Function at 0x14001e440
Capabilities:
Link many functions at runtime

Disassembly:
mov r11, rsp
push r12
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov rax, qword [0x140065ec0]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea r12, [0x140073520]
mov qword [r11 - 0x50], r12
mov edi, 7
mov qword [0x140073538], rdi
xor ebx, ebx
mov qword [0x140073530], rbx
mov word [0x140073520], bx
mov rax, qword [0x14006eeb0]
test rax, rax
jne 0x14001e4cc
mov ecx, 0x2a8
call fcn.1400276bc
mov qword [rsp + 0x20], rax
test rax, rax
je 0x14001e4c2
mov rcx, rax
call fcn.1400059d0
jmp 0x14001e4c5
mov rax, rbx
mov qword [0x14006eeb0], rax
cmp dword [rax], 6
jne 0x14001e52b
lea rdx, str.GetFileSizeEx
mov rcx, qword [0x140073098]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140073178], rax
mov qword [0x140073180], rax
cmp qword [0x14006eef8], 0
jne 0x14001e51f
lea rdx, [0x1400567f0]
mov rcx, qword [0x140073098]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14006eef8], rax
mov qword [0x140073308], rax
mov rax, qword [0x140073208]
jmp 0x14001e5ba
mov rax, qword [0x1400730a0]
test rax, rax
jne 0x14001e54b
lea rcx, str.KernelBase.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x1400730a0], rax
cmp qword [0x14006eef8], 0
jne 0x14001e57a
lea rdx, [0x1400567f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14006eef8], rax
mov qword [0x140073308], rax
mov rax, qword [0x1400730a0]
lea rdx, str.GetFileSizeEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140073178], rax
mov qword [0x140073180], rax
lea rdx, [0x140056800]
mov rcx, qword [0x1400730a0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140073208], rax
mov qword [0x140073210], rax
test rax, rax
jne 0x14001e607
mov rax, qword [0x140073098]
test rax, rax
jne 0x14001e5df
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x140073098], rax
cmp qword [0x140073238], 0
jne 0x14001e607
lea rdx, str.CreateFileMappingA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140073238], rax
mov qword [0x140073240], rax
mov rax, qword [0x14006eeb0]
test rax, rax
jne 0x14001e63b
mov ecx, 0x2a8
call fcn.1400276bc
mov qword [rsp + 0x20], rax
test rax, rax
je 0x14001e631
mov rcx, rax
call fcn.1400059d0
jmp 0x14001e634
mov rax, rbx
mov qword [0x14006eeb0], rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
lea rdx, [rax + 0x230]
or rbp, 0xffffffffffffffff
mov r9, rbp
xor r8d, r8d
lea rcx, [rsp + 0x38]
call fcn.140003080
nop
lea rcx, [rsp + 0x38]
mov r11, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x50]
cmp rsi, 8
cmovae rcx, r11
mov r8, qword [rsp + 0x48]
cmp r8, 7
cmovb rdi, r8
lea rdx, str.winword
test rdi, rdi
je 0x14001e6bc
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14001e6ad
add rcx, 2
add rdx, 2
dec rdi
jne 0x14001e696
jmp 0x14001e6bc
mov r9d, 1
cmp word [rcx], ax
cmovb r9d, ebp
jmp 0x14001e6bf
mov r9d, ebx
movsxd rax, r9d
test r9d, r9d
jne 0x14001e6da
cmp r8, 7
jae 0x14001e6d1
mov eax, ebp
jmp 0x14001e6da
mov eax, ebx
cmp r8, 7
setne al
test eax, eax
sete al
test al, al
jne 0x14001ea1c
lea rcx, [rsp + 0x38]
cmp rsi, 8
cmovae rcx, r11
mov r9d, 5
cmp r8, r9
cmovb r9, r8
lea rdx, str.excel
test r9, r9
je 0x14001e736
nop dword [rax]
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14001e727
add rcx, 2
add rdx, 2
dec r9
jne 0x14001e710
jmp 0x14001e736
mov r9d, 1
cmp word [rcx], ax
cmovb r9d, ebp
jmp 0x14001e739
mov r9d, ebx
movsxd rax, r9d
test r9d, r9d
jne 0x14001e754
cmp r8, 5
jae 0x14001e74b
mov eax, ebp
jmp 0x14001e754
mov eax, ebx
cmp r8, 5
setne al
test eax, eax
sete al
test al, al
jne 0x14001ea1c
lea rcx, [rsp + 0x38]
cmp rsi, 8
cmovae rcx, r11
mov r10d, 8
mov r9d, r10d
cmp r8, r10
cmovb r9, r8
lea rdx, str.powerpnt
test r9, r9
je 0x14001e7b6
nop word [rax + rax]
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14001e7a7
add rcx, 2
add rdx, 2
dec r9
jne 0x14001e790
jmp 0x14001e7b6
mov r9d, 1
cmp word [rcx], ax
cmovb r9d, ebp
jmp 0x14001e7b9
mov r9d, ebx
movsxd rax, r9d
test r9d, r9d
jne 0x14001e7d2
cmp r8, r10
jae 0x14001e7ca
mov eax, ebp
jmp 0x14001e7d2
mov eax, ebx
cmp r8, r10
setne al
test eax, eax
sete al
test al, al
jne 0x14001ea1c
lea rcx, [rsp + 0x38]
cmp rsi, r10
cmovae rcx, r11
cmp r8, r10
cmovb r10, r8
lea rdx, str.msaccess
test r10, r10
je 0x14001e826
nop
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14001e817
add rcx, 2
add rdx, 2
dec r10
jne 0x14001e800
jmp 0x14001e826
mov r9d, 1
cmp word [rcx], ax
cmovb r9d, ebp
jmp 0x14001e829
mov r9d, ebx
movsxd rax, r9d
test r9d, r9d
jne 0x14001e844
cmp r8, 8
jae 0x14001e83b
mov eax, ebp
jmp 0x14001e844
mov eax, ebx
cmp r8, 8
setne al
test eax, eax
sete al
test al, al
jne 0x14001ea1c
lea rcx, [rsp + 0x38]
cmp rsi, 8
cmovae rcx, r11
mov r9d, 6
cmp r8, r9
cmovb r9, r8
lea rdx, str.arcmap
test r9, r9
je 0x14001e89d
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14001e88e
add rcx, 2
add rdx, 2
dec r9
jne 0x14001e877
jmp 0x14001e89d
mov r9d, 1
cmp word [rcx], ax
cmovb r9d, ebp
jmp 0x14001e8a0
mov r9d, ebx
movsxd rax, r9d
test r9d, r9d
jne 0x14001e8bb
cmp r8, 6
jae 0x14001e8b2
mov eax, ebp
jmp 0x14001e8bb
mov eax, ebx
cmp r8, 6
setne al
test eax, eax
sete al
test al, al
jne 0x14001ea1c
lea rcx, [rsp + 0x38]
cmp rsi, 8
cmovae rcx, r11
mov r10d, 3
mov r9d, r10d
cmp r8, r10
cmovb r9, r8
lea rdx, [0x140055900]
test r9, r9
je 0x14001e917
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14001e908
add rcx, 2
add rdx, 2
dec r9
jne 0x14001e8f1
jmp 0x14001e917
mov r9d, 1
cmp word [rcx], ax
cmovb r9d, ebp
jmp 0x14001e91a
mov r9d, ebx
movsxd rax, r9d
test r9d, r9d
jne 0x14001e933
cmp r8, r10
jae 0x14001e92b
mov eax, ebp
jmp 0x14001e933
mov eax, ebx
cmp r8, r10
setne al
test eax, eax
sete al
test al, al
jne 0x14001ea1c
lea rcx, [rsp + 0x38]
cmp rsi, 8
cmovae rcx, r11
mov r9d, 2
cmp r8, r9
cmovb r9, r8
lea rdx, [0x140055908]
test r9, r9
je 0x14001e98c
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14001e97d
add rcx, 2
add rdx, 2
dec r9
jne 0x14001e966
jmp 0x14001e98c
mov r9d, 1
cmp word [rcx], ax
cmovb r9d, ebp
jmp 0x14001e98f
mov r9d, ebx
movsxd rax, r9d
test r9d, r9d
jne 0x14001e9aa
cmp r8, 2
jae 0x14001e9a1
mov eax, ebp
jmp 0x14001e9aa
mov eax, ebx
cmp r8, 2
setne al
test eax, eax
sete al
test al, al
jne 0x14001ea1c
lea rcx, [rsp + 0x38]
cmp rsi, 8
cmovae rcx, r11
cmp r8, r10
cmovb r10, r8
lea rdx, [0x140056830]
test r10, r10
je 0x14001e9f9
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14001e9ea
add rcx, 2
add rdx, 2
dec r10
jne 0x14001e9d3
jmp 0x14001e9f9
mov r9d, 1
cmp word [rcx], ax
cmovb r9d, ebp
jmp 0x14001e9fc
mov r9d, ebx
movsxd rax, r9d
test r9d, r9d
jne 0x14001ea13
cmp r8, 3
jae 0x14001ea0e
mov eax, ebp
jmp 0x14001ea13
setne bl
mov eax, ebx
test eax, eax
sete al
test al, al
je 0x14001ea26
mov dword [0x140073548], 1
call fcn.14001f1e0
nop
cmp qword [rsp + 0x50], 8
jb 0x14001ea3f
mov rcx, qword [rsp + 0x38]
call fcn.14002747c
nop
mov rax, r12
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400274a0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret