Function at 0x1400722e4
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov r12, rcx
lea rcx, [rax + 0x10]
call fcn.14004f534
xor esi, esi
cmp r9b, 1
movzx r13d, r9b
lea rcx, [rsp + 0xa0]
cmove r13d, esi
cmp r9b, 1
sete bpl
call fcn.140057154
lea rcx, [rsp + 0xa8]
call fcn.140057154
lea rcx, [rsp + 0x198]
call fcn.14004f534
cmp bpl, sil
je 0x140072358
sub qword [rsp + 0x198], 2
mov ebx, 0x3d
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x198]
mov r8d, ebx
call fcn.14005aa6c
lea ecx, [rbx - 0x17]
cmp bpl, sil
je 0x140072388
mov rax, qword [rsp + 0xa0]
mov word [rax], cx
lea rdx, [rsp + 0xa0]
xor r8d, r8d
mov rcx, r12
call fcn.140003728
mov rax, qword [rsp + 0xa0]
movsx r14, bpl
lea r15, [rax + r14*2]
mov rax, qword [rsp + 0x198]
cmp bx, word [rax]
jne 0x1400725e8
mov edi, 0x3b
add rax, 2
lea rdx, [rsp + 0xa8]
lea ebx, [rdi - 0xf]
lea rcx, [rsp + 0x198]
mov r9d, edi
mov r8d, ebx
mov qword [rsp + 0x198], rax
call fcn.14005ab00
mov r11, qword [rsp + 0x198]
movzx r9d, word [r11]
cmp bx, r9w
je 0x140072403
cmp di, r9w
jne 0x14007240f
add r11, 2
mov qword [rsp + 0x198], r11
mov rbx, qword [rsp + 0xa8]
mov dil, sil
cmp r13b, sil
jne 0x1400725ab
lea rcx, str.WINVER
mov rdx, rbx
call fcn.140050aa8
mov r10d, 0x2a
cmp al, sil
jne 0x140072458
lea rcx, [0x1400f7f88]
mov rdx, rbx
call fcn.140050aa8
cmp al, sil
je 0x1400725ab
mov dil, r10b
lea rcx, [rsp + 0x198]
call fcn.14004f534
mov rcx, qword [rsp + 0x198]
mov eax, 0x5e
mov rbx, rsi
mov r14, rsi
cmp ax, word [rcx]
jne 0x14007248d
or r14, 0xffffffffffffffff
add rcx, 2
mov qword [rsp + 0x198], rcx
mov eax, 0x2b
cmp ax, word [rcx]
jne 0x1400724bf
lea rax, [rcx + 2]
mov dil, 1
cmp word [rax], si
jne 0x1400724b4
mov word [rcx], r10w
mov rcx, qword [rsp + 0x198]
mov dil, r10b
jmp 0x1400724bf
mov rcx, rax
mov qword [rsp + 0x198], rax
movzx ebp, word [rcx]
cmp bp, si
jne 0x1400724d0
cmp dil, sil
je 0x140072577
mov qword [rsp + 0x58], rsi
cmp r10w, word [rcx]
je 0x1400724e0
cmp dil, r10b
jne 0x140072555
lea rcx, [rsp + 0xe0]
lea rdx, str._SystemRoot_System32kernel32.dll
mov r8d, 0x46
call fcn.1400d2bf0
cmp byte [r12 + 0xda], sil
jne 0x14007252b
test byte [r12 + 0xd], 0xf
jne 0x14007252b
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0xe0]
xor r9d, r9d
mov rcx, r12
mov byte [rsp + 0x20], 1
call fcn.14006a75c
jmp 0x140072548
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0xe0]
xor r9d, r9d
mov rcx, r12
mov byte [rsp + 0x20], 1
call fcn.140069518
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x198], rcx
xor r8d, r8d
mov rdx, r14
call fcn.140005798
lea rcx, [rsp + 0x58]
mov rbx, rax
call fcn.14004f564
cmp dil, sil
jne 0x140072577
cmp bp, si
jne 0x140072591
mov rbp, rbx
call fcn.140052b04
mov rbx, rax
cmp dil, sil
je 0x140072591
movzx eax, bp
shl rbx, 0x10
or rbx, rax
lea r9, [0x1400f3570]
mov r8, r15
mov rdx, rbx
mov rcx, r12
call fcn.14005a0f8
jmp 0x140073553
lea rcx, str.ispe
mov rdx, rbx
call fcn.140050aa8
cmp al, sil
je 0x1400725d6
call fcn.14000c558
mov r8, r15
mov rcx, r12
mov edx, eax
call fcn.14005a1d0
jmp 0x140073553
mov r15d, 0x2c
cmp r9w, si
je 0x1400725f4
cmp r15w, r9w
je 0x1400725f4
mov rsi, 0xffffffff80070057
jmp 0x140073553
cmp r13b, sil
je 0x140072603
cmp r13b, 2
jne 0x140072bc0
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x88]
call fcn.14006160c
mov rdi, qword [rsp + 0x88]
cmp bpl, sil
je 0x14007262d
mov eax, 0x26
mov word [rdi], ax
lea rcx, [rsp + 0x198]
call fcn.14004f534
lea rcx, str.FVER
mov rdx, rbx
call fcn.140050aa8
cmp al, sil
je 0x140072744
lea rcx, [rsp + 0x78]
call fcn.140057154
mov rcx, qword [rsp + 0x198]
mov qword [rsp + 0x70], rsi
call fcn.140018fa4
lea rcx, [rsp + 0x58]
mov rbx, rsi
mov r8d, 0x3b
mov edx, r15d
mov qword [rsp + 0x60], rbx
mov r11, rax
mov qword [rsp + 0x198], rax
mov qword [rsp + 0x58], rdi
movzx ebp, si
call fcn.14004f7c8
mov rcx, qword [rsp + 0x58]
cmp word [rcx], si
je 0x1400726d7
mov word [rcx], si
add rcx, 2
mov r9d, r8d
mov qword [rsp + 0x58], rcx
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov r8d, r15d
call fcn.14005ab00
mov rbx, qword [rsp + 0x60]
mov r11, qword [rsp + 0x198]
mov bp, word [rbx]
movzx eax, bp
mov rcx, r11
neg ax
lea rax, [rsp + 0x70]
sbb r8, r8
and r8, rax
movzx eax, word [rdi]
neg ax
lea rax, [rsp + 0x78]
sbb rdx, rdx
and rdx, rax
call fcn.140005798
mov r8, qword [rsp + 0x78]
mov rdx, rdi
mov rcx, r12
call fcn.140056790
cmp bp, si
je 0x140072726
mov r8, qword [rsp + 0x70]
mov rdx, rbx
mov rcx, r12
call fcn.140056790
lea rcx, [rsp + 0x60]
call fcn.14004f564
lea rcx, [rsp + 0x70]
call fcn.14004f564
lea rcx, [rsp + 0x78]
jmp 0x140073541
lea rcx, str.FTIME
mov rdx, rbx
call fcn.140050aa8
cmp al, sil
je 0x14007292e
mov rcx, qword [rsp + 0x198]
call fcn.140018fa4
lea rcx, [rsp + 0x70]
mov rbx, rax
call fcn.140057154
lea rcx, [rsp + 0x78]
call fcn.140057154
lea rcx, [rsp + 0x68]
call fcn.140057154
lea r11, [rdi + r14*2]
lea rdx, [rsp + 0x50]
lea rcx, str._local
mov r8d, 6
mov qword [rsp + 0x50], r11
call fcn.14005992c
cmp al, sil
je 0x1400727ce
cmp bpl, sil
je 0x1400727ca
mov rax, qword [rsp + 0x50]
mov ecx, 0x26
sub rax, 2
mov qword [rsp + 0x50], rax
mov word [rax], cx
or bpl, 2
lea rdx, [rsp + 0x50]
lea rcx, [0x1400f7f14]
mov r8d, 3
call fcn.14005992c
mov r8d, 4
cmp al, sil
je 0x1400727f3
or bpl, r8b
lea rdx, [rsp + 0x50]
lea rcx, str._ws1
call fcn.14005992c
cmp al, sil
je 0x14007280d
or bpl, 8
cmp bpl, sil
je 0x14007281a
mov eax, 0x26
mov word [rdi], ax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
mov r8d, r15d
call fcn.14005aa6c
mov rax, qword [rsp + 0x50]
cmp r15w, word [rax]
jne 0x140072878
add rax, 2
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
mov r8d, r15d
mov qword [rsp + 0x50], rax
call fcn.14005aa6c
mov rax, qword [rsp + 0x50]
cmp r15w, word [rax]
jne 0x140072878
add rax, 2
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x50]
mov r8d, r15d
mov qword [rsp + 0x50], rax
call fcn.14005aa6c
lea r8, [rsp + 0xe0]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov rdx, qword [rsp + 0x70]
mov rcx, r12
cmp eax, esi
je 0x1400728f5
lea r8, [rsp + 0xe4]
mov r9b, bpl
call fcn.14005b488
mov rdx, qword [rsp + 0x78]
lea r8, [rsp + 0xf4]
mov r9b, bpl
mov rcx, r12
call fcn.14005b488
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0xec]
mov r9b, bpl
mov rcx, r12
call fcn.14005b488
lea rcx, [rsp + 0x68]
call fcn.14004f564
lea rcx, [rsp + 0x78]
call fcn.14004f564
lea rcx, [rsp + 0x70]
jmp 0x140073541
lea rbp, [0x1400ee4c4]
mov r8, rbp
call fcn.140056790
mov rdx, qword [rsp + 0x78]
mov r8, rbp
mov rcx, r12
call fcn.140056790
mov rdx, qword [rsp + 0x68]
mov r8, rbp
mov rcx, r12
call fcn.140056790
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400728d7
lea rcx, str.FATTR
mov rdx, rbx
call fcn.140050aa8
cmp al, sil
je 0x140072bb3
mov rcx, qword [rsp + 0x198]
call fcn.140018fa4
mov r13d, 0x26
mov rbx, rax
cmp bpl, sil
je 0x140072965
mov word [rdi], r13w
lea rcx, [rsp + 0x58]
call fcn.140057154
lea rcx, [rsp + 0x68]
call fcn.140057154
lea rcx, [rsp + 0x78]
call fcn.140057154
lea rcx, [rsp + 0x70]
call fcn.140057154
lea rcx, [rsp + 0x60]
call fcn.140057154
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
mov r8d, r15d
mov qword [rsp + 0x50], rdi
call fcn.14005aa6c
mov rax, qword [rsp + 0x50]
cmp r15w, word [rax]
jne 0x140072a7a
cmp bpl, sil
je 0x1400729c8
mov word [rax], r13w
jmp 0x1400729d1
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x50]
mov r8d, r15d
call fcn.14005aa6c
mov rax, qword [rsp + 0x50]
cmp r15w, word [rax]
jne 0x140072a7a
cmp bpl, sil
je 0x1400729fd
mov word [rax], r13w
jmp 0x140072a06
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
mov r8d, r15d
call fcn.14005aa6c
mov rax, qword [rsp + 0x50]
cmp r15w, word [rax]
jne 0x140072a7a
cmp bpl, sil
je 0x140072a2e
mov word [rax], r13w
jmp 0x140072a37
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
mov r8d, r15d
call fcn.14005aa6c
mov rax, qword [rsp + 0x50]
cmp r15w, word [rax]
jne 0x140072a7a
cmp bpl, sil
je 0x140072a5f
mov word [rax], r13w
jmp 0x140072a68
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
mov r8d, r15d
call fcn.14005aa6c
lea r8, [rsp + 0xb0]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov rcx, r12
cmp eax, esi
je 0x140072b65
mov edx, dword [rsp + 0xb0]
mov r8, qword [rsp + 0x58]
shr edx, 5
and edx, 1
call fcn.14005a1d0
mov edx, dword [rsp + 0xb0]
mov r8, qword [rsp + 0x68]
shr edx, 1
mov rcx, r12
and edx, 1
call fcn.14005a1d0
mov edx, dword [rsp + 0xb0]
mov r8, qword [rsp + 0x78]
and edx, 1
mov rcx, r12
call fcn.14005a1d0
mov edx, dword [rsp + 0xb0]
mov r8, qword [rsp + 0x70]
shr edx, 2
mov rcx, r12
and edx, 1
call fcn.14005a1d0
mov r8d, dword [rsp + 0xb0]
lea rdx, str.0x_lX
lea rcx, [rsp + 0xe0]
mov word [rsp + 0xe0], si
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0xe0]
mov rcx, r12
call fcn.140056790
lea rcx, [rsp + 0x60]
call fcn.14004f564
lea rcx, [rsp + 0x70]
call fcn.14004f564
lea rcx, [rsp + 0x78]
call fcn.14004f564
lea rcx, [rsp + 0x68]
call fcn.14004f564
lea rcx, [rsp + 0x58]
jmp 0x140073541
mov rdx, qword [rsp + 0x58]
lea rbp, [0x1400ee4c4]
mov r8, rbp
call fcn.140056790
mov rdx, qword [rsp + 0x68]
mov r8, rbp
mov rcx, r12
call fcn.140056790
mov rdx, qword [rsp + 0x78]
mov r8, rbp
mov rcx, r12
call fcn.140056790
mov rdx, qword [rsp + 0x70]
mov r8, rbp
mov rcx, r12
call fcn.140056790
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140072b33
lea rcx, [rsp + 0x88]
call fcn.14004f564
cmp r13b, sil
jne 0x140073553
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x88]
call fcn.14006160c
lea rcx, [rsp + 0x198]
call fcn.14004f534
lea rcx, str.DROPFILE
mov rdx, rbx
call fcn.140050aa8
cmp al, sil
je 0x140072d0e
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x198]
mov qword [rsp + 0x80], rsi
call fcn.140065394
lea rcx, [rsp + 0x68]
call fcn.140057154
lea rcx, [rsp + 0x78]
call fcn.140057154
mov r11, qword [rsp + 0x88]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x60]
mov r8d, r15d
mov qword [rsp + 0x60], r11
call fcn.14005aa6c
mov rax, qword [rsp + 0x60]
cmp r15w, word [rax]
jne 0x140072c88
cmp bpl, sil
je 0x140072c6d
mov ecx, 0x26
mov word [rax], cx
jmp 0x140072c76
add rax, 2
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
mov r8d, r15d
call fcn.14005aa6c
lea rcx, [rsp + 0x70]
call fcn.140057154
lea rcx, [rsp + 0x58]
call fcn.140057154
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
cmp word [rbx], si
lea r8, [rsp + 0x58]
cmove r8, rsi
cmp rcx, rsi
je 0x140072cc4
lea rdx, [rsp + 0x70]
call fcn.140005d70
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, r12
call fcn.140056790
mov r8, qword [rsp + 0x58]
mov rdx, rbx
mov rcx, r12
call fcn.140056790
lea rcx, [rsp + 0x58]
call fcn.14004f564
lea rcx, [rsp + 0x70]
call fcn.14004f564
lea rcx, [rsp + 0x78]
call fcn.14004f564
lea rcx, [rsp + 0x68]
jmp 0x140073541
lea rcx, str.FPOS
mov rdx, rbx
call fcn.140050aa8
cmp al, sil
je 0x140072fc5
mov rcx, qword [rsp + 0x198]
call fcn.140018fa4
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x60], rax
call fcn.14004f534
mov rcx, qword [rsp + 0x60]
call fcn.140016268
lea rcx, [rsp + 0x80]
call fcn.140057154
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x80]
call fcn.140019400
mov rdi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
mov r13d, 0x26
cmp bpl, sil
je 0x140072d8a
mov word [rbx], r13w
lea rcx, [rsp + 0x98]
call fcn.140057154
lea rcx, [rsp + 0x90]
call fcn.140057154
lea rcx, [rsp + 0x68]
call fcn.140057154
lea rcx, [rsp + 0x78]
call fcn.140057154
lea rcx, [rsp + 0x70]
call fcn.140057154
lea rcx, [rsp + 0x58]
call fcn.140057154
lea rcx, [rsp + 0x60]
call fcn.140057154
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x50]
mov r8d, r15d
mov qword [rsp + 0x50], rbx
call fcn.14005aa6c
mov rax, qword [rsp + 0x50]
cmp r15w, word [rax]
jne 0x140072f29
cmp bpl, sil
je 0x140072e0a
mov word [rax], r13w
jmp 0x140072e13
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x50]
mov r8d, r15d
call fcn.14005aa6c
mov rax, qword [rsp + 0x50]
cmp r15w, word [rax]
jne 0x140072f29
cmp bpl, sil
je 0x140072e42
mov word [rax], r13w
jmp 0x140072e4b
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x50]
mov r8d, r15d
call fcn.14005aa6c
mov rax, qword [rsp + 0x50]
cmp r15w, word [rax]
jne 0x140072f29
cmp bpl, sil
je 0x140072e77
mov word [rax], r13w
jmp 0x140072e80
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
mov r8d, r15d
call fcn.14005aa6c
mov rax, qword [rsp + 0x50]
cmp r15w, word [rax]
jne 0x140072f29
cmp bpl, sil
je 0x140072eac
mov word [rax], r13w
jmp 0x140072eb5
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
mov r8d, r15d
call fcn.14005aa6c
mov rax, qword [rsp + 0x50]
cmp r15w, word [rax]
jne 0x140072f29
cmp bpl, sil
je 0x140072edd
mov word [rax], r13w
jmp 0x140072ee6
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
mov r8d, r15d
call fcn.14005aa6c
mov rax, qword [rsp + 0x50]
cmp r15w, word [rax]
jne 0x140072f29
cmp bpl, sil
je 0x140072f0e
mov word [rax], r13w
jmp 0x140072f17
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
mov r8d, r15d
call fcn.14005aa6c
mov rax, qword [rsp + 0x60]
mov r9, qword [rsp + 0x90]
mov r8, qword [rsp + 0x98]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x58]
mov rdx, rdi
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x70]
mov rcx, r12
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
call fcn.14004b128
lea rcx, [rsp + 0x60]
movsxd rsi, eax
call fcn.14004f564
lea rcx, [rsp + 0x58]
call fcn.14004f564
lea rcx, [rsp + 0x70]
call fcn.14004f564
lea rcx, [rsp + 0x78]
call fcn.14004f564
lea rcx, [rsp + 0x68]
call fcn.14004f564
lea rcx, [rsp + 0x90]
call fcn.14004f564
lea rcx, [rsp + 0x98]
jmp 0x140073534
lea rcx, str.PPID
mov rdx, rbx
call fcn.140050aa8
cmp al, sil
je 0x140073008
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x198]
mov qword [rsp + 0x80], rsi
call fcn.140065394
mov rcx, qword [rsp + 0x80]
call fcn.1400061b0
mov rdx, rax
jmp 0x140073023
lea rcx, str.ISADMIN
mov rdx, rbx
call fcn.140050aa8
cmp al, sil
je 0x140073038
call fcn.1400c196c
mov edx, eax
mov r8, qword [rsp + 0x88]
mov rcx, r12
call fcn.14005a1d0
jmp 0x140073546
lea rcx, str.PWIN
mov rdx, rbx
call fcn.140050aa8
cmp al, sil
je 0x140073213
lea rcx, [rsp + 0x98]
call fcn.140057154
lea rcx, [rsp + 0x80]
call fcn.140057154
mov r11, qword [rsp + 0x88]
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x90]
xor r9d, r9d
mov r8d, r15d
mov qword [rsp + 0x90], r11
call fcn.140049458
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x90]
mov r8d, r15d
call fcn.14005aa6c
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x198]
mov qword [rsp + 0x50], rsi
call fcn.14008e204
mov ecx, dword [rsp + 0x68]
cmp eax, esi
lea rdx, [rsp + 0x50]
cmovne ecx, dword [rsp + 0x50]
mov dword [rsp + 0x68], ecx
lea rcx, [rsp + 0x198]
call fcn.14008e204
mov ecx, dword [rsp + 0x6c]
lea rdx, [rsp + 0x50]
cmp eax, esi
cmovne ecx, dword [rsp + 0x50]
mov qword [rsp + 0x50], 3
mov dword [rsp + 0x6c], ecx
mov rax, qword [rsp + 0x68]
lea rcx, [rsp + 0x198]
mov qword [rsp + 0x58], rax
call fcn.14008e204
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_WindowFromPoint]
mov rbx, qword [rsp + 0x80]
mov r13, rax
mov rdi, rax
cmp rax, rsi
je 0x1400731ca
mov rbp, qword [rsp + 0x50]
cmp rbp, 3
jne 0x140073156
cmp word [rbx], si
je 0x1400731ca
mov r14d, 0xfffffff0
jmp 0x14007316f
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetParent]
cmp rax, rsi
je 0x140073181
mov rdi, rax
mov edx, r14d
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jb 0x14007315e
cmp rbp, 3
je 0x1400731ca
lea rdx, [rsp + 0x60]
mov rcx, rdi
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x64], esi
call qword [sym.imp.USER32.dll_ClientToScreen]
mov r11d, dword [rsp + 0x60]
mov eax, dword [rsp + 0x64]
sub dword [rsp + 0x58], r11d
mov r8d, ebp
sub dword [rsp + 0x5c], eax
mov rdx, qword [rsp + 0x58]
mov rcx, rdi
mov r13, rdi
call qword [sym.imp.USER32.dll_ChildWindowFromPointEx]
cmp rax, rsi
cmovne r13, rax
mov r8, qword [rsp + 0x98]
lea r9, [0x1400f3570]
mov rdx, r13
mov rcx, r12
call fcn.14005a0f8
lea r9, [0x1400f3570]
mov r8, rbx
mov rdx, rdi
mov rcx, r12
call fcn.14005a0f8
lea rcx, [rsp + 0x80]
call fcn.14004f564
lea rcx, [rsp + 0x98]
jmp 0x140073541
lea rcx, str.PEBIT
mov rdx, rbx
call fcn.140050aa8
cmp al, sil
je 0x140073546
mov rax, qword [rsp + 0x88]
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x98], rax
call fcn.140057154
lea rcx, [rsp + 0x58]
call fcn.140057154
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x98]
xor r9d, r9d
mov r8d, r15d
call fcn.140049458
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x98]
mov r8d, r15d
call fcn.14005aa6c
or r14, 0xffffffffffffffff
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x198]
lea r8d, [r14 + 0xe]
mov r13, r14
lea rbp, [0x1400ee4c4]
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], rsi
call fcn.140023d48
mov rcx, qword [rsp + 0x198]
cmp word [rcx], si
je 0x1400734e3
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov rax, qword [rsp + 0x198]
cmp word [rax + rcx*2 - 2], 0x5c
je 0x1400732f8
cmp word [rax + rcx*2 - 2], 0x2f
je 0x1400732f8
mov rcx, rax
call fcn.1400d14e0
cmp eax, esi
jne 0x1400732fd
mov rdx, qword [rsp + 0x198]
jmp 0x14007332d
mov word [rax + rcx*2 - 2], si
mov rdx, qword [rsp + 0x198]
lea rcx, [rsp + 0x60]
call fcn.140061724
lea rdx, str._version.dll
lea rcx, [rsp + 0x60]
call fcn.140057290
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x198], rdx
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], 0x80
lea rcx, [rsp + 0x90]
mov r9d, 7
mov r8d, 0x80000000
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x20], rsi
call fcn.140003590
mov rdi, qword [rsp + 0x90]
cmp rdi, rsi
je 0x1400734e3
mov r15d, 0x1000
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x1a8], esi
mov rdx, r15
call fcn.1400571c8
mov rbx, qword [rsp + 0x90]
mov r8, r15
mov rcx, rbx
xor edx, edx
call fcn.1400d1fa0
lea r9, [rsp + 0x1a8]
mov r8d, r15d
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, esi
je 0x1400734c8
mov edx, dword [rsp + 0x1a8]
cmp edx, 0x40
jb 0x1400734c8
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x1400734c8
mov ecx, dword [rbx + 0x3c]
lea eax, [rcx + 8]
cmp eax, edx
jbe 0x140073437
mov rdx, rcx
xor r8d, r8d
mov rcx, rdi
mov qword [rbx], rsi
call fcn.140050964
lea r9, [rsp + 0x1a8]
mov r8d, 8
mov rdx, rbx
mov rcx, rdi
mov dword [rsp + 0x1a8], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rsp + 0x1a8]
mov ecx, esi
lea eax, [rcx + 8]
cmp eax, edx
ja 0x1400734c8
mov eax, ecx
mov r13, qword [rax + rbx]
movabs rax, 0xffffffffffff
and r13, rax
movabs rax, 0x866400004550
cmp r13, rax
jne 0x14007346d
lea rbp, [0x1400f7ea8]
jmp 0x1400734c8
movabs rax, 0x14c00004550
cmp r13, rax
je 0x1400734c1
movabs rax, 0x20000004550
cmp r13, rax
jne 0x140073494
lea rbp, str.ia64
jmp 0x1400734c8
movabs rax, 0x1373c05454e
cmp r13, rax
je 0x1400734c1
movabs rax, 0x1b03c05454e
cmp r13, rax
je 0x1400734c1
movabs rax, 0xe73c05454e
cmp r13, rax
jne 0x1400734c8
lea rbp, [0x1400f7e90]
lea rcx, [rsp + 0x90]
call fcn.14004f564
cmp rdi, r14
je 0x1400734e3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x80]
mov r8, rbp
mov rcx, r12
call fcn.140056790
cmp r13, rsi
mov rcx, r12
jg 0x140073511
mov rdx, qword [rsp + 0x58]
lea r8, str._0x000000000001
call fcn.140056790
jmp 0x140073525
mov r8, qword [rsp + 0x58]
lea r9, str.0x_012I64X
mov rdx, r13
call fcn.14005a0f8
lea rcx, [rsp + 0x60]
call fcn.14004f564
lea rcx, [rsp + 0x58]
call fcn.14004f564
lea rcx, [rsp + 0x80]
call fcn.14004f564
lea rcx, [rsp + 0x88]
call fcn.14004f564
lea rcx, [rsp + 0xa8]
call fcn.14004f564
lea rcx, [rsp + 0xa0]
call fcn.14004f564
mov rbx, qword [rsp + 0x190]
mov rax, rsi
add rsp, 0x150
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret