mov rcx, rax
jmp 0x14000dc02
call fcn.1401d24e0
int3
call fcn.140015ca0
movdqa xmm0, xmmword [0x14029a950]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], 0
mov rax, qword [rbp + 0x68]
cmp rax, 0x10
jb 0x14000dc5c
inc rax
mov rcx, qword [rbp + 0x50]
cmp rax, 0x1000
jb 0x14000dc57
test cl, 0x1f
jne 0x14000dc51
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000dc51
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x14000dc51
mov rcx, rax
jmp 0x14000dc57
call fcn.1401d24e0
int3
call fcn.140015ca0
lea rcx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0x10
cmovae rcx, qword [rbp + 0xb0]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000dcb9
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [r14], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0xc8]
cmp rax, 0x10
jb 0x14000dd04
inc rax
mov rcx, qword [rbp + 0xb0]
cmp rax, 0x1000
jb 0x14000dcfe
test cl, 0x1f
jne 0x14000dcf8
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000dcf8
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x14000dcf8
mov rcx, rax
jmp 0x14000dcfe
call fcn.1401d24e0
int3
call fcn.140015ca0
nop
lea rcx, [rbp + 0x90]
call fcn.140012270
nop
mov rax, qword [rbp + 0x88]
cmp rax, 0x10
jb 0x14000dd59
inc rax
mov rcx, qword [rbp + 0x70]
cmp rax, 0x1000
jb 0x14000dd53
test cl, 0x1f
jne 0x14000dd4d
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000dd4d
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x14000dd4d
mov rcx, rax
jmp 0x14000dd53
call fcn.1401d24e0
int3
call fcn.140015ca0
nop
mov rcx, r12
call fcn.1401cd968
test eax, eax
je 0x14000dd6d
mov ecx, eax
call fcn.1401cd56c
nop
mov rcx, qword [rbp + 0xd8]
xor rcx, rsp
call fcn.1401cb100
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret