Function at 0x1400014a0
Capabilities:
Check for peb beingdebugged flag
Check os version
Get file size
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x248
mov r15d, ecx
mov rbx, rdx
test ecx, ecx
je 0x140001af6
mov rsi, qword [sym.imp.ucrtbase.dll__wcsicmp]
mov r14d, 2
xor r12d, r12d
xor r13d, r13d
lea rdi, str._xml
lea rbp, [0x140005080]
jmp 0x14000150c
cmp r15d, 1
jle 0x140001838
test r12, r12
jne 0x140001868
mov r12, qword [rbx + 8]
sub r15d, 2
add rbx, 0x10
test r15d, r15d
je 0x14000154c
mov rcx, qword [rbx]
mov rdx, rdi
call rsi
test eax, eax
je 0x1400014e8
mov rcx, qword [rbx]
mov rdx, rbp
call rsi
test eax, eax
jne 0x1400017d0
cmp r15d, 1
jle 0x140001ac4
test r13, r13
jne 0x140001add
sub r15d, 2
mov r13, qword [rbx + 8]
add rbx, 0x10
test r15d, r15d
jne 0x14000150c
test r13, r13
je 0x140001af6
test r12, r12
je 0x140001de1
mov rcx, r12
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov r8d, 1
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.kernel32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x140001b6f
lea rdx, [rsp + 0x110]
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetFileSizeEx]
test eax, eax
je 0x14000199d
mov r8, qword [rsp + 0x110]
test r8, r8
je 0x14000199d
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x140001c1f
mov rcx, r12
mov r8d, dword [rsp + 0x110]
mov rdx, rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xf0]
call qword [sym.imp.kernel32.dll_ReadFile]
mov rcx, r12
mov esi, eax
call qword [sym.imp.kernel32.dll_CloseHandle]
test esi, esi
je 0x140001c28
mov r9d, dword [rsp + 0xf0]
cmp r9d, 2
jbe 0x140001639
cmp byte [rbx], 0xff
je 0x140001bd8
mov r8, rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rdi, qword [sym.imp.kernel32.dll_MultiByteToWideChar]
call rdi
xor ecx, ecx
mov esi, eax
mov edx, eax
call qword [sym.imp.oleaut32.dll_SysAllocStringLen]
mov r15, rax
test rax, rax
je 0x140001c4d
mov r8, rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xf0]
call rdi
mov r8, rbx
xor edx, edx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapFree]
call fcn.140001280
mov r12, rax
test rax, rax
je 0x140001ba3
mov rcx, r13
call qword [sym.imp.oleaut32.dll_SysAllocString]
xor r10d, r10d
xor r8d, r8d
xor r9d, r9d
mov r13, rax
mov rcx, r12
mov rax, qword [rsp + 0xe0]
mov word [rsp + 0x110], r10w
mov word [rsp + 0xf0], r9w
lea rdx, [rsp + 0xc8]
mov r9d, r14d
movdqa xmm1, xmmword [rsp + 0xf0]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x100]
movdqa xmm2, xmmword [rsp + 0x110]
movaps xmmword [rsp + 0x80], xmm1
mov word [rsp + 0xd0], r8w
mov r8, r15
movdqa xmm0, xmmword [rsp + 0xd0]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x120]
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x60], xmm2
mov qword [rsp + 0x70], rax
mov rax, qword [r12]
mov qword [rsp + 0x40], rdx
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x38], rdx
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0xa0]
mov qword [rsp + 0x20], rdx
mov rdx, r13
mov dword [rsp + 0x30], 0
call qword [rax + pe_nt_image_headers64]
mov rsi, qword [sym.imp.oleaut32.dll_SysFreeString]
mov rcx, r13
mov ebx, eax
call rsi
mov rcx, r15
call rsi
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x10]
test ebx, ebx
js 0x140001845
mov rcx, qword [rsp + 0xc8]
xor r12d, r12d
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14000184b
mov rcx, qword [rbx]
lea rdx, [0x1400050b4]
call rsi
test eax, eax
jne 0x1400017f8
sub r15d, 1
add rbx, 8
mov r14d, 6
jmp 0x140001507
mov rcx, qword [rbx]
lea rdx, [0x1400050ba]
call rsi
test eax, eax
jne 0x140001c82
movzx eax, byte [section..data]
and eax, 1
cmp r15d, 1
jle 0x140001c6e
test al, al
jne 0x140001890
sub r15d, 2
add rbx, 0x10
jmp 0x140001507
test byte [section..data], 1
jne 0x140001991
mov r12d, 1
mov eax, r12d
add rsp, 0x248
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r9, str.Duplicated__xml_argument_n
test byte [section..data], 1
je 0x140001845
lea r8, str.create_command
lea rdx, section..data
xor ecx, ecx
call fcn.140001220
jmp 0x140001845
mov rcx, qword [rbx + 8]
lea rax, str._null_
test rcx, rcx
je 0x1400019ea
mov rax, rcx
shr rax, 0x10
je 0x140001b2a
mov qword [rsp + 0x58], rcx
mov rdx, 0xffffffffffffffff
call qword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov r8d, eax
lea rax, str._invalid_
test r8d, r8d
jne 0x1400019ea
mov rcx, qword [rsp + 0x58]
cmp word [rcx], 0
je 0x140001b49
xor eax, eax
nop word [rax + rax]
mov r8d, eax
add rax, 1
cmp word [rcx + rax*2], 0
jne 0x1400018f0
mov edx, 0x224c
lea r9, [rsp + 0x232]
mov word [rsp + 0x110], dx
lea rdx, [rsp + 0x112]
jmp 0x140001959
cmp ax, 9
je 0x140001a20
cmp ax, 0xa
jne 0x140001a53
mov eax, 0x6e5c
add rdx, 2
mov word [rdx - 2], ax
nop dword [rax]
lea eax, [r8 - 1]
test r8d, r8d
jle 0x1400019be
cmp rdx, r9
ja 0x1400019be
mov r8d, eax
movzx eax, word [rcx]
add rcx, 2
cmp ax, 0xd
je 0x140001a32
jbe 0x140001920
cmp ax, 0x22
je 0x140001ab0
cmp ax, 0x5c
jne 0x140001a44
mov r10d, 0x5c5c
add rdx, 2
mov word [rdx - 2], r10w
jmp 0x140001948
lea r9, str.Missing__xml_value_n
jmp 0x140001878
test byte [section..data], 1
jne 0x140001bb7
mov rcx, r12
mov r12d, 1
call qword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x14000184b
mov byte [rdx], 0x22
test eax, eax
jle 0x140001b66
mov ecx, 0x2e2e
mov byte [rdx + 3], 0x2e
lea rax, [rdx + 4]
mov word [rdx + 1], cx
mov byte [rax], 0
lea rcx, [rsp + 0x110]
call fcn.140002fe0
mov qword [rsp + 0x20], rax
xor ecx, ecx
sub r15d, 2
add rbx, 0x10
lea r9, str.Unsupported__ru_option__s_n
lea r8, str.create_command
lea rdx, section..data
call fcn.140001220
jmp 0x140001507
mov eax, 0x745c
add rdx, 2
mov word [rdx - 2], ax
jmp 0x140001948
mov eax, 0x725c
add rdx, 2
mov word [rdx - 2], ax
jmp 0x140001948
lea r10d, [rax - 0x20]
cmp r10w, 0x5e
jbe 0x140001b3e
mov r10d, eax
lea r11, str.0123456789abcdefwmain
mov byte [rdx], 0x5c
add rdx, 5
shr r10w, 0xc
and r10d, 0xf
movzx r10d, byte [r11 + r10]
mov byte [rdx - 4], r10b
mov r10d, eax
shr r10w, 8
and r10d, 0xf
movzx r10d, byte [r11 + r10]
mov byte [rdx - 3], r10b
mov r10d, eax
and eax, 0xf
shr r10w, 4
movzx eax, byte [r11 + rax]
and r10d, 0xf
movzx r10d, byte [r11 + r10]
mov byte [rdx - 1], al
mov byte [rdx - 2], r10b
jmp 0x140001948
mov r11d, 0x225c
add rdx, 2
mov word [rdx - 2], r11w
jmp 0x140001948
lea r9, str.Missing__tn_value_n
test byte [section..data], 1
je 0x140001845
jmp 0x140001878
lea r9, str.Duplicated__tn_argument_n
test byte [section..data], 1
je 0x140001845
jmp 0x140001878
test byte [section..data], 1
je 0x140001845
lea r9, str.Missing__tn_argument_n
lea r8, str.create_command
xor ecx, ecx
mov r12d, 1
lea rdx, section..data
call fcn.140001220
jmp 0x14000184b
movzx edx, cx
lea rcx, str._04x
call fcn.140001430
jmp 0x1400019ea
mov byte [rdx], al
add rdx, 1
jmp 0x140001948
mov ecx, 0x224c
mov byte [rsp + 0x112], 0x22
lea rdx, [rsp + 0x112]
mov word [rsp + 0x110], cx
lea rax, [rdx + 1]
jmp 0x1400019da
test byte [section..data], 1
je 0x140001845
lea r9, str.Could_not_open_file_n
lea r8, str.read_file_to_bstr
xor ecx, ecx
mov r12d, 1
lea rdx, section..data
call fcn.140001220
jmp 0x14000184b
mov rcx, r15
mov r12d, 1
call qword [sym.imp.oleaut32.dll_SysFreeString]
jmp 0x14000184b
lea r9, str.Empty_file_n
lea r8, str.read_file_to_bstr
xor ecx, ecx
lea rdx, section..data
call fcn.140001220
jmp 0x1400019aa
cmp byte [rbx + 1], 0xfe
jne 0x140001639
lea edx, [r9 - 2]
lea rcx, [rbx + 2]
shr edx, 1
call qword [sym.imp.oleaut32.dll_SysAllocStringLen]
xor edx, edx
mov r8, rbx
mov r15, rax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapFree]
test r15, r15
jne 0x1400016a8
jmp 0x140001845
mov rcx, r12
call qword [sym.imp.kernel32.dll_CloseHandle]
test byte [section..data], 1
je 0x140001c4d
lea r9, str.Read_failed_n
lea r8, str.read_file_to_bstr
xor ecx, ecx
lea rdx, section..data
call fcn.140001220
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x140001845
lea r9, str.Missing__ru_value_n
test al, al
je 0x140001845
jmp 0x140001878
test byte [section..data], 1
je 0x140001845
mov rbx, qword [rbx]
lea rax, str._null_
test rbx, rbx
je 0x140001da3
mov rax, rbx
shr rax, 0x10
je 0x140001e15
mov rdx, 0xffffffffffffffff
mov rcx, rbx
call qword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov r8d, eax
lea rax, str._invalid_
test r8d, r8d
jne 0x140001da3
cmp word [rbx], 0
je 0x140001eab
xor eax, eax
mov r9d, eax
add rax, 1
cmp word [rbx + rax*2], 0
jne 0x140001cde
mov eax, 0x224c
lea r8, str.0123456789abcdefwmain
lea r10, [rsp + 0x232]
mov word [rsp + 0x110], ax
lea rax, [rsp + 0x112]
jmp 0x140001d46
cmp dx, 9
je 0x140001e73
cmp dx, 0xa
jne 0x140001e29
mov r12d, 0x6e5c
add rax, 2
mov word [rax - 2], r12w
lea edx, [r9 - 1]
test r9d, r9d
jle 0x140001d7a
cmp rax, r10
ja 0x140001d7a
mov r9d, edx
movzx edx, word [rbx]
add rbx, 2
cmp dx, 0xd
je 0x140001dcf
jbe 0x140001d12
cmp dx, 0x22
je 0x140001e99
cmp dx, 0x5c
jne 0x140001e85
mov r11d, 0x5c5c
add rax, 2
mov word [rax - 2], r11w
jmp 0x140001d35
mov byte [rax], 0x22
test edx, edx
jle 0x140001ec5
mov word [rax + 1], 0x2e2e
lea rdx, [rax + 4]
mov byte [rax + 3], 0x2e
mov byte [rdx], 0
lea rcx, [rsp + 0x110]
call fcn.140002fe0
mov qword [rsp + 0x20], rax
lea r9, str.Unsupported_argument__s_n
lea r8, str.create_command
xor ecx, ecx
lea rdx, section..data
mov r12d, 1
call fcn.140001220
jmp 0x14000184b
mov ebp, 0x725c
add rax, 2
mov word [rax - 2], bp
jmp 0x140001d35
mov r12d, 0x80004005
test byte [section..data], 1
je 0x14000184b
lea r9, str.Missing__xml_argument_n
lea r8, str.create_command
xor ecx, ecx
lea rdx, section..data
call fcn.140001220
jmp 0x14000184b
movzx edx, bx
lea rcx, str._04x
call fcn.140001430
jmp 0x140001da3
mov ecx, edx
mov byte [rax], 0x5c
add rax, 5
shr cx, 0xc
and ecx, 0xf
movzx ecx, byte [r8 + rcx]
mov byte [rax - 4], cl
mov ecx, edx
shr cx, 8
and ecx, 0xf
movzx ecx, byte [r8 + rcx]
mov byte [rax - 3], cl
mov ecx, edx
and edx, 0xf
shr cx, 4
movzx edx, byte [r8 + rdx]
and ecx, 0xf
movzx ecx, byte [r8 + rcx]
mov byte [rax - 1], dl
mov byte [rax - 2], cl
jmp 0x140001d35
mov edi, 0x745c
add rax, 2
mov word [rax - 2], di
jmp 0x140001d35
lea ecx, [rdx - 0x20]
cmp cx, 0x5e
ja 0x140001e29
mov byte [rax], dl
add rax, 1
jmp 0x140001d35
mov esi, 0x225c
add rax, 2
mov word [rax - 2], si
jmp 0x140001d35
mov byte [rsp + 0x112], 0x22
lea rax, [rsp + 0x112]
mov word [rsp + 0x110], 0x224c
lea rdx, [rax + 1]
jmp 0x140001d93