Function at 0x140070364
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a0
mov r13, rcx
lea rcx, [rax + 0x10]
call fcn.140044ef4
xor ebp, ebp
cmp r9b, 1
movzx r14d, r9b
lea rcx, [rsp + 0xa0]
cmove r14d, ebp
cmp r9b, 1
sete r12b
call fcn.14004be6c
lea rcx, [rsp + 0xa8]
call fcn.14004be6c
lea rcx, [rsp + 0x1e8]
call fcn.140044ef4
cmp r12b, bpl
je 0x1400703d8
sub qword [rsp + 0x1e8], 2
mov ebx, 0x3d
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x1e8]
mov r8d, ebx
call fcn.14004f5d4
lea ecx, [rbx - 0x17]
cmp r12b, bpl
je 0x140070408
mov rax, qword [rsp + 0xa0]
mov word [rax], cx
lea rdx, [rsp + 0xa0]
xor r8d, r8d
mov rcx, r13
call fcn.1400035d0
mov rax, qword [rsp + 0x1e8]
mov rsi, qword [rsp + 0xa0]
movsx r15, r12b
lea rdi, [rsi + r15*2]
cmp bx, word [rax]
jne 0x1400704e9
add rax, 2
mov ebx, 0x2c
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x1e8]
mov r8d, ebx
mov qword [rsp + 0x1e8], rax
call fcn.14004f5d4
mov r11, qword [rsp + 0x1e8]
movzx r9d, word [r11]
cmp bx, r9w
jne 0x140070483
add r11, 2
mov qword [rsp + 0x1e8], r11
mov rbx, qword [rsp + 0xa8]
cmp r14b, bpl
jne 0x1400704d8
lea rcx, str.WINVER
mov rdx, rbx
call fcn.140045ff4
cmp al, bpl
je 0x1400704d8
call fcn.140047fa0
lea r8, str.0x_I64X
lea rcx, [rsp + 0x100]
mov rdx, rax
call fcn.1400a9320
lea r8, [rsp + 0x100]
mov rdx, rdi
mov rcx, r13
call fcn.14004b578
jmp 0x1400712f7
cmp r9w, bp
je 0x1400704f3
mov eax, 0x2c
cmp ax, r9w
je 0x1400704f3
mov ebp, 0x80070057
jmp 0x1400712f7
cmp r14b, bpl
je 0x140070502
cmp r14b, 2
jne 0x140070a20
lea rcx, [rsp + 0x88]
mov rdx, rsi
call fcn.140058920
mov rdi, qword [rsp + 0x88]
cmp r12b, bpl
je 0x140070527
mov eax, 0x26
mov word [rdi], ax
lea rcx, [rsp + 0x1e8]
call fcn.140044ef4
lea rcx, str.FVER
mov rdx, rbx
call fcn.140045ff4
cmp al, bpl
je 0x140070585
mov rcx, qword [rsp + 0x1e8]
call fcn.140015cb4
lea rcx, [rsp + 0x90]
mov rdx, rax
call fcn.140004a04
mov r8, qword [rsp + 0x90]
mov rdx, rdi
mov rcx, r13
call fcn.14004b578
lea rcx, [rsp + 0x90]
jmp 0x1400712e5
lea rcx, str.FTIME
mov rdx, rbx
call fcn.140045ff4
cmp al, bpl
je 0x140070781
mov rcx, qword [rsp + 0x1e8]
call fcn.140015cb4
lea rcx, [rsp + 0x60]
mov rbx, rax
call fcn.14004be6c
lea rcx, [rsp + 0x80]
call fcn.14004be6c
lea rcx, [rsp + 0x78]
call fcn.14004be6c
lea r11, [rdi + r15*2]
lea rdx, [rsp + 0x50]
lea rcx, str._local
mov r8d, 6
mov qword [rsp + 0x50], r11
call fcn.14004e558
cmp al, bpl
je 0x140070612
cmp r12b, bpl
je 0x14007060e
mov rax, qword [rsp + 0x50]
mov ecx, 0x26
sub rax, 2
mov qword [rsp + 0x50], rax
mov word [rax], cx
or r12b, 2
lea rdx, [rsp + 0x50]
lea rcx, [0x1400df63c]
mov r8d, 3
call fcn.14004e558
mov r8d, 4
cmp al, bpl
je 0x140070637
or r12b, r8b
lea rdx, [rsp + 0x50]
lea rcx, str._ws1
call fcn.14004e558
cmp al, bpl
je 0x140070651
or r12b, 8
cmp r12b, bpl
je 0x14007065e
mov eax, 0x26
mov word [rdi], ax
mov edi, 0x2c
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
mov r8d, edi
call fcn.14004f5d4
mov rax, qword [rsp + 0x50]
cmp di, word [rax]
jne 0x1400706c2
add rax, 2
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x50]
mov r8d, edi
mov qword [rsp + 0x50], rax
call fcn.14004f5d4
mov rax, qword [rsp + 0x50]
cmp di, word [rax]
jne 0x1400706c2
add rax, 2
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
mov r8d, edi
mov qword [rsp + 0x50], rax
call fcn.14004f5d4
lea r8, [rsp + 0xd8]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov rdx, qword [rsp + 0x60]
mov rcx, r13
cmp eax, ebp
je 0x140070745
lea r8, [rsp + 0xdc]
mov r9b, r12b
call fcn.14004ff98
mov rdx, qword [rsp + 0x80]
lea r8, [rsp + 0xec]
mov r9b, r12b
mov rcx, r13
call fcn.14004ff98
mov rdx, qword [rsp + 0x78]
lea r8, [rsp + 0xe4]
mov r9b, r12b
mov rcx, r13
call fcn.14004ff98
lea rcx, [rsp + 0x78]
call fcn.140044f24
lea rcx, [rsp + 0x80]
call fcn.140044f24
lea rcx, [rsp + 0x60]
jmp 0x1400712e5
lea rsi, [0x1400d63f4]
mov r8, rsi
call fcn.14004b578
mov rdx, qword [rsp + 0x80]
mov r8, rsi
mov rcx, r13
call fcn.14004b578
mov rdx, qword [rsp + 0x78]
mov r8, rsi
mov rcx, r13
call fcn.14004b578
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x140070724
lea rcx, str.FATTR
mov rdx, rbx
call fcn.140045ff4
cmp al, bpl
je 0x140070a13
mov rcx, qword [rsp + 0x1e8]
call fcn.140015cb4
mov esi, 0x26
mov rbx, rax
cmp r12b, bpl
je 0x1400707b6
mov word [rdi], si
lea rcx, [rsp + 0x68]
call fcn.14004be6c
lea rcx, [rsp + 0x78]
call fcn.14004be6c
lea rcx, [rsp + 0x80]
call fcn.14004be6c
lea rcx, [rsp + 0x60]
call fcn.14004be6c
lea rcx, [rsp + 0x58]
call fcn.14004be6c
mov qword [rsp + 0x50], rdi
mov edi, 0x2c
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x50]
mov r8d, edi
call fcn.14004f5d4
mov rax, qword [rsp + 0x50]
cmp di, word [rax]
jne 0x1400708ce
cmp r12b, bpl
je 0x14007081f
mov word [rax], si
jmp 0x140070828
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
mov r8d, edi
call fcn.14004f5d4
mov rax, qword [rsp + 0x50]
cmp di, word [rax]
jne 0x1400708ce
cmp r12b, bpl
je 0x140070852
mov word [rax], si
jmp 0x14007085b
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x50]
mov r8d, edi
call fcn.14004f5d4
mov rax, qword [rsp + 0x50]
cmp di, word [rax]
jne 0x1400708ce
cmp r12b, bpl
je 0x140070884
mov word [rax], si
jmp 0x14007088d
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
mov r8d, edi
call fcn.14004f5d4
mov rax, qword [rsp + 0x50]
cmp di, word [rax]
jne 0x1400708ce
cmp r12b, bpl
je 0x1400708b3
mov word [rax], si
jmp 0x1400708bc
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
mov r8d, edi
call fcn.14004f5d4
lea r8, [rsp + 0xb0]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov rcx, r13
cmp eax, ebp
je 0x1400709bf
mov edx, dword [rsp + 0xb0]
mov r8, qword [rsp + 0x68]
shr edx, 5
and edx, 1
call fcn.14004ed64
mov edx, dword [rsp + 0xb0]
mov r8, qword [rsp + 0x78]
shr edx, 1
mov rcx, r13
and edx, 1
call fcn.14004ed64
mov edx, dword [rsp + 0xb0]
mov r8, qword [rsp + 0x80]
and edx, 1
mov rcx, r13
call fcn.14004ed64
mov edx, dword [rsp + 0xb0]
mov r8, qword [rsp + 0x60]
shr edx, 2
mov rcx, r13
and edx, 1
call fcn.14004ed64
mov r8d, dword [rsp + 0xb0]
lea rdx, str.0x_lX
lea rcx, [rsp + 0x100]
mov word [rsp + 0x100], bp
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rsp + 0x58]
lea r8, [rsp + 0x100]
mov rcx, r13
call fcn.14004b578
lea rcx, [rsp + 0x58]
call fcn.140044f24
lea rcx, [rsp + 0x60]
call fcn.140044f24
lea rcx, [rsp + 0x80]
call fcn.140044f24
lea rcx, [rsp + 0x78]
call fcn.140044f24
lea rcx, [rsp + 0x68]
jmp 0x1400712e5
mov rdx, qword [rsp + 0x68]
lea rsi, [0x1400d63f4]
mov r8, rsi
call fcn.14004b578
mov rdx, qword [rsp + 0x78]
mov r8, rsi
mov rcx, r13
call fcn.14004b578
mov rdx, qword [rsp + 0x80]
mov r8, rsi
mov rcx, r13
call fcn.14004b578
mov rdx, qword [rsp + 0x60]
mov r8, rsi
mov rcx, r13
call fcn.14004b578
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x14007098a
lea rcx, [rsp + 0x88]
call fcn.140044f24
cmp r14b, bpl
jne 0x1400712f7
lea rcx, [rsp + 0x88]
mov rdx, rsi
call fcn.140058920
lea rcx, [rsp + 0x1e8]
call fcn.140044ef4
lea rcx, str.DROPFILE
mov rdx, rbx
call fcn.140045ff4
cmp al, bpl
je 0x140070b6e
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x1e8]
mov qword [rsp + 0x70], rbp
call fcn.14004fbd8
lea rcx, [rsp + 0x78]
call fcn.14004be6c
lea rcx, [rsp + 0x80]
call fcn.14004be6c
mov r11, qword [rsp + 0x88]
mov ebx, 0x2c
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x58]
mov r8d, ebx
mov qword [rsp + 0x58], r11
call fcn.14004f5d4
mov rax, qword [rsp + 0x58]
cmp bx, word [rax]
jne 0x140070ae5
cmp r12b, bpl
je 0x140070ac7
lea ecx, [rbx - 6]
mov word [rax], cx
jmp 0x140070ad0
add rax, 2
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x58]
mov r8d, ebx
call fcn.14004f5d4
lea rcx, [rsp + 0x60]
call fcn.14004be6c
lea rcx, [rsp + 0x68]
call fcn.14004be6c
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x70]
cmp word [rbx], bp
lea r8, [rsp + 0x68]
cmove r8, rbp
cmp rcx, rbp
je 0x140070b21
lea rdx, [rsp + 0x60]
call fcn.140004efc
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x78]
mov rcx, r13
call fcn.14004b578
mov r8, qword [rsp + 0x68]
mov rdx, rbx
mov rcx, r13
call fcn.14004b578
lea rcx, [rsp + 0x68]
call fcn.140044f24
lea rcx, [rsp + 0x60]
call fcn.140044f24
lea rcx, [rsp + 0x80]
call fcn.140044f24
lea rcx, [rsp + 0x78]
jmp 0x1400712e5
lea rcx, str.FPOS
mov rdx, rbx
call fcn.140045ff4
cmp al, bpl
je 0x140070e28
mov rcx, qword [rsp + 0x1e8]
call fcn.140015cb4
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x58], rax
call fcn.140044ef4
mov rcx, qword [rsp + 0x58]
call fcn.140012d94
lea rcx, [rsp + 0x70]
call fcn.14004be6c
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x70]
call fcn.1400160d8
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x88]
mov esi, 0x26
cmp r12b, bpl
je 0x140070bdf
mov word [rbx], si
lea rcx, [rsp + 0x90]
call fcn.14004be6c
lea rcx, [rsp + 0x98]
call fcn.14004be6c
lea rcx, [rsp + 0x78]
call fcn.14004be6c
lea rcx, [rsp + 0x80]
call fcn.14004be6c
lea rcx, [rsp + 0x60]
call fcn.14004be6c
lea rcx, [rsp + 0x68]
call fcn.14004be6c
lea rcx, [rsp + 0x58]
call fcn.14004be6c
mov qword [rsp + 0x50], rbx
mov ebx, 0x2c
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x50]
mov r8d, ebx
call fcn.14004f5d4
mov rax, qword [rsp + 0x50]
cmp bx, word [rax]
jne 0x140070d7d
cmp r12b, bpl
je 0x140070c65
mov word [rax], si
jmp 0x140070c6e
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x50]
mov r8d, ebx
call fcn.14004f5d4
mov rax, qword [rsp + 0x50]
cmp bx, word [rax]
jne 0x140070d7d
cmp r12b, bpl
je 0x140070c9b
mov word [rax], si
jmp 0x140070ca4
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
mov r8d, ebx
call fcn.14004f5d4
mov rax, qword [rsp + 0x50]
cmp bx, word [rax]
jne 0x140070d7d
cmp r12b, bpl
je 0x140070cce
mov word [rax], si
jmp 0x140070cd7
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x50]
mov r8d, ebx
call fcn.14004f5d4
mov rax, qword [rsp + 0x50]
cmp bx, word [rax]
jne 0x140070d7d
cmp r12b, bpl
je 0x140070d04
mov word [rax], si
jmp 0x140070d0d
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
mov r8d, ebx
call fcn.14004f5d4
mov rax, qword [rsp + 0x50]
cmp bx, word [rax]
jne 0x140070d7d
cmp r12b, bpl
je 0x140070d33
mov word [rax], si
jmp 0x140070d3c
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x50]
mov r8d, ebx
call fcn.14004f5d4
mov rax, qword [rsp + 0x50]
cmp bx, word [rax]
jne 0x140070d7d
cmp r12b, bpl
je 0x140070d62
mov word [rax], si
jmp 0x140070d6b
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
mov r8d, ebx
call fcn.14004f5d4
mov rax, qword [rsp + 0x58]
mov r9, qword [rsp + 0x98]
mov r8, qword [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x68]
mov rdx, rdi
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
mov rcx, r13
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call fcn.140041b14
lea rcx, [rsp + 0x58]
mov ebp, eax
call fcn.140044f24
lea rcx, [rsp + 0x68]
call fcn.140044f24
lea rcx, [rsp + 0x60]
call fcn.140044f24
lea rcx, [rsp + 0x80]
call fcn.140044f24
lea rcx, [rsp + 0x78]
call fcn.140044f24
lea rcx, [rsp + 0x98]
call fcn.140044f24
lea rcx, [rsp + 0x90]
call fcn.140044f24
lea rcx, [rsp + 0x70]
jmp 0x1400712e5
lea rcx, str.PPID
mov rdx, rbx
call fcn.140045ff4
cmp al, bpl
je 0x140070e62
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x1e8]
mov qword [rsp + 0x70], rbp
call fcn.14004fbd8
mov rcx, qword [rsp + 0x70]
call fcn.140005344
mov rdx, rax
jmp 0x140070e7d
lea rcx, str.ISADMIN
mov rdx, rbx
call fcn.140045ff4
cmp al, bpl
je 0x140070e92
call fcn.1400a9538
mov edx, eax
mov r8, qword [rsp + 0x88]
mov rcx, r13
call fcn.14004ed64
jmp 0x1400712ea
lea rcx, str.PWIN
mov rdx, rbx
call fcn.140045ff4
cmp al, bpl
je 0x14007105b
lea rcx, [rsp + 0x90]
call fcn.14004be6c
lea rcx, [rsp + 0x70]
call fcn.14004be6c
mov r11, qword [rsp + 0x88]
xor r9d, r9d
lea ebx, [r9 + 0x2c]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x98]
mov r8d, ebx
mov qword [rsp + 0x98], r11
call fcn.14003f640
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x98]
mov r8d, ebx
call fcn.14004f5d4
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x1e8]
mov qword [rsp + 0x50], rbp
call fcn.140005c30
mov ecx, dword [rsp + 0x68]
cmp eax, ebp
lea rdx, [rsp + 0x50]
cmovne ecx, dword [rsp + 0x50]
mov dword [rsp + 0x68], ecx
lea rcx, [rsp + 0x1e8]
call fcn.140005c30
mov ecx, dword [rsp + 0x6c]
lea rdx, [rsp + 0x50]
cmp eax, ebp
cmovne ecx, dword [rsp + 0x50]
mov qword [rsp + 0x50], 3
mov dword [rsp + 0x6c], ecx
mov rbx, qword [rsp + 0x68]
lea rcx, [rsp + 0x1e8]
mov qword [rsp + 0x60], rbx
call fcn.140005c30
mov rcx, rbx
call qword [sym.imp.USER32.dll_WindowFromPoint]
mov rbx, qword [rsp + 0x70]
mov r12, rax
mov rdi, rax
cmp rax, rbp
je 0x14007101d
mov rsi, qword [rsp + 0x50]
cmp rsi, 3
jne 0x140070fa9
cmp word [rbx], bp
je 0x14007101d
mov r14d, 0xfffffff0
jmp 0x140070fc2
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetParent]
cmp rax, rbp
je 0x140070fd4
mov rdi, rax
mov edx, r14d
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jb 0x140070fb1
cmp rsi, 3
je 0x14007101d
lea rdx, [rsp + 0x58]
mov rcx, rdi
mov dword [rsp + 0x58], ebp
mov dword [rsp + 0x5c], ebp
call qword [sym.imp.USER32.dll_ClientToScreen]
mov r11d, dword [rsp + 0x58]
mov eax, dword [rsp + 0x5c]
sub dword [rsp + 0x60], r11d
mov r8d, esi
sub dword [rsp + 0x64], eax
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
mov r12, rdi
call qword [sym.imp.USER32.dll_ChildWindowFromPointEx]
cmp rax, rbp
cmovne r12, rax
mov r8, qword [rsp + 0x90]
lea r9, str.0x_I64X
mov rdx, r12
mov rcx, r13
call fcn.14004ec8c
lea r9, str.0x_I64X
mov r8, rbx
mov rdx, rdi
mov rcx, r13
call fcn.14004ec8c
lea rcx, [rsp + 0x70]
call fcn.140044f24
jmp 0x140070578
lea rcx, str.PEBIT
mov rdx, rbx
call fcn.140045ff4
cmp al, bpl
je 0x1400712ea
cmp byte [0x1400ef008], 1
lea r14, [0x1400df5f0]
lea r15, [0x1400df5e8]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x1e8]
mov rsi, r14
mov r8d, 0xd
mov qword [rsp + 0x58], rbp
mov dword [rsp + 0x50], ebp
cmovge rsi, r15
call fcn.140020840
mov rcx, qword [rsp + 0x1e8]
cmp word [rcx], bp
je 0x1400712cd
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov rax, qword [rsp + 0x1e8]
cmp word [rax + rcx*2 - 2], 0x5c
je 0x1400710f8
cmp word [rax + rcx*2 - 2], 0x2f
je 0x1400710f8
mov rcx, rax
call fcn.1400b8a34
cmp eax, ebp
jne 0x1400710fd
mov rdx, qword [rsp + 0x1e8]
jmp 0x14007112d
mov word [rax + rcx*2 - 2], bp
mov rdx, qword [rsp + 0x1e8]
lea rcx, [rsp + 0x58]
call fcn.140058a38
lea rdx, str._version.dll
lea rcx, [rsp + 0x58]
call fcn.14004bfa8
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x1e8], rdx
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], 0x80
lea rcx, [rsp + 0x70]
mov r9d, 7
mov r8d, 0x80000000
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x20], rbp
call fcn.1400034e0
mov rdi, qword [rsp + 0x70]
lea rsi, [0x1400d63f4]
cmp rdi, rbp
je 0x1400712cd
mov r12d, 0x1000
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x1f8], ebp
mov edx, r12d
call fcn.14004bedc
mov rbx, qword [rsp + 0x70]
mov r8, r12
mov rcx, rbx
xor edx, edx
call fcn.1400b93b0
lea r9, [rsp + 0x1f8]
mov r8d, r12d
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebp
je 0x1400712b4
mov edx, dword [rsp + 0x1f8]
cmp edx, 0x40
jb 0x1400712b4
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x1400712b4
mov ecx, dword [rbx + 0x3c]
lea eax, [rcx + 8]
cmp eax, edx
jbe 0x14007122f
mov rdx, rcx
xor r8d, r8d
mov rcx, rdi
mov qword [rbx], rbp
call fcn.140045f34
lea r9, [rsp + 0x1f8]
mov r8d, 8
mov rdx, rbx
mov rcx, rdi
mov dword [rsp + 0x1f8], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rsp + 0x1f8]
mov ecx, ebp
lea eax, [rcx + 8]
cmp eax, edx
ja 0x1400712b4
mov eax, ecx
mov rcx, qword [rax + rbx]
movabs rax, 0xffffffffffff
and rcx, rax
movabs rax, 0x866400004550
cmp rcx, rax
jne 0x14007125d
mov rsi, r15
jmp 0x1400712b4
movabs rax, 0x14c00004550
cmp rcx, rax
je 0x1400712b1
movabs rax, 0x20000004550
cmp rcx, rax
jne 0x140071284
lea rsi, str.ia64
jmp 0x1400712b4
movabs rax, 0x1373c05454e
cmp rcx, rax
je 0x1400712b1
movabs rax, 0x1b03c05454e
cmp rcx, rax
je 0x1400712b1
movabs rax, 0xe73c05454e
cmp rcx, rax
jne 0x1400712b4
mov rsi, r14
lea rcx, [rsp + 0x70]
call fcn.140044f24
cmp rdi, 0xffffffffffffffff
je 0x1400712cd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x88]
mov r8, rsi
mov rcx, r13
call fcn.14004b578
lea rcx, [rsp + 0x58]
call fcn.140044f24
lea rcx, [rsp + 0x88]
call fcn.140044f24
lea rcx, [rsp + 0xa8]
call fcn.140044f24
lea rcx, [rsp + 0xa0]
call fcn.140044f24
mov rbx, qword [rsp + 0x1e0]
mov eax, ebp
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret