Function at 0x14004f070
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x4c8
lea rbp, [rsp + 0x40]
mov rax, qword [0x1400ced18]
xor rax, rbp
mov qword [rbp + 0x470], rax
cmp qword [rbp + 0x4a0], 0
jne 0x14004f0aa
xor eax, eax
jmp 0x14004f340
lea rax, [rbp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
lea rax, [0x1400ce018]
mov rax, qword [rax]
mov qword [rbp + 0x38], rax
mov edx, 0x80
lea rcx, [rbp + 0x38]
call fcn.140021f10
mov rcx, qword [rbp + 0x4a8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x80
mov r9, rax
lea r8, [0x140097c64]
mov rdx, qword [rbp + 0x4a0]
lea rcx, str.Telemetry
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [rbp + 0x44], eax
mov dword [rbp + 0x10], 3
mov rax, qword [rbp + 0x38]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14004f12e
mov qword [rbp + 0x50], 0
jmp 0x14004f20d
mov rcx, qword [rbp + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 0x3fffffff
jle 0x14004f153
mov qword [rbp + 0x18], 0
jmp 0x14004f205
movsxd rax, dword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x14004f170
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140082e00
sub rsp, rax
lea rax, [rsp + 0x40]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x28], 0
je 0x14004f19e
cmp qword [rbp + 8], 0
jne 0x14004f1a8
mov qword [rbp + 0x18], 0
jmp 0x14004f205
mov rax, qword [rbp + 0x28]
mov byte [rax], 0
movsxd rax, dword [rbp]
shl rax, 1
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rbp + 8]
xor edx, edx
mov ecx, dword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [rbp + 0x40], eax
cmp dword [rbp + 0x40], 0
jne 0x14004f1fd
mov qword [rbp + 0x18], 0
jmp 0x14004f205
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x50], rax
mov r8d, dword [rbp + 0x44]
mov rdx, qword [rbp + 0x50]
lea rcx, [rbp + 0x70]
call fcn.1400466b0
mov edx, 0xffffffff
lea rcx, [rbp + 0x38]
call fcn.140027380
lea rax, [rbp + 0x70]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14004f248
mov qword [rbp + 0x58], 0
jmp 0x14004f327
mov rcx, qword [rbp + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 0x3fffffff
jle 0x14004f26d
mov qword [rbp + 0x20], 0
jmp 0x14004f31f
movsxd rax, dword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x14004f28a
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140082e00
sub rsp, rax
lea rax, [rsp + 0x40]
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x20], rax
cmp qword [rbp + 0x30], 0
je 0x14004f2b8
cmp qword [rbp + 8], 0
jne 0x14004f2c2
mov qword [rbp + 0x20], 0
jmp 0x14004f31f
mov rax, qword [rbp + 0x30]
mov byte [rax], 0
movsxd rax, dword [rbp]
shl rax, 1
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rbp + 8]
xor edx, edx
mov ecx, dword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [rbp + 0x48], eax
cmp dword [rbp + 0x48], 0
jne 0x14004f317
mov qword [rbp + 0x20], 0
jmp 0x14004f31f
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x58], rax
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atol]
mov dword [rbp + 0x4c], eax
lea rcx, [rbp + 0x38]
call fcn.1400202f0
mov eax, dword [rbp + 0x4c]
mov rcx, qword [rbp + 0x470]
xor rcx, rbp
call fcn.140082550
lea rsp, [rbp + 0x488]
pop rdi
pop rbp
ret