Function at 0x14000b710
Capabilities:
Read file on windows
Terminate process

Disassembly:
push rbx
push rsi
push rdi
push r13
mov eax, 0x1068
call fcn.1400b0560
sub rsp, rax
mov rax, qword [0x14013b4f8]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov rsi, rcx
mov rdi, rdx
mov ecx, dword [0x1400b3ac8]
xor r13b, r13b
call fcn.140068070
mov ecx, dword [0x1400b3ac8]
call fcn.140061e90
xor ecx, ecx
mov rbx, rax
call fcn.140068060
test rbx, rbx
je 0x14000b76e
mov ecx, dword [rbx + 0xa4]
call fcn.140068060
mov qword [rsp + 0x10a0], rbp
xor r8d, r8d
mov qword [rsp + 0x1060], r12
mov edx, 0x83
mov qword [rsp + 0x1058], r14
mov rcx, rsi
mov qword [rsp + 0x1050], r15
call fcn.1400a8ea0
mov rdx, rsi
xor ecx, ecx
call fcn.140061ec0
mov rcx, rdi
call fcn.140009700
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.140009860
test al, al
je 0x14000b86b
mov rcx, rsi
call fcn.1400a9ac0
test al, al
jne 0x14000b7e2
mov rcx, rsi
call fcn.14000db10
test al, al
je 0x14000bbc4
mov rcx, rsi
mov bl, 1
call fcn.140069d00
cmp qword [0x14013c930], 0
je 0x14000bb9c
mov rdx, rsi
xor ecx, ecx
call fcn.140062560
lea r8, str.demo_server.example.com
xor edx, edx
mov rcx, rsi
call fcn.1400a9030
mov edx, 4
mov rcx, rsi
lea r8d, [rdx - 3]
call fcn.1400a8ea0
mov rcx, rsi
call fcn.1400a9b10
mov r15, qword [rsp + 0x1050]
mov r14, qword [rsp + 0x1058]
mov r12, qword [rsp + 0x1060]
mov rbp, qword [rsp + 0x10a0]
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400b0530
add rsp, 0x1068
pop r13
pop rdi
pop rsi
pop rbx
ret
mov rdx, rsi
mov rcx, rbx
call fcn.140009780
test al, al
jne 0x14000b7e2
cmp byte [rbx], r13b
je 0x14000bb0a
xor r9d, r9d
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400a93f0
xor ebp, ebp
cmp dword [rsp + 0x30], ebp
jle 0x14000bb0a
xor r14d, r14d
nop dword [rax + rax]
mov rax, qword [rsp + 0x38]
lea edi, [rbp + 1]
lea r15, [r14*8]
mov rbx, qword [r15 + rax]
cmp edi, dword [rsp + 0x30]
jge 0x14000b8d1
mov rdx, qword [r15 + rax + 8]
jmp 0x14000b8d3
xor edx, edx
mov r9, rsi
lea r12, [r14 + 1]
mov r8d, 1
mov rcx, rbx
call fcn.140068590
cmp eax, 0xfffffffe
jne 0x14000b8f9
lea rcx, str.option___s__requires_an_argument
jmp 0x14000baf3
cmp eax, 2
jne 0x14000b908
mov ebp, edi
mov r14, r12
jmp 0x14000bafb
cmp eax, 1
je 0x14000bafb
lea rdx, str._cleanup
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14000bb32
xor ecx, ecx
lea rdx, str._pgpfp
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x14000b957
cmp rcx, 7
jne 0x14000b931
xor ecx, ecx
call fcn.1400a92b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp byte [0x1400c163c], 0
je 0x14000b9bc
lea rdx, [0x1400b3818]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14000bb22
lea rdx, [0x1400b3828]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14000bb22
lea rdx, str._host_ca
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14000bb22
lea rdx, str.__host_ca
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14000bb22
lea rdx, str._demo_config_box
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x14000b9fe
cmp edi, dword [rsp + 0x30]
jl 0x14000b9e1
lea rcx, str._s_expects_an_output_filename
jmp 0x14000baf3
mov rax, qword [rsp + 0x38]
mov r13b, 1
mov ebp, edi
mov r14, r12
mov rcx, qword [rax + r12*8]
mov qword [0x14013d188], rcx
jmp 0x14000bafb
lea rdx, str._demo_terminal
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x14000bae0
lea ecx, [rbp + 2]
cmp ecx, dword [rsp + 0x30]
jl 0x14000ba2a
lea rcx, str._s_expects_input_and_output_filenames
jmp 0x14000baf3
mov rax, qword [rsp + 0x38]
lea rdx, [0x1400b38c8]
mov ebp, ecx
add r14, 2
mov rdi, qword [r15 + rax + 8]
mov rax, qword [r15 + rax + 0x10]
mov rcx, rdi
mov qword [0x14013c938], rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
test rax, rax
jne 0x14000ba6d
mov rdx, rdi
lea rcx, str.cant_open_input_file__s
call fcn.140007ca0
call fcn.1400a6c40
mov r9, rbx
mov qword [0x14013c930], rax
mov edx, 1
lea rcx, [rsp + 0x40]
mov r8d, 0x1000
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
test eax, eax
jle 0x14000bad5
nop word [rax + rax]
mov rcx, qword [0x14013c930]
lea rdx, [rsp + 0x40]
add rcx, 0x18
mov r8d, eax
call fcn.1400a2290
mov r9, rbx
lea rcx, [rsp + 0x40]
mov edx, 1
mov r8d, 0x1000
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
test eax, eax
jg 0x14000baa0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x14000bafb
cmp byte [rbx], 0x2d
lea rcx, str.unexpected_argument___s_
jne 0x14000baf3
lea rcx, str.unknown_option___s_
mov rdx, rbx
call fcn.140007ca0
inc ebp
inc r14
cmp ebp, dword [rsp + 0x30]
jl 0x14000b8b0
mov rcx, rsi
call fcn.140069d00
xor bl, bl
test r13b, r13b
jne 0x14000bbcc
jmp 0x14000b7ec
xor ecx, ecx
call fcn.14000e2f0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rdx, qword [str.l:_v_]
lea rcx, str.This_procedure_will_remove_ALL_Registry_entries_nassociated_with__s__and_will_also_remove_nthe_random_seed_file.__This_only_affects_the_ncurrently_logged_in_user.__n_nTHIS_PROCESS_WILL_DESTROY_YOUR_SAVED_SESSIONS._nAre_you_really_sure_you_want_to_continue_
call fcn.1400a6690
mov rdx, qword [str.l:_v_]
lea rcx, str._s_Warning
mov rbx, rax
call fcn.1400a6690
mov r9d, 0x134
mov dword [rsp + 0x20], 4
mov r8, rax
mov rdx, rbx
xor ecx, ecx
mov rdi, rax
call fcn.1400a92e0
cmp eax, 6
jne 0x14000bb83
call fcn.14006a3f0
mov rcx, rbx
call fcn.1400a62e0
mov rcx, rdi
call fcn.1400a62e0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
test bl, bl
jne 0x14000b826
mov rcx, rsi
call fcn.140068530
test al, al
jne 0x14000b826
mov rcx, rsi
call fcn.14000db10
test al, al
jne 0x14000b826
xor ecx, ecx
call fcn.140007ad0
int3
mov rdx, rsi
mov byte [0x14013dbc8], 1
xor ecx, ecx
call fcn.140062560
lea r8, str.demo_server.example.com
xor edx, edx
mov rcx, rsi
call fcn.1400a9030
mov rcx, rsi
call fcn.14000db10
xor ecx, ecx
call fcn.140007ad0
int3