Function at 0x180010024
Capabilities:
Accept command line arguments
Acquire debug privileges
Check os version

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rbx, rcx
xor r14d, r14d
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r14
movups xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x18002e2d0]
movdqu xmmword [rsp + 0x50], xmm1
mov word [rsp + 0x40], r14w
mov dword [rbp + 0x278], r14d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rbp + 0x278]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, 0x1000
lea edi, [r14 + 2]
cmp dword [rbp + 0x278], edi
je 0x1800101e1
test rbx, rbx
je 0x1800100d6
cmp qword [rbx], r14
je 0x1800100d6
cmp dword [rbx + 8], r14d
jbe 0x1800100d6
lea rdx, str.embedded_data
lea rcx, [rsp + 0x40]
call fcn.18000f5c4
mov r8d, dword [rbx + 8]
mov rdx, qword [rbx]
lea rcx, [rsp + 0x70]
call fcn.180001c38
jmp 0x1800103b2
mov r8b, r14b
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.1800020cc
nop
lea rax, [rbp - 8]
cmp qword [rbp + 0x10], 7
cmova rax, qword [rbp - 8]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 8]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.18000de54
mov r8b, r14b
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.180002114
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x48], xmm1
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 7
cmova rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
lea rcx, [rbp - 0x58]
call fcn.180001fe8
nop
lea rcx, [rbp - 0x28]
call fcn.18000df34
nop
lea rcx, [rbp - 8]
call fcn.18000df34
lea rax, str.Invalid_arguments._nUsage:___fumo_file__nTip:_you_can_drag_the_.fumo_file_on_the_loader_executable
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0x62
lea r8, [rbp - 0x58]
lea rdx, [rsp + 0x30]
mov ecx, 1
call fcn.18000b4c0
mov ebx, eax
mov esi, 0x1000
mov rdx, qword [rbp - 0x40]
cmp rdx, 7
jbe 0x1800105ff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, rsi
jb 0x1800101d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800101d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180027f28
jmp 0x1800105ff
lea rdx, [rax + 8]
mov r8b, r14b
lea rcx, [rbp - 0x78]
call fcn.1800020cc
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x48], xmm1
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 7
cmova rdx, qword [rbp - 0x78]
mov r8, qword [rbp - 0x68]
lea rcx, [rbp - 0x58]
call fcn.180001fe8
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x18001025d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, rsi
jb 0x180010258
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180010258
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180027f28
movdqa xmm0, xmmword [0x18002e2d0]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov ebx, 0x20
mov r8d, ebx
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 7
cmova rdx, qword [rbp - 0x78]
mov dword [rsp + 0x20], 1
lea r9d, [rbx + 0x20]
mov r8d, ebx
lea rcx, [rbp + 0x20]
call fcn.18000c218
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x20], rax
mov rax, qword [rbp + 0x20]
movsxd rdx, dword [rax + 4]
lea r8d, [rdx - 0xb0]
mov dword [rbp + rdx + 0x1c], r8d
cmp qword [rbp + 0xb0], r14
jne 0x1800102f0
lea rax, str.Failed_to_open_file:_
mov qword [rsp + 0x38], 0x17
jmp 0x18001036f
mov qword [rsp + 0x60], r14
mov word [rsp + 0x68], 1
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x20]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ios_char__struct_std::char_traits_char__::rdbuf_void_const___ptr64]
mov qword [rsp + 0x30], rax
test rax, rax
sete byte [rsp + 0x38]
mov byte [rsp + 0x39], r14b
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm1
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.180001cd4
mov rax, qword [rsp + 0x78]
sub rax, qword [rsp + 0x70]
cmp rax, 0x1020
jae 0x18001039f
lea rax, str.File_to_small:_
mov qword [rsp + 0x38], 0x11
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov ecx, edi
call fcn.18000b4c0
mov ebx, eax
lea rcx, [rbp + 0x20]
call fcn.18000d35c
nop
lea rcx, [rbp - 0x78]
call fcn.18000df34
jmp 0x1800105ff
lea rcx, [rbp + 0x20]
call fcn.18000d35c
nop
lea rcx, [rbp - 0x78]
call fcn.18000df34
mov rax, qword [rsp + 0x70]
cmp dword [rax], 0x4f4d5546
je 0x1800103ea
lea rax, str.Invalid_file_format:__nTip:_use_fumo_encoder_to_generate_a_.fumo_file
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0x46
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov ecx, edi
call fcn.18000b4c0
jmp 0x1800105fd
add rax, 4
cmp dword [rax], edi
je 0x18001042f
mov dword [rbp + 0x280], edi
lea rcx, str.Invalid_file_version__expected:___found:__:__nTip:_use_fumo_encoder_to_generate_a_.fumo_file
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0x61
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x280]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov ecx, edi
call fcn.18000b520
jmp 0x1800105fd
mov dword [rbp + 0x130], 0x114
lea rcx, [rbp + 0x130]
call qword [sym.imp.ntdll.dll_RtlGetVersion]
cmp dword [rbp + 0x134], 0xa
jb 0x1800105bf
cmp dword [rbp + 0x13c], 0x4a61
jb 0x1800105bf
call fcn.180011630
mov ebx, eax
test eax, eax
jne 0x1800105ff
call fcn.180011460
mov ebx, eax
test eax, eax
jne 0x1800105ff
lea rcx, str.SeDebugPrivilege
call fcn.180012588
test al, al
jne 0x1800104b8
lea rax, str.Failed_to_get_debug_privileges
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0x1e
lea rdx, [rsp + 0x30]
lea ecx, [rbx + 3]
call fcn.18000b3f4
jmp 0x1800105fd
lea rdx, [0x18002da98]
lea rcx, [rbp - 0x38]
call fcn.180027b10
nop
mov rcx, qword [rbp - 0x38]
test rcx, rcx
jne 0x1800104f8
lea rax, [0x18002daa8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0x15
lea rdx, [rsp + 0x30]
mov ecx, 0x65
call fcn.18000b3f4
jmp 0x18001056c
xor r8d, r8d
mov edx, dword [rbp + 0x13c]
call fcn.1800126dc
mov ebx, eax
test eax, eax
jne 0x180010589
lea rbx, str.explorer.exe
mov rcx, rbx
call fcn.18000f7f4
test eax, eax
jne 0x18001052d
lea rax, str.Failed_to_find_
mov ecx, 0x96
jmp 0x180010551
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x180010570
lea rax, str.Failed_to_open_
mov ecx, 0x97
lea rdx, [rsp + 0x30]
mov r8, rbx
mov qword [rsp + 0x38], 0x11
mov qword [rsp + 0x30], rax
call fcn.18000b590
mov ebx, eax
jmp 0x180010589
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.180012820
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdi, qword [rbp - 0x30]
test rdi, rdi
je 0x1800105ff
or eax, 0xffffffff
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x1800105ff
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
or eax, 0xffffffff
lock xadd dword [rdi + 0xc], eax
cmp eax, 1
jne 0x1800105ff
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
jmp 0x1800105ff
lea rax, str.Unsupported_OS_version:_..._nUpdate_windows_and_try_again
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0x3e
lea rax, [rbp + 0x13c]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x138]
lea r8, [rbp + 0x134]
lea rdx, [rsp + 0x30]
mov ecx, 0x32
call fcn.18000b450
mov ebx, eax
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x180010640
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, rsi
jb 0x18001063b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001063b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180027f28
movdqa xmm0, xmmword [0x18002e2d0]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x18001068e
mov rdx, qword [rbp - 0x80]
sub rdx, rcx
mov rax, rcx
cmp rdx, rsi
jb 0x180010689
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180010689
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180027f28
mov eax, ebx
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret