Function at 0x540200
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a8a43
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x5f300c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x94]
mov edx, dword [ebp + 8]
test esi, esi
mov dword [ebp - 0x80], 0
mov byte [ebp - 0x7a], 0
sete byte [ebp - 0x79]
call fcn.0052bfa0
mov dword [ebp - 4], 0
mov eax, 0x2aaaaaab
mov ecx, dword [ebp - 0x90]
sub ecx, dword [ebp - 0x94]
imul ecx
mov dword [ebp - 0x84], 0
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x5407a8
xor edi, edi
mov dword [ebp - 0x98], edi
mov edi, edi
add edi, dword [ebp - 0x94]
cmp dword [edi + 0x14], 8
jb 0x54029e
mov edi, dword [edi]
movzx eax, word [edi]
cmp eax, 0x2d
je 0x5403bb
cmp eax, 0x2f
je 0x5403bb
test esi, esi
je 0x540aeb
cmp byte [ebx + 0xbd8], 0
mov byte [ebp - 0x79], 1
jne 0x54034d
mov ecx, ebx
call fcn.005432a0
push 0
push 0x5d3038
lea ecx, [ebx + 0xb0c]
call fcn.00528190
test eax, eax
je 0x5402f0
mov ecx, ebx
call fcn.00543840
push 0
push 0x5d3030
lea ecx, [ebx + 0xb0c]
call fcn.00528190
test eax, eax
je 0x54034d
push 0
push 0x5d2fd4
lea ecx, [ebx + 0xb0c]
call fcn.00528190
test eax, eax
je 0x54034d
push 0x5d2fbc
lea ecx, [ebx + 0xb0c]
call fcn.00527310
test al, al
je 0x54034d
push 0
push str.save.session.advanced
lea ecx, [ebx + 0xb0c]
call fcn.00528190
test eax, eax
je 0x54034d
mov ecx, ebx
call fcn.00543f20
mov eax, dword [ebx]
mov ecx, ebx
push edi
mov eax, dword [eax + 0x7c]
call eax
test al, al
jne 0x540764
mov ecx, edi
mov dword [ebp - 0x60], vtable.FilePath.0
xor eax, eax
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 7
mov word [ebp - 0x5c], ax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x540380
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x5c]
call fcn.0040acf0
push 0x18
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 0xd
push eax
mov ecx, ebx
call fcn.0054e6b0
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0
call fcn.0040ab30
jmp 0x540764
movzx eax, word [edi + 2]
add edi, 2
test ax, ax
je 0x54074e
cmp eax, 0x2d
jne 0x540550
cmp word [edi + 2], 0
je 0x54074e
mov ecx, edi
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
jmp 0x540400
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x540400
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.0040acf0
or dword [ebp - 0x80], 1
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
jb 0x540429
mov ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x18], 4
jne 0x54047d
push 4
mov edx, str.grep
call fcn.00436670
add esp, 4
test eax, eax
jne 0x54047d
mov ecx, dword [ebp - 0x90]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x94]
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, dword [ebp - 0x84]
cmp eax, 4
jb 0x54047d
mov eax, dword [ebp - 0x98]
mov byte [ebp - 0x7b], 1
cmp dword [eax + esi + 0x28], 4
jae 0x540481
mov byte [ebp - 0x7b], 0
and dword [ebp - 0x80], 0xfffffffe
lea ecx, [ebp - 0x28]
call fcn.0040ab30
cmp byte [ebp - 0x7b], 0
jne 0x54090b
movzx eax, word [edi]
mov esi, edi
mov edx, eax
test ax, ax
je 0x5404d7
cmp ax, 0x2e
je 0x5404c7
cmp ax, 0x61
jb 0x5404b5
cmp ax, 0x7a
jbe 0x5404c7
movzx edx, ax
cmp ax, 0x41
jb 0x5404d7
movzx edx, ax
cmp ax, 0x5a
ja 0x5404d7
movzx ecx, word [esi + 2]
add esi, 2
mov eax, ecx
mov edx, ecx
test cx, cx
jne 0x5404a3
cmp dx, 0x3a
jne 0x54068d
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5404e6
sub ecx, edx
sar ecx, 1
cmp ecx, 5
jb 0x540510
push str.open:
lea eax, [edi + 0xa]
push eax
push edi
call fcn.0055cea0
add esp, 0xc
test al, al
jne 0x54053f
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x540515
sub ecx, edx
sar ecx, 1
cmp ecx, 0xc
jb 0x54058c
push str.loadsession:
lea eax, [edi + 0x18]
push eax
push edi
call fcn.0055cea0
add esp, 0xc
test al, al
je 0x54058c
cmp dword [ebp + 0xc], 0
je 0x540aeb
mov al, 1
mov byte [ebp - 0x79], al
jmp 0x54058f
cmp eax, 0x40
jne 0x54056a
cmp esi, 1
jne 0x540764
mov ecx, ebx
call fcn.00551a70
jmp 0x540764
cmp eax, 0x70
je 0x540578
cmp eax, 0x50
jne 0x5403df
cmp word [edi + 2], 0
jne 0x5403df
mov byte [ebp - 0x7a], 1
jmp 0x540764
mov al, byte [ebp - 0x79]
test al, al
je 0x540764
push edi
lea ecx, [ebp - 0x78]
call fcn.00519f70
lea edx, [ebp - 0x78]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x28]
call fcn.00560610
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 8
call fcn.0040ab30
mov eax, dword [ebp - 0x18]
push ecx
inc eax
lea ecx, [ebp - 0x34]
push eax
call fcn.0040a750
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp esi, 0x10
jb 0x5405dd
mov ecx, edx
add ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x28]
cmp esi, 0x10
jb 0x5405ea
mov eax, edx
mov esi, dword [ebp - 0x34]
sub ecx, eax
push ecx
push eax
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov ecx, ebx
push esi
call fcn.0053f040
mov byte [ebp - 4], 8
test esi, esi
je 0x54064c
mov ecx, dword [ebp - 0x2c]
mov eax, esi
sub ecx, esi
cmp ecx, 0x1000
jb 0x54062d
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x540adb
push ecx
push esi
call fcn.0059e222
add esp, 8
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x540764
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x54067e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x540adb
push edx
push ecx
call fcn.0059e222
add esp, 8
jmp 0x540764
cmp byte [ebp - 0x79], 0
je 0x540764
lea ecx, [ebp - 0x60]
call fcn.00518d30
mov dword [ebp - 0x88], eax
push edi
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0xa
call fcn.00519f70
lea edx, [ebp - 0x78]
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x28]
call fcn.00560610
mov edx, eax
mov byte [ebp - 4], 0xc
cmp dword [edx + 0x14], 0x10
jb 0x5406cf
mov edx, dword [edx]
push 0
push 0
lea eax, [ebx + 0x444]
push eax
push dword [ebp - 0x88]
lea ecx, [ebx + 0xb0c]
push 0
push edx
call fcn.005284d0
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x540726
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x54071c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x540adb
push edx
push ecx
call fcn.0059e222
add esp, 8
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.0040ab30
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0
call fcn.0040ab30
jmp 0x540764
cmp esi, 1
jne 0x540764
cmp eax, 0x2d
mov ecx, ebx
sete al
movzx eax, al
push eax
call fcn.005516c0
mov ecx, dword [ebp - 0x90]
mov eax, 0x2aaaaaab
sub ecx, dword [ebp - 0x94]
mov esi, dword [ebp - 0x84]
mov edi, dword [ebp - 0x98]
inc esi
imul ecx
add edi, 0x18
mov dword [ebp - 0x84], esi
sar edx, 2
mov eax, edx
mov dword [ebp - 0x98], edi
shr eax, 0x1f
add eax, edx
cmp esi, eax
mov esi, dword [ebp + 0xc]
jb 0x540290
cmp esi, 1
jne 0x540aeb
cmp byte [ebx + 0xbd8], 0
jne 0x540811
mov ecx, ebx
call fcn.005432a0
push 0
push 0x5d2fe4
lea ecx, [ebx + 0xb0c]
call fcn.00528190
test eax, eax
je 0x5407de
mov ecx, ebx
call fcn.00543840
push 0
push 0x5d3084
lea ecx, [ebx + 0xb0c]
call fcn.00528190
test eax, eax
je 0x540811
push 0
push 0x5d3074
lea ecx, [ebx + 0xb0c]
call fcn.00528190
test eax, eax
je 0x540811
mov ecx, ebx
call fcn.00543f20
mov esi, dword [ebx + 0x26c]
lea edx, [ebx + 0x258]
mov eax, dword [edx + 0x10]
mov ecx, edx
cmp esi, 8
jb 0x540829
mov ecx, dword [edx]
test eax, eax
je 0x540869
dec eax
cmp eax, 0xffffffff
jb 0x540836
or eax, 0xffffffff
cmp word [ecx + eax*2], 0x5c
lea eax, [ecx + eax*2]
je 0x54084d
cmp eax, ecx
je 0x540869
sub eax, 2
cmp word [eax], 0x5c
jne 0x540840
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
je 0x540869
cmp esi, 8
jb 0x54085d
mov edx, dword [edx]
cmp word [edx + eax*2 + 2], 0
jne 0x540aeb
cmp dword [ebx + 0xbd0], 1
jne 0x540aeb
mov eax, dword [ebx + 0xbc4]
cmp byte [eax + 0x2c], 0
jne 0x540aeb
xor eax, eax
mov dword [ebp - 0x60], vtable.FilePath.0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 7
mov word [ebp - 0x5c], ax
push eax
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 0xe
push eax
mov ecx, ebx
call fcn.0054e6b0
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0
call fcn.0040ab30
push 0x5d3094
lea eax, [ebp - 0x40]
lea ecx, [ebx + 0xb0c]
push eax
call fcn.00528070
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x40]
mov edi, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x40]
cmp edi, 0x10
jb 0x5408e5
mov ecx, esi
mov edx, dword [ebp - 0x30]
push 4
push 0x5d308c
call fcn.00436600
add esp, 8
test al, al
je 0x540a35
push 0
push 0x9a
jmp 0x540aae
mov edi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x94]
lea ecx, [edi + 1]
lea ecx, [ecx + ecx*2]
mov edx, dword [eax + ecx*8 + 0x14]
lea ecx, [eax + ecx*8]
mov esi, ecx
cmp edx, 8
jb 0x54092d
mov esi, dword [ecx]
xor eax, eax
cmp word [esi], 0x77
mov esi, ecx
sete al
add eax, 4
mov dword [ebp - 0x80], eax
cmp edx, 8
jb 0x540945
mov esi, dword [ecx]
cmp word [esi + 2], 0x63
jne 0x540952
or eax, 2
mov dword [ebp - 0x80], eax
mov esi, ecx
cmp edx, 8
jb 0x54095b
mov esi, dword [ecx]
cmp word [esi + 4], 0x64
jne 0x540968
or eax, 8
mov dword [ebp - 0x80], eax
cmp edx, 8
jb 0x54096f
mov ecx, dword [ecx]
cmp word [ecx + 6], 0x62
jne 0x54097c
or eax, 0x10
mov dword [ebp - 0x80], eax
lea eax, [edi + 3]
push eax
lea ecx, [ebp - 0x94]
call fcn.00450100
mov ecx, eax
call fcn.0040a800
push eax
lea ecx, [ebp - 0x78]
call fcn.00519f70
lea edx, [ebp - 0x78]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00560610
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 3
call fcn.0040a810
lea ecx, [ebp - 0x28]
call fcn.004145f0
mov edx, eax
lea ecx, [ebp - 0x5c]
call fcn.0055cab0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x88], 0
call fcn.004145f0
mov ecx, dword [ebp - 0x84]
mov edi, eax
add ecx, 2
push ecx
lea ecx, [ebp - 0x94]
call fcn.00450100
mov ecx, eax
call fcn.0040a800
lea ecx, [ebp - 0x44]
mov esi, eax
call fcn.00518d30
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.00518440
lea ecx, [ebp - 0x88]
push ecx
push edi
push esi
push eax
push dword [ebp - 0x80]
mov ecx, ebx
call fcn.00552a10
lea ecx, [ebp - 0x44]
call fcn.0050f910
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
lea ecx, [ebp - 0x40]
cmp edi, 0x10
jb 0x540a3f
mov ecx, esi
mov edx, dword [ebp - 0x30]
push 7
push 0x5d304c
call fcn.00436600
add esp, 8
test al, al
je 0x540a5e
push 0
push 0x99
jmp 0x540aae
lea ecx, [ebp - 0x40]
cmp edi, 0x10
jb 0x540a68
mov ecx, esi
mov edx, dword [ebp - 0x30]
push 7
push 0x5d3044
call fcn.00436600
add esp, 8
test al, al
je 0x540a87
push 0
push 0x98
jmp 0x540aae
lea ecx, [ebp - 0x40]
cmp edi, 0x10
jb 0x540a91
mov ecx, esi
mov edx, dword [ebp - 0x30]
push 7
push str.UTF16BE
call fcn.00436600
add esp, 8
test al, al
je 0x540abb
push 0
push 0x97
mov ecx, ebx
call fcn.00539b00
mov esi, dword [ebp - 0x40]
mov edi, dword [ebp - 0x2c]
cmp edi, 0x10
jb 0x540aeb
inc edi
mov eax, esi
cmp edi, 0x1000
jb 0x540ae1
mov esi, dword [esi - 4]
add edi, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x540ae1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edi
push esi
call fcn.0059e222
add esp, 8
lea ecx, [ebp - 0x94]
call fcn.005416e0
mov al, byte [ebp - 0x7a]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059df64
mov esp, ebp
pop ebp
ret 8