Function at 0x140002e70
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov r12, rcx
mov qword [rsp + 0x68], rcx
xor r13d, r13d
mov dword [rsp + 0x44], r13d
lea r8, str.TrustedInstallerManager.exe
mov rdx, rcx
lea rcx, [rbp - 0x40]
call fcn.140007040
nop
lea r8, str.TrustedInstallerManager_2.exe
mov rdx, r12
lea rcx, [rbp - 0x60]
call fcn.140007040
nop
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x130]
call sub.VCRUNTIME140.dll_memset
lea rbx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rbx, qword [rbp - 0x40]
lea rax, [0x140000000]
lea rax, [rax + 0xbd58]
mov qword [rbp + 0x130], rax
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x44], 4
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x130]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x130], rdi
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x12c], edx
lea rcx, [rbp + 0x140]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x140], rax
mov byte [rbp + 0x1bc], r13b
mov byte [rbp + 0x1b1], r13b
lea rcx, [rbp + 0x140]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0x1c0], r13
mov rax, qword [0x140010c30]
mov qword [rbp + 0x1b4], rax
mov qword [rbp + 0x1a8], r13
lea r8d, [r13 + 0x21]
mov rdx, rbx
lea rcx, [rbp + 0x140]
call fcn.140006aa0
test rax, rax
jne 0x140003007
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x130]
add rcx, rax
xor r8d, r8d
lea edx, [r13 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x130], rdi
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x12c], edx
cmp qword [rbp + 0x1c0], 0
jne 0x1400030ec
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r13
mov r8d, 0x2c
lea rdx, str.Unable_to_open_the_original_file_for_reading
lea rcx, [rsp + 0x20]
call fcn.140007610
nop
lea rdx, str.Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400071a0
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
mov rcx, rax
call fcn.140007f20
lea rdx, [0x140007370]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1400030ec
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400030e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400030e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008ccc
lea rdx, [rbp - 0x40]
lea rcx, [rbp]
call fcn.140002810
nop
cmp qword [rbp + 0x10], 0
jne 0x1400031b1
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r13
mov r8d, 0x35
lea rdx, str.Unable_to_calculate_the_MD5_hash_of_the_original_file
lea rcx, [rsp + 0x20]
call fcn.140007610
nop
lea rdx, str.Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400071a0
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
mov rcx, rax
call fcn.140007f20
lea rdx, [0x140007370]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1400031b1
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400031ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400031ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008ccc
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x20], r13
mov word [rsp + 0x28], 1
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
mov rax, qword [rbp + rcx + 0x178]
mov qword [rsp + 0x50], rax
test rax, rax
sete byte [rsp + 0x58]
mov byte [rsp + 0x59], 0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x60], rcx
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
movzx esi, byte [rsp + 0x59]
mov rbx, qword [rsp + 0x50]
movzx r15d, byte [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
test rax, rax
jne 0x14000323c
movzx r14d, byte [rsp + 0x58]
jmp 0x140003260
test rbx, rbx
je 0x140003254
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::sgetc_void____ptr64]
cmp eax, 0xffffffff
je 0x140003254
movzx esi, al
jmp 0x140003257
mov rbx, r13
mov r14b, 1
nop word [rax + rax]
test r15b, r15b
jne 0x14000327e
test rdi, rdi
je 0x140003278
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::sgetc_void____ptr64]
cmp eax, 0xffffffff
jne 0x14000327b
mov rdi, r13
mov r15b, 1
test rbx, rbx
jne 0x140003359
test rdi, rdi
jne 0x140003362
mov rax, qword [rsp + 0x70]
mov rbx, rax
mov ecx, 0x5a4d
cmp word [rax], cx
je 0x1400033df
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r13
mov r8d, 0x1c
lea rdx, str.Invalid_DOS_header_signature
lea rcx, [rsp + 0x20]
call fcn.140007610
nop
lea rdx, str.Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400071a0
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
mov rcx, rax
call fcn.140007f20
lea rdx, [0x140007370]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1400033da
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400033d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400033d5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
test rdi, rdi
jne 0x140003290
test r14b, r14b
jne 0x140003382
test rbx, rbx
je 0x14000337f
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::sgetc_void____ptr64]
cmp eax, 0xffffffff
je 0x14000337f
movzx esi, al
jmp 0x140003382
mov rbx, r13
mov byte [rsp + 0x40], sil
mov rax, qword [rsp + 0x78]
cmp rax, qword [rbp - 0x80]
je 0x14000339c
mov byte [rax], sil
inc qword [rsp + 0x78]
jmp 0x1400033b0
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x70]
call fcn.1400080e0
test rbx, rbx
je 0x140003254
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::sbumpc_void____ptr64]
cmp eax, 0xffffffff
je 0x140003254
mov byte [rsp + 0x58], 0
jmp 0x14000323c
call fcn.140008ccc
mov rax, qword [rsp + 0x70]
movsxd rbx, dword [rbx + 0x3c]
add rbx, rax
cmp dword [rbx], 0x4550
je 0x14000349e
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r13
mov r8d, 0x1b
lea rdx, str.Invalid_NT_header_signature
lea rcx, [rsp + 0x20]
call fcn.140007610
nop
lea rdx, str.Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400071a0
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
mov rcx, rax
call fcn.140007f20
lea rdx, [0x140007370]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14000349e
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003499
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003499
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008ccc
movzx r10d, word [rbx + 0x14]
add r10, 0x18
add r10, rbx
mov rdi, r13
mov r8d, r13d
movzx r9d, word [rbx + 6]
test r9d, r9d
je 0x1400034f4
lea r11, str..text
movsxd rax, r8d
lea rcx, [rax + rax*4]
lea rdx, [r10 + rcx*8]
mov rcx, r13
nop
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r11 + rcx - 1]
jne 0x14000359b
cmp rcx, 6
jne 0x1400034d0
mov rdi, rdx
test rdx, rdx
jne 0x1400035b1
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r13
mov r8d, 0x38
lea rdx, str.Unable_to_locate_the_code_section_in_the_executable_file
lea rcx, [rsp + 0x20]
call fcn.140007610
nop
lea rdx, str.Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400071a0
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
mov rcx, rax
call fcn.140007f20
lea rdx, [0x140007370]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1400035b1
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400035ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400035ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
inc r8d
cmp r8d, r9d
jl 0x1400034c1
jmp 0x1400034f4
call fcn.140008ccc
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rax
lea rcx, [rbp - 0x78]
call fcn.140002de0
nop
mov rcx, qword [rsp + 0x78]
sub rcx, qword [rsp + 0x70]
mov eax, dword [rdi + 0x14]
cmp rax, rcx
jb 0x14000368a
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r13
mov r8d, 0x1b
lea rdx, str.Invalid_code_section_offset
lea rcx, [rsp + 0x20]
call fcn.140007610
nop
lea rdx, str.Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400071a0
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
mov rcx, rax
call fcn.140007f20
lea rdx, [0x140007370]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14000368a
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003685
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003685
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008ccc
mov ecx, dword [rdi + 0x14]
mov rbx, qword [rsp + 0x70]
add rbx, rcx
mov esi, dword [rdi + 0x10]
lea r15, [rsi + rbx]
cmp qword [rsp + 0x78], r15
jae 0x140003753
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r13
mov r8d, 0x19
lea rdx, str.Invalid_code_section_size
lea rcx, [rsp + 0x20]
call fcn.140007610
nop
lea rdx, str.Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400071a0
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
mov rcx, rax
call fcn.140007f20
lea rdx, [0x140007370]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140003753
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000374e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000374e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008ccc
mov rdi, qword [rbp - 0x70]
mov r14, qword [rbp - 0x78]
sub rdi, r14
cmp rsi, rdi
jl 0x1400037a2
mov rsi, r15
sub rsi, rdi
mov r8, rdi
mov rdx, rbx
mov rcx, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
sete al
test al, al
jne 0x14000379f
cmp rbx, rsi
je 0x1400037a2
inc rbx
mov r8, rdi
mov rdx, rbx
mov rcx, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
sete al
test al, al
je 0x140003780
mov r15, rbx
mov rax, qword [rsp + 0x70]
sub r15, rax
mov byte [rax + r15], 0x12
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0x20]
call sub.VCRUNTIME140.dll_memset
lea rbx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova rbx, qword [rbp - 0x60]
lea rax, [0x140000000]
lea rax, [rax + 0xbc90]
mov qword [rbp + 0x20], rax
lea rcx, [rbp + 0xc8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x44], 5
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x20]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x20], rdi
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x1c], edx
lea rcx, [rbp + 0x28]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rsi, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x28], rsi
mov byte [rbp + 0xa4], 0
mov byte [rbp + 0x99], 0
lea rcx, [rbp + 0x28]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0xa8], r13
mov rax, qword [0x140010c30]
mov qword [rbp + 0x9c], rax
mov qword [rbp + 0x90], r13
mov r8d, 0x22
mov rdx, rbx
lea rcx, [rbp + 0x28]
call fcn.140006aa0
test rax, rax
jne 0x1400038ae
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x20]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x20], rdi
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x1c], edx
cmp qword [rbp + 0xa8], 0
jne 0x140003987
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r13
mov r8d, 0x2c
lea rdx, str.Unable_to_open_the_modified_file_for_writing
lea rcx, [rsp + 0x20]
call fcn.140007610
nop
lea rdx, str.Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400071a0
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
mov rcx, rax
call fcn.140007f20
lea rdx, [0x140007370]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140003987
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003982
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003982
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008ccc
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
sub r8, rdx
lea rcx, [rbp + 0x20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x28]
call fcn.140006930
test rax, rax
jne 0x1400039c8
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x20]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x20]
call fcn.140002810
nop
cmp qword [rbp - 0x10], 0
jne 0x140003a8e
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r13
mov r8d, 0x35
lea rdx, str.Unable_to_calculate_the_MD5_hash_of_the_modified_file
lea rcx, [rsp + 0x20]
call fcn.140007610
nop
lea rdx, str.Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400071a0
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
mov rcx, rax
call fcn.140007f20
lea rdx, [0x140007370]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140003a8e
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003a88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003a88
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008ccc
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140003acc
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ac7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003ac7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008ccc
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x20], rdi
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x1c], edx
mov qword [rbp + 0x28], rsi
cmp qword [rbp + 0xa8], 0
je 0x140003b39
mov rax, qword [rbp + 0x40]
lea rcx, [rbp + 0x98]
cmp qword [rax], rcx
jne 0x140003b39
mov rdx, qword [rbp + 0xb8]
mov rcx, qword [rbp + 0xb0]
mov qword [rax], rcx
mov rax, qword [rbp + 0x60]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp + 0x78]
mov dword [rax], edx
cmp byte [rbp + 0xa4], 0
je 0x140003b4b
lea rcx, [rbp + 0x28]
call fcn.140006930
lea rcx, [rbp + 0x28]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x30]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0xc8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x140003bb7
mov rdx, qword [rbp - 0x68]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ba6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003ba6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008ccc
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r13
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140003c02
mov rdx, qword [rbp - 0x80]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003bf0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003bf0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008ccc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x140003c40
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c3b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003c3b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008ccc
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x18], 0xf
mov byte [rbp], 0
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x130], rax
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x12c], edx
mov qword [rbp + 0x140], rsi
cmp qword [rbp + 0x1c0], 0
je 0x140003ccc
mov rax, qword [rbp + 0x158]
lea rcx, [rbp + 0x1b0]
cmp qword [rax], rcx
jne 0x140003ccc
mov rdx, qword [rbp + 0x1d0]
mov rcx, qword [rbp + 0x1c8]
mov qword [rax], rcx
mov rax, qword [rbp + 0x178]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp + 0x190]
mov dword [rax], edx
cmp byte [rbp + 0x1bc], 0
je 0x140003ce1
lea rcx, [rbp + 0x140]
call fcn.140006930
lea rcx, [rbp + 0x140]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x148]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140003d48
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003d43
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008ccc
movdqa xmm0, xmmword [0x14000beb0]
movdqu xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140003d97
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003d92
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008ccc
movdqa xmm0, xmmword [0x14000beb0]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov rdx, qword [r12 + 0x18]
cmp rdx, 0xf
jbe 0x140003de0
inc rdx
mov rcx, qword [r12]
cmp rdx, 0x1000
jb 0x140003ddb
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003e25
mov rcx, r8
call fcn.140008ccc
mov qword [r12 + 0x10], r13
mov qword [r12 + 0x18], 0xf
mov byte [r12], 0
mov al, 1
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.140008c70
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3