Function at 0x1400014a0
Capabilities:
Access peb ldr_data

Disassembly:
push rdi
sub rsp, 0x270
movzx eax, byte [rcx]
mov rdi, rcx
movzx edx, byte [rcx + 1]
cmp al, dl
jne 0x1400014bc
cmp dl, 0x5c
je 0x1400014db
or al, 0x20
sub al, 0x61
cmp al, 0x19
ja 0x140001719
cmp dl, 0x3a
jne 0x140001719
cmp byte [rcx + 2], 0x5c
jne 0x140001719
mov qword [rsp + 0x288], rbx
mov ecx, 1
mov qword [rsp + 0x290], rbp
mov qword [rsp + 0x298], rsi
mov qword [rsp + 0x268], r14
mov qword [rsp + 0x260], r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.ENT_BASE
call fcn.140001450
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, [0x14000724c]
call fcn.140001450
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword gs:[0x60]
lea r15, str.SSPICLI.DLL
mov edx, 0x5c
mov rcx, r15
mov r14, qword [rax + 0x18]
add r14, 0x10
mov rbx, qword [r14]
call fcn.140002d38
xor esi, esi
test rax, rax
mov ebp, esi
setne bpl
mov rcx, r15
test ebp, ebp
je 0x140001582
mov rdx, qword [rbx + 0x50]
jmp 0x140001586
mov rdx, qword [rbx + 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140001615
mov rbx, qword [rbx]
cmp rbx, r14
jne 0x140001575
xor edx, edx
lea rcx, str.ntdll.dll
call fcn.140001330
mov rcx, rax
mov edx, 0xa301ecda
call fcn.1400011d0
mov rbx, rax
test rax, rax
je 0x140001619
mov edx, 0x104
mov dword [rsp + 0x24], esi
mov rcx, r15
mov qword [rsp + 0x28], r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
lea r9, [rsp + 0x280]
mov qword [rsp + 0x280], rsi
add ax, ax
lea r8, [rsp + 0x20]
mov word [rsp + 0x20], ax
xor edx, edx
add ax, 2
xor ecx, ecx
mov word [rsp + 0x22], ax
call rbx
mov rcx, qword [rsp + 0x280]
test eax, eax
cmovs rcx, rsi
mov rsi, rcx
jmp 0x140001619
mov rsi, qword [rbx + 0x30]
mov edx, 0x9b08696
mov rcx, rsi
call fcn.1400011d0
mov r15, qword [rsp + 0x260]
mov rbx, rax
mov r14, qword [rsp + 0x268]
mov rsi, qword [rsp + 0x298]
mov rbp, qword [rsp + 0x290]
test rax, rax
je 0x140001703
mov r8d, 0x104
lea rcx, [rsp + 0x50]
mov rdx, rdi
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs]
xorps xmm0, xmm0
lea rdx, [rsp + 0x30]
xor eax, eax
lea rcx, [rsp + 0x50]
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
call rbx
mov ebx, eax
mov ecx, 1
cmp eax, 0x80090305
jne 0x1400016d1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Done__status:_SEC_E_SECPKG_NOT_FOUND__this_is_normal_if_DllMain_returns_FALSE
call fcn.140001450
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, [0x14000724c]
call fcn.140001450
mov rbx, qword [rsp + 0x288]
xor eax, eax
add rsp, 0x270
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, ebx
lea rdx, str.Done__status:_0x_lx
mov rcx, rax
call fcn.140001450
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, [0x14000724c]
call fcn.140001450
mov rbx, qword [rsp + 0x288]
mov eax, 1
add rsp, 0x270
pop rdi
ret
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rdi
lea rdx, str.You_must_provide_a_full_path:__s
mov rcx, rax
call fcn.140001450
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, [0x14000724c]
call fcn.140001450
mov eax, 1
add rsp, 0x270
pop rdi
ret