Function at 0x14006cb9c
Capabilities:
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xf0
mov r12, rcx
lea rcx, [rax + 0x20]
call fcn.1400467ac
lea rcx, [rsp + 0x148]
call fcn.14004679c
xor esi, esi
cmp eax, esi
jne 0x14006cbdf
lea eax, [rsi + 1]
jmp 0x14006d56b
lea rcx, [rsp + 0x148]
call fcn.140046a90
lea rcx, [rsp + 0x80]
call fcn.14004be6c
lea rcx, [rsp + 0xb0]
call fcn.14004be6c
lea rcx, [rsp + 0xa8]
call fcn.14004be6c
lea rcx, [rsp + 0xb8]
call fcn.14004be6c
mov ebp, 2
lea rcx, [rsp + 0x138]
lea r14d, [rbp + 4]
mov qword [rsp + 0x60], rbp
mov dword [rsp + 0x40], r14d
call fcn.140044ef4
mov r11, qword [rsp + 0x138]
lea r8d, [rbp + 0xd]
lea rcx, str.__gethostbyname
mov rdx, r11
mov r13b, sil
call fcn.140045fc8
lea ecx, [rbp + 0x1e]
lea edx, [rbp + 2]
lea r9d, [rbp + 0x28]
cmp al, sil
je 0x14006cceb
add r11, 0x1e
lea r8d, [rbp + 7]
mov qword [rsp + 0x138], r11
movzx eax, word [r11]
cmp ax, si
je 0x14006cc97
cmp r8w, ax
ja 0x14006cc92
cmp ax, 0xd
jbe 0x14006cc97
cmp cx, ax
jne 0x14006ccd9
mov r13b, 1
jmp 0x14006ccd9
cmp r8w, ax
ja 0x14006cca8
cmp ax, 0xd
jbe 0x14006ccde
cmp cx, ax
je 0x14006ccde
cmp r9w, ax
jne 0x14006ccb8
or r13b, bpl
jmp 0x14006ccca
mov ecx, 0x23
cmp cx, ax
mov ecx, 0x20
jne 0x14006ccca
or r13b, dl
add r11, rbp
mov qword [rsp + 0x138], r11
mov ax, word [r11]
cmp ax, si
jne 0x14006cc9c
lea rcx, [rsp + 0x138]
call fcn.140044ef4
or rdi, 0xffffffffffffffff
lea rdx, [rsp + 0x138]
lea rcx, str.__file
mov r8d, edi
call fcn.14004e558
lea ebx, [rdi + 2]
lea rdx, [rsp + 0x138]
cmp al, sil
lea rcx, str.__shm
mov r8d, edi
cmovne ebx, edi
call fcn.14004e558
lea ecx, [rdi - 1]
cmp al, sil
lea rdx, [rsp + 0x138]
mov r8d, edi
cmovne ebx, ecx
lea rcx, str.__event
call fcn.14004e558
lea ecx, [rdi - 3]
mov byte [rsp + 0x148], sil
cmp al, sil
mov rax, qword [rsp + 0x138]
cmovne ebx, ecx
lea ecx, [rdi + 0x2b]
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x44], ebx
cmp cx, word [rax]
jne 0x14006cd8f
add rax, rbp
lea rcx, [rsp + 0x138]
mov byte [rsp + 0x148], 1
mov qword [rsp + 0x138], rax
call fcn.140044ef4
mov ecx, 0x3b
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x138]
lea eax, [rcx - 0xf]
mov word [rsp + 0x20], cx
mov rcx, r12
mov r9d, eax
call fcn.14003f5bc
cmp r13b, sil
je 0x14006d058
lea rcx, [rsp + 0x68]
call fcn.14004be6c
mov r9d, 0x2c
lea rdx, [rsp + 0x138]
lea r8d, [r9 + 0xf]
mov rcx, r12
mov word [rsp + 0x20], r8w
lea r8, [rsp + 0x68]
call fcn.14003f5bc
mov rdx, qword [rsp + 0x68]
mov ecx, 4
mov word [rsp + 0x40], cx
lea rcx, [rsp + 0x60]
mov r9d, edi
mov r8d, edi
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x60], rsi
call fcn.14004bdac
lea rcx, [rsp + 0x58]
call fcn.14004be6c
mov rbx, qword [rsp + 0x60]
lea rdi, [rsp + 0x44]
mov dword [rsp + 0x44], esi
mov qword [rsp + 0x78], rdi
mov byte [rsp + 0x148], 1
mov r14, rsi
cmp rbx, rsi
je 0x14006ce91
cmp byte [rbx], sil
je 0x14006ce5f
mov rcx, rbx
call qword [0x1400f21a0]
mov dword [rsp + 0x44], eax
cmp eax, 0xffffffff
jne 0x14006ce91
mov dword [rsp + 0x44], esi
mov rcx, rbx
call qword [0x1400f21a8]
cmp rax, rsi
je 0x14006ce91
mov r14, qword [rax + 0x18]
movzx ecx, word [rax + 0x12]
mov word [rsp + 0x40], cx
cmp qword [r14], rsi
je 0x14006ce96
mov rbx, qword [rsp + 0x58]
mov byte [rsp + 0x148], r13b
jmp 0x14006d011
mov cx, word [rsp + 0x40]
movsxd rbx, dword [rsp + 0x48]
mov eax, 4
test al, r13b
je 0x14006cf59
lea edx, [rbx + 0x3e]
lea rcx, [rsp + 0x58]
call fcn.14004bf70
mov r11, rbx
mov rbx, qword [rsp + 0x58]
lea rax, [rbx + r11*2]
mov ecx, 0x20
mov rdx, rdi
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x138], rax
xor eax, eax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
movsx eax, word [rsp + 0x40]
mov qword [rsp + 0x88], rsi
cmp eax, ecx
cmova eax, ecx
lea rcx, [rsp + 0x88]
movsxd r8, eax
call fcn.1400177f8
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x138]
lea r8, str.0x_08I64X
call fcn.1400a9320
mov rcx, qword [rsp + 0x138]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov rax, qword [rsp + 0x138]
lea rdx, [rax + rcx*2]
mov qword [rsp + 0x138], rdx
jmp 0x14006cfe6
movsx edi, cx
lea rcx, [rsp + 0x58]
lea eax, [rdi + rdi*2]
lea edx, [rbx + rax*2]
call fcn.14004bf70
mov r11, rbx
mov rbx, qword [rsp + 0x58]
lea rax, [rbx + r11*2]
lea ecx, [rdi - 1]
cmp ecx, esi
lea rdx, [rax + 2]
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x50], rax
jl 0x14006cfe0
mov rdi, qword [rsp + 0x78]
mov ebx, ecx
movzx r8d, byte [rdi]
lea rdx, [0x1400df390]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0x138]
inc rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
sub ebx, 1
movsxd rcx, eax
mov rax, qword [rsp + 0x138]
lea rax, [rax + rcx*2]
mov qword [rsp + 0x138], rax
mov rdx, rax
jns 0x14006cf97
mov rbx, qword [rsp + 0x58]
sub rdx, rbp
mov word [rdx], si
test byte [rsp + 0x148], bpl
je 0x14006d027
cmp qword [r14], rsi
je 0x14006d027
mov cx, word [rsp + 0x40]
mov eax, 0x20
mov word [rdx], ax
sub rdx, qword [rsp + 0x50]
add rdx, rbp
sar rdx, 1
add dword [rsp + 0x48], edx
mov rdi, qword [r14]
mov qword [rsp + 0x78], rdi
cmp rdi, rsi
je 0x14006d027
add r14, 8
jmp 0x14006ce96
mov rdx, qword [rsp + 0x80]
mov r8, rbx
mov rcx, r12
call fcn.14004b578
lea rcx, [rsp + 0x58]
call fcn.140044f24
lea rcx, [rsp + 0x60]
call fcn.140044f24
lea rcx, [rsp + 0x68]
jmp 0x14006d141
cmp ebx, edi
jne 0x14006d15a
mov rcx, qword [rsp + 0x138]
mov edx, 0xffdf
mov edi, 3
movzx eax, word [rcx]
mov r14d, 0x80000000
and ax, dx
lea edx, [rdi + 0x54]
cmp dx, ax
jne 0x14006d09c
lea eax, [rdi + 1]
add rcx, rbp
mov r14d, 0xc0000000
mov edi, eax
mov qword [rsp + 0x138], rcx
movzx eax, word [rcx]
cmp ax, si
je 0x14006d0cb
mov edx, 0x2c
lea r8d, [rdx + 0xf]
add rcx, rbp
mov qword [rsp + 0x138], rcx
cmp dx, ax
je 0x14006d0cb
cmp r8w, ax
je 0x14006d0cb
mov ax, word [rcx]
cmp ax, si
jne 0x14006d0ad
lea rcx, [rsp + 0x48]
call fcn.14004be6c
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x138]
mov r9d, 0x2c
mov rcx, r12
mov word [rsp + 0x20], si
call fcn.14003f5bc
mov rcx, qword [rsp + 0x48]
call fcn.140015cb4
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], esi
lea rcx, [rsp + 0x78]
mov r9d, 7
mov r8d, r14d
mov rdx, rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x20], rsi
call fcn.1400034e0
mov rdi, rax
cmp rax, rsi
jne 0x14006d14b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x48]
mov esi, eax
call fcn.140044f24
jmp 0x14006d535
lea rcx, [rsp + 0x48]
call fcn.140044f24
jmp 0x14006d4d8
cmp ebx, 0xfffffffe
jne 0x14006d598
mov rcx, qword [rsp + 0x138]
lea r8d, [rbx + 6]
mov edx, 0xffdf
movzx eax, word [rcx]
mov rbx, rsi
mov r13d, ebp
and ax, dx
lea edx, [r8 + 0x53]
mov dword [rsp + 0x44], r8d
mov rdi, rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rbx
mov r14d, 0x80000000
cmp dx, ax
jne 0x14006d1c5
mov eax, dword [rsp + 0x40]
add rcx, rbp
mov r13d, r8d
mov r14d, 0xc0000000
mov byte [r12 + 0xd1], r8b
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x138], rcx
movzx eax, word [rcx]
cmp ax, si
je 0x14006d1f4
mov edx, 0x2c
lea r8d, [rdx + 0xf]
add rcx, rbp
mov qword [rsp + 0x138], rcx
cmp dx, ax
je 0x14006d1f4
cmp r8w, ax
je 0x14006d1f4
mov ax, word [rcx]
cmp ax, si
jne 0x14006d1d6
lea rcx, [rsp + 0x58]
call fcn.14004be6c
lea rcx, [rsp + 0x50]
call fcn.14004be6c
mov eax, 0x3b
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x138]
lea r9d, [rax - 0xf]
mov rcx, r12
mov word [rsp + 0x20], ax
call fcn.14003f5bc
mov r11, qword [rsp + 0x138]
cmp word [r11], si
je 0x14006d2ae
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x138]
call fcn.140051edc
mov r11, qword [rsp + 0x138]
cmp word [r11], si
je 0x14006d2a9
add r11, rbp
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x138]
mov r9d, 0x2c
mov rcx, r12
mov word [rsp + 0x20], si
mov qword [rsp + 0x138], r11
call fcn.14003f5bc
mov r11, qword [rsp + 0x138]
cmp word [r11], si
je 0x14006d2a9
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x138]
call fcn.140051edc
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x58]
cmp word [rax], si
je 0x14006d57d
cmp rbx, rsi
jl 0x14006d57d
cmp rdi, rsi
jl 0x14006d57d
or qword [rsp + 0x78], 0xffffffffffffffff
lea rcx, [rsp + 0x48]
call fcn.14004be6c
or r9d, 0xffffffff
lea rdx, str.Globalpecmd2012.shm.
lea rcx, [rsp + 0x48]
or r8d, r9d
call fcn.14004c024
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x48]
call fcn.14004bfa8
mov ecx, dword [rsp + 0x44]
lea rax, [rbx + rdi]
mov rbx, qword [rsp + 0x48]
xor edx, edx
mov qword [rsp + 0xc0], rax
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rdi, rax
cmp rax, rsi
jne 0x14006d449
mov rcx, qword [rsp + 0x50]
cmp word [rcx], si
je 0x14006d3a4
movsx edi, byte [r12 + 0xd1]
call fcn.140015cb4
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], esi
lea rcx, [rsp + 0x78]
mov rdx, rax
mov r9d, 7
mov r8d, r14d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x20], rsi
call fcn.1400034e0
mov r14, rax
cmp rax, rsi
jne 0x14006d3a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x48]
mov esi, eax
call fcn.140044f24
lea rcx, [rsp + 0x50]
call fcn.140044f24
lea rcx, [rsp + 0x58]
jmp 0x14006d141
mov r14, qword [rsp + 0x78]
xor edx, edx
lea rcx, [rsp + 0xc9]
mov byte [rsp + 0xc8], sil
lea r8d, [rdx + 0x27]
call fcn.1400b93b0
lea rcx, [rsp + 0xc8]
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov r9d, 1
lea rcx, [rsp + 0xc8]
mov edx, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov rcx, qword [rsp + 0xc0]
lea rax, [rsp + 0xc8]
mov r9, rcx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ecx
lea rdx, [rsp + 0x88]
mov r8d, r13d
mov rcx, r14
shr r9, 0x20
mov dword [rsp + 0x88], 0x18
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x98], esi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rdi, rax
cmp rax, rsi
je 0x14006d481
jmp 0x14006d44e
mov r14, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
and r13d, 4
mov r8, rdx
or r13d, 8
mov qword [rsp + 0x20], rcx
shr r13d, 1
mov r9d, edx
sar r8, 0x20
mov edx, r13d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbp, rax
cmp r14, 0xffffffffffffffff
je 0x14006d490
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rbp, rsi
jne 0x14006d4b6
cmp rdi, rsi
je 0x14006d37e
cmp rdi, 0xffffffffffffffff
je 0x14006d37e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14006d37e
lea rcx, [rsp + 0x48]
call fcn.140044f24
lea rcx, [rsp + 0x50]
call fcn.140044f24
lea rcx, [rsp + 0x58]
call fcn.140044f24
mov ebx, dword [rsp + 0x70]
mov r14d, dword [rsp + 0x40]
mov rax, qword [rsp + 0x140]
cmp rax, rsi
jne 0x14006d500
mov rcx, r12
call fcn.140015440
mov rax, qword [r12 + 0x40]
cmp rax, rsi
je 0x14006d591
cmp byte [rsp + 0x148], sil
jne 0x14006d511
mov r12, qword [rax + 0x208]
mov dword [rsp + 0x30], r14d
lea r8, [rsp + 0x80]
mov r9, rdi
mov rdx, r12
mov rcx, rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbp
call fcn.14004c8a8
lea rcx, [rsp + 0xb8]
call fcn.140044f24
lea rcx, [rsp + 0xa8]
call fcn.140044f24
lea rcx, [rsp + 0xb0]
call fcn.140044f24
lea rcx, [rsp + 0x80]
call fcn.140044f24
mov eax, esi
add rsp, 0xf0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, [rsp + 0x50]
call fcn.140044f24
lea rcx, [rsp + 0x58]
call fcn.140044f24
mov esi, 0x80070057
jmp 0x14006d535
cmp ebx, 0xfffffffc
jne 0x14006d76a
lea rcx, [rsp + 0x70]
call fcn.14004be6c
lea rcx, [rsp + 0x68]
call fcn.14004be6c
lea eax, [rbx + 0x3f]
lea r9d, [rbx + 0x30]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x138]
mov rcx, r12
mov word [rsp + 0x20], ax
call fcn.14003f5bc
mov r11, qword [rsp + 0x70]
cmp word [r11], si
jne 0x14006d5f2
lea rcx, [rsp + 0x68]
call fcn.140044f24
lea rcx, [rsp + 0x70]
jmp 0x14006d58c
lea rdx, [rsp + 0x44]
lea rcx, [rsp + 0x138]
mov dword [rsp + 0x44], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x48], esi
call fcn.140005c0c
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x138]
call fcn.140005c0c
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x138]
call fcn.140005c0c
lea rcx, [rsp + 0x50]
call fcn.14004be6c
lea rdx, str.Globalpecmd2012.event.
lea rcx, [rsp + 0x50]
mov r9d, edi
mov r8d, edi
call fcn.14004c024
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14004bfa8
cmp dword [rsp + 0x44], esi
jne 0x14006d68a
mov r8, qword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
mov ecx, 0x100002
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov rdi, rax
cmp rax, rsi
jne 0x14006d747
xor edx, edx
lea rcx, [rsp + 0xc9]
mov byte [rsp + 0xc8], sil
lea r8d, [rdx + 0x27]
call fcn.1400b93b0
lea rcx, [rsp + 0xc8]
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor r9d, r9d
lea rcx, [rsp + 0xc8]
lea edx, [r9 + 1]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
cmp dword [rsp + 0x44], esi
mov r9, qword [rsp + 0x50]
mov r8d, esi
setne r8b
cmp dword [rsp + 0x40], esi
lea rax, [rsp + 0xc8]
mov edx, esi
lea rcx, [rsp + 0x88]
setne dl
mov dword [rsp + 0x88], 0x18
mov dword [rsp + 0x98], esi
mov qword [rsp + 0x90], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
cmp rax, rsi
jne 0x14006d747
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x50]
mov esi, eax
call fcn.140044f24
lea rcx, [rsp + 0x68]
call fcn.140044f24
lea rcx, [rsp + 0x70]
jmp 0x14006d141
lea rcx, [rsp + 0x50]
call fcn.140044f24
lea rcx, [rsp + 0x68]
call fcn.140044f24
lea rcx, [rsp + 0x70]
call fcn.140044f24
jmp 0x14006d4dd
mov rax, qword [rsp + 0x138]
cmp word [rax], si
je 0x14006d7ed
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x138]
call fcn.14004fbd8
mov r11, qword [rsp + 0x138]
cmp word [r11], si
je 0x14006d7e8
add r11, rbp
lea rdx, [rsp + 0x44]
lea rcx, [rsp + 0x138]
mov qword [rsp + 0x138], r11
call fcn.14004fc04
mov r11, qword [rsp + 0x138]
cmp word [r11], si
je 0x14006d7e4
add r11, rbp
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x138]
mov qword [rsp + 0x138], r11
call fcn.14004fc04
mov r14d, dword [rsp + 0x40]
mov ebx, dword [rsp + 0x44]
mov rbp, qword [rsp + 0x60]
mov r8d, r14d
mov edx, ebx
mov ecx, ebp
call qword [0x1400f2110]
cmp rax, rsi
mov rdi, rax
jg 0x14006d4dd
mov esi, 1
jmp 0x14006d535