Function at 0x140034420
Capabilities:
Accept command line arguments
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x13c0]
mov eax, 0x14c0
call fcn.140100df0
sub rsp, rax
xor r14d, r14d
mov r12, rdx
mov r13, rcx
mov byte [rcx + 0xbda], r8b
lea rsi, [0x1401035ac]
test rdx, rdx
jne 0x1400345f1
lea rdx, [rbp - 0x80]
mov r8d, 0x106
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x104
ja 0x14003461a
lea edx, [r12 + 0x5c]
lea rcx, [rbp - 0x80]
call qword [sym.imp.MSVCR100.dll_wcsrchr]
mov rbx, rax
test rax, rax
je 0x14003461a
lea edx, [r12 + 0x2e]
mov rcx, rax
call qword [sym.imp.MSVCR100.dll_wcsrchr]
test rax, rax
je 0x14003461a
lea rdx, str..ahk
sub rax, rdx
nop
movzx ecx, word [rdx]
add rdx, 2
mov word [rax + rdx - 2], cx
test cx, cx
jne 0x1400344c0
cmp qword [0x14013f6b0], r14
lea r12, [rbp - 0x80]
jne 0x140034621
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400345f1
lea rcx, [rbp + 0x1b0]
mov rdx, rsi
lea r12, [rbp + 0x1b0]
call fcn.140088550
or rcx, 0xffffffffffffffff
mov rdi, rbx
mov r11, rax
xor eax, eax
repne scasw ax, word [rdi]
not rcx
lea rdx, [rcx + r11]
cmp rdx, 0x105
ja 0x140034afe
lea rax, [r11 + r11]
mov rcx, rbx
sub rax, rbx
lea rdx, [rbp + rax + 0x1b0]
movzx eax, word [rcx]
add rcx, 2
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x140034540
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400345f1
lea rcx, [0x14011cbb8]
sub rbx, rcx
movzx eax, word [rcx]
add rcx, 2
mov word [rbx + rcx - 2], ax
test ax, ax
jne 0x140034571
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400345f1
lea r9, [rbp - 0x80]
lea r8, str._ms_its:_s::_docs_Welcome.htm_
lea rcx, [rbp + 0x3c0]
mov edx, 0x800
call qword [sym.imp.MSVCR100.dll__snwprintf]
mov qword [rsp + 0x48], r14
mov byte [rsp + 0x40], r14b
mov byte [rsp + 0x38], r14b
lea rax, [0x14011cc18]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x80]
lea r8, [rbp + 0x3c0]
lea rdx, str.hh.exe
mov rcx, r13
mov byte [rsp + 0x20], r14b
call fcn.140060b90
test eax, eax
jne 0x14003461a
cmp qword [0x14013f6b0], r14
jne 0x140034621
lea r8, [rbp + 0x3c0]
xor r9d, r9d
mov edx, 0x800
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x1400347d1
xor eax, eax
jmp 0x140034afe
lea rdx, [rbp + 0x3c0]
mov r8d, 0x800
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14003464f
lea rdx, [rbp + 0x3c0]
mov r8d, 0x800
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x410
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea rcx, str.ntdll.dll
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp + 0x1400]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov r9d, gethostbyaddr
xor edx, edx
mov rcx, r15
call rax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx + 0x20]
cmp word [rax + 0x70], r14w
je 0x1400347c8
mov dword [rbp + 0x1410], r14d
mov rcx, qword [rax + 0x78]
lea rdx, [rbp + 0x1410]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r8d, dword [rbp + 0x1410]
mov r14, rax
cmp r8d, 1
jle 0x1400347bc
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx + 0x20]
cmp word [rdx + 0x70], 0
je 0x1400347bc
mov edi, 1
cmp r8d, edi
jle 0x1400347bc
lea rbx, [rax + 8]
nop dword [rax]
mov rsi, qword [rbx]
lea rdx, [0x14011cc30]
mov r8d, 1
mov rcx, rsi
call qword [sym.imp.MSVCR100.dll_wcsncmp]
test eax, eax
je 0x140034747
lea rdx, [0x14011cc34]
mov r8d, 1
mov rcx, rsi
call qword [sym.imp.MSVCR100.dll_wcsncmp]
test eax, eax
jne 0x140034757
inc edi
add rbx, 8
cmp edi, dword [rbp + 0x1410]
jl 0x140034710
jmp 0x1400347b5
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140034795
lea rdx, [rbp + 0x3c0]
mov r8d, 0x800
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x1400347b5
lea rdx, [rbp + 0x3c0]
mov r8d, 0x800
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x1400347b5
lea r8, [rbp + 0x3c0]
xor r9d, r9d
mov edx, 0x800
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x14003461a
lea rsi, [0x1401035ac]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor r14d, r14d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [r12], 0x2a
jne 0x1400347ff
cmp word [r12 + 2], 0
jne 0x1400347ff
mov byte [0x14013f73b], 1
mov dword [0x14013f874], 4
mov dword [0x14013b0c4], 1
jmp 0x140034812
lea rcx, [rbp + 0x3c0]
mov byte [0x14013f73b], 0
call fcn.1400e16b0
cmp word [rbp + 0x3c0], 0
je 0x140034894
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rbp + 0x3c0]
repne scasw ax, word [rdi]
not rcx
lea rbx, [rcx + rcx - 2]
lea rsi, [rcx - 1]
lea rcx, [rbx + 2]
call fcn.1400dd290
mov rdi, rax
test rax, rax
jne 0x14003486f
lea r8, [rbp + 0x3c0]
lea rdx, str.Out_of_memory.
lea rcx, [0x140143150]
call fcn.14005f7b0
mov rdi, r14
lea rsi, [0x1401035ac]
jmp 0x140034897
test rsi, rsi
je 0x140034886
lea rdx, [rbp + 0x3c0]
mov r8, rbx
mov rcx, rax
call sub.MSVCR100.dll_memcpy
mov word [rbx + rdi], r14w
lea rsi, [0x1401035ac]
jmp 0x140034897
mov rdi, rsi
mov qword [r13 + 0xba8], rdi
test rdi, rdi
je 0x14003461a
lea rcx, [rbp + 0x3c0]
mov edx, 0x5c
call qword [sym.imp.MSVCR100.dll_wcsrchr]
mov rbx, rax
test rax, rax
je 0x140034964
mov word [rax], r14w
cmp word [rbp + 0x3c0], 0
je 0x14003494b
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rbp + 0x3c0]
repne scasw ax, word [rdi]
not rcx
lea rsi, [rcx + rcx - 2]
lea r12, [rcx - 1]
lea rcx, [rsi + 2]
call fcn.1400dd290
mov rdi, rax
test rax, rax
jne 0x140034926
lea r8, [rbp + 0x3c0]
lea rdx, str.Out_of_memory.
lea rcx, [0x140143150]
call fcn.14005f7b0
mov rdi, r14
lea rsi, [0x1401035ac]
jmp 0x14003494e
test r12, r12
je 0x14003493d
lea rdx, [rbp + 0x3c0]
mov r8, rsi
mov rcx, rax
call sub.MSVCR100.dll_memcpy
mov word [rsi + rdi], r14w
lea rsi, [0x1401035ac]
jmp 0x14003494e
mov rdi, rsi
mov qword [r13 + 0xbb0], rdi
test rdi, rdi
je 0x14003461a
add rbx, 2
jmp 0x14003496b
lea rbx, [rbp + 0x3c0]
or rdx, 0xffffffffffffffff
mov rcx, rbx
call fcn.1400dd1d0
mov qword [r13 + 0xbb8], rax
test rax, rax
je 0x14003461a
mov r9, qword [r13 + 0xbb0]
lea rcx, [0x14011cc38]
lea r8, str._s_s____s
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x3c0]
mov edx, 0x800
mov qword [rsp + 0x20], rax
call fcn.1400e0640
cmp word [rbp + 0x3c0], 0
je 0x140034a39
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rbp + 0x3c0]
repne scasw ax, word [rdi]
not rcx
lea rbx, [rcx + rcx - 2]
lea rsi, [rcx - 1]
lea rcx, [rbx + 2]
call fcn.1400dd290
mov rdi, rax
test rax, rax
jne 0x140034a14
lea r8, [rbp + 0x3c0]
lea rdx, str.Out_of_memory.
lea rcx, [0x140143150]
call fcn.14005f7b0
mov rdi, r14
lea rsi, [0x1401035ac]
jmp 0x140034a3c
test rsi, rsi
je 0x140034a2b
lea rdx, [rbp + 0x3c0]
mov r8, rbx
mov rcx, rax
call sub.MSVCR100.dll_memcpy
mov word [rbx + rdi], r14w
lea rsi, [0x1401035ac]
jmp 0x140034a3c
mov rdi, rsi
mov qword [r13 + 0xbd0], rdi
test rdi, rdi
je 0x14003461a
lea rdx, [rbp + 0x3c2]
mov ebx, SafeArrayAllocDescriptor
mov r8d, 0x7fe
xor ecx, ecx
mov word [rbp + 0x3c0], bx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140034af9
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rbp + 0x3c0]
repne scasw ax, word [rdi]
or rdx, 0xffffffffffffffff
not rcx
mov word [rbp + rcx*2 + 0x3be], bx
mov word [rbp + rcx*2 + 0x3c0], r14w
lea rcx, [rbp + 0x3c0]
call fcn.1400dd1d0
mov qword [r13 + 0xbc0], rax
test rax, rax
je 0x14003461a
lea edx, [rbx + 0x3a]
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.MSVCR100.dll_wcsrchr]
test rax, rax
jne 0x140034ad5
mov qword [r13 + 0xbc8], rsi
lea rcx, [rbp + 0x3c2]
or rdx, 0xffffffffffffffff
mov word [rax], r14w
call fcn.1400dd1d0
mov qword [r13 + 0xbc8], rax
test rax, rax
je 0x14003461a
mov eax, 1
mov rbx, qword [rsp + 0x1508]
add rsp, 0x14c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret