Function at 0x14001d0e0
Capabilities:
Read .ini file
Set file attributes

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x20290
call fcn.1400a28a0
sub rsp, rax
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x202c8], rbx
mov qword [rsp + 0x202d0], rbp
mov qword [rsp + 0x202d8], rsi
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0x20280], rax
mov r15, rcx
mov dword [rsp + 0x30], 0
xor edx, edx
mov r8d, 0xfffe
lea rcx, [rsp + 0x280]
call fcn.140080d50
xor edx, edx
mov r8d, 0xfffe
lea rcx, [rsp + 0x10280]
call fcn.140080d50
call fcn.140069504
mov rcx, qword [rax + 8]
call fcn.1400418e0
mov r8, rax
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.140081cd0
mov edx, 0x20
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea r9, [rsp + 0x70]
mov r8d, 0x7fff
lea rdx, [rsp + 0x280]
lea rcx, str.DeviceDesc
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
xor r14d, r14d
or r13, 0xffffffffffffffff
nop
nop
nop
movsxd rax, r14d
lea r12, [rsp + rax*2 + 0x280]
call fcn.1400696cc
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x14001dc1f
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x20], rsi
test r12, r12
je 0x14001d2d1
test r12, 0xffffffffffff0000
jne 0x14001d232
movzx edi, r12w
mov ecx, edi
call fcn.1400696b8
test rax, rax
je 0x14001d326
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140003a40
mov rsi, qword [rsp + 0x20]
jmp 0x14001d326
xor eax, eax
mov rcx, r13
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
je 0x14001d2d1
mov ebx, dword [rsi - 0x10]
mov rbp, r12
sub rbp, rsi
sar rbp, 1
mov edx, 1
sub edx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, ecx
or eax, edx
jge 0x14001d27d
mov edx, ecx
lea rcx, [rsp + 0x20]
call fcn.140003180
mov rsi, qword [rsp + 0x20]
cmp rbp, rbx
ja 0x14001d29d
movsxd rax, edi
lea rbx, [rax + rax]
lea r8, [rsi + rbp*2]
mov r9, rbx
mov rdx, rbx
mov rcx, rsi
call fcn.140081c40
jmp 0x14001d2b5
movsxd rax, edi
lea rbx, [rax + rax]
mov r9, rbx
mov r8, r12
mov rdx, rbx
mov rcx, rsi
call fcn.140080540
test edi, edi
js 0x14001d7d8
cmp edi, dword [rsi - 0xc]
jg 0x14001d7d8
mov dword [rsi - 0x10], edi
mov word [rbx + rsi], 0
jmp 0x14001d326
lea rdx, [rsi - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14001d326
cmp dword [rdx + 0x10], 0
jge 0x14001d2fc
cmp dword [rsi - 0xc], 0
jl 0x14001d7e3
mov dword [rsi - 0x10], 0
mov word [rsi], 0
jmp 0x14001d326
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001d314
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x20], rsi
mov rdi, rsi
cmp word [rsi], 0
je 0x14001d3f5
nop
nop
nop
nop
movzx edx, word [rdi]
lea rcx, [0x1400a7614]
call fcn.1400804a0
test rax, rax
je 0x14001d35e
add rdi, 2
cmp word [rdi], 0
jne 0x14001d340
cmp rdi, rsi
je 0x14001d3f5
sub rdi, rsi
sar rdi, 1
mov edx, dword [rsi - 0x10]
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edx
or eax, ecx
jge 0x14001d390
lea rcx, [rsp + 0x20]
call fcn.140003180
mov rsi, qword [rsp + 0x20]
movsxd rax, edi
lea r8, [rsi + rax*2]
mov ebx, dword [rsi - 0x10]
sub ebx, edi
lea eax, [rbx + 1]
movsxd rdx, eax
add rdx, rdx
mov r9, rdx
mov rcx, rsi
call fcn.140081c40
test eax, eax
je 0x14001d3d8
cmp eax, 0xc
je 0x14001d7fa
cmp eax, 0x16
je 0x14001d7f4
cmp eax, 0x22
je 0x14001d7f4
cmp eax, 0x50
jne 0x14001d7ee
test ebx, ebx
js 0x14001d800
cmp ebx, dword [rsi - 0xc]
jg 0x14001d800
mov dword [rsi - 0x10], ebx
movsxd rax, ebx
mov word [rsi + rax*2], 0
mov r8d, 1
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.1400038a0
xor edx, edx
lea rdi, [0x1400a7610]
mov rsi, qword [rax]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x14001d425
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
setne dil
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001d44c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x14001d793
mov rdx, r15
mov rcx, r12
call fcn.1400804d0
test rax, rax
jne 0x14001d87a
call fcn.1400696cc
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x14001d86f
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x38], rsi
test r15, r15
je 0x14001d56a
test r15, 0xffffffffffff0000
jne 0x14001d4cb
movzx edi, r15w
mov ecx, edi
call fcn.1400696b8
test rax, rax
je 0x14001d5bf
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140003a40
jmp 0x14001d5bf
xor eax, eax
mov rcx, r13
mov rdi, r15
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
je 0x14001d56a
mov ebx, dword [rsi - 0x10]
mov rbp, r15
sub rbp, rsi
sar rbp, 1
mov edx, 1
sub edx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, ecx
or eax, edx
jge 0x14001d516
mov edx, ecx
lea rcx, [rsp + 0x38]
call fcn.140003180
mov rsi, qword [rsp + 0x38]
cmp rbp, rbx
ja 0x14001d536
movsxd rax, edi
lea rbx, [rax + rax]
lea r8, [rsi + rbp*2]
mov r9, rbx
mov rdx, rbx
mov rcx, rsi
call fcn.140081c40
jmp 0x14001d54e
movsxd rax, edi
lea rbx, [rax + rax]
mov r9, rbx
mov r8, r15
mov rdx, rbx
mov rcx, rsi
call fcn.140080540
test edi, edi
js 0x14001d80b
cmp edi, dword [rsi - 0xc]
jg 0x14001d80b
mov dword [rsi - 0x10], edi
mov word [rbx + rsi], 0
jmp 0x14001d5bf
lea rdx, [rsi - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14001d5bf
cmp dword [rdx + 0x10], 0
jge 0x14001d595
cmp dword [rsi - 0xc], 0
jl 0x14001d816
mov dword [rsi - 0x10], 0
mov word [rsi], 0
jmp 0x14001d5bf
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001d5ad
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov rdi, qword [rsp + 0x20]
cmp dword [rdi - 0x10], 0
jg 0x14001d5cf
mov eax, r13d
jmp 0x14001d5eb
mov dx, 0x20
mov rcx, rdi
call fcn.1400804a0
test rax, rax
jne 0x14001d5e5
mov eax, r13d
jmp 0x14001d5eb
sub rax, rdi
sar rax, 1
lea r8d, [rax + 1]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140003e50
nop
mov rdx, qword [rax]
lea rsi, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rsi, rdi
je 0x14001d6b9
cmp dword [rdi + 0x10], 0
jl 0x14001d6aa
mov rcx, qword [rsi]
cmp rcx, qword [rdi]
jne 0x14001d6aa
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rsi + 0x10], 0
jl 0x14001d647
cmp rax, qword [rsi]
jne 0x14001d647
mov rbx, rsi
lock add dword [rsi + 0x10], 1
jmp 0x14001d684
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rsi + 8]
call qword [rax]
mov rbx, rax
test rax, rax
je 0x14001d821
mov ecx, dword [rsi + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rsi + 8]
add ecx, 1
movsxd rdx, ecx
lea r9, [rdx + rdx]
lea r8, [rsi + 0x18]
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.140080540
mov eax, r13d
lock xadd dword [rdi + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001d69f
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x20], rax
jmp 0x14001d6b9
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x20]
call fcn.140003c40
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001d6da
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0x20]
cmp dword [rax - 0x10], 0
je 0x14001d772
mov r8d, 5
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x38]
call fcn.1400038a0
xor edx, edx
lea rdi, str.Canon
mov rsi, qword [rax]
mov ecx, 6
repe cmpsw word [rsi], word [rdi]
je 0x14001d719
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
sete dil
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001d740
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x14001d772
mov rdi, qword [rsp + 0x38]
cmp dword [rdi - 0x10], 0
jl 0x14001d777
mov rdx, qword [rsp + 0x20]
mov rcx, rdi
call fcn.1400804d0
test rax, rax
je 0x14001d777
sub rax, rdi
sar rax, 1
test eax, eax
jns 0x14001d827
jmp 0x14001d777
mov rdi, qword [rsp + 0x38]
lea rdx, [rdi - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001d793
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, r13
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx - 1]
lea r14d, [r14 + rcx + 1]
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001d7cb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test edi, edi
je 0x14001d8a3
jmp 0x14001d1c0
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
nop
call fcn.14006766c
int3
call fcn.14006766c
int3
call fcn.140067624
int3
mov ecx, 0x80070057
call fcn.140001000
nop
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
nop
call fcn.1400019f0
nop
mov dword [rsp + 0x30], 1
lea rdx, [rdi - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001d84c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001d8a3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14001d8a3
mov ecx, 0x80004005
call fcn.140001000
int3
mov dword [rsp + 0x30], 1
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001d8a3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r9, [rsp + 0x70]
mov r8d, 0x7fff
lea rdx, [rsp + 0x10280]
lea rcx, str.DriverDesc
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
xor r14d, r14d
nop
nop
nop
movsxd rax, r14d
lea r12, [rsp + rax*2 + 0x10280]
call fcn.1400696cc
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x14001dc14
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x28], rsi
test r12, r12
je 0x14001d9e1
test r12, 0xffffffffffff0000
jne 0x14001d942
movzx edi, r12w
mov ecx, edi
call fcn.1400696b8
test rax, rax
je 0x14001da36
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140003a40
mov rsi, qword [rsp + 0x28]
jmp 0x14001da36
xor eax, eax
mov rcx, r13
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
je 0x14001d9e1
mov ebx, dword [rsi - 0x10]
mov rbp, r12
sub rbp, rsi
sar rbp, 1
mov edx, 1
sub edx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, ecx
or eax, edx
jge 0x14001d98d
mov edx, ecx
lea rcx, [rsp + 0x28]
call fcn.140003180
mov rsi, qword [rsp + 0x28]
cmp rbp, rbx
ja 0x14001d9ad
movsxd rax, edi
lea rbx, [rax + rax]
lea r8, [rsi + rbp*2]
mov r9, rbx
mov rdx, rbx
mov rcx, rsi
call fcn.140081c40
jmp 0x14001d9c5
movsxd rax, edi
lea rbx, [rax + rax]
mov r9, rbx
mov r8, r12
mov rdx, rbx
mov rcx, rsi
call fcn.140080540
test edi, edi
js 0x14001dbb2
cmp edi, dword [rsi - 0xc]
jg 0x14001dbb2
mov dword [rsi - 0x10], edi
mov word [rbx + rsi], 0
jmp 0x14001da36
lea rdx, [rsi - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14001da36
cmp dword [rdx + 0x10], 0
jge 0x14001da0c
cmp dword [rsi - 0xc], 0
jl 0x14001dbbd
mov dword [rsi - 0x10], 0
mov word [rsi], 0
jmp 0x14001da36
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001da24
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x28], rsi
mov rdi, rsi
cmp word [rsi], 0
je 0x14001db05
nop
nop
nop
nop
movzx edx, word [rdi]
lea rcx, [0x1400a7614]
call fcn.1400804a0
test rax, rax
je 0x14001da6e
add rdi, 2
cmp word [rdi], 0
jne 0x14001da50
cmp rdi, rsi
je 0x14001db05
sub rdi, rsi
sar rdi, 1
mov edx, dword [rsi - 0x10]
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edx
or eax, ecx
jge 0x14001daa0
lea rcx, [rsp + 0x28]
call fcn.140003180
mov rsi, qword [rsp + 0x28]
movsxd rax, edi
lea r8, [rsi + rax*2]
mov ebx, dword [rsi - 0x10]
sub ebx, edi
lea eax, [rbx + 1]
movsxd rdx, eax
add rdx, rdx
mov r9, rdx
mov rcx, rsi
call fcn.140081c40
test eax, eax
je 0x14001dae8
cmp eax, 0xc
je 0x14001dbd4
cmp eax, 0x16
je 0x14001dbce
cmp eax, 0x22
je 0x14001dbce
cmp eax, 0x50
jne 0x14001dbc8
test ebx, ebx
js 0x14001dbda
cmp ebx, dword [rsi - 0xc]
jg 0x14001dbda
mov dword [rsi - 0x10], ebx
movsxd rax, ebx
mov word [rsi + rax*2], 0
mov r8d, 1
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x28]
call fcn.1400038a0
xor edx, edx
lea rdi, [0x1400a7610]
mov rsi, qword [rax]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x14001db35
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
setne dil
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001db5c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x14001db71
mov rdx, r15
mov rcx, r12
call fcn.1400804d0
test rax, rax
jne 0x14001dbe5
xor eax, eax
mov rcx, r13
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx - 1]
lea r14d, [r14 + rcx + 1]
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001dba9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test edi, edi
je 0x14001dc0e
jmp 0x14001d8d0
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
nop
call fcn.14006766c
int3
call fcn.14006766c
int3
call fcn.140067624
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rsp + 0x30], 1
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r13d
add r13d, 0xffffffff
test r13d, r13d
jg 0x14001dc0e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [rsp + 0x30]
jmp 0x14001dc2a
mov ecx, 0x80004005
call fcn.140001000
int3
mov ecx, 0x80004005
call fcn.140001000
int3
mov rcx, qword [rsp + 0x20280]
xor rcx, rsp
call fcn.140081050
lea r11, [rsp + 0x20290]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret