Function at 0x14002d710
Capabilities:
Enumerate files on windows
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x450]
sub rsp, 0x550
mov rax, qword [0x1400ab680]
xor rax, rsp
mov qword [rbp + 0x440], rax
mov r15, rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
lea rax, vtable.CMenu.0
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rbx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov edi, ebx
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x3c], ebx
mov r12d, ebx
mov r14d, ebx
mov dword [rsp + 0x38], ebx
call fcn.14003be40
mov rcx, rax
test rax, rax
je 0x14002e20e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x70], rax
call fcn.14003be40
mov rcx, rax
test rax, rax
je 0x14002e219
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x28], rax
call fcn.14003be40
mov rcx, rax
test rax, rax
je 0x14002e224
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x78], rax
xor ecx, ecx
call fcn.140068980
mov rcx, rax
call fcn.140068180
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0xd8]
test rax, rax
mov edx, ebx
je 0x14002d801
mov rdx, qword [rax + 8]
lea rcx, [rbp - 0x68]
call fcn.14004ae7c
mov edx, 3
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.USER32.dll_GetSubMenu]
mov rcx, rax
call fcn.14004af68
test rax, rax
mov rdx, rbx
je 0x14002d82d
mov rdx, qword [rax + 8]
lea rcx, [rsp + 0x40]
call fcn.14004ae7c
mov r8, qword [r15 + 0x210]
lea rdx, str._s.
lea rcx, [rbp - 0x70]
call fcn.14000c550
nop
mov rax, qword [r15 + 0x238]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x14002d86d
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14002d887
call fcn.14003be40
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
je 0x14002e22f
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x58], rax
mov eax, 1
mov dword [rsp + 0x30], eax
mov r9, qword [r15 + 0x240]
mov eax, dword [r9 - 0x10]
mov rdx, qword [r15 + 0x238]
mov dword [rsp + 0x20], eax
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x58]
call fcn.1400211e0
mov rbx, qword [rbp - 0x58]
mov r9, rbx
xor edx, edx
mov r8d, 0x8100
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.USER32.dll_AppendMenuW]
nop
lea rdx, [rbx - 0x18]
mov r13, 0xffffffffffffffff
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002d8fd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [r15 + 0x320]
lea r8, [r15 + 0x238]
mov rdx, qword [rcx + 0x10]
call fcn.140050378
lea rdx, [rbp - 0x10]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
mov qword [rbp - 0x48], rax
cmp rax, r13
je 0x14002db1a
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14002db1a
mov r14d, 0x8101
nop dword [rax]
lea eax, [r14 - 0x8100]
cmp eax, 0xff
jg 0x14002db11
test byte [rbp - 0x10], 0x10
je 0x14002dafc
call fcn.14003be40
test rax, rax
je 0x14002e23a
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rax, [rbp + 0x1c]
cmp rax, 0x10000
jae 0x14002d9ab
lea rax, [rbp + 0x1c]
movzx edx, ax
lea rcx, [rsp + 0x78]
call fcn.1400029b0
jmp 0x14002d9ce
lea rcx, [rbp + 0x1c]
mov rax, r13
inc rax
cmp word [rcx + rax*2], 0
jne 0x14002d9b2
mov r8d, eax
lea rdx, [rbp + 0x1c]
lea rcx, [rsp + 0x78]
call fcn.140002ba0
nop
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x14002d9f6
cmp rax, qword [rbx - 0x18]
jne 0x14002d9f6
lea rdi, [rbx - 0x18]
lock inc dword [rbx - 8]
jmp 0x14002da2c
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rdi, rax
test rax, rax
je 0x14002e245
mov ecx, dword [rbx - 0x10]
mov dword [rax + 8], ecx
mov r9d, dword [rbx - 0x10]
inc r9d
mov r8, rbx
movsxd rdx, r9d
lea rcx, [rax + 0x18]
call fcn.140002d90
lea rax, [rdi + 0x18]
mov qword [rbp - 0x50], rax
mov rax, qword [r15]
lea rdx, [rbp - 0x50]
mov rcx, r15
call qword [rax + 0x348]
test eax, eax
je 0x14002dae1
mov esi, r14d
mov edi, r14d
inc r14d
mov r8d, edi
lea r9, [rbp + 0x1c]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.USER32.dll_AppendMenuW]
lea r8, [rbp + 0x1c]
mov rdx, qword [r15 + 0x330]
lea rcx, [r15 + 0x320]
call fcn.1400503ec
mov rax, qword [r15 + 0x218]
lea rdx, [rbp + 0x1c]
sub rdx, rax
nop
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x14002daa6
add rax, 2
test cx, cx
jne 0x14002da90
xor eax, eax
jmp 0x14002daab
sbb eax, eax
or eax, 1
mov ecx, dword [rsp + 0x34]
test eax, eax
mov edx, 1
cmove ecx, edx
mov dword [rsp + 0x34], ecx
cmovne esi, r12d
mov r12d, esi
mov rdx, qword [r15 + 0x220]
lea rcx, [rbp + 0x1c]
call fcn.14005ff88
mov rsi, qword [rbp - 0x48]
test rax, rax
je 0x14002dae1
mov dword [rsp + 0x38], edi
mov eax, r13d
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x14002dafc
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [rbp - 0x10]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14002d950
mov r14d, dword [rsp + 0x38]
mov edi, dword [rsp + 0x34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdx, qword [r15 + 0x238]
test rdx, rdx
je 0x14002e23a
mov rax, qword [r15 + 0x218]
sub rdx, rax
nop dword [rax]
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x14002db58
add rax, 2
test cx, cx
jne 0x14002db40
xor esi, esi
mov eax, esi
jmp 0x14002db5f
sbb eax, eax
or eax, 1
xor esi, esi
test eax, eax
jne 0x14002dddc
call fcn.140068154
mov ecx, dword [r15 + 0x330]
dec ecx
xor edx, edx
div ecx
inc edx
mov ecx, edx
cmp rcx, qword [r15 + 0x330]
jge 0x14002e1fd
mov rax, qword [r15 + 0x328]
lea rdx, [rax + rdx*8]
lea rcx, [rbp - 0x40]
call fcn.140002590
mov dword [rsp + 0x30], 2
lea rdx, [rbp - 0x40]
lea rcx, [r15 + 0x218]
call fcn.1400026b0
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002dbd6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [r15 + 0x218]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x14002dbf4
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14002dc0e
call fcn.14003be40
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
je 0x14002e24b
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x38], rax
mov dword [rsp + 0x30], 6
mov r9, qword [r15 + 0x218]
mov ecx, dword [r9 - 0x10]
lea rdx, [0x140090d30]
mov rax, r13
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14002dc40
mov dword [rsp + 0x20], ecx
mov r8d, eax
lea rcx, [rbp - 0x38]
call fcn.1400211e0
nop
mov rbx, qword [rbp - 0x38]
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x14002dc76
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14002dc90
call fcn.14003be40
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
je 0x14002e256
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x30], 0xe
lea r9, [0x140090d38]
mov rax, r13
inc rax
cmp word [r9 + rax*2], 0
jne 0x14002dcb0
mov dword [rsp + 0x20], eax
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp - 0x80]
call fcn.1400211e0
lea rdx, [rbp - 0x80]
lea rcx, [r15 + 0x240]
call fcn.1400026b0
mov dword [rsp + 0x30], 6
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002dd05
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [rsp + 0x30], 2
mov eax, r13d
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x14002dd28
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r12d, 0x8100
mov rax, qword [r15 + 0x238]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x14002dd4c
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14002dd66
call fcn.14003be40
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
je 0x14002e261
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x30], rax
mov dword [rsp + 0x30], 0x12
mov r9, qword [r15 + 0x240]
mov eax, dword [r9 - 0x10]
mov rdx, qword [r15 + 0x238]
mov dword [rsp + 0x20], eax
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x30]
call fcn.1400211e0
mov rbx, qword [rbp - 0x30]
mov qword [rsp + 0x20], rbx
mov r9d, 0x8100
xor r8d, r8d
mov edx, r9d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.USER32.dll_ModifyMenuW]
nop
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002ddf6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14002ddf6
test edi, edi
jne 0x14002ddf6
mov r12d, r14d
lea rdx, [r15 + 0x220]
lea rcx, [r15 + 0x218]
call fcn.1400026b0
lea rdi, vtable.CMenu.0
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rsi
mov r8d, dword [r15 + 0x330]
add r8d, 0x8100
mov dword [rsp + 0x20], esi
mov r9d, r12d
mov edx, 0x8100
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.USER32.dll_CheckMenuRadioItem]
lea rcx, [rsp + 0x40]
call fcn.14004af24
mov edx, 5
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.USER32.dll_GetSubMenu]
mov rcx, rax
call fcn.14004af68
test rax, rax
mov rdx, rsi
je 0x14002de63
mov rdx, qword [rax + 8]
lea rcx, [rsp + 0x40]
call fcn.14004ae7c
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.USER32.dll_GetSubMenu]
mov rcx, rax
call fcn.14004af68
test rax, rax
mov rdx, rsi
je 0x14002de8e
mov rdx, qword [rax + 8]
lea rcx, [rsp + 0x68]
call fcn.14004ae7c
xor edx, edx
mov r8d, 0x400
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USER32.dll_RemoveMenu]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.USER32.dll_GetSubMenu]
mov rcx, rax
call fcn.14004af68
test rax, rax
mov rdx, rsi
je 0x14002decf
mov rdx, qword [rax + 8]
lea rcx, [rsp + 0x58]
call fcn.14004ae7c
xor edx, edx
mov r8d, 0x400
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.USER32.dll_RemoveMenu]
mov r8, qword [r15 + 0x248]
lea rdx, str._s.lang
lea rcx, [rbp - 0x78]
call fcn.14000c550
lea rdx, [rbp - 0x10]
mov rbx, qword [rbp - 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14002e0a4
mov edi, 0x8200
cmp dword [rbp - 0x10], 0x10
je 0x14002e075
mov esi, edi
mov ebx, edi
inc edi
call fcn.14003be40
mov rcx, rax
test rax, rax
je 0x14002e203
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea r9, [rbp + 0x1c]
mov r8, qword [r15 + 0x248]
lea rdx, str._s_s
lea rcx, [rsp + 0x50]
call fcn.14000c550
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
lea r9, [rbp + 0x240]
lea r8, [0x1400901e0]
lea rdx, str.LANGUAGE
lea rcx, [0x140091bb8]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edx, 0x2e
lea rcx, [rbp + 0x1c]
call fcn.14005fed8
test rax, rax
je 0x14002dfbe
xor ecx, ecx
mov word [rax], cx
lea r9, [rbp + 0x1c]
lea r8, [rbp + 0x240]
lea rdx, str._s____s_
lea rcx, [rsp + 0x50]
call fcn.14000c550
mov r8, rbx
movzx eax, word [rbp + 0x1c]
sub ax, 0x41
mov rbx, qword [rsp + 0x50]
xor edx, edx
mov r9, rbx
cmp ax, 0xd
mov rcx, qword [rsp + 0x70]
jbe 0x14002dfff
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.USER32.dll_AppendMenuW]
lea rcx, [r15 + 0x348]
lea r8, [rbp + 0x1c]
mov rdx, qword [rcx + 0x10]
call fcn.1400503ec
mov rax, qword [r15 + 0x250]
lea rdx, [rbp + 0x1c]
sub rdx, rax
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x14002e03d
add rax, 2
test cx, cx
jne 0x14002e027
xor eax, eax
jmp 0x14002e042
sbb eax, eax
or eax, 1
mov ecx, dword [rsp + 0x3c]
test eax, eax
mov edx, 1
cmove ecx, edx
mov dword [rsp + 0x3c], ecx
cmovne esi, r12d
mov r12d, esi
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002e075
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [rbp - 0x10]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14002e097
lea eax, [rdi - 0x8200]
cmp eax, 0xff
jle 0x14002df26
mov rbx, qword [rbp - 0x78]
xor esi, esi
lea rdi, vtable.CMenu.0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r8d, dword [r15 + 0x358]
add r8d, 0x8200
mov dword [rsp + 0x20], esi
mov r9d, r12d
mov edx, 0x8200
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov r8d, dword [r15 + 0x358]
add r8d, 0x8200
mov dword [rsp + 0x20], esi
mov r9d, r12d
mov edx, 0x8200
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.USER32.dll_CheckMenuRadioItem]
lea rcx, [rsp + 0x58]
call fcn.14004af24
lea rcx, [rsp + 0x68]
call fcn.14004af24
lea rcx, [rsp + 0x40]
call fcn.14004af24
lea rcx, [rbp - 0x68]
call fcn.14004af24
cmp dword [rsp + 0x3c], 0
jne 0x14002e137
xor r8d, r8d
xor edx, edx
lea rcx, str.FATAL_ERROR:_Missing_Language_Files__
call fcn.140045af8
nop
mov qword [rsp + 0x58], rdi
lea rcx, [rsp + 0x58]
call fcn.14004aefc
nop
mov qword [rsp + 0x68], rdi
lea rcx, [rsp + 0x68]
call fcn.14004aefc
nop
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002e172
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002e191
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r13d
sub r13d, 1
jg 0x14002e1af
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov qword [rsp + 0x40], rdi
lea rcx, [rsp + 0x40]
call fcn.14004aefc
nop
mov qword [rbp - 0x68], rdi
lea rcx, [rbp - 0x68]
call fcn.14004aefc
nop
mov rcx, qword [rbp + 0x440]
xor rcx, rsp
call fcn.14005df90
lea r11, [rsp + 0x550]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14003b7f8
nop
mov ecx, 0x80004005
call fcn.140002fe0
nop
mov ecx, 0x80004005
call fcn.140002fe0
nop
mov ecx, 0x80004005
call fcn.140002fe0
nop
mov ecx, 0x80004005
call fcn.140002fe0
nop
mov ecx, 0x80004005
call fcn.140002fe0
nop
mov ecx, 0x80004005
call fcn.140002fe0
nop
call fcn.140002ee0
nop
mov ecx, 0x80004005
call fcn.140002fe0
nop
mov ecx, 0x80004005
call fcn.140002fe0
nop
mov ecx, 0x80004005
call fcn.140002fe0
int3