Function at 0x14003f0b8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
xor r14d, r14d
mov r13, rdx
mov rbp, rcx
mov r15b, r14b
call fcn.140015460
mov rdx, qword [rsp + 0x138]
mov byte [0x14010d8e7], r14b
movzx eax, word [rdx]
lea r8d, [r14 + 0x2a]
cmp r8w, ax
lea ecx, [r14 + 0x20]
lea r10d, [r14 + 9]
sete r12b
lea r9d, [r14 + 0xd]
jmp 0x14003f131
cmp r10w, ax
ja 0x14003f11d
cmp ax, r9w
jbe 0x14003f137
cmp cx, ax
je 0x14003f137
add rdx, 2
mov qword [rsp + 0x138], rdx
mov ax, word [rdx]
cmp ax, r14w
jne 0x14003f111
lea rcx, [rsp + 0x138]
call fcn.140014d28
mov rax, qword [rsp + 0x138]
mov ecx, 0x2d
mov qword [rsp + 0x58], rax
cmp cx, word [rax]
movzx ebx, r8b
mov edi, r14d
lea esi, [rcx - 0x2c]
cmove ebx, ecx
lea rdx, [rsp + 0x138]
lea rcx, str._user
mov r8d, 5
mov qword [rsp + 0x58], rax
call fcn.14005a810
cmp al, r14b
jne 0x14003f243
lea rdx, [rsp + 0x138]
lea rcx, [0x1400f62b4]
mov r8d, 2
call fcn.14005a810
cmp al, r14b
jne 0x14003f243
mov rcx, qword [rsp + 0x58]
movsx edx, bl
movzx eax, word [rcx]
cmp edx, eax
jne 0x14003f252
movzx eax, word [rcx + 2]
cmp edx, eax
jne 0x14003f252
add rcx, 4
lea rdx, [rsp + 0x58]
mov r8d, 4
mov qword [rsp + 0x58], rcx
lea rcx, str.user
call fcn.14005a810
cmp al, r14b
jne 0x14003f22f
lea rdx, [rsp + 0x58]
lea rcx, [0x1400f529c]
mov r8d, esi
call fcn.14005a810
cmp al, r14b
jne 0x14003f22f
lea rdx, [rsp + 0x58]
lea rcx, [0x1400f17bc]
mov r8d, 4
call fcn.14005a810
cmp al, r14b
je 0x14003f252
mov r15b, sil
jmp 0x14003f231
mov edi, esi
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x138], rax
jmp 0x14003f166
mov rax, qword [rsp + 0x138]
mov edi, esi
jmp 0x14003f166
mov rsi, qword [0x14010b258]
lea rax, str.UCallBackhWnd
cmp edi, r14d
cmovne rsi, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rax, str.GlobalPECMD:main_u
lea r8, str.GlobalPECMD:main
cmp edi, r14d
mov edx, 1
cmovne r8, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp rbx, r14
je 0x14003f2b0
mov ecx, 0xb7
cmp eax, ecx
jne 0x14003f2b0
mov rax, rcx
jmp 0x14003fb83
cmp edi, r14d
je 0x14003f2be
mov byte [0x14010d8e3], 0x20
jmp 0x14003f2d5
mov rax, qword [rsp + 0x138]
cmp word [rax], r14w
setne al
add al, 0x10
mov byte [0x14010d8e3], al
lea rcx, [rsp + 0xb0]
lea rdx, str.LOGS__D:DebugPeMain2.log
mov r8d, 0x36
call fcn.1400d4ab0
lea rbx, [0x14010df00]
cmp qword [0x14010da48], r14
jne 0x14003f325
lea rcx, [rsp + 0xbe]
call fcn.1400d34e4
cmp eax, r14d
je 0x14003f325
lea rdx, [rsp + 0xb8]
or r8, 0xffffffffffffffff
mov rcx, rbx
call fcn.140026f9c
movsx r9d, byte [0x14010d8e3]
lea rdx, str.MAIN___s__0x_X_r_n
mov r8, r13
mov rcx, rbx
call fcn.14001650c
mov r8, qword [0x14010e1b0]
lea rdx, str.MAIN:_pecmd::RegDeleteKeyExW0x_p_r_n
mov rcx, rbx
call fcn.14001650c
call fcn.1400226ec
movzx r11d, byte [0x14010d8e1]
cmp r12b, r14b
mov r12d, 1
cmovne r11d, r12d
mov byte [0x14010d8e1], r11b
cmp edi, r14d
jne 0x14003f43a
mov rax, qword [rsp + 0x138]
cmp word [rax], r14w
je 0x14003f46d
lea ecx, [r12 + 2]
call fcn.140018acc
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x140]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
lea rdx, str.SOFTWAREPELOGON
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x140], r14
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x140]
cmp rcx, r14
je 0x14003f3f1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.MAIN_DBG:_d_r_n
mov r8d, 0x29b7
mov rcx, rbx
call fcn.14001662c
call fcn.1400216d4
lea rdx, str.MAIN_DBG:_d_r_n
mov r8d, 0x29b9
mov rcx, rbx
call fcn.14001662c
call fcn.1400152a0
lea rdx, str.MAIN_DBG:_d_r_n
mov r8d, 0x29bb
mov rcx, rbx
call fcn.14001662c
mov rax, qword [rsp + 0x138]
cmp word [rax], r14w
je 0x14003f46d
lea rdx, [0x1400f04f4]
mov r9d, 0x24
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x20], r14
call fcn.14002ebf0
mov rax, qword [rsp + 0x138]
movzx ebx, word [rax]
mov ecx, 0x23
lea edx, [rcx + 7]
cmp bx, dx
jne 0x14003f49b
add rax, 2
cmp cx, word [rax]
je 0x14003f49b
lea rcx, [rsp + 0x138]
mov qword [rsp + 0x138], rax
call fcn.140014d28
lea rdx, [0x1400f04f4]
lea rcx, [0x1400f04f4]
call sym.PECMD.exe_LoadEnvi
movzx r11d, byte [0x14010e495]
mov rax, qword [rsp + 0x138]
cmp word [rax], r14w
cmove r11d, r12d
mov byte [0x14010e495], r11b
call fcn.140050c18
call fcn.14003f004
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea r8, str.MainPECMDPID
lea rdx, str.SOFTWAREPELOGON
mov dword [rsp + 0x148], eax
lea rax, [rsp + 0x148]
mov r9d, 4
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call fcn.140051760
lea rdx, str.MAIN_DBG:_d_r_n
lea rcx, [0x14010df00]
mov r8d, 0x29c5
call fcn.14001662c
lea rcx, [0x14010df00]
xor edx, edx
call fcn.1400c4c74
cmp qword [rbp + 0x78], r14
jne 0x14003f5e7
mov eax, dword [0x14010e098]
test r12b, al
jne 0x14003f571
or eax, r12d
lea rcx, [0x1400edee0]
mov qword [0x14010e090], r14
mov dword [0x14010e098], eax
call fcn.1400d4320
lea r12, [0x14010e090]
mov edx, 0x10000
mov rcx, rbp
mov qword [rbp + 0x78], r12
call fcn.14005642c
lea rcx, [rsp + 0x140]
call fcn.140058038
mov rdx, qword [rsp + 0x140]
mov rcx, r12
call fcn.14008e660
mov rax, qword [0x14010e090]
mov qword [rsp + 0x140], r14
mov rcx, qword [rax]
mov r12d, 1
mov rdx, r13
mov qword [rbp + 0x80], rcx
mov rcx, rbp
mov r8d, r12d
call fcn.140065aac
lea rcx, [rsp + 0x140]
mov dword [rbp + 0x8c], r14d
call fcn.140050424
lea r13, [0x14010df00]
lea rdx, str.MAIN_DBG:_d_r_n
mov r8d, 0x29d1
mov rcx, r13
call fcn.14001662c
cmp edi, r14d
jne 0x14003f647
mov al, byte [0x14010d8e3]
lea r8, str.bInMain
lea rdx, str.SOFTWAREPELOGON
mov byte [rsp + 0x140], al
lea rax, [rsp + 0x140]
mov r9d, 3
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call fcn.140051760
lea r12, str.MAIN_DBG:_d_r_n
mov r8d, 0x29d5
mov rcx, r13
mov rdx, r12
call fcn.14001662c
mov r11, qword [rsp + 0x138]
cmp word [r11], r14w
je 0x14003f672
call fcn.140018a94
lea rax, [0x14010dd80]
lea rdx, str.SOFTWAREPELOGON
mov r9d, 0xb
mov r8, rsi
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call fcn.140051760
cmp bx, r14w
jne 0x14003f6ad
cmp edi, r14d
je 0x14003f6b2
call fcn.14002f6b4
mov rcx, rbp
call fcn.140021c48
mov ecx, 0x8000
call fcn.140068404
mov r11, qword [rsp + 0x138]
cmp word [r11], r14w
jne 0x14003f6d7
cmp edi, r14d
je 0x14003f71b
mov r8d, 0x29e0
mov rdx, r12
mov rcx, r13
call fcn.14001662c
lea rax, [0x14010d940]
lea rcx, [0x14003f034]
xor edx, edx
mov r9d, 0x10000
mov r8d, 0x80000
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call fcn.1400504f8
mov r11, qword [rsp + 0x138]
mov r8d, 0x2a
cmp word [r11], r8w
jne 0x14003f758
lea r9d, [r8 - 7]
lea rax, [r11 + 2]
cmp r9w, word [rax]
je 0x14003f758
lea rcx, [rsp + 0x138]
mov qword [rsp + 0x138], rax
call fcn.140014d28
mov r11, qword [rsp + 0x138]
cmp word [r11], r8w
je 0x14003f72b
cmp word [r11], r14w
je 0x14003fb53
mov r8d, 0x29e8
mov rdx, r12
mov rcx, r13
call fcn.14001662c
mov rcx, qword [rsp + 0x138]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x70]
add eax, 0x5c8
movsxd rdx, eax
call fcn.1400580ac
mov r14, qword [rsp + 0x70]
xor ebx, ebx
mov word [r14], bx
mov r12, qword [rsp + 0x70]
mov r8d, 0x104
add r12, 0x280
xor ecx, ecx
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r8d, [rbx + 0x5c]
xor edx, edx
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov rsi, rax
cmp rax, rbx
jne 0x14003f7d7
mov rsi, r12
jmp 0x14003f7db
add rsi, 2
mov rcx, qword [rsp + 0x138]
call fcn.140017dc8
cmp eax, ebx
je 0x14003f862
mov rdx, qword [rsp + 0x138]
lea rcx, [rsp + 0x140]
call fcn.14006252c
mov rdx, qword [rsp + 0x138]
lea rcx, [0x1400f61b8]
mov r8d, 4
call fcn.140051938
movzx ecx, byte [0x14010de64]
mov rdx, qword [rsp + 0x140]
xor r14d, r14d
cmp al, r14b
mov qword [rsp + 0x20], r14
lea eax, [r14 + 1]
cmovne ecx, eax
xor r9d, r9d
xor r8d, r8d
mov byte [0x14010de64], cl
mov rcx, rbp
call fcn.1400409b4
lea rcx, [rsp + 0x140]
call fcn.140050424
jmp 0x14003fb2b
mov rax, qword [rsp + 0x138]
lea rcx, [rsp + 0x68]
mov r13b, bl
mov qword [rsp + 0x50], rax
call fcn.140058038
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x50]
mov r9d, 0x1000
mov rcx, rbp
mov word [rsp + 0x20], bx
call fcn.140049d5c
lea rcx, [rsp + 0x60]
mov edx, 0x400
call fcn.1400580ac
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rbx
mov word [rax], bx
mov rax, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x78]
mov r9d, 7
mov r8d, 0x80000000
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x140], ebx
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x20], rbx
call fcn.140003588
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rbx
mov rbx, qword [rsp + 0x78]
lea r9, [rsp + 0x140]
mov r8d, 0x7fe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r11d, dword [rsp + 0x140]
mov rax, qword [rsp + 0x50]
shr r11, 1
xor ecx, ecx
mov word [rax + r11*2], cx
mov rdx, qword [rsp + 0x50]
mov eax, 0xfeff
cmp ax, word [rdx]
jne 0x14003f94c
add rdx, 2
mov qword [rsp + 0x50], rdx
lea rcx, str._pecmd
mov r8d, 7
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
xor edx, edx
cmp eax, edx
jne 0x14003f9f9
mov rax, qword [rsp + 0x50]
add rax, 0xe
mov qword [rsp + 0x50], rax
movzx ecx, word [rax]
cmp cx, dx
je 0x14003f9f9
mov r10d, 9
lea r8d, [r10 + 0x17]
mov r9d, 0xd
cmp r10w, cx
ja 0x14003f99b
cmp cx, r9w
jbe 0x14003f9b2
cmp r8w, cx
je 0x14003f9b2
add rax, 2
mov qword [rsp + 0x50], rax
mov cx, word [rax]
cmp cx, dx
jne 0x14003f989
cmp r8w, word [rax]
je 0x14003f9be
cmp r10w, word [rax]
jne 0x14003f9c9
add rax, 2
mov qword [rsp + 0x50], rax
jmp 0x14003f9b2
cmp word [rax], 0xa
je 0x14003f9f9
cmp word [rax], r9w
je 0x14003f9f9
lea rdx, [rsp + 0x50]
lea rcx, str.__inline_main
mov r8d, r9d
call fcn.140050478
xor edx, edx
cmp eax, edx
jne 0x14003f9f6
mov rax, qword [rsp + 0x50]
jmp 0x14003f977
mov r13b, 1
cmp rbx, rdx
je 0x14003fa0d
cmp rbx, 0xffffffffffffffff
je 0x14003fa0d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x60]
call fcn.140050424
lea rcx, [rsp + 0x68]
call fcn.140050424
xor ebx, ebx
lea rcx, [r12 + 0x488]
cmp r13b, bl
je 0x14003fa70
mov r8, qword [rsp + 0x138]
lea rdx, str.LOAD_sysinit__s
call fcn.140014d04
lea eax, [rbx + 1]
xor r14d, r14d
lea rdx, [r12 + 0x488]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
mov byte [0x14010de64], al
mov qword [rsp + 0x20], r14
call fcn.1400409b4
jmp 0x14003fb2b
lea rdx, str.___exe:__s_____s_
mov r9, rsi
mov r8, r12
call fcn.140014d04
lea rcx, [r12 + 0x488]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, qword [rsp + 0x138]
lea rdx, str.LOAD_sysinit__s
movsxd rcx, eax
lea rcx, [r12 + rcx*2 + 0x488]
call fcn.140014d04
cmp word [r14], bx
je 0x14003fafb
mov ebx, 1
mov ecx, ebx
call fcn.140018acc
lea rax, [rsp + 0x148]
lea r9d, [rbx + 3]
lea r8, str.SysStartuped
lea rdx, str.SOFTWAREPELOGONRAMDATA
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x148], ebx
mov qword [rsp + 0x20], rax
call fcn.140051760
xor r14d, r14d
movsx eax, r15b
lea rdx, [r12 + 0x488]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov r8, rbp
mov rcx, rbp
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], eax
call fcn.14000c7c8
lea rcx, [rsp + 0x70]
call fcn.140050424
jmp 0x14003fb53
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x80]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
cmp eax, r14d
jne 0x14003fb37
mov rcx, qword [0x14010dd60]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
movsxd rax, dword [rsp + 0x90]
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret