Function at 0x140045c90
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
xor r14d, r14d
mov rbp, rdx
mov r12, rcx
mov r15b, r14b
call fcn.140017908
mov rdx, qword [rsp + 0x178]
mov byte [0x14013c96a], r14b
movzx eax, word [rdx]
lea r8d, [r14 + 0x2a]
cmp r8w, ax
lea ecx, [r14 + 0x20]
lea r10d, [r14 + 9]
sete sil
lea r9d, [r14 + 0xd]
jmp 0x140045d09
cmp r10w, ax
ja 0x140045cf5
cmp ax, r9w
jbe 0x140045d0f
cmp cx, ax
je 0x140045d0f
add rdx, 2
mov qword [rsp + 0x178], rdx
mov ax, word [rdx]
cmp ax, r14w
jne 0x140045ce9
lea rcx, [rsp + 0x178]
call fcn.1400170b0
mov rax, qword [rsp + 0x178]
mov ecx, 0x2d
mov qword [rsp + 0x58], rax
cmp cx, word [rax]
movzx ebx, r8b
mov edi, r14d
lea r13d, [rcx - 0x2c]
cmove ebx, ecx
lea rdx, [rsp + 0x178]
lea rcx, str._user
mov r8d, 5
mov qword [rsp + 0x58], rax
call fcn.1400660ac
cmp al, r14b
jne 0x140045e1d
lea rdx, [rsp + 0x178]
lea rcx, [0x140122ad4]
mov r8d, 2
call fcn.1400660ac
cmp al, r14b
jne 0x140045e1d
mov rcx, qword [rsp + 0x58]
movsx edx, bl
movzx eax, word [rcx]
cmp edx, eax
jne 0x140045e2d
movzx eax, word [rcx + 2]
cmp edx, eax
jne 0x140045e2d
add rcx, 4
lea rdx, [rsp + 0x58]
mov r8d, 4
mov qword [rsp + 0x58], rcx
lea rcx, [0x140122acc]
call fcn.1400660ac
cmp al, r14b
jne 0x140045e08
lea rdx, [rsp + 0x58]
lea rcx, [0x140122944]
mov r8d, r13d
call fcn.1400660ac
cmp al, r14b
jne 0x140045e08
lea rdx, [rsp + 0x58]
lea rcx, [0x14011dc94]
mov r8d, 4
call fcn.1400660ac
cmp al, r14b
je 0x140045e2d
mov r15b, r13b
jmp 0x140045e0b
mov edi, r13d
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x178], rax
jmp 0x140045d3f
mov rax, qword [rsp + 0x178]
mov edi, r13d
jmp 0x140045d3f
mov r13, qword [0x14013a288]
lea rax, str.UCallBackhWnd
cmp edi, r14d
cmovne r13, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
lea rcx, [rsp + 0xc9]
lea r8d, [rdx + 0x27]
mov byte [rsp + 0xc8], r14b
call fcn.140102a90
lea rax, [rsp + 0xc8]
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x80], 0x18
mov dword [rsp + 0x90], r14d
call fcn.14005e7dc
lea rax, str.GlobalPECMD:main_u
lea r8, str.GlobalPECMD:main
cmp edi, r14d
lea rcx, [rsp + 0x80]
mov edx, 1
cmovne r8, rax
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp rbx, r14
je 0x140045edc
mov ecx, 0xb7
cmp eax, ecx
jne 0x140045edc
mov rax, rcx
jmp 0x140046822
cmp edi, r14d
je 0x140045eea
mov byte [section.flag_dat], 0x20
jmp 0x140045f01
mov rax, qword [rsp + 0x178]
cmp word [rax], r14w
setne al
add al, 0x10
mov byte [section.flag_dat], al
lea rcx, [rsp + 0xf0]
lea rdx, str.LOGS__D:DebugPeMain2.log
mov r8d, 0x36
call fcn.1401036e0
cmp edi, r14d
je 0x140045f2d
mov eax, 0x55
mov word [rsp + 0x11a], ax
lea rbx, [0x14013d130]
cmp qword [0x14013cb18], r14
jne 0x140045f63
lea rcx, [rsp + 0xfe]
call fcn.140101e70
cmp eax, r14d
je 0x140045f63
lea rdx, [rsp + 0xf8]
or r8, 0xffffffffffffffff
mov rcx, rbx
call fcn.140026338
cmp byte [0x14013ccb1], r14b
je 0x140045fa5
movsx r9d, byte [section.flag_dat]
lea rdx, str.MAIN___s__0x_X_r_n
mov r8, rbp
mov rcx, rbx
call fcn.140018c6c
cmp byte [0x14013ccb1], r14b
je 0x140045fa5
mov r8, qword [0x14013d408]
lea rdx, str.MAIN:_pecmd::RegDeleteKeyExW0x_p_r_n
mov rcx, rbx
call fcn.140018c6c
call fcn.140023544
movzx r11d, byte [0x140147003]
cmp sil, r14b
mov esi, 1
cmovne r11d, esi
mov byte [0x140147003], r11b
cmp edi, r14d
jne 0x1400460a1
mov rax, qword [rsp + 0x178]
cmp word [rax], r14w
je 0x1400460d4
lea ecx, [rsi + 2]
call fcn.14001b888
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x180]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
lea rdx, str.SOFTWAREPELOGON
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x180], r14
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x180]
cmp rcx, r14
je 0x14004603d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [0x14013ccb1], r14b
je 0x14004605b
lea rdx, str.MAIN_DBG:_d_r_n
mov r8d, 0x2f1c
mov rcx, rbx
call fcn.140018d8c
call fcn.14002286c
cmp byte [0x14013ccb1], r14b
je 0x14004607e
lea rdx, str.MAIN_DBG:_d_r_n
mov r8d, 0x2f1e
mov rcx, rbx
call fcn.140018d8c
call fcn.140017724
cmp byte [0x14013ccb1], r14b
je 0x1400460a1
lea rdx, str.MAIN_DBG:_d_r_n
mov r8d, 0x2f20
mov rcx, rbx
call fcn.140018d8c
mov rax, qword [rsp + 0x178]
cmp word [rax], r14w
je 0x1400460d4
lea rdx, [0x14011c638]
mov r9d, 0x24
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], r14
call fcn.14002cc30
mov rax, qword [rsp + 0x178]
movzx ebx, word [rax]
mov ecx, 0x23
lea edx, [rcx + 7]
cmp bx, dx
jne 0x140046102
add rax, 2
cmp cx, word [rax]
je 0x140046102
lea rcx, [rsp + 0x178]
mov qword [rsp + 0x178], rax
call fcn.1400170b0
lea rdx, [0x14011c638]
lea rcx, [0x14011c638]
call sym.PECMD.exe_LoadEnvi
movzx r11d, byte [0x14013d6f7]
mov rax, qword [rsp + 0x178]
cmp word [rax], r14w
cmove r11d, esi
mov byte [0x14013d6f7], r11b
call fcn.14005b9a0
call fcn.14003e1f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea r8, str.MainPECMDPID
lea rdx, str.SOFTWAREPELOGON
mov dword [rsp + 0x188], eax
lea rax, [rsp + 0x188]
mov r9d, 4
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call fcn.14005c5a0
cmp byte [0x14013ccb1], r14b
je 0x1400461a2
lea rdx, str.MAIN_DBG:_d_r_n
lea rcx, [0x14013d130]
mov r8d, 0x2f2a
call fcn.140018d8c
lea rcx, [0x14013d130]
xor edx, edx
call fcn.1400e8574
cmp qword [r12 + 0x78], r14
jne 0x140046259
mov eax, dword [0x14013d2a0]
test sil, al
jne 0x1400461e1
or eax, esi
lea rcx, [0x14011ab90]
mov qword [0x14013d298], r14
mov dword [0x14013d2a0], eax
call fcn.140102f50
lea rsi, [0x14013d298]
mov edx, 0x10000
mov rcx, r12
mov qword [r12 + 0x78], rsi
call fcn.14006159c
lea rcx, [rsp + 0x180]
call fcn.140063620
mov rdx, qword [rsp + 0x180]
mov rcx, rsi
call fcn.1400a4020
mov rax, qword [0x14013d298]
mov qword [rsp + 0x180], r14
mov rcx, qword [rax]
mov esi, 1
mov rdx, rbp
mov qword [r12 + 0x80], rcx
mov rcx, r12
mov r8d, esi
call fcn.140073ccc
lea rcx, [rsp + 0x180]
mov dword [r12 + 0x8c], r14d
call fcn.14005b104
cmp byte [0x14013ccb1], r14b
je 0x14004627b
lea rdx, str.MAIN_DBG:_d_r_n
lea rcx, [0x14013d130]
mov r8d, 0x2f36
call fcn.140018d8c
cmp edi, r14d
jne 0x1400462be
mov al, byte [section.flag_dat]
lea r8, str.bInMain
lea rdx, str.SOFTWAREPELOGON
mov byte [rsp + 0x180], al
lea rax, [rsp + 0x180]
mov r9d, 3
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call fcn.14005c5a0
cmp byte [0x14013ccb1], r14b
je 0x1400462e0
lea rdx, str.MAIN_DBG:_d_r_n
lea rcx, [0x14013d130]
mov r8d, 0x2f3a
call fcn.140018d8c
mov rax, qword [rsp + 0x178]
cmp word [rax], r14w
je 0x1400462f3
call fcn.14001b850
lea rax, [0x14013cf78]
lea rdx, str.SOFTWAREPELOGON
mov r9d, 0xb
mov r8, r13
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call fcn.14005c5a0
cmp bx, r14w
jne 0x14004632e
cmp edi, r14d
je 0x140046333
call fcn.14002e30c
mov rcx, r12
call fcn.140022e94
mov ecx, 0x8000
call fcn.140077358
mov rcx, qword [rsp + 0x178]
cmp word [rcx], r14w
jne 0x140046358
cmp edi, r14d
je 0x1400463ad
cmp byte [0x14013ccb1], r14b
je 0x14004637a
lea rdx, str.MAIN_DBG:_d_r_n
lea rcx, [0x14013d130]
mov r8d, 0x2f45
call fcn.140018d8c
lea rax, [0x14013c96c]
lea rcx, [0x140045868]
xor edx, edx
mov r9d, 0x10000
mov r8d, 0x80000
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call fcn.14005b228
mov rcx, qword [rsp + 0x178]
mov r9d, 0x2a
cmp word [rcx], r9w
jne 0x1400463ea
lea r8d, [r9 - 7]
lea rax, [rcx + 2]
cmp r8w, word [rax]
je 0x1400463ea
lea rcx, [rsp + 0x178]
mov qword [rsp + 0x178], rax
call fcn.1400170b0
mov rcx, qword [rsp + 0x178]
cmp word [rcx], r9w
je 0x1400463bd
cmp word [rcx], r14w
je 0x1400467f2
cmp byte [0x14013ccb1], r14b
je 0x14004641e
lea rdx, str.MAIN_DBG:_d_r_n
lea rcx, [0x14013d130]
mov r8d, 0x2f4d
call fcn.140018d8c
mov rcx, qword [rsp + 0x178]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x68]
add eax, 0x5c8
movsxd rdx, eax
call fcn.140063694
mov r14, qword [rsp + 0x68]
xor ebx, ebx
mov word [r14], bx
mov rbp, qword [rsp + 0x68]
mov r8d, 0x104
add rbp, 0x280
xor ecx, ecx
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r8d, [rbx + 0x5c]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov rsi, rax
cmp rax, rbx
jne 0x14004647a
mov rsi, rbp
jmp 0x14004647e
add rsi, 2
mov rcx, qword [rsp + 0x178]
call fcn.14001ab84
cmp eax, ebx
je 0x140046505
mov rdx, qword [rsp + 0x178]
lea rcx, [rsp + 0x180]
call fcn.1400702b0
mov rdx, qword [rsp + 0x178]
lea rcx, [0x1401229d8]
mov r8d, 4
call fcn.14005c788
movzx ecx, byte [0x14013d032]
mov rdx, qword [rsp + 0x180]
xor r14d, r14d
cmp al, r14b
mov qword [rsp + 0x20], r14
lea eax, [r14 + 1]
cmovne ecx, eax
xor r9d, r9d
xor r8d, r8d
mov byte [0x14013d032], cl
mov rcx, r12
call fcn.14004c0bc
lea rcx, [rsp + 0x180]
call fcn.14005b104
jmp 0x1400467ca
mov rax, qword [rsp + 0x178]
lea rcx, [rsp + 0x70]
mov r13b, bl
mov qword [rsp + 0x50], rax
call fcn.140063620
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x50]
mov r9d, 0x1000
mov rcx, r12
mov word [rsp + 0x20], bx
call fcn.1400545f8
lea rcx, [rsp + 0x60]
mov edx, 0x400
call fcn.140063694
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rbx
mov word [rax], bx
mov rax, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x70]
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x78]
mov r9d, 7
mov r8d, 0x80000000
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x180], ebx
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x20], rbx
call fcn.140003864
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rbx
mov rbx, qword [rsp + 0x78]
lea r9, [rsp + 0x180]
mov r8d, 0x7fe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r11d, dword [rsp + 0x180]
mov rax, qword [rsp + 0x50]
shr r11, 1
xor ecx, ecx
mov word [rax + r11*2], cx
mov rdx, qword [rsp + 0x50]
mov eax, 0xfeff
cmp ax, word [rdx]
jne 0x1400465ef
add rdx, 2
mov qword [rsp + 0x50], rdx
lea rcx, str._pecmd
mov r8d, 7
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
xor edx, edx
cmp eax, edx
jne 0x14004669c
mov rax, qword [rsp + 0x50]
add rax, 0xe
mov qword [rsp + 0x50], rax
movzx ecx, word [rax]
cmp cx, dx
je 0x14004669c
mov r10d, 9
lea r8d, [r10 + 0x17]
mov r9d, 0xd
cmp r10w, cx
ja 0x14004663e
cmp cx, r9w
jbe 0x140046655
cmp r8w, cx
je 0x140046655
add rax, 2
mov qword [rsp + 0x50], rax
mov cx, word [rax]
cmp cx, dx
jne 0x14004662c
cmp r8w, word [rax]
je 0x140046661
cmp r10w, word [rax]
jne 0x14004666c
add rax, 2
mov qword [rsp + 0x50], rax
jmp 0x140046655
cmp word [rax], 0xa
je 0x14004669c
cmp word [rax], r9w
je 0x14004669c
lea rdx, [rsp + 0x50]
lea rcx, str.__inline_main
mov r8d, r9d
call fcn.14005b1a8
xor edx, edx
cmp eax, edx
jne 0x140046699
mov rax, qword [rsp + 0x50]
jmp 0x14004661a
mov r13b, 1
cmp rbx, rdx
je 0x1400466b0
cmp rbx, 0xffffffffffffffff
je 0x1400466b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x60]
call fcn.14005b104
lea rcx, [rsp + 0x70]
call fcn.14005b104
xor ebx, ebx
lea rcx, [rbp + 0x488]
cmp r13b, bl
je 0x140046711
mov r8, qword [rsp + 0x178]
lea rdx, str.LOAD_sysinit__s
call fcn.14001708c
lea eax, [rbx + 1]
xor r14d, r14d
lea rdx, [rbp + 0x488]
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
mov byte [0x14013d032], al
mov qword [rsp + 0x20], r14
call fcn.14004c0bc
jmp 0x1400467ca
lea rdx, str.___exe:__s_____s_
mov r9, rsi
mov r8, rbp
call fcn.14001708c
lea rcx, [rbp + 0x488]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, qword [rsp + 0x178]
lea rdx, str.LOAD_sysinit__s
movsxd rcx, eax
lea rcx, [rbp + rcx*2 + 0x488]
call fcn.14001708c
cmp word [r14], bx
je 0x14004679b
mov ebx, 1
mov ecx, ebx
call fcn.14001b888
lea rax, [rsp + 0x188]
lea r9d, [rbx + 3]
lea r8, str.SysStartuped
lea rdx, str.SOFTWAREPELOGONRAMDATA
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x188], ebx
mov qword [rsp + 0x20], rax
call fcn.14005c5a0
xor r14d, r14d
movsx eax, r15b
lea rdx, [rbp + 0x488]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov r8, r12
mov rcx, r12
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], eax
call fcn.14000e26c
lea rcx, [rsp + 0x68]
call fcn.14005b104
jmp 0x1400467f2
lea rcx, [rsp + 0x98]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x98]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x98]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
cmp eax, r14d
jne 0x1400467d6
mov rcx, qword [0x14013cf58]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
movsxd rax, dword [rsp + 0xa8]
mov rbx, qword [rsp + 0x170]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret