Function at 0x140067bc7
Capabilities:
Get geographical location
Get keyboard layout
Read file via mapping

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
mov r13d, r9d
mov rsi, r8
mov r14, rdx
mov r15, rcx
mov rax, qword [0x1400cb0e0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
call fcn.1400743fc
mov qword [0x1400ce020], r15
mov qword [0x1400ce028], 0
mov dword [0x1400ce030], 3
or byte [0x1400cbc44], 0x44
call fcn.140074a8c
call fcn.1400618b0
call fcn.140073d93
call fcn.14006604a
call fcn.14007445d
cmp dword [0x1400ce034], 4
jb 0x140067c4d
jne 0x140067c60
cmp dword [0x1400ce038], 2
je 0x140067c60
lea rcx, str.MSWHEEL_ROLLMSG
call qword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x1400cb0b8], eax
call fcn.140072ee6
lea rcx, str.user32.dll
call fcn.140074344
mov rbx, rax
lea rcx, str.winmm.dll
call fcn.140074344
mov rbp, rax
test rbx, rbx
je 0x140067cb0
lea rdx, str.FlashWindowEx
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
call rdi
mov qword [0x1400cdc08], rax
lea rdx, str.ToUnicodeEx
mov rcx, rbx
call rdi
jmp 0x140067cbd
mov qword [0x1400cdc08], 0
xor eax, eax
mov qword [0x1400ce000], rax
test rbp, rbp
je 0x140067cdb
lea rdx, str.PlaySoundA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x140067cdd
xor eax, eax
mov qword [0x1400cdbf8], rax
call fcn.14000312c
mov qword [0x1400ce040], rax
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
cmp eax, 2
jb 0x140067d5c
mov rdx, qword [0x14009e0b0]
lea rcx, str._s_Fatal_Error
call fcn.14005f835
mov rsi, rax
lea rdx, str.Failed_to_initialize_COM_subsystem
xor ecx, ecx
mov r9d, 0x30
mov r8, rax
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rsi
call fcn.140011913
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.14007de70
mov eax, 1
add rsp, 0xd8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, dword [0x14009e0b8]
mov dword [0x1400ce048], ecx
call fcn.14001da4d
mov dword [0x1400ce04c], 0
test rax, rax
je 0x140067d88
mov eax, dword [rax + 0x8c]
mov dword [0x1400ce04c], eax
mov rcx, qword [0x1400ce040]
mov edx, 0x7a
xor r8d, r8d
call fcn.140003b60
mov rdx, qword [0x1400ce040]
xor ecx, ecx
call fcn.140021d9a
mov bl, byte [rsi]
test bl, bl
je 0x140067dca
lea rbp, [rsi + 2]
movsx ecx, bl
call fcn.14008c9a4
test eax, eax
je 0x140067dfc
mov bl, byte [rbp - 1]
inc rbp
test bl, bl
jne 0x140067db4
mov rcx, qword [0x1400ce040]
call fcn.140003045
mov rcx, qword [0x1400ce040]
call fcn.1400030da
test al, al
jne 0x140067f67
call fcn.14006609a
test al, al
jne 0x140067f67
jmp 0x14006890c
lea rcx, [rbp - 2]
cmp bl, 0x26
jne 0x140067e33
cmp byte [rbp - 1], 0x52
jne 0x140067eb9
mov al, byte [rbp]
test al, al
je 0x140067e22
cmp al, 0x26
je 0x140067e22
cmp al, 0x40
jne 0x140067eb9
call fcn.140078c87
mov byte [0x1400ce050], 1
mov bl, byte [rbp]
jmp 0x140067e36
mov rbp, rcx
test bl, bl
je 0x140067dca
cmp bl, 0x26
je 0x140067eb6
cmp bl, 0x40
jne 0x140068809
mov rcx, rbp
call fcn.14008d450
movsxd rsi, eax
mov rcx, rax
shl rcx, 0x20
movabs rdi, 0xffffffff00000000
mov rbx, rcx
cmp rsi, 2
jl 0x140067e82
movsx ecx, byte [rbp + rsi - 1]
dec rsi
call fcn.14008c9a4
lea rcx, [rbx + rdi]
test eax, eax
jne 0x140067e64
sar rbx, 0x20
mov byte [rbp + rbx], 0
mov rdx, qword [0x1400ce040]
inc rbp
mov rcx, rbp
call fcn.140021d9a
mov rcx, qword [0x1400ce040]
call fcn.1400146c1
test al, al
je 0x140067f4e
jmp 0x140067f5b
mov rcx, rbp
inc rcx
lea rdx, [0x1400afd3e]
lea r8, [rsp + 0x68]
lea r9, [rsp + 0x7c]
call fcn.14001c050
cmp eax, 2
jne 0x140067f4e
mov eax, dword [rsp + 0x7c]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x140067f4e
mov rsi, rax
mov eax, dword [rsp + 0x7c]
lea rdx, [rsp + 0x80]
mov qword [rdx], rsi
mov qword [rdx + 0x10], rax
mov qword [rdx + 8], 0
mov dword [rdx + 0x18], 0
mov qword [rdx + 0x20], rdx
mov rcx, qword [0x1400ce040]
call fcn.140004150
test al, al
je 0x140068939
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140067f5b
call fcn.14006609a
test al, al
je 0x14006890c
mov rcx, qword [0x1400ce040]
call fcn.140003045
mov rcx, qword [0x1400ce040]
call fcn.14001d934
test r14, r14
jne 0x140067fe4
lea rsi, [rsp + 0x80]
mov dword [rsi], 0
lea rax, [0x140068aa8]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], r15
mov edx, 0xc8
mov rcx, r15
call qword [sym.imp.USER32.dll_LoadIconA]
mov qword [rsi + 0x20], rax
xor ecx, ecx
mov edx, 0x7f01
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rsi + 0x28], rax
xorps xmm0, xmm0
movups xmmword [rsi + 0x30], xmm0
mov r8, qword [0x14009e0b0]
xor ecx, ecx
xor edx, edx
call fcn.140014acb
mov qword [rsi + 0x40], rax
mov rcx, rsi
call qword [sym.imp.USER32.dll_RegisterClassW]
lea rcx, [0x1400cc958]
xor edi, edi
xor edx, edx
mov r8d, 0xb18
call fcn.14007f3a0
mov rcx, qword [0x1400ce040]
mov edx, 0x66
call fcn.140003415
mov dword [0x1400ce054], eax
mov rcx, qword [0x1400ce040]
mov edx, 0x9d
call fcn.140003415
mov dword [0x1400ce058], eax
call fcn.14006c310
mov dword [0x1400cd470], 0xa
mov dword [0x1400cd474], 0x14
mov dword [0x1400cd478], 0x19
mov dword [0x1400cd47c], 0x1c
mov rcx, qword [0x1400ce040]
mov edx, 0x75
call fcn.140003415
lea eax, [rax + rax*4]
lea r12d, [rax + rax]
add r12d, 0x19
mov ebx, dword [0x1400cd47c]
mov ebp, dword [0x1400cd474]
mov rcx, qword [0x1400ce040]
mov edx, 0x76
call fcn.140003415
mov esi, eax
imul esi, ebp
add esi, ebx
mov rbx, qword [0x1400ce028]
call fcn.140067868
test eax, eax
mov dword [rsp + 0x64], r13d
je 0x1400680bd
mov edx, 2
mov rcx, rbx
call qword [0x1400cc918]
mov rcx, rax
jmp 0x1400680c2
mov ecx, 0x12340042
lea rbx, [rsp + 0x80]
mov dword [rbx], 0x28
mov rdx, rbx
call fcn.140067a94
mov r14d, dword [rbx + 0xc]
mov ebp, dword [rbx + 0x10]
sub r14d, dword [rbx + 4]
sub ebp, dword [rbx + 8]
cmp r12d, r14d
cmovle r14d, r12d
cmp esi, ebp
cmovle ebp, esi
mov r8, qword [0x14009e0b0]
xor ecx, ecx
xor edx, edx
call fcn.140014acb
mov r12, rax
mov rcx, qword [0x1400ce040]
mov edx, 0x6f
call fcn.14000335e
movzx ebx, al
shl ebx, 0x15
or ebx, 0xcf0000
mov rcx, qword [0x1400ce040]
mov edx, 0x71
call fcn.140003415
mov esi, ebx
and esi, 0xea0000
cmp eax, 1
cmovne esi, ebx
mov rcx, qword [0x1400ce040]
mov edx, 0x58
call fcn.14000335e
movzx ebx, al
lea r13d, [rbx*8]
mov rcx, qword [0x1400ce040]
mov edx, 0x81
call fcn.14000335e
lea ecx, [rbx*8 + 0x200]
test al, al
cmove ecx, r13d
mov qword [rsp + 0x50], r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], r14d
mov eax, 0x80000000
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x58], 0
mov rdx, r12
mov r8, r12
mov r9d, esi
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [0x1400ce028], rax
mov rcx, r12
call fcn.140011913
xor ecx, ecx
xor edx, edx
call fcn.14006c46b
lea rax, [0x1400a7bf0]
mov qword [0x1400cc950], rax
lea r8, [0x1400cc950]
mov rcx, qword [0x1400ce040]
lea rdx, [0x1400cc958]
call fcn.1400534dd
mov qword [0x1400ce018], rax
mov rdx, qword [0x1400ce040]
mov rcx, rax
call fcn.14006cb1b
mov rdx, qword [0x1400ce040]
lea rcx, str._y_n_
call fcn.1400102ce
mov qword [0x1400ce060], rax
mov rcx, qword [0x1400ce018]
mov rdx, rax
call fcn.14005a868
mov rcx, qword [0x1400ce040]
mov edx, 0x62
call fcn.140003415
mov esi, eax
mov rcx, qword [0x1400ce040]
mov edx, 0x75
call fcn.140003415
mov ebx, eax
mov rcx, qword [0x1400ce040]
mov edx, 0x76
call fcn.140003415
mov rcx, qword [0x1400ce018]
mov edx, eax
mov r8d, ebx
mov r9d, esi
call fcn.1400536cb
mov rcx, qword [0x1400ce028]
lea rbx, [rsp + 0x68]
mov rdx, rbx
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rcx, qword [0x1400ce028]
lea rsi, [rsp + 0x80]
mov rdx, rsi
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [0x1400ce040]
mov edx, 0x82
call fcn.140003415
mov dword [0x1400cd480], eax
mov dword [0x1400cd484], eax
add eax, eax
mov ecx, dword [rbx + 8]
add ecx, eax
sub ecx, dword [rbx]
sub ecx, dword [rsi + 8]
add ecx, dword [rsi]
add eax, dword [rbx + 0xc]
sub eax, dword [rbx + 4]
sub eax, dword [rsi + 0xc]
add eax, dword [rsi + 4]
mov dword [0x1400cd478], ecx
mov dword [0x1400cd47c], eax
mov rdx, qword [0x1400ce018]
mov ebp, dword [rdx + 0x174]
mov edx, dword [rdx + 0x178]
imul edx, dword [0x1400cd470]
add edx, ecx
imul ebp, dword [0x1400cd474]
add ebp, eax
mov rcx, qword [0x1400ce028]
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], edx
mov dword [rsp + 0x30], 0xe
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [0x1400cd470]
lea ecx, [rax + 0xf]
sar ecx, 0x1f
shr ecx, 0x1c
lea eax, [rax + rcx]
add eax, 0xf
sar eax, 4
imul eax, dword [0x1400cd474]
add eax, eax
movsxd rbp, eax
mov edx, 1
xor r8d, r8d
mov rcx, rbp
call fcn.140011888
mov rbx, rax
xor edx, edx
mov rcx, rax
mov r8, rbp
call fcn.14007f3a0
mov edx, dword [0x1400cd474]
mov ecx, dword [0x1400cd470]
mov qword [rsp + 0x20], rbx
mov r8d, 1
mov r9d, 1
call qword [sym.imp.GDI32.dll_CreateBitmap]
mov qword [0x1400cd488], rax
mov rcx, rbx
call fcn.140011913
mov r9d, dword [0x1400cd474]
mov r8d, dword [0x1400cd470]
mov rdx, qword [0x1400cd488]
mov rcx, qword [0x1400ce028]
call qword [sym.imp.USER32.dll_CreateCaret]
movabs rax, 0x1f0000001c
mov qword [rsi], rax
mov dword [rsi + 8], edi
mov rax, qword [0x1400ce018]
mov eax, dword [rax + 0x174]
lea ecx, [rax - 1]
mov dword [rsi + 0xc], ecx
mov dword [rsi + 0x10], eax
mov dword [rsi + 0x14], edi
mov rcx, qword [0x1400ce028]
lea r8, [rsp + 0x80]
mov edx, 1
xor r9d, r9d
call qword [sym.imp.USER32.dll_SetScrollInfo]
mov dword [0x1400cd490], edi
mov dword [0x1400cd494], edi
call qword [sym.imp.USER32.dll_GetDoubleClickTime]
mov dword [0x1400cd498], eax
mov rcx, qword [0x1400ce028]
xor edx, edx
call qword [sym.imp.USER32.dll_GetSystemMenu]
mov qword [0x1400cd4a0], rax
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov qword [0x1400cd4a8], rax
lea r9, [0x1400af5d1]
mov rsi, qword [sym.imp.USER32.dll_AppendMenuA]
xor edx, edx
mov r8d, 0x190
mov rcx, rax
call rsi
mov rcx, qword [0x1400cd4a8]
lea r9, str.Paste
xor edx, edx
mov r8d, 0x1a0
call rsi
call qword [sym.imp.USER32.dll_CreateMenu]
mov qword [0x1400cd4b0], rax
lea rcx, [0x1400cd4b8]
mov dl, 1
call fcn.140021d9f
call fcn.14006cba9
lea r14, str.Clear_Scrollback
lea r15, str.Reset_Terminal
lea r12, str.Full_Screen
lea r13, str.About__s
lea rax, [0x1400cd4a0]
mov rbp, qword [rdi + rax]
mov edx, 0x800
xor r8d, r8d
xor r9d, r9d
mov rcx, rbp
call rsi
xor edx, edx
mov r8d, 0x10
mov rcx, rbp
lea r9, str.Event_Log
call rsi
mov edx, 0x800
xor r8d, r8d
xor r9d, r9d
mov rcx, rbp
call rsi
xor edx, edx
mov r8d, 0x20
mov rcx, rbp
lea r9, str.New_Session...
call rsi
xor edx, edx
mov r8d, 0x30
mov rcx, rbp
lea r9, str.Duplicate_Session
call rsi
mov r8, qword [0x1400cd4b0]
mov edx, 0x10
mov rcx, rbp
lea r9, str.Saved_Sessions
call rsi
xor edx, edx
mov r8d, 0x50
mov rcx, rbp
lea r9, str.Change_Settings...
call rsi
mov edx, 0x800
xor r8d, r8d
xor r9d, r9d
mov rcx, rbp
call rsi
xor edx, edx
mov r8d, 0x170
mov rcx, rbp
lea r9, str.Copy_All_to_Clipboard
call rsi
xor edx, edx
mov r8d, 0x60
mov rcx, rbp
mov r9, r14
call rsi
xor edx, edx
mov r8d, 0x70
mov rcx, rbp
mov r9, r15
call rsi
mov edx, 0x800
xor r8d, r8d
xor r9d, r9d
mov rcx, rbp
call rsi
mov rcx, qword [0x1400ce040]
mov edx, 0x71
call fcn.140003415
xor edx, edx
cmp eax, 1
sete dl
mov r8d, 0x180
mov rcx, rbp
mov r9, r12
call rsi
mov edx, 0x800
xor r8d, r8d
xor r9d, r9d
mov rcx, rbp
call rsi
call fcn.14007308a
test al, al
je 0x1400685fd
xor edx, edx
mov r8d, 0x140
mov rcx, rbp
lea r9, str.Help
call rsi
mov rcx, r13
mov rdx, qword [0x14009e0b0]
call fcn.14005f835
mov rbx, rax
xor edx, edx
mov r8d, 0x150
mov rcx, rbp
mov r9, rax
call rsi
mov rcx, rbx
call fcn.140011913
add rdi, 8
cmp rdi, 0x10
jne 0x1400684c2
cmp byte [0x1400ce050], 0
je 0x140068655
mov rax, qword [str._y_n_]
lea rcx, str._y_n_
lea rdx, str.Running_with_restricted_process_ACL
call qword [rax]
call fcn.14006cc56
xor edi, edi
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, ax
lea rsi, [rsp + 0x80]
mov edx, 0x1004
mov r9d, 0x14
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov rcx, rsi
call fcn.14008ad18
mov dword [0x1400cdfa4], eax
mov rcx, qword [0x1400ce028]
mov edx, dword [rsp + 0x64]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400ce028]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov qword [0x1400cd4d0], rdi
mov qword [0x1400cd4d8], rdi
call fcn.14006cede
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, qword [0x1400ce028]
sete dl
mov rcx, qword [0x1400ce018]
call fcn.14005a870
mov rcx, qword [0x1400ce028]
call qword [sym.imp.USER32.dll_UpdateWindow]
lea r15, [rsp + 0x68]
mov rdi, qword [sym.imp.USER32.dll_PeekMessageW]
mov rbx, qword [sym.imp.USER32.dll_IsWindow]
mov r13, qword [sym.imp.USER32.dll_DispatchMessageW]
mov r14, qword [sym.imp.USER32.dll_IsDialogMessageA]
call fcn.14000191c
mov r12d, 0
test al, al
jne 0x14006875d
mov dword [rsp + 0x20], 0
xor r12d, r12d
xor edx, edx
xor r8d, r8d
xor r9d, r9d
mov rcx, rsi
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x14006875d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, qword [0x1400ce028]
sete dl
mov rcx, qword [0x1400ce018]
call fcn.14005a870
mov r12d, 0xffffffff
mov rcx, r15
call fcn.140072b06
mov rbp, rax
mov ecx, dword [rsp + 0x68]
mov dword [rsp + 0x20], 0x1cff
xor r8d, r8d
mov rdx, rax
mov r9d, r12d
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, dword [rsp + 0x68]
jae 0x140068795
mov eax, eax
mov rcx, qword [rbp + rax*8]
call fcn.140072c85
mov rcx, rbp
call fcn.140011913
mov dword [rsp + 0x20], 1
xor edx, edx
xor r8d, r8d
xor r9d, r9d
mov rcx, rsi
call rdi
test eax, eax
je 0x1400687f1
cmp dword [rsp + 0x88], 0x12
je 0x1400687fb
mov rcx, qword [0x1400ce068]
call rbx
test eax, eax
je 0x1400687de
mov rcx, qword [0x1400ce068]
mov rdx, rsi
call r14
test eax, eax
jne 0x1400687e4
mov rcx, rsi
call r13
cmp dword [rsp + 0x88], 0x8005
je 0x14006879d
call fcn.1400018c2
jmp 0x14006870c
mov ecx, dword [rsp + 0x90]
call fcn.140068966
ud2
xor edi, edi
lea rbx, [rsp + 0x68]
lea r8, [rsp + 0x80]
xor r9d, r9d
mov rcx, rsi
mov rdx, rbx
call fcn.14007c146
mov eax, dword [rbx]
test eax, eax
jle 0x140067dca
mov rcx, qword [rsp + 0x80]
movsxd rbx, edi
mov rsi, qword [rcx + rbx*8]
mov r9, qword [0x1400ce040]
inc ebx
cmp ebx, eax
jge 0x140068855
movsxd rax, ebx
mov rdx, qword [rcx + rax*8]
jmp 0x140068857
xor edx, edx
mov r8d, 1
mov rcx, rsi
call fcn.1400019b0
cmp eax, 1
je 0x140068874
cmp eax, 2
jne 0x140068883
add edi, 2
mov ebx, edi
mov eax, dword [rsp + 0x68]
mov edi, ebx
cmp ebx, eax
jl 0x140068830
jmp 0x140067dca
cmp eax, 0xfffffffe
jne 0x140068894
lea rcx, str.option___s__requires_an_argument
jmp 0x14006895c
lea rdx, [0x1400b30f6]
mov rcx, rsi
call fcn.14008d170
test eax, eax
jne 0x140068915
mov rdi, qword [0x14009e0b0]
lea rcx, str.This_procedure_will_remove_ALL_Registry_entries_nassociated_with__s__and_will_also_remove_nthe_random_seed_file.__This_only_affects_the_ncurrently_logged_in_user.__n_nTHIS_PROCESS_WILL_DESTROY_YOUR_SAVED_SESSIONS._nAre_you_really_sure_you_want_to_continue_
mov rdx, rdi
call fcn.14005f835
mov rsi, rax
lea rcx, str._s_Warning
mov rdx, rdi
call fcn.14005f835
mov rdi, rax
mov r8d, 0x134
mov r9d, 4
mov rcx, rsi
mov rdx, rax
call fcn.14007bf83
cmp eax, 6
jne 0x1400688f3
call fcn.14007ac2b
mov rcx, rsi
call fcn.140011913
mov rcx, rdi
call fcn.140011913
xor ecx, ecx
call fcn.140088100
ud2
xor ecx, ecx
call fcn.140068966
ud2
lea rdx, str._pgpfp
mov rcx, rsi
call fcn.14008d170
test eax, eax
jne 0x140068947
call fcn.14007c086
mov ecx, 1
call fcn.140088100
ud2
lea rcx, str.Serialised_configuration_data_was_invalid
call fcn.1400689c4
ud2
cmp byte [rsi], 0x2d
jne 0x140068955
lea rcx, str.unknown_option___s_
jmp 0x14006895c
lea rcx, str.unexpected_argument___s_
mov rdx, rsi
call fcn.140068a35
ud2