Function at 0x1400713d4
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov r12, rcx
lea rcx, [rax + 0x10]
call fcn.14004ea3c
xor esi, esi
cmp r9b, 1
movzx r13d, r9b
lea rcx, [rsp + 0xa0]
cmove r13d, esi
cmp r9b, 1
sete bpl
call fcn.140055fcc
lea rcx, [rsp + 0xa8]
call fcn.140055fcc
lea rcx, [rsp + 0x198]
call fcn.14004ea3c
cmp bpl, sil
je 0x140071448
sub qword [rsp + 0x198], 2
mov ebx, 0x3d
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x198]
mov r8d, ebx
call fcn.140059810
lea ecx, [rbx - 0x17]
cmp bpl, sil
je 0x140071478
mov rax, qword [rsp + 0xa0]
mov word [rax], cx
lea rdx, [rsp + 0xa0]
xor r8d, r8d
mov rcx, r12
call fcn.140003728
mov rax, qword [rsp + 0xa0]
movsx r14, bpl
lea r15, [rax + r14*2]
mov rax, qword [rsp + 0x198]
cmp bx, word [rax]
jne 0x1400716d8
mov edi, 0x3b
add rax, 2
lea rdx, [rsp + 0xa8]
lea ebx, [rdi - 0xf]
lea rcx, [rsp + 0x198]
mov r9d, edi
mov r8d, ebx
mov qword [rsp + 0x198], rax
call fcn.1400598a4
mov r11, qword [rsp + 0x198]
movzx r9d, word [r11]
cmp bx, r9w
je 0x1400714f3
cmp di, r9w
jne 0x1400714ff
add r11, 2
mov qword [rsp + 0x198], r11
mov rbx, qword [rsp + 0xa8]
mov dil, sil
cmp r13b, sil
jne 0x14007169b
lea rcx, str.WINVER
mov rdx, rbx
call fcn.14004fe38
mov r10d, 0x2a
cmp al, sil
jne 0x140071548
lea rcx, [0x1400f36f8]
mov rdx, rbx
call fcn.14004fe38
cmp al, sil
je 0x14007169b
mov dil, r10b
lea rcx, [rsp + 0x198]
call fcn.14004ea3c
mov rcx, qword [rsp + 0x198]
mov eax, 0x5e
mov rbx, rsi
mov r14, rsi
cmp ax, word [rcx]
jne 0x14007157d
or r14, 0xffffffffffffffff
add rcx, 2
mov qword [rsp + 0x198], rcx
mov eax, 0x2b
cmp ax, word [rcx]
jne 0x1400715af
lea rax, [rcx + 2]
mov dil, 1
cmp word [rax], si
jne 0x1400715a4
mov word [rcx], r10w
mov rcx, qword [rsp + 0x198]
mov dil, r10b
jmp 0x1400715af
mov rcx, rax
mov qword [rsp + 0x198], rax
movzx ebp, word [rcx]
cmp bp, si
jne 0x1400715c0
cmp dil, sil
je 0x140071667
mov qword [rsp + 0x58], rsi
cmp r10w, word [rcx]
je 0x1400715d0
cmp dil, r10b
jne 0x140071645
lea rcx, [rsp + 0xe0]
lea rdx, str._SystemRoot_System32kernel32.dll
mov r8d, 0x46
call fcn.1400cd520
cmp byte [r12 + 0xda], sil
jne 0x14007161b
test byte [r12 + 0xd], 0xf
jne 0x14007161b
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0xe0]
xor r9d, r9d
mov rcx, r12
mov byte [rsp + 0x20], 1
call fcn.140069994
jmp 0x140071638
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0xe0]
xor r9d, r9d
mov rcx, r12
mov byte [rsp + 0x20], 1
call fcn.140068750
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x198], rcx
xor r8d, r8d
mov rdx, r14
call fcn.140005738
lea rcx, [rsp + 0x58]
mov rbx, rax
call fcn.14004ea6c
cmp dil, sil
jne 0x140071667
cmp bp, si
jne 0x140071681
mov rbp, rbx
call fcn.140051da8
mov rbx, rax
cmp dil, sil
je 0x140071681
movzx eax, bp
shl rbx, 0x10
or rbx, rax
lea r9, [0x1400ee708]
mov r8, r15
mov rdx, rbx
mov rcx, r12
call fcn.140058ea4
jmp 0x140072643
lea rcx, str.ispe
mov rdx, rbx
call fcn.14004fe38
cmp al, sil
je 0x1400716c6
call fcn.14000c2c8
mov r8, r15
mov rcx, r12
mov edx, eax
call fcn.140058f7c
jmp 0x140072643
mov r15d, 0x2c
cmp r9w, si
je 0x1400716e4
cmp r15w, r9w
je 0x1400716e4
mov rsi, 0xffffffff80070057
jmp 0x140072643
cmp r13b, sil
je 0x1400716f3
cmp r13b, 2
jne 0x140071cb0
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x88]
call fcn.14006016c
mov rdi, qword [rsp + 0x88]
cmp bpl, sil
je 0x14007171d
mov eax, 0x26
mov word [rdi], ax
lea rcx, [rsp + 0x198]
call fcn.14004ea3c
lea rcx, str.FVER
mov rdx, rbx
call fcn.14004fe38
cmp al, sil
je 0x140071834
lea rcx, [rsp + 0x78]
call fcn.140055fcc
mov rcx, qword [rsp + 0x198]
mov qword [rsp + 0x70], rsi
call fcn.1400188a8
lea rcx, [rsp + 0x58]
mov rbx, rsi
mov r8d, 0x3b
mov edx, r15d
mov qword [rsp + 0x60], rbx
mov r11, rax
mov qword [rsp + 0x198], rax
mov qword [rsp + 0x58], rdi
movzx ebp, si
call fcn.14004ecd0
mov rcx, qword [rsp + 0x58]
cmp word [rcx], si
je 0x1400717c7
mov word [rcx], si
add rcx, 2
mov r9d, r8d
mov qword [rsp + 0x58], rcx
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov r8d, r15d
call fcn.1400598a4
mov rbx, qword [rsp + 0x60]
mov r11, qword [rsp + 0x198]
mov bp, word [rbx]
movzx eax, bp
mov rcx, r11
neg ax
lea rax, [rsp + 0x70]
sbb r8, r8
and r8, rax
movzx eax, word [rdi]
neg ax
lea rax, [rsp + 0x78]
sbb rdx, rdx
and rdx, rax
call fcn.140005738
mov r8, qword [rsp + 0x78]
mov rdx, rdi
mov rcx, r12
call fcn.140055710
cmp bp, si
je 0x140071816
mov r8, qword [rsp + 0x70]
mov rdx, rbx
mov rcx, r12
call fcn.140055710
lea rcx, [rsp + 0x60]
call fcn.14004ea6c
lea rcx, [rsp + 0x70]
call fcn.14004ea6c
lea rcx, [rsp + 0x78]
jmp 0x140072631
lea rcx, str.FTIME
mov rdx, rbx
call fcn.14004fe38
cmp al, sil
je 0x140071a1e
mov rcx, qword [rsp + 0x198]
call fcn.1400188a8
lea rcx, [rsp + 0x70]
mov rbx, rax
call fcn.140055fcc
lea rcx, [rsp + 0x78]
call fcn.140055fcc
lea rcx, [rsp + 0x68]
call fcn.140055fcc
lea r11, [rdi + r14*2]
lea rdx, [rsp + 0x50]
lea rcx, str._local
mov r8d, 6
mov qword [rsp + 0x50], r11
call fcn.140058710
cmp al, sil
je 0x1400718be
cmp bpl, sil
je 0x1400718ba
mov rax, qword [rsp + 0x50]
mov ecx, 0x26
sub rax, 2
mov qword [rsp + 0x50], rax
mov word [rax], cx
or bpl, 2
lea rdx, [rsp + 0x50]
lea rcx, [0x1400f3684]
mov r8d, 3
call fcn.140058710
mov r8d, 4
cmp al, sil
je 0x1400718e3
or bpl, r8b
lea rdx, [rsp + 0x50]
lea rcx, str._ws1
call fcn.140058710
cmp al, sil
je 0x1400718fd
or bpl, 8
cmp bpl, sil
je 0x14007190a
mov eax, 0x26
mov word [rdi], ax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
mov r8d, r15d
call fcn.140059810
mov rax, qword [rsp + 0x50]
cmp r15w, word [rax]
jne 0x140071968
add rax, 2
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
mov r8d, r15d
mov qword [rsp + 0x50], rax
call fcn.140059810
mov rax, qword [rsp + 0x50]
cmp r15w, word [rax]
jne 0x140071968
add rax, 2
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x50]
mov r8d, r15d
mov qword [rsp + 0x50], rax
call fcn.140059810
lea r8, [rsp + 0xe0]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov rdx, qword [rsp + 0x70]
mov rcx, r12
cmp eax, esi
je 0x1400719e5
lea r8, [rsp + 0xe4]
mov r9b, bpl
call fcn.14005a250
mov rdx, qword [rsp + 0x78]
lea r8, [rsp + 0xf4]
mov r9b, bpl
mov rcx, r12
call fcn.14005a250
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0xec]
mov r9b, bpl
mov rcx, r12
call fcn.14005a250
lea rcx, [rsp + 0x68]
call fcn.14004ea6c
lea rcx, [rsp + 0x78]
call fcn.14004ea6c
lea rcx, [rsp + 0x70]
jmp 0x140072631
lea rbp, [0x1400e94a4]
mov r8, rbp
call fcn.140055710
mov rdx, qword [rsp + 0x78]
mov r8, rbp
mov rcx, r12
call fcn.140055710
mov rdx, qword [rsp + 0x68]
mov r8, rbp
mov rcx, r12
call fcn.140055710
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400719c7
lea rcx, str.FATTR
mov rdx, rbx
call fcn.14004fe38
cmp al, sil
je 0x140071ca3
mov rcx, qword [rsp + 0x198]
call fcn.1400188a8
mov r13d, 0x26
mov rbx, rax
cmp bpl, sil
je 0x140071a55
mov word [rdi], r13w
lea rcx, [rsp + 0x58]
call fcn.140055fcc
lea rcx, [rsp + 0x68]
call fcn.140055fcc
lea rcx, [rsp + 0x78]
call fcn.140055fcc
lea rcx, [rsp + 0x70]
call fcn.140055fcc
lea rcx, [rsp + 0x60]
call fcn.140055fcc
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
mov r8d, r15d
mov qword [rsp + 0x50], rdi
call fcn.140059810
mov rax, qword [rsp + 0x50]
cmp r15w, word [rax]
jne 0x140071b6a
cmp bpl, sil
je 0x140071ab8
mov word [rax], r13w
jmp 0x140071ac1
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x50]
mov r8d, r15d
call fcn.140059810
mov rax, qword [rsp + 0x50]
cmp r15w, word [rax]
jne 0x140071b6a
cmp bpl, sil
je 0x140071aed
mov word [rax], r13w
jmp 0x140071af6
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
mov r8d, r15d
call fcn.140059810
mov rax, qword [rsp + 0x50]
cmp r15w, word [rax]
jne 0x140071b6a
cmp bpl, sil
je 0x140071b1e
mov word [rax], r13w
jmp 0x140071b27
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
mov r8d, r15d
call fcn.140059810
mov rax, qword [rsp + 0x50]
cmp r15w, word [rax]
jne 0x140071b6a
cmp bpl, sil
je 0x140071b4f
mov word [rax], r13w
jmp 0x140071b58
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
mov r8d, r15d
call fcn.140059810
lea r8, [rsp + 0xb0]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov rcx, r12
cmp eax, esi
je 0x140071c55
mov edx, dword [rsp + 0xb0]
mov r8, qword [rsp + 0x58]
shr edx, 5
and edx, 1
call fcn.140058f7c
mov edx, dword [rsp + 0xb0]
mov r8, qword [rsp + 0x68]
shr edx, 1
mov rcx, r12
and edx, 1
call fcn.140058f7c
mov edx, dword [rsp + 0xb0]
mov r8, qword [rsp + 0x78]
and edx, 1
mov rcx, r12
call fcn.140058f7c
mov edx, dword [rsp + 0xb0]
mov r8, qword [rsp + 0x70]
shr edx, 2
mov rcx, r12
and edx, 1
call fcn.140058f7c
mov r8d, dword [rsp + 0xb0]
lea rdx, str.0x_lX
lea rcx, [rsp + 0xe0]
mov word [rsp + 0xe0], si
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0xe0]
mov rcx, r12
call fcn.140055710
lea rcx, [rsp + 0x60]
call fcn.14004ea6c
lea rcx, [rsp + 0x70]
call fcn.14004ea6c
lea rcx, [rsp + 0x78]
call fcn.14004ea6c
lea rcx, [rsp + 0x68]
call fcn.14004ea6c
lea rcx, [rsp + 0x58]
jmp 0x140072631
mov rdx, qword [rsp + 0x58]
lea rbp, [0x1400e94a4]
mov r8, rbp
call fcn.140055710
mov rdx, qword [rsp + 0x68]
mov r8, rbp
mov rcx, r12
call fcn.140055710
mov rdx, qword [rsp + 0x78]
mov r8, rbp
mov rcx, r12
call fcn.140055710
mov rdx, qword [rsp + 0x70]
mov r8, rbp
mov rcx, r12
call fcn.140055710
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140071c23
lea rcx, [rsp + 0x88]
call fcn.14004ea6c
cmp r13b, sil
jne 0x140072643
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x88]
call fcn.14006016c
lea rcx, [rsp + 0x198]
call fcn.14004ea3c
lea rcx, str.DROPFILE
mov rdx, rbx
call fcn.14004fe38
cmp al, sil
je 0x140071dfe
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x198]
mov qword [rsp + 0x80], rsi
call fcn.140063ef4
lea rcx, [rsp + 0x68]
call fcn.140055fcc
lea rcx, [rsp + 0x78]
call fcn.140055fcc
mov r11, qword [rsp + 0x88]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x60]
mov r8d, r15d
mov qword [rsp + 0x60], r11
call fcn.140059810
mov rax, qword [rsp + 0x60]
cmp r15w, word [rax]
jne 0x140071d78
cmp bpl, sil
je 0x140071d5d
mov ecx, 0x26
mov word [rax], cx
jmp 0x140071d66
add rax, 2
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
mov r8d, r15d
call fcn.140059810
lea rcx, [rsp + 0x70]
call fcn.140055fcc
lea rcx, [rsp + 0x58]
call fcn.140055fcc
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
cmp word [rbx], si
lea r8, [rsp + 0x58]
cmove r8, rsi
cmp rcx, rsi
je 0x140071db4
lea rdx, [rsp + 0x70]
call fcn.140005bb4
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, r12
call fcn.140055710
mov r8, qword [rsp + 0x58]
mov rdx, rbx
mov rcx, r12
call fcn.140055710
lea rcx, [rsp + 0x58]
call fcn.14004ea6c
lea rcx, [rsp + 0x70]
call fcn.14004ea6c
lea rcx, [rsp + 0x78]
call fcn.14004ea6c
lea rcx, [rsp + 0x68]
jmp 0x140072631
lea rcx, str.FPOS
mov rdx, rbx
call fcn.14004fe38
cmp al, sil
je 0x1400720b5
mov rcx, qword [rsp + 0x198]
call fcn.1400188a8
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x60], rax
call fcn.14004ea3c
mov rcx, qword [rsp + 0x60]
call fcn.140015c5c
lea rcx, [rsp + 0x80]
call fcn.140055fcc
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x80]
call fcn.140018d04
mov rdi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
mov r13d, 0x26
cmp bpl, sil
je 0x140071e7a
mov word [rbx], r13w
lea rcx, [rsp + 0x98]
call fcn.140055fcc
lea rcx, [rsp + 0x90]
call fcn.140055fcc
lea rcx, [rsp + 0x68]
call fcn.140055fcc
lea rcx, [rsp + 0x78]
call fcn.140055fcc
lea rcx, [rsp + 0x70]
call fcn.140055fcc
lea rcx, [rsp + 0x58]
call fcn.140055fcc
lea rcx, [rsp + 0x60]
call fcn.140055fcc
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x50]
mov r8d, r15d
mov qword [rsp + 0x50], rbx
call fcn.140059810
mov rax, qword [rsp + 0x50]
cmp r15w, word [rax]
jne 0x140072019
cmp bpl, sil
je 0x140071efa
mov word [rax], r13w
jmp 0x140071f03
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x50]
mov r8d, r15d
call fcn.140059810
mov rax, qword [rsp + 0x50]
cmp r15w, word [rax]
jne 0x140072019
cmp bpl, sil
je 0x140071f32
mov word [rax], r13w
jmp 0x140071f3b
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x50]
mov r8d, r15d
call fcn.140059810
mov rax, qword [rsp + 0x50]
cmp r15w, word [rax]
jne 0x140072019
cmp bpl, sil
je 0x140071f67
mov word [rax], r13w
jmp 0x140071f70
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
mov r8d, r15d
call fcn.140059810
mov rax, qword [rsp + 0x50]
cmp r15w, word [rax]
jne 0x140072019
cmp bpl, sil
je 0x140071f9c
mov word [rax], r13w
jmp 0x140071fa5
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
mov r8d, r15d
call fcn.140059810
mov rax, qword [rsp + 0x50]
cmp r15w, word [rax]
jne 0x140072019
cmp bpl, sil
je 0x140071fcd
mov word [rax], r13w
jmp 0x140071fd6
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
mov r8d, r15d
call fcn.140059810
mov rax, qword [rsp + 0x50]
cmp r15w, word [rax]
jne 0x140072019
cmp bpl, sil
je 0x140071ffe
mov word [rax], r13w
jmp 0x140072007
add rax, 2
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
mov r8d, r15d
call fcn.140059810
mov rax, qword [rsp + 0x60]
mov r9, qword [rsp + 0x90]
mov r8, qword [rsp + 0x98]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x58]
mov rdx, rdi
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x70]
mov rcx, r12
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
call fcn.14004a878
lea rcx, [rsp + 0x60]
movsxd rsi, eax
call fcn.14004ea6c
lea rcx, [rsp + 0x58]
call fcn.14004ea6c
lea rcx, [rsp + 0x70]
call fcn.14004ea6c
lea rcx, [rsp + 0x78]
call fcn.14004ea6c
lea rcx, [rsp + 0x68]
call fcn.14004ea6c
lea rcx, [rsp + 0x90]
call fcn.14004ea6c
lea rcx, [rsp + 0x98]
jmp 0x140072624
lea rcx, str.PPID
mov rdx, rbx
call fcn.14004fe38
cmp al, sil
je 0x1400720f8
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x198]
mov qword [rsp + 0x80], rsi
call fcn.140063ef4
mov rcx, qword [rsp + 0x80]
call fcn.140005ff4
mov rdx, rax
jmp 0x140072113
lea rcx, str.ISADMIN
mov rdx, rbx
call fcn.14004fe38
cmp al, sil
je 0x140072128
call fcn.1400bc2dc
mov edx, eax
mov r8, qword [rsp + 0x88]
mov rcx, r12
call fcn.140058f7c
jmp 0x140072636
lea rcx, str.PWIN
mov rdx, rbx
call fcn.14004fe38
cmp al, sil
je 0x140072303
lea rcx, [rsp + 0x98]
call fcn.140055fcc
lea rcx, [rsp + 0x80]
call fcn.140055fcc
mov r11, qword [rsp + 0x88]
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x90]
xor r9d, r9d
mov r8d, r15d
mov qword [rsp + 0x90], r11
call fcn.1400488e8
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x90]
mov r8d, r15d
call fcn.140059810
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x198]
mov qword [rsp + 0x50], rsi
call fcn.14008a3ec
mov ecx, dword [rsp + 0x68]
cmp eax, esi
lea rdx, [rsp + 0x50]
cmovne ecx, dword [rsp + 0x50]
mov dword [rsp + 0x68], ecx
lea rcx, [rsp + 0x198]
call fcn.14008a3ec
mov ecx, dword [rsp + 0x6c]
lea rdx, [rsp + 0x50]
cmp eax, esi
cmovne ecx, dword [rsp + 0x50]
mov qword [rsp + 0x50], 3
mov dword [rsp + 0x6c], ecx
mov rax, qword [rsp + 0x68]
lea rcx, [rsp + 0x198]
mov qword [rsp + 0x58], rax
call fcn.14008a3ec
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_WindowFromPoint]
mov rbx, qword [rsp + 0x80]
mov r13, rax
mov rdi, rax
cmp rax, rsi
je 0x1400722ba
mov rbp, qword [rsp + 0x50]
cmp rbp, 3
jne 0x140072246
cmp word [rbx], si
je 0x1400722ba
mov r14d, 0xfffffff0
jmp 0x14007225f
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetParent]
cmp rax, rsi
je 0x140072271
mov rdi, rax
mov edx, r14d
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jb 0x14007224e
cmp rbp, 3
je 0x1400722ba
lea rdx, [rsp + 0x60]
mov rcx, rdi
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x64], esi
call qword [sym.imp.USER32.dll_ClientToScreen]
mov r11d, dword [rsp + 0x60]
mov eax, dword [rsp + 0x64]
sub dword [rsp + 0x58], r11d
mov r8d, ebp
sub dword [rsp + 0x5c], eax
mov rdx, qword [rsp + 0x58]
mov rcx, rdi
mov r13, rdi
call qword [sym.imp.USER32.dll_ChildWindowFromPointEx]
cmp rax, rsi
cmovne r13, rax
mov r8, qword [rsp + 0x98]
lea r9, [0x1400ee708]
mov rdx, r13
mov rcx, r12
call fcn.140058ea4
lea r9, [0x1400ee708]
mov r8, rbx
mov rdx, rdi
mov rcx, r12
call fcn.140058ea4
lea rcx, [rsp + 0x80]
call fcn.14004ea6c
lea rcx, [rsp + 0x98]
jmp 0x140072631
lea rcx, str.PEBIT
mov rdx, rbx
call fcn.14004fe38
cmp al, sil
je 0x140072636
mov rax, qword [rsp + 0x88]
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x98], rax
call fcn.140055fcc
lea rcx, [rsp + 0x58]
call fcn.140055fcc
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x98]
xor r9d, r9d
mov r8d, r15d
call fcn.1400488e8
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x98]
mov r8d, r15d
call fcn.140059810
or r14, 0xffffffffffffffff
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x198]
lea r8d, [r14 + 0xe]
mov r13, r14
lea rbp, [0x1400e94a4]
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], rsi
call fcn.1400236d0
mov rcx, qword [rsp + 0x198]
cmp word [rcx], si
je 0x1400725d3
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov rax, qword [rsp + 0x198]
cmp word [rax + rcx*2 - 2], 0x5c
je 0x1400723e8
cmp word [rax + rcx*2 - 2], 0x2f
je 0x1400723e8
mov rcx, rax
call fcn.1400cbe14
cmp eax, esi
jne 0x1400723ed
mov rdx, qword [rsp + 0x198]
jmp 0x14007241d
mov word [rax + rcx*2 - 2], si
mov rdx, qword [rsp + 0x198]
lea rcx, [rsp + 0x60]
call fcn.140060284
lea rdx, str._version.dll
lea rcx, [rsp + 0x60]
call fcn.140056108
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x198], rdx
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], 0x80
lea rcx, [rsp + 0x90]
mov r9d, 7
mov r8d, 0x80000000
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x20], rsi
call fcn.140003590
mov rdi, qword [rsp + 0x90]
cmp rdi, rsi
je 0x1400725d3
mov r15d, 0x1000
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x1a8], esi
mov rdx, r15
call fcn.140056040
mov rbx, qword [rsp + 0x90]
mov r8, r15
mov rcx, rbx
xor edx, edx
call fcn.1400cc8d0
lea r9, [rsp + 0x1a8]
mov r8d, r15d
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, esi
je 0x1400725b8
mov edx, dword [rsp + 0x1a8]
cmp edx, 0x40
jb 0x1400725b8
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x1400725b8
mov ecx, dword [rbx + 0x3c]
lea eax, [rcx + 8]
cmp eax, edx
jbe 0x140072527
mov rdx, rcx
xor r8d, r8d
mov rcx, rdi
mov qword [rbx], rsi
call fcn.14004fd5c
lea r9, [rsp + 0x1a8]
mov r8d, 8
mov rdx, rbx
mov rcx, rdi
mov dword [rsp + 0x1a8], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rsp + 0x1a8]
mov ecx, esi
lea eax, [rcx + 8]
cmp eax, edx
ja 0x1400725b8
mov eax, ecx
mov r13, qword [rax + rbx]
movabs rax, 0xffffffffffff
and r13, rax
movabs rax, 0x866400004550
cmp r13, rax
jne 0x14007255d
lea rbp, [0x1400f3618]
jmp 0x1400725b8
movabs rax, 0x14c00004550
cmp r13, rax
je 0x1400725b1
movabs rax, 0x20000004550
cmp r13, rax
jne 0x140072584
lea rbp, str.ia64
jmp 0x1400725b8
movabs rax, 0x1373c05454e
cmp r13, rax
je 0x1400725b1
movabs rax, 0x1b03c05454e
cmp r13, rax
je 0x1400725b1
movabs rax, 0xe73c05454e
cmp r13, rax
jne 0x1400725b8
lea rbp, [0x1400f3600]
lea rcx, [rsp + 0x90]
call fcn.14004ea6c
cmp rdi, r14
je 0x1400725d3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x80]
mov r8, rbp
mov rcx, r12
call fcn.140055710
cmp r13, rsi
mov rcx, r12
jg 0x140072601
mov rdx, qword [rsp + 0x58]
lea r8, str._0x000000000001
call fcn.140055710
jmp 0x140072615
mov r8, qword [rsp + 0x58]
lea r9, str.0x_012I64X
mov rdx, r13
call fcn.140058ea4
lea rcx, [rsp + 0x60]
call fcn.14004ea6c
lea rcx, [rsp + 0x58]
call fcn.14004ea6c
lea rcx, [rsp + 0x80]
call fcn.14004ea6c
lea rcx, [rsp + 0x88]
call fcn.14004ea6c
lea rcx, [rsp + 0xa8]
call fcn.14004ea6c
lea rcx, [rsp + 0xa0]
call fcn.14004ea6c
mov rbx, qword [rsp + 0x190]
mov rax, rsi
add rsp, 0x150
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret