Function at 0x140002820
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1740
call fcn.14006a6b0
sub rsp, rax
mov qword [rsp + 0x488], 0xfffffffffffffffe
mov qword [rsp + 0x1780], rbx
mov qword [rsp + 0x1788], rsi
mov rax, qword [0x1400dc010]
xor rax, rsp
mov qword [rsp + 0x1730], rax
mov ebx, r8d
mov rdi, rdx
mov r15, rcx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x330], rcx
mov qword [rsp + 0x338], rdx
xor r12d, r12d
mov dword [rsp + 0x50], r12d
call fcn.14000db70
mov rcx, rax
mov qword [rsp + 0x498], rax
test rax, rax
je 0x140003aeb
mov rax, qword [rax]
call qword [rax + 0x18]
mov qword [rsp + 0x4a0], rax
add rax, 0x18
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x28], r12
lea rax, [rsp + 0x520]
mov qword [rsp + 0x20], rax
mov r9d, 0x104
xor r8d, r8d
lea rdx, str.powershell.exe
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
lea rcx, [rsp + 0x520]
mov rsi, 0xffffffffffffffff
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140002900
mov dword [rsp + 0x348], eax
mov r8d, eax
lea rdx, [rsp + 0x520]
lea rcx, [rsp + 0x60]
call fcn.14000d350
sub ebx, 1
je 0x140003169
sub ebx, 1
je 0x140002c15
cmp ebx, 1
jne 0x140002f81
mov r14, qword [rdi]
mov qword [rsp + 0x1d0], r14
mov rbx, r12
mov qword [rsp + 0xf0], rbx
movzx ecx, word [r14]
test cx, cx
je 0x140002992
mov word [rsp + 0x78], cx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x140002979
test rbx, rbx
jne 0x140002984
mov rbx, r14
jmp 0x14000297c
mov rbx, r12
mov qword [rsp + 0xf0], rbx
add r14, 2
mov qword [rsp + 0x1d0], r14
jmp 0x140002957
test rbx, rbx
je 0x1400029fa
mov rax, qword [rdi]
mov qword [rsp + 0x368], rax
sub rbx, rax
sar rbx, 1
mov dword [rsp + 0x128], ebx
test ebx, ebx
js 0x140003af6
mov ecx, 1
sub ecx, dword [rax - 8]
mov dword [rsp + 0x12c], ecx
mov eax, dword [rax - 0xc]
sub eax, ebx
mov dword [rsp + 0x130], eax
or eax, ecx
jge 0x1400029e0
mov edx, ebx
mov rcx, rdi
call fcn.14000d2f0
mov rax, qword [rdi]
cmp ebx, dword [rax - 0xc]
jg 0x140003b00
mov dword [rax - 0x10], ebx
movsxd rcx, ebx
mov rax, qword [rdi]
mov word [rax + rcx*2], r12w
mov qword [rsp + 0x370], rdi
mov rbx, qword [rdi]
mov qword [rsp + 0xf8], rbx
nop dword [rax]
movzx ecx, word [rbx]
mov word [rsp + 0x80], cx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x140002a33
add rbx, 2
mov qword [rsp + 0xf8], rbx
jmp 0x140002a10
mov r9, qword [rdi]
mov qword [rsp + 0x378], r9
cmp rbx, r9
je 0x140002b33
mov qword [rsp + 0x380], r9
sub rbx, r9
sar rbx, 1
mov dword [rsp + 0x134], ebx
mov edx, dword [r9 - 0x10]
mov dword [rsp + 0x138], edx
test edx, edx
js 0x140003b0a
mov ecx, 1
sub ecx, dword [r9 - 8]
mov dword [rsp + 0x13c], ecx
mov eax, dword [r9 - 0xc]
sub eax, edx
mov dword [rsp + 0x140], eax
or eax, ecx
jge 0x140002a9b
mov rcx, rdi
call fcn.14000d2f0
mov r9, qword [rdi]
movsxd rax, ebx
lea rdx, [r9 + rax*2]
mov qword [rsp + 0xf8], rdx
mov ecx, dword [r9 - 0x10]
mov dword [rsp + 0x144], ecx
mov r14d, ecx
sub r14d, ebx
mov dword [rsp + 0x148], r14d
mov dword [rsp + 0x14c], ecx
lea eax, [r14 + 1]
movsxd r8, eax
add r8, r8
mov qword [rsp + 0x388], r8
je 0x140002b0e
test rdx, rdx
jne 0x140002af4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
jmp 0x140003b20
lea eax, [rcx + 1]
movsxd rcx, eax
add rcx, rcx
cmp rcx, r8
jb 0x140003b14
mov rcx, r9
call sub.VCRUNTIME140.dll_memmove
test r14d, r14d
js 0x140003b30
mov rax, qword [rdi]
cmp r14d, dword [rax - 0xc]
jg 0x140003b30
mov dword [rax - 0x10], r14d
movsxd rcx, r14d
mov rax, qword [rdi]
mov word [rax + rcx*2], r12w
mov r8, rdi
lea rdx, str.C:WindowsSystem32wbemwmic.exe
lea rcx, [rsp + 0x1e8]
call fcn.14000ba80
mov qword [rsp + 0x390], rax
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov qword [rsp + 0x398], rcx
mov rbx, qword [rdi]
sub rbx, 0x18
mov qword [rsp + 0x1d8], rbx
cmp rcx, rbx
je 0x140002bdb
cmp dword [rbx + 0x10], 0
jl 0x140002bbe
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140002bbe
call fcn.14000d260
mov qword [rsp + 0x1e0], rax
mov eax, esi
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x140002bad
mov rdx, qword [rsp + 0x1d8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsp + 0x1e0]
add rax, 0x18
mov qword [rdi], rax
jmp 0x140002bdb
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x150], r8d
mov qword [rsp + 0x3a0], rdx
mov rcx, rdi
call fcn.14000d350
nop
mov rcx, qword [rsp + 0x1e8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x1f0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140002f81
mov rdx, qword [rsp + 0x1f0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140002f81
lea rdx, [0x140099334]
lea rcx, [rsp + 0xd0]
call fcn.14000c8e0
nop
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x220]
call fcn.14000bc20
mov r15, rax
mov r14, qword [rdi]
mov qword [rsp + 0x1f8], r14
mov rbx, r12
mov qword [rsp + 0x100], rbx
nop dword [rax]
movzx ecx, word [r14]
test cx, cx
je 0x140002c9e
mov word [rsp + 0x88], cx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x140002c85
test rbx, rbx
jne 0x140002c90
mov rbx, r14
jmp 0x140002c88
mov rbx, r12
mov qword [rsp + 0x100], rbx
add r14, 2
mov qword [rsp + 0x1f8], r14
jmp 0x140002c60
test rbx, rbx
je 0x140002d06
mov rax, qword [rdi]
mov qword [rsp + 0x3a8], rax
sub rbx, rax
sar rbx, 1
mov dword [rsp + 0x154], ebx
test ebx, ebx
js 0x140003b3b
mov ecx, 1
sub ecx, dword [rax - 8]
mov dword [rsp + 0x158], ecx
mov eax, dword [rax - 0xc]
sub eax, ebx
mov dword [rsp + 0x15c], eax
or eax, ecx
jge 0x140002cec
mov edx, ebx
mov rcx, rdi
call fcn.14000d2f0
mov rax, qword [rdi]
cmp ebx, dword [rax - 0xc]
jg 0x140003b45
mov dword [rax - 0x10], ebx
movsxd rcx, ebx
mov rax, qword [rdi]
mov word [rax + rcx*2], r12w
mov qword [rsp + 0x3b0], rdi
mov rbx, qword [rdi]
mov qword [rsp + 0x108], rbx
nop dword [rax]
movzx ecx, word [rbx]
mov word [rsp + 0x90], cx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x140002d43
add rbx, 2
mov qword [rsp + 0x108], rbx
jmp 0x140002d20
mov r9, qword [rdi]
mov qword [rsp + 0x3b8], r9
cmp rbx, r9
je 0x140002e43
mov qword [rsp + 0x3c0], r9
sub rbx, r9
sar rbx, 1
mov dword [rsp + 0x160], ebx
mov edx, dword [r9 - 0x10]
mov dword [rsp + 0x164], edx
test edx, edx
js 0x140003b4f
mov ecx, 1
sub ecx, dword [r9 - 8]
mov dword [rsp + 0x168], ecx
mov eax, dword [r9 - 0xc]
sub eax, edx
mov dword [rsp + 0x16c], eax
or eax, ecx
jge 0x140002dab
mov rcx, rdi
call fcn.14000d2f0
mov r9, qword [rdi]
movsxd rax, ebx
lea rdx, [r9 + rax*2]
mov qword [rsp + 0x108], rdx
mov ecx, dword [r9 - 0x10]
mov dword [rsp + 0x170], ecx
mov r14d, ecx
sub r14d, ebx
mov dword [rsp + 0x174], r14d
mov dword [rsp + 0x178], ecx
lea eax, [r14 + 1]
movsxd r8, eax
add r8, r8
mov qword [rsp + 0x3c8], r8
je 0x140002e1e
test rdx, rdx
jne 0x140002e04
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
jmp 0x140003b65
lea eax, [rcx + 1]
movsxd rcx, eax
add rcx, rcx
cmp rcx, r8
jb 0x140003b59
mov rcx, r9
call sub.VCRUNTIME140.dll_memmove
test r14d, r14d
js 0x140003b75
mov rax, qword [rdi]
cmp r14d, dword [rax - 0xc]
jg 0x140003b75
mov dword [rax - 0x10], r14d
movsxd rcx, r14d
mov rax, qword [rdi]
mov word [rax + rcx*2], r12w
mov r8, rdi
mov rdx, r15
lea rcx, [rsp + 0x210]
call fcn.14000bc20
mov qword [rsp + 0x3d0], rax
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov qword [rsp + 0x3d8], rcx
mov rbx, qword [rdi]
sub rbx, 0x18
mov qword [rsp + 0x200], rbx
cmp rcx, rbx
je 0x140002ee7
cmp dword [rbx + 0x10], 0
jl 0x140002eca
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140002eca
call fcn.14000d260
mov qword [rsp + 0x208], rax
mov eax, esi
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x140002eb9
mov rdx, qword [rsp + 0x200]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsp + 0x208]
add rax, 0x18
mov qword [rdi], rax
jmp 0x140002ee7
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x17c], r8d
mov qword [rsp + 0x3e0], rdx
mov rcx, rdi
call fcn.14000d350
nop
mov rcx, qword [rsp + 0x210]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x218], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140002f19
mov rdx, qword [rsp + 0x218]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x220]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x228], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140002f4b
mov rdx, qword [rsp + 0x228]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0xd0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x230], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140002f7c
mov rdx, qword [rsp + 0x230]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov r15, qword [rsp + 0x68]
mov qword [rsp + 0x70], r12
mov qword [rsp + 0xc8], r12
mov dword [rsp + 0x350], 0x18
mov dword [rsp + 0x360], 1
mov qword [rsp + 0x358], r12
xor r9d, r9d
lea r8, [rsp + 0x350]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x140003044
lea rdx, [0x140099390]
mov rcx, r15
call fcn.14000c950
or dword [rsp + 0x50], 1
mov rcx, qword [rsp + 0x60]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x278], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140003011
mov rdx, qword [rsp + 0x278]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rdi]
sub rcx, 0x18
mov qword [rsp + 0x280], rcx
lock xadd dword [rcx + 0x10], esi
sub esi, 1
jg 0x14000303c
mov rdx, qword [rsp + 0x280]
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rax, r15
jmp 0x140003abe
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x1400030cf
lea rdx, [0x1400993f0]
mov rcx, r15
call fcn.14000c950
or dword [rsp + 0x50], 1
mov rcx, qword [rsp + 0x60]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x288], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x14000309d
mov rdx, qword [rsp + 0x288]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rax, qword [rdi]
sub rax, 0x18
mov qword [rsp + 0x290], rax
lock xadd dword [rax + 0x10], esi
sub esi, 1
jg 0x1400030c7
mov rdx, qword [rsp + 0x290]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, r15
jmp 0x140003abe
mov r14, qword [rdi]
mov eax, dword [r14 - 0x10]
mov dword [rsp + 0x1ac], eax
lea ebx, [rax + 1]
mov dword [rsp + 0x1b0], ebx
xor eax, eax
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x120], rax
xor edx, edx
lea r8d, [rax + 0x68]
lea rcx, [rsp + 0x4b0]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x4b0], 0x68
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x510], rax
mov qword [rsp + 0x508], rax
mov eax, dword [rsp + 0x4ec]
bts eax, 8
mov dword [rsp + 0x4ec], eax
or eax, 1
mov dword [rsp + 0x4ec], eax
mov word [rsp + 0x4f0], r12w
test ebx, ebx
js 0x140003b80
jmp 0x1400034d2
lea rdx, [0x1400992e0]
lea rcx, [rsp + 0xe8]
call fcn.14000c8e0
nop
mov r14, qword [rdi]
mov qword [rsp + 0x238], r14
mov rbx, r12
mov qword [rsp + 0xd8], rbx
movzx ecx, word [r14]
test cx, cx
je 0x1400031d2
mov word [rsp + 0x98], cx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x1400031b9
test rbx, rbx
jne 0x1400031c4
mov rbx, r14
jmp 0x1400031bc
mov rbx, r12
mov qword [rsp + 0xd8], rbx
add r14, 2
mov qword [rsp + 0x238], r14
jmp 0x140003194
test rbx, rbx
je 0x14000323a
mov rax, qword [rdi]
mov qword [rsp + 0x3e8], rax
sub rbx, rax
sar rbx, 1
mov dword [rsp + 0x180], ebx
test ebx, ebx
js 0x140003b8b
mov ecx, 1
sub ecx, dword [rax - 8]
mov dword [rsp + 0x184], ecx
mov eax, dword [rax - 0xc]
sub eax, ebx
mov dword [rsp + 0x188], eax
or eax, ecx
jge 0x140003220
mov edx, ebx
mov rcx, rdi
call fcn.14000d2f0
mov rax, qword [rdi]
cmp ebx, dword [rax - 0xc]
jg 0x140003b95
mov dword [rax - 0x10], ebx
movsxd rcx, ebx
mov rax, qword [rdi]
mov word [rax + rcx*2], r12w
mov qword [rsp + 0x3f0], rdi
mov rbx, qword [rdi]
mov qword [rsp + 0xe0], rbx
nop dword [rax]
movzx ecx, word [rbx]
mov word [rsp + 0xa0], cx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x140003273
add rbx, 2
mov qword [rsp + 0xe0], rbx
jmp 0x140003250
mov r9, qword [rdi]
mov qword [rsp + 0x3f8], r9
cmp rbx, r9
je 0x140003373
mov qword [rsp + 0x400], r9
sub rbx, r9
sar rbx, 1
mov dword [rsp + 0x18c], ebx
mov edx, dword [r9 - 0x10]
mov dword [rsp + 0x190], edx
test edx, edx
js 0x140003b9f
mov ecx, 1
sub ecx, dword [r9 - 8]
mov dword [rsp + 0x194], ecx
mov eax, dword [r9 - 0xc]
sub eax, edx
mov dword [rsp + 0x198], eax
or eax, ecx
jge 0x1400032db
mov rcx, rdi
call fcn.14000d2f0
mov r9, qword [rdi]
movsxd rax, ebx
lea rdx, [r9 + rax*2]
mov qword [rsp + 0xe0], rdx
mov ecx, dword [r9 - 0x10]
mov dword [rsp + 0x19c], ecx
mov r14d, ecx
sub r14d, ebx
mov dword [rsp + 0x1a0], r14d
mov dword [rsp + 0x1a4], ecx
lea eax, [r14 + 1]
movsxd r8, eax
add r8, r8
mov qword [rsp + 0x408], r8
je 0x14000334e
test rdx, rdx
jne 0x140003334
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
jmp 0x140003bb5
lea eax, [rcx + 1]
movsxd rcx, eax
add rcx, rcx
cmp rcx, r8
jb 0x140003ba9
mov rcx, r9
call sub.VCRUNTIME140.dll_memmove
test r14d, r14d
js 0x140003bc5
mov rax, qword [rdi]
cmp r14d, dword [rax - 0xc]
jg 0x140003bc5
mov dword [rax - 0x10], r14d
movsxd rcx, r14d
mov rax, qword [rdi]
mov word [rax + rcx*2], r12w
mov r8, rdi
lea rdx, str.C:WINDOWSSystem32cmd.exe__c__
lea rcx, [rsp + 0x260]
call fcn.14000ba80
nop
lea r8, [rsp + 0xe8]
mov rdx, rax
lea rcx, [rsp + 0x250]
call fcn.14000bc20
mov qword [rsp + 0x410], rax
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov qword [rsp + 0x418], rcx
mov rbx, qword [rdi]
sub rbx, 0x18
mov qword [rsp + 0x240], rbx
cmp rcx, rbx
je 0x140003434
cmp dword [rbx + 0x10], 0
jl 0x140003417
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140003417
call fcn.14000d260
mov qword [rsp + 0x248], rax
mov eax, esi
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x140003406
mov rdx, qword [rsp + 0x240]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsp + 0x248]
add rax, 0x18
mov qword [rdi], rax
jmp 0x140003434
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x1a8], r8d
mov qword [rsp + 0x420], rdx
mov rcx, rdi
call fcn.14000d350
nop
mov rcx, qword [rsp + 0x250]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x258], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140003466
mov rdx, qword [rsp + 0x258]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x260]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x268], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140003498
mov rdx, qword [rsp + 0x268]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0xe8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x270], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140002f81
mov rdx, qword [rsp + 0x270]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140002f81
mov ecx, 1
sub ecx, dword [r14 - 8]
mov dword [rsp + 0x1b4], ecx
mov eax, dword [r14 - 0xc]
sub eax, ebx
mov dword [rsp + 0x1b8], eax
or eax, ecx
jge 0x1400034fd
mov edx, ebx
mov rcx, rdi
call fcn.14000d2f0
mov rdx, qword [rdi]
mov qword [rsp + 0x428], rdx
lea rax, [rsp + 0x110]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
mov dword [rsp + 0xb4], eax
mov rcx, qword [rdi]
movsxd rdx, dword [rcx - 0xc]
mov dword [rsp + 0x1bc], edx
mov qword [rsp + 0x430], rcx
test rcx, rcx
jne 0x14000357a
mov eax, r12d
mov dword [rsp + 0xa8], eax
jmp 0x14000358f
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov dword [rsp + 0xa8], eax
test eax, eax
js 0x140003bf9
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jg 0x140003bf9
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rdi]
mov word [rax + rcx*2], r12w
test ebx, ebx
jne 0x140003622
lea rdx, [0x140099460]
mov rcx, r15
call fcn.14000c950
or dword [rsp + 0x50], 1
mov rcx, qword [rsp + 0x60]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x298], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x1400035f0
mov rdx, qword [rsp + 0x298]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rax, qword [rdi]
sub rax, 0x18
mov qword [rsp + 0x2a0], rax
lock xadd dword [rax + 0x10], esi
sub esi, 1
jg 0x14000361a
mov rdx, qword [rsp + 0x2a0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, r15
jmp 0x140003abe
mov edx, 0x927c0
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ebx, eax
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x1400036cc
lea rax, [rsp + 0x2a8]
mov qword [rsp + 0x438], rax
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x440], rax
lea rdx, [0x14009a114]
lea rcx, [rsp + 0x2a8]
call fcn.14000c950
mov rbx, rax
lea rdx, [0x1400994c0]
lea rcx, [rsp + 0x2b0]
call fcn.14000c950
nop
mov r8d, dword [rsp + 0xb0]
mov rdx, rbx
mov rcx, rax
call fcn.14005c860
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140003738
lea rax, [rsp + 0x2b8]
mov qword [rsp + 0x448], rax
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x450], rax
lea rdx, [0x140099090]
lea rcx, [rsp + 0x2b8]
call fcn.14000c8e0
mov rbx, rax
lea rdx, [0x140099570]
lea rcx, [rsp + 0x2c0]
call fcn.14000c950
nop
mov r8d, esi
mov rdx, rbx
mov rcx, rax
call fcn.14005c860
lea rdx, [0x14009a114]
lea rcx, [rsp + 0x58]
call fcn.14000c950
nop
nop word [rax + rax]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0xb8]
mov r8d, 0x1000
lea rdx, [rsp + 0x730]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0xb4], eax
test eax, eax
je 0x1400038fd
mov r8d, dword [rsp + 0xb8]
test r8d, r8d
je 0x1400038fd
lea rdx, [rsp + 0x730]
lea rcx, [rsp + 0x2d0]
call fcn.14000c7d0
mov qword [rsp + 0x458], rax
mov r15, qword [rax]
movsxd rcx, dword [r15 - 0x10]
mov dword [rsp + 0x1c0], ecx
mov qword [rsp + 0x460], r15
mov qword [rsp + 0x2c8], r15
mov r12, r15
mov rax, qword [rsp + 0x58]
sub r12, rax
sar r12, 1
mov qword [rsp + 0x468], r12
mov r13d, dword [rax - 0x10]
test ecx, ecx
js 0x140003bd0
test r15, r15
jne 0x140003805
xor r14d, r14d
mov dword [rsp + 0xc0], r14d
jmp 0x140003820
mov rdx, rcx
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov r14, rax
mov dword [rsp + 0xc0], eax
mov rax, qword [rsp + 0x58]
mov ecx, 0x7fffffff
sub ecx, r14d
cmp ecx, r13d
jl 0x140003bda
lea ebx, [r14 + r13]
mov dword [rsp + 0x1c4], ebx
test ebx, ebx
js 0x140003be4
lea rcx, [rax - 0x18]
mov qword [rsp + 0x470], rcx
mov edx, 1
sub edx, dword [rcx + 0x10]
mov dword [rsp + 0x1c8], edx
mov ecx, dword [rcx + 0xc]
sub ecx, ebx
mov dword [rsp + 0x1cc], ecx
or ecx, edx
jge 0x140003880
mov edx, ebx
lea rcx, [rsp + 0x58]
call fcn.14000d2f0
mov rax, qword [rsp + 0x58]
cmp r12, r13
ja 0x140003891
lea r15, [rax + r12*2]
mov qword [rsp + 0x2c8], r15
movsxd rdx, r14d
add rdx, rdx
lea rcx, [rax + r13*2]
mov r9, rdx
mov r8, r15
call fcn.14000dc80
mov rax, qword [rsp + 0x58]
cmp ebx, dword [rax - 0xc]
jg 0x140003bee
mov dword [rax - 0x10], ebx
movsxd rcx, ebx
mov rax, qword [rsp + 0x58]
xor r12d, r12d
mov word [rax + rcx*2], r12w
mov rcx, qword [rsp + 0x2d0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x2d8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x1400038f8
mov rdx, qword [rsp + 0x2d8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140003750
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400039b9
lea rdx, [0x1400995f0]
mov r15, qword [rsp + 0x68]
mov rcx, r15
call fcn.14000c8e0
or dword [rsp + 0x50], 1
mov rcx, qword [rsp + 0x58]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x2e0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140003958
mov rdx, qword [rsp + 0x2e0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x2e8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140003987
mov rdx, qword [rsp + 0x2e8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rax, qword [rdi]
sub rax, 0x18
mov qword [rsp + 0x2f0], rax
lock xadd dword [rax + 0x10], esi
sub esi, 1
jg 0x1400039b1
mov rdx, qword [rsp + 0x2f0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, r15
jmp 0x140003abe
mov rcx, qword [rsp + 0x58]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x478], rcx
call fcn.14000d260
mov qword [rsp + 0x480], rax
add rax, 0x18
mov r15, qword [rsp + 0x68]
mov qword [r15], rax
or dword [rsp + 0x50], 1
mov rcx, qword [rsp + 0x58]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x2f8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140003a17
mov rdx, qword [rsp + 0x2f8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x300], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140003a46
mov rdx, qword [rsp + 0x300]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rax, qword [rdi]
sub rax, 0x18
mov qword [rsp + 0x308], rax
lock xadd dword [rax + 0x10], esi
sub esi, 1
jg 0x140003a70
mov rdx, qword [rsp + 0x308]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, r15
jmp 0x140003abe
mov rcx, qword [rsp + 0x1730]
xor rcx, rsp
call fcn.1400693e0
lea r11, [rsp + 0x1740]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000df80
nop
mov ecx, 0x80070057
call fcn.14000df80
mov ecx, 0x80070057
call fcn.14000df80
mov ecx, 0x80070057
call fcn.14000df80
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov ecx, 0x80070057
call fcn.14000df80
mov ecx, 0x80070057
call fcn.14000df80
nop
mov ecx, 0x80070057
call fcn.14000df80
mov ecx, 0x80070057
call fcn.14000df80
mov ecx, 0x80070057
call fcn.14000df80
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov ecx, 0x80070057
call fcn.14000df80
mov ecx, 0x80070057
call fcn.14000df80
nop
mov ecx, 0x80070057
call fcn.14000df80
nop
mov ecx, 0x80070057
call fcn.14000df80
mov ecx, 0x80070057
call fcn.14000df80
mov ecx, 0x80070057
call fcn.14000df80
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov ecx, 0x80070057
call fcn.14000df80
mov ecx, 0x80070057
call fcn.14000df80
nop
mov ecx, 0x80070057
call fcn.14000df80
mov ecx, 0x80070057
call fcn.14000df80
mov ecx, 0x80070057
call fcn.14000df80
mov ecx, 0x80070057
call fcn.14000df80
nop
mov ecx, 0x80070057
call fcn.14000df80
int3