Function at 0x140002000
Capabilities:
Read file on windows
Terminate process

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov r14, rdx
movsxd r15, ecx
lea rcx, str.AcExpressRes.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140008ce0], rax
mov edx, 0x4c6
lea rcx, [rsp + 0x70]
call fcn.140001e90
nop
mov rdx, rax
lea rcx, [0x140008cf8]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov esi, 1
mov edi, esi
cmp rdi, r15
jge 0x1400021a3
mov rbx, qword [r14 + rdi*8]
cmp word [rbx], 0x2d
jne 0x1400021a3
add rbx, 2
movzx eax, word [rbx]
test ax, ax
je 0x140002119
nop
movzx ecx, ax
add rbx, 2
sub ecx, 0x3f
je 0x140002192
sub ecx, 0x25
je 0x140002103
sub ecx, 1
je 0x1400020f7
cmp ecx, 0xa
jne 0x140002169
or rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400020c0
lea rbx, [rbx + rax*2]
inc esi
inc rdi
lea r8, [0x1400055cc]
mov rdx, qword [r14 + rdi*8]
lea rcx, [0x140008d00]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
cmp qword [0x140008d00], 0
je 0x140002123
jmp 0x14000210d
mov dword [0x140008cd0], 1
jmp 0x14000210d
mov dword [0x140008cc4], 1
movzx eax, word [rbx]
test ax, ax
jne 0x140002090
inc esi
inc rdi
jmp 0x140002067
mov edx, 0x4b7
lea rcx, [rsp + 0x70]
call fcn.140001e90
mov rbx, rax
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov r8, qword [rbx]
lea rdx, str.dumpshx:__s._n
call fcn.1400010a0
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rbx, qword [0x140008cf8]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, rbx
call fcn.1400010a0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140001ef0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp esi, r15d
je 0x140002215
movsxd rdx, esi
lea r8, [0x1400055d0]
mov rdx, qword [r14 + rdx*8]
lea rcx, [0x140008d08]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
mov rcx, qword [0x140008d08]
test rcx, rcx
jne 0x14000221c
mov edx, 0x4b8
lea rcx, [rsp + 0x70]
call fcn.140001e90
mov rbx, rax
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov r8, qword [rbx]
lea rdx, str.dumpshx:__s._n
call fcn.1400010a0
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [0x140008d08]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov ecx, eax
mov edx, 0x8000
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__setmode]
mov edx, 0x4b9
lea rcx, [rsp + 0x70]
call fcn.140001e90
mov rdx, qword [rax]
mov rcx, qword [0x140008d00]
call fcn.1400010a0
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
call fcn.140001ce0
mov dword [0x140008cd4], eax
cmp eax, 0xffffffff
je 0x1400025de
test eax, eax
je 0x1400024b2
cmp eax, 1
je 0x1400024ec
cmp eax, 2
je 0x1400022da
cmp eax, 3
jne 0x1400025cd
mov rcx, qword [0x140008d08]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
mov ebx, eax
mov rcx, qword [0x140008d08]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
movzx edi, al
shl di, 8
movzx eax, bl
or di, ax
je 0x1400025cd
nop word [rax + rax]
dec di
call fcn.140001410
test eax, eax
je 0x1400025cd
test di, di
jne 0x1400022c0
jmp 0x1400025cd
mov rcx, qword [0x140008d08]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
mov ebx, eax
mov rcx, qword [0x140008d08]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
movzx ecx, al
shl cx, 8
movzx eax, bl
or cx, ax
cmp cx, 8
jne 0x140002479
mov rcx, qword [0x140008d08]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
mov ebx, eax
mov rcx, qword [0x140008d08]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
movzx edi, al
shl di, 8
movzx eax, bl
or di, ax
mov rcx, qword [0x140008d08]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
mov ebx, eax
mov rcx, qword [0x140008d08]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
movzx ecx, al
shl ecx, 8
movzx eax, bl
or ecx, eax
mov dword [0x140008cc0], ecx
movsxd rcx, ecx
mov edx, 4
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov qword [0x140008cc8], rax
xor ebp, ebp
cmp dword [0x140008cc0], ebp
jle 0x140002407
xor esi, esi
nop dword [rax + rax]
mov rcx, qword [0x140008d08]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
mov ebx, eax
mov rcx, qword [0x140008d08]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
movzx ecx, al
shl cx, 8
movzx eax, bl
or cx, ax
mov rax, qword [0x140008cc8]
mov word [rsi + rax], cx
mov rcx, qword [0x140008d08]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
mov ebx, eax
mov rcx, qword [0x140008d08]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
movzx ecx, al
shl cx, 8
movzx eax, bl
or cx, ax
mov rax, qword [0x140008cc8]
mov word [rsi + rax + 2], cx
inc ebp
lea rsi, [rsi + 4]
cmp ebp, dword [0x140008cc0]
jl 0x140002390
movsx ecx, di
call fcn.140001df0
test eax, eax
je 0x140002440
mov dword [0x140008cd8], 0
test di, di
je 0x1400025cd
dec di
call fcn.140001410
test eax, eax
je 0x1400025cd
test di, di
jne 0x140002426
jmp 0x1400025cd
mov edx, 0x4bd
lea rcx, [rsp + 0x70]
call fcn.140001e90
mov rbx, rax
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov r8, qword [rbx]
lea rdx, str.dumpshx:__s._n
call fcn.1400010a0
lea rcx, [rsp + 0x70]
jmp 0x1400025c7
mov edx, 0x4be
lea rcx, [rsp + 0x78]
call fcn.140001e90
mov rbx, rax
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov r8, qword [rbx]
lea rdx, str.dumpshx:__s._n
call fcn.1400010a0
lea rcx, [rsp + 0x78]
jmp 0x1400025c7
mov edx, 0x4bb
lea rcx, [rsp + 0x70]
call fcn.140001e90
mov rbx, rax
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov r8, qword [rbx]
lea rdx, str.dumpshx:__s._n
call fcn.1400010a0
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rcx, qword [0x140008d08]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
mov rcx, qword [0x140008d08]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
mov rcx, qword [0x140008d08]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
mov rcx, qword [0x140008d08]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
mov rcx, qword [0x140008d08]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
mov ebx, eax
mov rcx, qword [0x140008d08]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
movzx edi, al
shl di, 8
movzx eax, bl
or di, ax
movsx rbx, di
mov r9, qword [0x140008d08]
mov r8, rbx
mov edx, 4
lea rcx, [0x1400088b0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rbx
jne 0x140002593
mov dword [0x140008cf0], 0
test di, di
je 0x1400025cd
nop dword [rax]
dec di
call fcn.140001410
test eax, eax
je 0x1400025cd
test di, di
jne 0x140002580
jmp 0x1400025cd
mov edx, 0x4bc
lea rcx, [rsp + 0x20]
call fcn.140001e90
mov rbx, rax
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov r8, qword [rbx]
lea rdx, str.dumpshx:__s._n
call fcn.1400010a0
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rcx, qword [0x140008ce0]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x140002624
mov edx, 0x4ba
lea rcx, [rsp + 0x70]
call fcn.140001e90
mov rbx, rax
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov r8, qword [rbx]
lea rdx, str.dumpshx:__s._n
call fcn.1400010a0
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret