Function at 0x14002b960
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create process suspended
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1330]
mov eax, 0x1430
call fcn.140048fb0
sub rsp, rax
mov rax, qword [0x140071040]
xor rax, rsp
mov qword [rbp + 0x1320], rax
mov r14, rdx
mov qword [rbp - 0x48], rdx
mov ebx, ecx
xor edi, edi
mov dword [rsp + 0x58], edi
xorps xmm0, xmm0
movups xmmword [rbp + 0x270], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x280], xmm1
lea r8d, [rdi + 4]
lea rdx, str._jar
lea rcx, [rbp + 0x270]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x290], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2a0], xmm1
lea r8d, [rdi + 0x13]
lea rdx, str.___Executed_file:
lea rcx, [rbp + 0x290]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2c0], xmm1
lea r8d, [rdi + 4]
lea rdx, str..bat
lea rcx, [rbp + 0x2b0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2e0], xmm1
lea r8d, [rdi + 0x13]
lea rdx, str.___Executed_file:
lea rcx, [rbp + 0x2d0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rdi
lfence
mov ecx, 0x80
call fcn.1400069a0
mov rdi, rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
lea rcx, [rax + 0x80]
mov qword [rbp - 0x80], rcx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x68], rax
lea rsi, [rbp + 0x270]
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rdi
lea rax, [rsp + 0x70]
mov qword [rbp - 0x60], rax
nop
mov qword [rsp + 0x58], rdi
mov rdx, rsi
mov rcx, rdi
call fcn.140005560
nop
lea rcx, [rdi + 0x20]
lea rdx, [rsi + 0x20]
call fcn.140005560
nop
add rdi, 0x40
mov qword [rbp - 0x68], rdi
add rsi, 0x40
lea rax, [rbp + 0x2f0]
cmp rsi, rax
jne 0x14002bac0
mov qword ds:[rbp - 0x70], rdi
mov qword [rsp + 0x78], rdi
xor esi, esi
mov qword [rsp + 0x68], rsi
lea r9, [0x140015140]
lea edx, [rsi + 0x40]
lea r8d, [rsi + 2]
lea rcx, [rbp + 0x270]
call fcn.1400486ec
lea rdx, str.__A_Z_:______.exe_...__s_
lea rcx, [rbp + 0x180]
call fcn.140022200
nop
lea r9, [rbp + 0x31a]
sub r9, 2
mov eax, 0xcccccccd
mul ebx
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub bx, cx
add bx, 0x30
mov word [r9], bx
mov ebx, edx
test edx, edx
jne 0x14002bb40
xorps xmm0, xmm0
movups xmmword [rbp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x258], xmm1
lea rax, [rbp + 0x31a]
cmp r9, rax
jne 0x14002bba6
movdqa xmm0, xmmword [0x140060dd0]
movdqu xmmword [rbp + 0x258], xmm0
mov word [rbp + 0x248], si
jmp 0x14002bbc5
lea r8, ds:[rbp + 0x31a]
sub r8, r9
sar r8, 1
mov rdx, r9
lea rcx, [rbp + 0x248]
call fcn.1400066a0
mov dword [rsp + 0x58], 0xc
mov r15d, 0xe
mov r9d, r15d
lea r8, str.memory.exe__p
lea rcx, [rbp + 0x248]
call fcn.140015540
xorps xmm0, xmm0
movups xmmword [rbp + 0x228], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x238], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x228], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x238], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rcx, [rbp + 0x248]
call fcn.1400058e0
mov qword [rbp - 0x40], 0x18
mov qword [rbp - 0x30], 1
mov qword [rbp - 0x38], rsi
xor r9d, r9d
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xor r8d, r8d
lea edx, [r15 - 0xd]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov dword [rbp + 0x110], 0x68
xorps xmm0, xmm0
movups xmmword [rbp + 0x118], xmm0
movups xmmword [rbp + 0x128], xmm0
movups xmmword [rbp + 0x138], xmm0
movups xmmword [rbp + 0x148], xmm0
movups xmmword [rbp + 0x158], xmm0
movups xmmword [rbp + 0x168], xmm0
mov rax, qword [rbp - 0x50]
mov qword [rbp + 0x168], rax
psrldq xmm0, 4
movd eax, xmm0
or eax, 0x101
mov dword [rbp + 0x14c], eax
mov word [rbp + 0x150], si
lea rdx, [rbp + 0x228]
cmp qword [rbp + 0x240], 7
cmova rdx, qword [rbp + 0x228]
lea rax, [rbp]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x110]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
nop dword [rax + rax]
test eax, eax
je 0x14002c430
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x320]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x50]
mov r8d, 0x1000
lea rdx, [rbp + 0x320]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002c407
lea r13, vtable.std::basic_istringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
lea r12, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
nop
cmp dword [rsp + 0x50], 0
je 0x14002c407
lea rax, [rbp + 0x320]
mov r9, 0xffffffffffffffff
nop dword [rax]
inc r9
cmp byte [rax + r9], 0
jne 0x14002bda0
lea rax, [rbp + 0x320]
add rax, r9
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e8], xmm0
mov qword [rbp + 0x1f8], rsi
mov qword [rbp + 0x200], rsi
lea rcx, [rbp + 0x320]
cmp rcx, rax
jne 0x14002bdf7
mov rbx, rsi
mov qword [rbp + 0x1f8], rbx
mov edi, 7
mov qword [rbp + 0x200], rdi
mov word [rbp + 0x1e8], si
jmp 0x14002be18
lea rdx, [rbp + 0x320]
lea rcx, [rbp + 0x1e8]
call fcn.1400123a0
mov rdi, qword [rbp + 0x200]
mov rbx, qword [rbp + 0x1f8]
lea rax, [0x14005b680]
mov qword [rbp + 0x20], rax
lea rcx, [rbp + 0xb0]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
nop
or r15d, 1
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x58], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x20]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__::constructor_class_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x20], r13
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x90]
mov dword [rbp + rcx + 0x1c], edx
lea rax, [rbp + 0x30]
mov qword [rbp - 0x70], rax
lea rcx, [rbp + 0x30]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
nop
mov qword [rbp + 0x30], r12
lea rsi, [rbp + 0x1e8]
cmp rdi, 7
cmova rsi, qword [rbp + 0x1e8]
mov eax, 2
cmp rbx, 0x7fffffff
ja 0x14002c3fc
test rbx, rbx
je 0x14002bf27
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x14002c4c9
lfence
mov rax, qword [rbp + 0x1f8]
lea rdi, [rax + rax]
mov rcx, rdi
call fcn.1400069a0
mov rbx, rax
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rdi + rbx]
mov qword [rbp + 0x98], rcx
mov rcx, qword [rbp + 0x48]
mov qword [rcx], rbx
mov rcx, qword [rbp + 0x68]
mov qword [rcx], rbx
sar rdi, 1
mov rax, qword [rbp + 0x80]
mov dword [rax], edi
mov eax, 3
mov ecx, dword [rsp + 0x58]
mov qword [rsp + 0x68], rcx
xor esi, esi
jmp 0x14002bf30
xor esi, esi
mov qword [rbp + 0x98], rsi
mov dword [rbp + 0xa0], eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c8], xmm0
mov qword [rbp + 0x1d8], rsi
mov qword [rbp + 0x1e0], 7
mov word [rbp + 0x1c8], si
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x20]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
movzx r8d, ax
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp + 0x20]
call fcn.1400239e0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x14002c365
nop dword [rax]
xor r13b, r13b
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
cmp rdi, r12
je 0x14002c1e9
nop word [rax + rax]
lea r15, [rdi + 0x20]
mov rax, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 7
jbe 0x14002bfdb
mov rcx, qword [rdi]
lea r8, [rcx + rax*2]
mov rdx, rcx
jmp 0x14002bfe2
lea r8, [rdi + rax*2]
mov rdx, rdi
xorps xmm0, xmm0
movups xmmword [rbp + 0x208], xmm0
mov qword [rbp + 0x218], rsi
mov qword [rbp + 0x220], rsi
cmp rdx, r8
jne 0x14002c01d
mov qword [rbp + 0x218], rsi
mov ebx, 7
mov qword [rbp + 0x220], rbx
xor eax, eax
mov word [rbp + 0x208], ax
jmp 0x14002c03d
sub r8, rdx
sar r8, 1
lea rcx, [rbp + 0x208]
call fcn.1400066a0
mov rbx, qword [rbp + 0x220]
mov rsi, qword [rbp + 0x218]
lea rax, [rbp + 0x1c8]
cmp qword [rbp + 0x1e0], 7
cmova rax, qword [rbp + 0x1c8]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp + 0x1d8]
mov qword [rbp - 0x18], rax
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x70], xmm0
lea rcx, [rbp - 0x70]
call fcn.140004d80
test al, al
jne 0x14002c1be
lea r11, [rbp + 0x208]
cmp rbx, 7
cmova r11, qword [rbp + 0x208]
lea rbx, [rbp + 0x1c8]
cmp qword [rbp + 0x1e0], 7
cmova rbx, qword [rbp + 0x1c8]
mov rax, qword [rbp + 0x1d8]
cmp rsi, rax
ja 0x14002c1be
sub rax, rsi
test rsi, rsi
je 0x14002c154
inc rax
lea r14, [rbx + rax*2]
mov rax, rbx
movzx r10d, word [r11]
nop word [rax + rax]
mov rcx, r14
sub rcx, rax
sar rcx, 1
mov edx, 0
je 0x14002c10c
cmp word [rax], r10w
je 0x14002c109
cmp rcx, 1
je 0x14002c10c
dec rcx
add rax, 2
cmp word [rax], r10w
jne 0x14002c0f6
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x14002c1be
mov r8, rsi
mov rdx, r11
test rsi, rsi
je 0x14002c148
mov r9, rax
sub r9, r11
nop dword [rax + rax]
movzx ecx, word [r9 + rdx]
cmp cx, word [rdx]
jne 0x14002c22b
add rdx, 2
sub r8, 1
jne 0x14002c130
sub rax, rbx
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x14002c1be
mov r8, qword [r15 + 0x10]
cmp qword [r15 + 0x18], 7
jbe 0x14002c162
mov r15, qword [r15]
mov rdx, r15
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140008ee0
lea rdx, [rbp + 0x1c8]
cmp qword [rbp + 0x1e0], 7
cmova rdx, qword [rbp + 0x1c8]
mov r8, qword [rbp + 0x1d8]
mov rcx, rax
call fcn.140008ee0
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r13b, 1
lea r8, [rbp + 0x1c8]
lea rdx, [rbp + 0x1a8]
call fcn.140006140
nop
lea rcx, [rbp + 0x208]
call fcn.1400058e0
add rdi, 0x40
cmp rdi, r12
mov esi, 0
jne 0x14002bfc0
mov r14, qword [rbp - 0x48]
test r13b, r13b
jne 0x14002c30e
mov r8, r14
cmp qword [r14 + 0x18], 7
jbe 0x14002c1f6
mov r8, qword [r14]
cmp qword [r14 + 0x10], 7
jne 0x14002c234
mov edx, 7
lea rax, str.Winmgmt
mov rcx, rax
sub r8, rax
nop
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x14002c234
add rcx, 2
sub rdx, 1
jne 0x14002c210
jmp 0x14002c30e
add rax, 2
jmp 0x14002c0e0
lea rcx, [rbp + 0x1c8]
cmp qword [rbp + 0x1e0], 7
cmova rcx, qword [rbp + 0x1c8]
mov rax, qword [rbp + 0x1d8]
lea rdx, [rcx + rax*2]
mov dword [rsp + 0x20], 0x10
lea r9, [rbp + 0x180]
call fcn.140023bc0
test al, al
je 0x14002c30e
lea rax, [rbp + 0x1c8]
cmp qword [rbp + 0x1e0], 7
cmova rax, qword [rbp + 0x1c8]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x1d8]
mov qword [rbp - 8], rax
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x70], xmm0
lea rcx, [rbp - 0x70]
call fcn.140004d80
test al, al
jne 0x14002c30e
lea rdx, str.___Executed_file_with_modified_extension:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
nop dword [rax]
call fcn.1400064a0
lea rdx, [rbp + 0x1c8]
cmp qword [rbp + 0x1e0], 7
cmova rdx, qword [rbp + 0x1c8]
mov r8, qword [rbp + 0x1d8]
mov rcx, rax
call fcn.140008ee0
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, [rbp + 0x1c8]
lea rdx, [rbp + 0x1b8]
call fcn.140006140
mov rax, qword ds:[rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x20]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
movzx r8d, ax
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp + 0x20]
call fcn.1400239e0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
mov esi, 0
jne 0x14002bfa0
lea r12, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
lea r13, vtable.std::basic_istringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
lea rcx, [rbp + 0x1c8]
call fcn.1400058e0
nop
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x20], r13
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x90]
mov dword [rbp + rcx + 0x1c], edx
mov qword [rbp + 0x30], r12
lea rcx, [rbp + 0x30]
call fcn.14002db20
lea rcx, [rbp + 0x30]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea rcx, [rbp + 0x38]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1e8]
call fcn.1400058e0
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x50]
mov r8d, 0x1000
lea rdx, [rbp + 0x320]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002c407
mov r15, qword [rsp + 0x68]
jmp 0x14002bd80
nop dword [rax]
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_alloc_void_]
nop
mov edx, 0xffffffff
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword ds:[rbp]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x228]
call fcn.1400058e0
nop
lea rcx, [rbp + 0x180]
call fcn.1400181a0
mov rcx, qword ds:[rbp + 0x1a0]
test rcx, rcx
je 0x14002c48f
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14004ed88]
mov r8, rax
test rax, rax
je 0x14002c48f
mov rcx, qword [rax]
mov rax, qword [rcx]
mov edx, 1
mov rcx, r8
call qword [0x14004ed88]
nop
lea rcx, [rsp + 0x70]
call fcn.140015280
mov rcx, qword [rbp + 0x1320]
xor rcx, rsp
call fcn.1400482e0
lea r11, [rsp + 0x1430]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140003ed0
nop
int3