Function at 0x140027c90
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r8d, dword [rcx + 0xa50]
lea rdx, [0x1401c4a70]
mov rbx, rcx
mov r9, rcx
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0xa54]
lea rdx, str.rdpmode
mov r9, rbx
mov dword [rbx + 0xa50], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0xa58]
lea rdx, str.noscreensaver
mov r9, rbx
mov dword [rbx + 0xa54], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0xa5c]
lea rdx, [0x1401c4a98]
mov r9, rbx
mov dword [rbx + 0xa58], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x7a8]
lea rdx, str.Secure
mov r9, rbx
mov dword [rbx + 0xa5c], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x7a4]
lea rdx, str.MSLogonRequired
mov r9, rbx
mov dword [rbx + 0x7a8], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x7ac]
lea rdx, str.NewMSLogon
mov r9, rbx
mov dword [rbx + 0x7a4], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x7b4]
lea rdx, str.UseDSMPlugin
mov r9, rbx
mov dword [rbx + 0x7ac], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea r9, [rbx + 0x7b8]
mov qword [rsp + 0x28], rbx
lea r8, [0x14019528c]
mov dword [rbx + 0x7b4], eax
lea rdx, str.DSMPlugin
mov dword [rsp + 0x20], 0x80
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov r8d, dword [rbx + 0x7b0]
lea rdx, str.ReverseAuthRequired
mov r9, rbx
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea r9, [rbx + 0x838]
mov qword [rsp + 0x28], rbx
lea r8, [0x14019528c]
mov dword [rbx + 0x7b0], eax
lea rdx, str.DSMPluginConfig
mov dword [rsp + 0x20], 0x200
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov r8d, dword [rbx + 0xa60]
lea rdx, str.AllowLoopback
mov r9, rbx
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0xa64]
lea rdx, str.AuthRequired
mov r9, rbx
mov dword [rbx + 0xa60], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [rbx + 0xa64], eax
mov r8d, dword [rbx + 0xa68]
lea rdx, str.ConnectPriority
mov r9, rbx
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea r9, [rbx + 0xa6c]
mov qword [rsp + 0x28], rbx
lea r8, [0x14019528c]
mov dword [rbx + 0xa68], eax
lea rdx, str.AuthHosts
mov dword [rsp + 0x20], __WSAFDIsSet
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov r8d, dword [rbx + 0x10c]
lea rdx, str.AllowShutdown
mov r9, rbx
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x104]
lea rdx, str.AllowProperties
mov r9, rbx
mov dword [rbx + 0x10c], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x108]
lea rdx, str.AllowInjection
mov r9, rbx
mov dword [rbx + 0x104], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x110]
lea rdx, str.AllowEditClients
mov r9, rbx
mov dword [rbx + 0x108], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x114]
lea rdx, str.FileTransferTimeout
mov r9, rbx
mov dword [rbx + 0x110], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [rbx + 0x114], eax
cmp eax, 0x258
jle 0x140027fb8
mov dword [rbx + 0x114], 0x258
mov r8d, dword [rbx + 0x118]
lea rdx, str.KeepAliveInterval
mov r9, rbx
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x11c]
lea rdx, str.IdleInputTimeout
mov r9, rbx
mov dword [rbx + 0x118], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [rbx + 0x11c], eax
mov eax, dword [rbx + 0x114]
dec eax
cmp dword [rbx + 0x118], eax
jl 0x140028016
mov dword [rbx + 0x118], eax
lea r9, [rbx + 0x120]
mov qword [rsp + 0x28], rbx
lea r8, [0x14019528c]
mov dword [rsp + 0x20], 0x400
lea rdx, str.service_commandline
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea r9, [rbx + 0x520]
mov qword [rsp + 0x28], rbx
lea r8, [0x14019528c]
mov dword [rsp + 0x20], 0x200
lea rdx, str.accept_reject_mesg
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edx, dword [rbx + 0x7a8]
xor eax, eax
nop dword [rax]
mov byte [rsp + rax + 0x30], 0
inc rax
cmp rax, 8
jb 0x140028080
test edx, edx
lea rax, [0x1401efc48]
lea rcx, [0x1401efd50]
cmove rcx, rax
xor edx, edx
call fcn.140017490
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.140018200
mov rax, qword [rsp + 0x30]
lea rdx, str.DebugMode
mov r8d, dword [rbx + 0xb04]
lea rcx, str.admin
mov r9, rbx
mov qword [rbx + 0x734], rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea r9, [rbx + 0xb08]
mov qword [rsp + 0x28], rbx
lea r8, [0x14019528c]
mov dword [rbx + 0xb04], eax
lea rdx, str.path
mov dword [rsp + 0x20], 0x200
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov r8d, dword [rbx + 0xd08]
lea rdx, str.DebugLevel
mov r9, rbx
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0xd0c]
lea rdx, str.Avilog
mov r9, rbx
mov dword [rbx + 0xd08], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x790]
lea rdx, str.FileTransferEnabled
mov r9, rbx
mov dword [rbx + 0xd0c], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x794]
lea rdx, str.FTUserImpersonation
mov r9, rbx
mov dword [rbx + 0x790], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x798]
lea rdx, str.BlankMonitorEnabled
mov r9, rbx
mov dword [rbx + 0x794], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x79c]
lea rdx, str.BlankInputsOnly
mov r9, rbx
mov dword [rbx + 0x798], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x7a0]
lea rdx, str.DefaultScale
mov r9, rbx
mov dword [rbx + 0x79c], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x7b4]
lea rdx, str.UseDSMPlugin
mov r9, rbx
mov dword [rbx + 0x7a0], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea r9, [rbx + 0x7b8]
mov qword [rsp + 0x28], rbx
lea r8, [0x14019528c]
mov dword [rbx + 0x7b4], eax
lea rdx, str.DSMPlugin
mov dword [rsp + 0x20], 0x80
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x200
lea r9, [rbx + 0x838]
lea r8, [0x14019528c]
lea rdx, str.DSMPluginConfig
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov r8d, dword [rbx + 0xa38]
lea rdx, str.primary
mov r9, rbx
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0xa3c]
lea rdx, str.secondary
mov r9, rbx
mov dword [rbx + 0xa38], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x720]
lea rdx, str.SocketConnect
mov r9, rbx
mov dword [rbx + 0xa3c], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x724]
lea rdx, str.HTTPConnect
mov r9, rbx
mov dword [rbx + 0x720], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x728]
lea rdx, str.AutoPortSelect
mov r9, rbx
mov dword [rbx + 0x724], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x72c]
lea rdx, str.PortNumber
mov r9, rbx
mov dword [rbx + 0x728], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9, rbx
lea rdx, str.HTTPPortNumber
lea rcx, str.admin
mov dword [rbx + 0x72c], eax
lea r8d, [rax - 0x64]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x758]
lea rdx, str.IdleTimeout
mov r9, rbx
mov dword [rbx + 0x730], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x768]
lea rdx, str.RemoveWallpaper
mov r9, rbx
mov dword [rbx + 0x758], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x76c]
lea rdx, str.RemoveEffects
mov r9, rbx
mov dword [rbx + 0x768], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x770]
lea rdx, str.RemoveFontSmoothing
mov r9, rbx
mov dword [rbx + 0x76c], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x744]
lea rdx, str.QuerySetting
mov r9, rbx
mov dword [rbx + 0x770], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x750]
lea rdx, str.QueryTimeout
mov dword [rbx + 0x744], eax
lea rcx, str.admin
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x754]
lea rdx, str.QueryDisableTime
mov r9, rbx
mov dword [rbx + 0x750], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x74c]
lea rdx, str.QueryAccept
mov r9, rbx
mov dword [rbx + 0x754], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x75c]
lea rdx, str.MaxViewerSetting
mov r9, rbx
mov dword [rbx + 0x74c], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x760]
lea rdx, str.MaxViewers
mov r9, rbx
mov dword [rbx + 0x75c], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x764]
lea rdx, str.Collabo
mov r9, rbx
mov dword [rbx + 0x760], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0xa40]
lea rdx, str.Frame
mov r9, rbx
mov dword [rbx + 0x764], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0xa44]
lea rdx, str.Notification
mov r9, rbx
mov dword [rbx + 0xa40], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0xa48]
lea rdx, [0x1401c4cf8]
mov r9, rbx
mov dword [rbx + 0xa44], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0xa4c]
lea rdx, str.NotificationSelection
mov r9, rbx
mov dword [rbx + 0xa48], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x748]
lea rdx, str.QueryIfNoLogon
mov r9, rbx
mov dword [rbx + 0xa4c], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r9d, 8
mov qword [rsp + 0x20], rbx
lea r8, [rbx + 0x734]
mov dword [rbx + 0x748], eax
lea rdx, str.passwd
lea rcx, [0x1401c7268]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
lea r8, [rbx + 0x73c]
mov qword [rsp + 0x20], rbx
mov r9d, 8
lea rdx, str.passwd2
lea rcx, [0x1401c7268]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
mov r8d, dword [rbx + 0x774]
lea rdx, str.InputsEnabled
mov r9, rbx
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [rbx + 0x774], eax
mov r9, rbx
mov r8d, dword [rbx + 0x778]
lea rdx, str.LockSetting
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x77c]
lea rdx, str.LocalInputsDisabled
mov r9, rbx
mov dword [rbx + 0x778], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x780]
lea rdx, str.EnableJapInput
mov r9, rbx
mov dword [rbx + 0x77c], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x784]
lea rdx, str.EnableUnicodeInput
mov r9, rbx
mov dword [rbx + 0x780], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x788]
lea rdx, str.EnableWin8Helper
mov r9, rbx
mov dword [rbx + 0x784], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x78c]
lea rdx, str.clearconsole
mov r9, rbx
mov dword [rbx + 0x788], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0xd14]
lea rdx, str.sendbuffer
mov r9, rbx
mov dword [rbx + 0x78c], eax
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea r8, str.VNCACCESS
mov edx, __WSAFDIsSet
lea rcx, [rbx + 0xe69]
mov dword [rbx + 0xd14], eax
call fcn.14013b330
lea r9, [rbx + 0xe69]
mov qword [rsp + 0x28], rbx
lea r8, [0x14019528c]
mov dword [rsp + 0x20], __WSAFDIsSet
lea rdx, str.group1
lea rcx, str.admin_auth
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea r8, str.Administrators
mov edx, __WSAFDIsSet
lea rcx, [rbx + 0xeff]
call fcn.14013b330
lea r9, [rbx + 0xeff]
mov qword [rsp + 0x28], rbx
lea r8, [0x14019528c]
mov dword [rsp + 0x20], __WSAFDIsSet
lea rdx, str.group2
lea rcx, str.admin_auth
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea r8, str.VNCVIEWONLY
mov edx, __WSAFDIsSet
lea rcx, [rbx + 0xf95]
call fcn.14013b330
lea r9, [rbx + 0xf95]
mov qword [rsp + 0x28], rbx
lea r8, [0x14019528c]
mov dword [rsp + 0x20], __WSAFDIsSet
lea rdx, str.group3
lea rcx, str.admin_auth
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea r9, [rbx + 0x1038]
mov qword [rsp + 0x28], rbx
lea r8, [0x14019528c]
mov dword [rsp + 0x20], 0xfa
lea rdx, str.cloudServer
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
movzx r8d, byte [rbx + 0x1132]
lea rdx, str.cloudEnabled
mov r9, rbx
lea rcx, str.admin
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x102c]
lea rdx, str.locdom1
test eax, eax
lea rcx, str.admin_auth
mov r9, rbx
setne al
mov byte [rbx + 0x1132], al
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x1030]
lea rdx, str.locdom2
mov r9, rbx
mov dword [rbx + 0x102c], eax
lea rcx, str.admin_auth
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0x1034]
lea rdx, str.locdom3
mov r9, rbx
mov dword [rbx + 0x1030], eax
lea rcx, str.admin_auth
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0xe30]
lea rdx, str.TurboMode
mov r9, rbx
mov dword [rbx + 0x1034], eax
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0xe34]
lea rdx, str.PollUnderCursor
mov r9, rbx
mov dword [rbx + 0xe30], eax
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0xe38]
lea rdx, str.PollForeground
mov r9, rbx
mov dword [rbx + 0xe34], eax
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0xe3c]
lea rdx, str.PollFullScreen
mov r9, rbx
mov dword [rbx + 0xe38], eax
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0xe40]
lea rdx, str.OnlyPollConsole
mov r9, rbx
mov dword [rbx + 0xe3c], eax
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0xe44]
lea rdx, str.OnlyPollOnEvent
mov r9, rbx
mov dword [rbx + 0xe40], eax
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0xe48]
lea rdx, str.MaxCpu2
mov r9, rbx
mov dword [rbx + 0xe44], eax
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [rbx + 0xe48], eax
test eax, eax
jne 0x1400289de
mov dword [rbx + 0xe48], 0x64
mov r8d, dword [rbx + 0xe4c]
lea rdx, str.MaxFPS
mov r9, rbx
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0xe50]
lea rdx, str.EnableDriver
mov r9, rbx
mov dword [rbx + 0xe4c], eax
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [rbx + 0xe50], eax
test eax, eax
je 0x140028a3a
xor ecx, ecx
call fcn.140031bf0
movzx eax, al
mov dword [rbx + 0xe50], eax
mov r8d, dword [rbx + 0xe54]
lea rdx, str.EnableHook
mov r9, rbx
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0xe58]
lea rdx, str.EnableVirtual
mov r9, rbx
mov dword [rbx + 0xe54], eax
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r8d, dword [rbx + 0xe60]
lea rdx, str.autocapt
mov r9, rbx
mov dword [rbx + 0xe58], eax
lea rcx, str.poll
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [rbx + 0xe60], eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140132620
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret