Function at 0x1400674c3
Capabilities:
Get geographical location
Get keyboard layout
Read file via mapping

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
mov r12d, r9d
mov rsi, r8
mov r14, rdx
mov r15, rcx
mov rax, qword [0x1400ca0f0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
call fcn.140073cae
mov qword [0x1400cd030], r15
mov qword [0x1400cd038], 0
mov dword [0x1400cd040], 3
or byte [0x1400cac54], 0x44
call fcn.140074328
call fcn.14006128c
call fcn.14007363e
call fcn.140065994
call fcn.140073d0f
cmp dword [0x1400cd044], 4
jb 0x140067549
jne 0x14006755c
cmp dword [0x1400cd048], 2
je 0x14006755c
lea rcx, str.MSWHEEL_ROLLMSG
call qword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x1400ca0c8], eax
call fcn.1400727be
lea rcx, str.user32.dll
call fcn.140073bf6
mov rbx, rax
lea rcx, str.winmm.dll
call fcn.140073bf6
mov rbp, rax
test rbx, rbx
je 0x1400675ac
lea rdx, str.FlashWindowEx
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
call rdi
mov qword [0x1400ccc18], rax
lea rdx, str.ToUnicodeEx
mov rcx, rbx
call rdi
jmp 0x1400675b9
mov qword [0x1400ccc18], 0
xor eax, eax
mov qword [0x1400cd010], rax
test rbp, rbp
je 0x1400675d7
lea rdx, str.PlaySoundA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1400675d9
xor eax, eax
mov qword [0x1400ccc08], rax
call fcn.14000313c
mov qword [0x1400cd050], rax
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
cmp eax, 2
jb 0x140067658
mov rdx, qword [str.9p_v_]
lea rcx, str._s_Fatal_Error
call fcn.14005f1b3
mov rsi, rax
lea rdx, str.Failed_to_initialize_COM_subsystem
xor ecx, ecx
mov r8, rax
mov r9d, 0x30
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rsi
call fcn.1400118b0
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.14007d5e0
mov eax, 1
add rsp, 0xd8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, dword [0x14009d0b8]
mov dword [0x1400cd058], ecx
call fcn.14001d735
mov dword [0x1400cd05c], 0
test rax, rax
je 0x140067684
mov eax, dword [rax + 0x8c]
mov dword [0x1400cd05c], eax
mov rcx, qword [0x1400cd050]
mov edx, 0x7b
xor r8d, r8d
call fcn.140003b70
mov rdx, qword [0x1400cd050]
xor ecx, ecx
call fcn.140021a8d
mov bl, byte [rsi]
test bl, bl
je 0x140067798
lea rbp, [rsi + 2]
movsx ecx, bl
call fcn.14008c114
test eax, eax
je 0x1400676cf
mov bl, byte [rbp - 1]
inc rbp
test bl, bl
jne 0x1400676b4
jmp 0x140067798
lea rcx, [rbp - 2]
cmp bl, 0x26
jne 0x140067706
cmp byte [rbp - 1], 0x52
jne 0x140068126
mov al, byte [rbp]
test al, al
je 0x1400676f5
cmp al, 0x26
je 0x1400676f5
cmp al, 0x40
jne 0x140068126
call fcn.1400784b9
mov byte [0x1400cd060], 1
mov bl, byte [rbp]
jmp 0x140067709
mov rbp, rcx
test bl, bl
je 0x140067798
cmp bl, 0x26
je 0x140068123
cmp bl, 0x40
je 0x1400681c3
xor edi, edi
lea rbx, [rsp + 0x68]
lea r8, [rsp + 0x80]
mov rcx, rsi
mov rdx, rbx
xor r9d, r9d
call fcn.14007b962
mov eax, dword [rbx]
test eax, eax
jle 0x140067798
mov rcx, qword [rsp + 0x80]
movsxd rbx, edi
mov rsi, qword [rcx + rbx*8]
mov r9, qword [0x1400cd050]
inc ebx
cmp ebx, eax
jge 0x14006776b
movsxd rax, ebx
mov rdx, qword [rcx + rax*8]
jmp 0x14006776d
xor edx, edx
mov rcx, rsi
mov r8d, 1
call fcn.140001990
cmp eax, 1
je 0x14006778e
cmp eax, 2
jne 0x14006804e
add edi, 2
mov ebx, edi
mov eax, dword [rsp + 0x68]
mov edi, ebx
cmp ebx, eax
jl 0x140067746
mov rcx, qword [0x1400cd050]
call fcn.140003051
mov rcx, qword [0x1400cd050]
call fcn.1400030e8
test al, al
jne 0x1400677c1
call fcn.1400659e4
test al, al
je 0x140068242
mov rcx, qword [0x1400cd050]
call fcn.14001d61c
test r14, r14
jne 0x14006783e
lea rsi, [rsp + 0x80]
mov dword [rsi], 0
lea rax, [0x14006839c]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], r15
mov edx, 0xc8
mov rcx, r15
call qword [sym.imp.USER32.dll_LoadIconA]
mov qword [rsi + 0x20], rax
mov edx, 0x7f01
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rsi + 0x28], rax
xorps xmm0, xmm0
movups xmmword [rsi + 0x30], xmm0
mov r8, qword [str.9p_v_]
xor ecx, ecx
xor edx, edx
call fcn.1400149f3
mov qword [rsi + 0x40], rax
mov rcx, rsi
call qword [sym.imp.USER32.dll_RegisterClassW]
mov dword [rsp + 0x64], r12d
lea rcx, [0x1400cb968]
xor r14d, r14d
mov r8d, 0xb18
xor edx, edx
call fcn.14007eb10
mov rcx, qword [0x1400cd050]
mov edx, 0x67
call fcn.140003425
mov dword [0x1400cd064], eax
mov rcx, qword [0x1400cd050]
mov edx, 0x9e
call fcn.140003425
mov dword [0x1400cd068], eax
call fcn.14006bbc0
mov dword [0x1400cc480], 0xa
mov dword [0x1400cc484], 0x14
mov esi, 0x19
mov dword [0x1400cc488], esi
mov dword [0x1400cc48c], 0x1c
mov rcx, qword [0x1400cd050]
mov edx, 0x76
call fcn.140003425
lea ebp, [rax + rax*4]
add ebp, ebp
add ebp, esi
mov edi, dword [0x1400cc48c]
mov ebx, dword [0x1400cc484]
mov rcx, qword [0x1400cd050]
mov edx, 0x77
call fcn.140003425
mov esi, eax
imul esi, ebx
add esi, edi
mov rbx, qword [0x1400cd038]
call fcn.140067164
mov ecx, 0x12340042
test eax, eax
je 0x140067918
mov rcx, rbx
mov edx, 2
call qword [0x1400cb928]
mov rcx, rax
lea rbx, [rsp + 0x80]
mov dword [rbx], 0x28
mov rdx, rbx
call fcn.140067393
mov r12d, dword [rbx + 0xc]
mov edi, dword [rbx + 0x10]
sub r12d, dword [rbx + 4]
sub edi, dword [rbx + 8]
cmp ebp, r12d
cmovle r12d, ebp
cmp esi, edi
cmovle edi, esi
mov r8, qword [str.9p_v_]
xor ecx, ecx
xor edx, edx
call fcn.1400149f3
mov r13, rax
mov rcx, qword [0x1400cd050]
mov edx, 0x70
call fcn.14000336e
movzx ebp, al
shl ebp, 0x15
or ebp, 0xcf0000
mov rcx, qword [0x1400cd050]
mov edx, 0x72
call fcn.140003425
mov ebx, ebp
and ebx, 0xea0000
cmp eax, 1
cmovne ebx, ebp
mov rcx, qword [0x1400cd050]
mov edx, 0x59
call fcn.14000336e
movzx ebp, al
lea esi, [rbp*8]
mov rcx, qword [0x1400cd050]
mov edx, 0x82
call fcn.14000336e
lea ecx, [rbp*8 + 0x200]
test al, al
cmove ecx, esi
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], r12d
mov eax, 0x80000000
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov rdx, r13
mov r8, r13
mov r9d, ebx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [0x1400cd038], rax
mov rcx, r13
call fcn.1400118b0
xor ecx, ecx
xor edx, edx
call fcn.14006bd3c
lea rax, [0x1400a6bf0]
mov qword [0x1400cb960], rax
lea r8, [0x1400cb960]
mov rcx, qword [0x1400cd050]
lea rdx, [0x1400cb968]
call fcn.140053062
mov qword [0x1400cd028], rax
mov rdx, qword [0x1400cd050]
mov rcx, rax
call fcn.14006c3f4
mov rdx, qword [0x1400cd050]
lea rcx, str._i_n_
call fcn.1400102ea
mov qword [0x1400cd070], rax
mov rcx, qword [0x1400cd028]
mov rdx, rax
call fcn.14005a4e9
mov rcx, qword [0x1400cd050]
mov edx, 0x63
call fcn.140003425
mov esi, eax
mov rcx, qword [0x1400cd050]
mov edx, 0x76
call fcn.140003425
mov edi, eax
mov rcx, qword [0x1400cd050]
mov edx, 0x77
call fcn.140003425
mov rcx, qword [0x1400cd028]
mov edx, eax
mov r8d, edi
mov r9d, esi
call fcn.140053260
mov rcx, qword [0x1400cd038]
lea rdi, [rsp + 0x68]
mov rdx, rdi
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rcx, qword [0x1400cd038]
lea rsi, [rsp + 0x80]
mov rdx, rsi
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [0x1400cd050]
mov edx, 0x83
call fcn.140003425
mov dword [0x1400cc490], eax
mov dword [0x1400cc494], eax
add eax, eax
mov ecx, dword [rdi + 8]
add ecx, eax
sub ecx, dword [rdi]
sub ecx, dword [rsi + 8]
add ecx, dword [rsi]
add eax, dword [rdi + 0xc]
sub eax, dword [rdi + 4]
sub eax, dword [rsi + 0xc]
add eax, dword [rsi + 4]
mov dword [0x1400cc488], ecx
mov dword [0x1400cc48c], eax
mov rdx, qword [0x1400cd028]
mov ebp, dword [rdx + 0x174]
mov edx, dword [rdx + 0x178]
imul edx, dword [0x1400cc480]
add edx, ecx
imul ebp, dword [0x1400cc484]
add ebp, eax
mov rcx, qword [0x1400cd038]
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], edx
mov dword [rsp + 0x30], 0xe
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [0x1400cc480]
lea ecx, [rax + 0xf]
add eax, 0x1e
test ecx, ecx
cmovns eax, ecx
sar eax, 4
imul eax, dword [0x1400cc484]
add eax, eax
movsxd rdi, eax
mov edx, 1
mov rcx, rdi
xor r8d, r8d
call fcn.140011830
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rdi
call fcn.14007eb10
mov edx, dword [0x1400cc484]
mov ecx, dword [0x1400cc480]
mov qword [rsp + 0x20], rbx
mov r8d, 1
mov r9d, 1
call qword [sym.imp.GDI32.dll_CreateBitmap]
mov qword [0x1400cc498], rax
mov rcx, rbx
call fcn.1400118b0
mov r9d, dword [0x1400cc484]
mov r8d, dword [0x1400cc480]
mov rdx, qword [0x1400cc498]
mov rcx, qword [0x1400cd038]
call qword [sym.imp.USER32.dll_CreateCaret]
movabs rax, 0x1f0000001c
mov qword [rsi], rax
mov dword [rsi + 8], r14d
mov rax, qword [0x1400cd028]
mov eax, dword [rax + 0x174]
lea ecx, [rax - 1]
mov dword [rsi + 0xc], ecx
mov dword [rsi + 0x10], eax
mov dword [rsi + 0x14], r14d
mov rcx, qword [0x1400cd038]
lea r8, [rsp + 0x80]
mov edx, 1
xor r9d, r9d
call qword [sym.imp.USER32.dll_SetScrollInfo]
mov dword [0x1400cc4a0], r14d
mov dword [0x1400cc4a4], r14d
call qword [sym.imp.USER32.dll_GetDoubleClickTime]
mov dword [0x1400cc4a8], eax
mov rcx, qword [0x1400cd038]
xor edx, edx
call qword [sym.imp.USER32.dll_GetSystemMenu]
mov qword [0x1400cc4b0], rax
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov qword [0x1400cc4b8], rax
lea r9, [0x1400ae5f1]
mov rdi, qword [sym.imp.USER32.dll_AppendMenuA]
mov r8d, 0x190
mov rcx, rax
xor edx, edx
call rdi
mov rcx, qword [0x1400cc4b8]
lea r9, str.Paste
mov r8d, 0x1a0
xor edx, edx
call rdi
call qword [sym.imp.USER32.dll_CreateMenu]
mov qword [0x1400cc4c0], rax
lea rcx, [0x1400cc4c8]
mov dl, 1
call fcn.140021a92
call fcn.14006c482
lea rsi, str.Clear_Scrollback
lea r15, str.Reset_Terminal
lea r12, str.Full_Screen
lea r13, str.About__s
lea rax, [0x1400cc4b0]
mov rbx, qword [rax + r14*8]
mov rcx, rbx
mov edx, 0x800
xor r8d, r8d
xor r9d, r9d
call rdi
mov r8d, 0x10
mov rcx, rbx
xor edx, edx
lea r9, str.Event_Log
call rdi
mov rcx, rbx
mov edx, 0x800
xor r8d, r8d
xor r9d, r9d
call rdi
mov r8d, 0x20
mov rcx, rbx
xor edx, edx
lea r9, str.New_Session...
call rdi
mov r8d, 0x30
mov rcx, rbx
xor edx, edx
lea r9, str.Duplicate_Session
call rdi
mov r8, qword [0x1400cc4c0]
mov rcx, rbx
mov edx, 0x10
lea r9, str.Saved_Sessions
call rdi
mov r8d, 0x50
mov rcx, rbx
xor edx, edx
lea r9, str.Change_Settings...
call rdi
mov rcx, rbx
mov edx, 0x800
xor r8d, r8d
xor r9d, r9d
call rdi
mov r8d, 0x170
mov rcx, rbx
xor edx, edx
lea r9, str.Copy_All_to_Clipboard
call rdi
mov r8d, 0x60
mov rcx, rbx
xor edx, edx
mov r9, rsi
call rdi
mov r8d, 0x70
mov rcx, rbx
xor edx, edx
mov r9, r15
call rdi
mov rcx, rbx
mov edx, 0x800
xor r8d, r8d
xor r9d, r9d
call rdi
mov rcx, qword [0x1400cd050]
mov edx, 0x72
call fcn.140003425
xor edx, edx
cmp eax, 1
sete dl
mov r8d, 0x180
mov rcx, rbx
mov r9, r12
call rdi
mov rcx, rbx
mov edx, 0x800
xor r8d, r8d
xor r9d, r9d
call rdi
call fcn.140072931
test al, al
je 0x140067e4d
mov r8d, 0x140
mov rcx, rbx
xor edx, edx
lea r9, str.Help
call rdi
mov rcx, r13
mov rdx, qword [str.9p_v_]
call fcn.14005f1b3
mov rbp, rax
mov r8d, 0x150
mov rcx, rbx
xor edx, edx
mov r9, rax
call rdi
mov rcx, rbp
call fcn.1400118b0
test r14, r14
mov r14d, 1
je 0x140067d12
cmp byte [0x1400cd060], 0
je 0x140067ea6
mov rax, qword [str._i_n_]
lea rcx, str._i_n_
lea rdx, str.Running_with_restricted_process_ACL
call qword [rax]
call fcn.14006c52f
xor edi, edi
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, ax
lea rsi, [rsp + 0x80]
mov edx, 0x1004
mov r8, rsi
mov r9d, 0x14
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov rcx, rsi
call fcn.14008a488
mov dword [0x1400ccfb4], eax
mov rcx, qword [0x1400cd038]
mov edx, dword [rsp + 0x64]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400cd038]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov qword [0x1400cc4e0], rdi
mov qword [0x1400cc4e8], rdi
call fcn.14006c7b4
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, qword [0x1400cd038]
sete dl
mov rcx, qword [0x1400cd028]
call fcn.14005a4f1
mov rcx, qword [0x1400cd038]
call qword [sym.imp.USER32.dll_UpdateWindow]
lea r15, [rsp + 0x68]
mov r14, qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov rdi, qword [sym.imp.USER32.dll_PeekMessageW]
mov r12, qword [sym.imp.USER32.dll_IsWindow]
mov r13, qword [sym.imp.USER32.dll_PeekMessageA]
call fcn.1400018fd
mov ebx, 0
test al, al
jne 0x140067fa8
mov dword [rsp + 0x20], 0
xor ebx, ebx
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call r13
test eax, eax
jne 0x140067fa8
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, qword [0x1400cd038]
sete dl
mov rcx, qword [0x1400cd028]
call fcn.14005a4f1
mov ebx, 0xffffffff
mov rcx, r15
call fcn.1400723e9
mov rbp, rax
mov ecx, dword [rsp + 0x68]
mov dword [rsp + 0x20], 0x1cff
mov rdx, rax
xor r8d, r8d
mov r9d, ebx
call r14
cmp eax, dword [rsp + 0x68]
jae 0x140067fdd
mov eax, eax
mov rcx, qword [rbp + rax*8]
call fcn.140072560
mov rcx, rbp
call fcn.1400118b0
mov dword [rsp + 0x20], 1
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call rdi
test eax, eax
je 0x140068044
cmp dword [rsp + 0x88], 0x12
je 0x1400680d8
mov rcx, qword [0x1400cd078]
call r12
test eax, eax
je 0x14006802e
mov rcx, qword [0x1400cd078]
mov rdx, rsi
call qword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x140068037
mov rcx, rsi
call qword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [rsp + 0x88], 0x8005
je 0x140067fe5
call fcn.1400018a3
jmp 0x140067f5d
cmp eax, 0xfffffffe
jne 0x140068062
lea rcx, str.option___s__requires_an_argument
mov rdx, rsi
call fcn.14006832a
lea rdx, [0x1400b2194]
mov rcx, rsi
call fcn.14008c8e0
test eax, eax
jne 0x1400680e4
mov rdi, qword [str.9p_v_]
lea rcx, str.This_procedure_will_remove_ALL_Registry_entries_nassociated_with__s__and_will_also_remove_nthe_random_seed_file.__This_only_affects_the_ncurrently_logged_in_user.__n_nTHIS_PROCESS_WILL_DESTROY_YOUR_SAVED_SESSIONS._nAre_you_really_sure_you_want_to_continue_
mov rdx, rdi
call fcn.14005f1b3
mov rsi, rax
lea rcx, str._s_Warning
mov rdx, rdi
call fcn.14005f1b3
mov rdi, rax
mov rcx, rsi
mov rdx, rax
mov r8d, 0x134
mov r9d, 4
call fcn.14007b79f
cmp eax, 6
jne 0x1400680c1
call fcn.14007a445
mov rcx, rsi
call fcn.1400118b0
mov rcx, rdi
call fcn.1400118b0
xor ecx, ecx
call fcn.140087870
mov ecx, dword [rsp + 0x90]
call fcn.140068256
lea rdx, str._pgpfp
mov rcx, rsi
call fcn.14008c8e0
test eax, eax
jne 0x140068106
call fcn.14007b8a2
mov ecx, 1
call fcn.140087870
cmp byte [rsi], 0x2d
jne 0x140068117
lea rcx, str.unknown_option___s_
jmp 0x14006805a
lea rcx, str.unexpected_argument___s_
jmp 0x14006805a
mov rcx, rbp
inc rcx
lea rdx, [0x1400aed76]
lea r8, [rsp + 0x68]
lea r9, [rsp + 0x7c]
call fcn.14001bd1d
cmp eax, 2
jne 0x140068228
mov eax, dword [rsp + 0x7c]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x140068228
mov rsi, rax
mov eax, dword [rsp + 0x7c]
lea rdx, [rsp + 0x80]
mov qword [rdx], rsi
mov qword [rdx + 0x10], rax
mov qword [rdx + 8], 0
mov dword [rdx + 0x18], 0
mov qword [rdx + 0x20], rdx
mov rcx, qword [0x1400cd050]
call fcn.140004160
test al, al
je 0x140068249
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140068231
mov rcx, rbp
call fcn.14008cbc0
movsxd rsi, eax
mov rcx, rax
shl rcx, 0x20
movabs rdi, 0xffffffff00000000
mov rbx, rcx
cmp rsi, 2
jl 0x1400681fd
movsx ecx, byte [rbp + rsi - 1]
dec rsi
call fcn.14008c114
lea rcx, [rbx + rdi]
test eax, eax
jne 0x1400681df
sar rbx, 0x20
mov byte [rbp + rbx], 0
mov rdx, qword [0x1400cd050]
inc rbp
mov rcx, rbp
call fcn.140021a8d
mov rcx, qword [0x1400cd050]
call fcn.1400145f4
test al, al
jne 0x140068231
call fcn.1400659e4
test al, al
je 0x140068242
mov rcx, qword [0x1400cd050]
call fcn.140003051
jmp 0x1400677c1
xor ecx, ecx
call fcn.140068256
lea rcx, str.Serialised_configuration_data_was_invalid
call fcn.1400682b3
int3