Function at 0x14002a780
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create process suspended
Encode data using xor
Hash data using fnv
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1300]
mov eax, 0x1400
call fcn.140049f80
sub rsp, rax
mov rax, qword [0x14006c040]
xor rax, rsp
mov qword [rbp + 0x12f0], rax
mov rdi, rdx
mov qword [rsp + 0x60], rdx
mov ebx, ecx
xor r14d, r14d
mov dword [rsp + 0x54], r14d
xorps xmm0, xmm0
movups xmmword [rbp + 0x270], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x280], xmm1
lea r8d, [r14 + 4]
lea rdx, str._jar
lea rcx, [rbp + 0x270]
call fcn.140006c60
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x290], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2a0], xmm1
lea r8d, [r14 + 0x13]
lea rdx, str.___Executed_file:
lea rcx, [rbp + 0x290]
call fcn.140006c60
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2c0], xmm1
lea r8d, [r14 + 4]
lea rdx, str..bat
lea rcx, [rbp + 0x2b0]
call fcn.140006c60
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2e0], xmm1
lea r8d, [r14 + 0x13]
lea rdx, str.___Executed_file:
lea rcx, [rbp + 0x2d0]
call fcn.140006c60
nop
lea rax, [rbp + 0x270]
mov qword [rbp - 0x20], rax
lea rax, [rbp + 0x2f0]
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x50]
call fcn.1400121c0
nop
lea r9, [0x140012180]
lea edx, [r14 + 0x40]
lea r8d, [r14 + 2]
lea rcx, [rbp + 0x270]
call fcn.1400497dc
mov qword [rbp - 0x78], r14
lea rax, [rbp - 0x70]
mov qword [rsp + 0x70], rax
mov cl, 1
call qword [sym.imp.MSVCP140.dll_private:_static_class_std::locale::_Locimp____ptr64___cdecl_std::locale::_Init_bool_]
mov qword [rbp - 0x58], rax
lea rcx, [rbp - 0x60]
call fcn.140022320
mov qword [rbp - 0x70], rax
lea rcx, [rbp - 0x60]
call fcn.140008ec0
mov qword [rbp - 0x68], rax
lea r8, [0x140058d50]
lea rdx, str.__A_Z_:______.exe_...__s_
lea rcx, [rbp - 0x78]
call fcn.140021d20
nop
mov edx, ebx
lea rcx, [rbp + 0x250]
call fcn.140011340
nop
lea r9d, [r14 + 0xe]
lea r8, str.memory.exe__p
mov rcx, rax
call fcn.140012380
xorps xmm0, xmm0
movups xmmword [rbp + 0x230], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x240], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x230], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x240], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov esi, 2
mov dword [rsp + 0x54], esi
mov rdx, qword [rbp + 0x268]
cmp rdx, 7
jbe 0x14002a9cc
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword ds:[rbp + 0x250]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a9c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002a9c7
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400493f0
movdqa xmm0, xmmword [0x14005d4a0]
movdqu xmmword [rbp + 0x260], xmm0
mov word [rbp + 0x250], r14w
mov qword [rbp - 0x38], 0x18
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x30], r14
xor r9d, r9d
lea r8, [rbp - 0x38]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov dword [rbp + 0x100], 0x68
xorps xmm0, xmm0
movups xmmword [rbp + 0x108], xmm0
movups xmmword [rbp + 0x118], xmm0
movups xmmword [rbp + 0x128], xmm0
movups xmmword [rbp + 0x138], xmm0
movups xmmword [rbp + 0x148], xmm0
movups xmmword [rbp + 0x158], xmm0
mov rax, qword [rsp + 0x78]
mov qword [rbp + 0x158], rax
psrldq xmm0, 4
movd eax, xmm0
or eax, 0x101
mov dword [rbp + 0x13c], eax
mov word [rbp + 0x140], r14w
lea rdx, [rbp + 0x230]
cmp qword [rbp + 0x248], 7
cmova rdx, qword [rbp + 0x230]
lea rax, [rbp - 0x10]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x100]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rbx, 0xffffffffffffffff
test eax, eax
je 0x14002b61a
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x2f0]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x58]
mov r8d, 0x1000
lea rdx, [rbp + 0x2f0]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002b5f5
movabs r12, 0xcbf29ce484222325
movabs r15, 0x100000001b3
lea r13, str.Winmgmt
nop dword [rax]
cmp dword [rsp + 0x58], 0
je 0x14002b5f5
lea rax, [rbp + 0x2f0]
mov r9, rbx
inc r9
cmp byte [rax + r9], 0
jne 0x14002ab65
lea rax, [rbp + 0x2f0]
add rax, r9
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
mov qword [rbp + 0x1e0], r14
mov qword [rbp + 0x1e8], r14
lea rcx, [rbp + 0x2f0]
cmp rcx, rax
jne 0x14002abbc
mov rbx, r14
mov qword [rbp + 0x1e0], rbx
mov qword [rbp + 0x1e8], 7
mov word [rbp + 0x1d0], r14w
jmp 0x14002abd6
lea rdx, [rbp + 0x2f0]
lea rcx, [rbp + 0x1d0]
call fcn.1400124a0
mov rbx, qword [rbp + 0x1e0]
lea rax, [0x140059078]
mov qword [rbp + 0x10], rax
lea rcx, [rbp + 0xa0]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
nop
or esi, 1
mov dword [rsp + 0x54], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x10]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__::constructor_class_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x10]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx + 0x10], rax
mov rax, qword [rbp + 0x10]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x90]
mov dword [rbp + rcx + 0xc], edx
lea rax, [rbp + 0x20]
mov qword [rsp + 0x70], rax
lea rcx, [rbp + 0x20]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
nop
lea rax, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + 0x20], rax
lea rsi, [rbp + 0x1d0]
mov r14, qword [rbp + 0x1d0]
mov qword [rbp - 0x80], r14
cmp qword [rbp + 0x1e8], 7
cmova rsi, r14
mov eax, 2
cmp rbx, 0x7fffffff
ja 0x14002b5ee
test rbx, rbx
je 0x14002ad0b
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x14002b7ae
lfence
mov rax, qword [rbp + 0x1e0]
lea rdi, [rax + rax]
mov rcx, rdi
call fcn.140006ec0
mov rbx, rax
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rdi + rbx]
mov qword [rbp + 0x88], rcx
mov rcx, qword [rbp + 0x38]
mov qword [rcx], rbx
mov rcx, qword [rbp + 0x58]
mov qword [rcx], rbx
sar rdi, 1
mov rax, qword [rbp + 0x70]
mov dword [rax], edi
mov eax, 3
mov rcx, qword [rbp + 0x1d0]
mov qword [rbp - 0x80], rcx
mov rdi, qword [rsp + 0x60]
xor ebx, ebx
jmp 0x14002ad12
mov qword [rbp + 0x88], rbx
mov dword [rbp + 0x90], eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
mov qword [rbp + 0x1a0], rbx
mov qword [rbp + 0x1a8], 7
mov word [rbp + 0x190], bx
mov rax, qword [rbp + 0x10]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x10]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
movzx r8d, ax
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x10]
call fcn.1400224e0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x14002b47d
nop
mov byte [rsp + 0x50], 0
mov r14, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
mov qword [rsp + 0x70], rax
cmp r14, rax
je 0x14002b1b5
jmp 0x14002ada2
xor ebx, ebx
lea r13, [r14 + 0x20]
mov rax, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 7
jbe 0x14002adbd
mov rcx, qword [r14]
lea r8, [rcx + rax*2]
mov rdx, rcx
jmp 0x14002adc4
lea r8, [r14 + rax*2]
mov rdx, r14
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
mov qword [rbp + 0x1c0], rbx
mov qword [rbp + 0x1c8], rbx
cmp rdx, r8
jne 0x14002ae05
mov r15, rbx
mov qword [rbp + 0x1c0], rbx
mov r12d, 7
mov qword [rbp + 0x1c8], r12
mov word [rbp + 0x1b0], bx
jmp 0x14002ae25
sub r8, rdx
sar r8, 1
lea rcx, [rbp + 0x1b0]
call fcn.140006c60
mov r12, qword [rbp + 0x1c8]
mov r15, qword [rbp + 0x1c0]
lea rdx, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 7
cmova rdx, qword [rbp + 0x190]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
mov qword [rbp + 0x200], rbx
mov qword [rbp + 0x208], rbx
mov r8, qword [rbp + 0x1a0]
lea rcx, [rbp + 0x1f0]
call fcn.140006c60
lea r8, ds:[rbp + 0x1f0]
mov r11, qword [rbp + 0x1f0]
mov rdi, qword [rbp + 0x208]
cmp rdi, 7
cmova r8, r11
movabs rcx, 0xcbf29ce484222325
mov r10, qword [rbp + 0x200]
lea r9, [r10 + r10]
mov rdx, rbx
test r9, r9
je 0x14002aecc
movabs rdi, 0x100000001b3
nop
movzx eax, byte ds:[rdx + r8]
xor rcx, rax
imul rcx, rdi
inc rdx
cmp rdx, r9
jb 0x14002aeb0
mov rdi, qword [rbp + 0x208]
and rcx, qword [0x14006f920]
add rcx, rcx
mov rax, qword [0x14006f908]
mov r9, qword [rax + rcx*8 + 8]
mov rsi, qword [0x14006f8f8]
cmp r9, rsi
jne 0x14002aef3
mov r9, rbx
jmp 0x14002af56
mov rbx, qword [rax + rcx*8]
nop word [rax + rax]
lea rax, [r9 + 0x10]
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x14002af12
mov rax, qword [rax]
lea r8, [rbp + 0x1f0]
cmp rdi, 7
cmova r8, r11
cmp r10, rcx
jne 0x14002af48
mov rdx, r10
test r10, r10
je 0x14002af56
sub r8, rax
movzx ecx, word [rax + r8]
cmp cx, word [rax]
jne 0x14002af48
add rax, 2
sub rdx, 1
jne 0x14002af31
jmp 0x14002af56
cmp r9, rbx
je 0x14002af53
mov r9, qword [r9 + 8]
jmp 0x14002af00
xor r9d, r9d
mov rbx, rsi
test r9, r9
cmovne rbx, r9
cmp rdi, 7
jbe 0x14002af9b
lea rdx, [rdi*2 + 2]
mov rax, r11
cmp rdx, 0x1000
jb 0x14002af93
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b5c5
mov rcx, r11
call fcn.1400493f0
xor edx, edx
mov qword [rbp + 0x200], rdx
mov qword [rbp + 0x208], 7
mov word [rbp + 0x1f0], dx
mov rdi, qword [rbp + 0x1b0]
cmp rbx, rsi
jne 0x14002b119
lea r11, [rbp + 0x1b0]
cmp r12, 7
cmova r11, rdi
lea rbx, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 7
cmova rbx, qword [rbp + 0x190]
mov rax, qword [rbp + 0x1a0]
cmp r15, rax
ja 0x14002b119
sub rax, r15
test r15, r15
je 0x14002b098
lea rsi, [rbx + 2]
lea rsi, [rsi + rax*2]
mov rcx, rbx
movzx r10d, word [r11]
nop word [rax + rax]
mov rax, rsi
sub rax, rcx
sar rax, 1
je 0x14002b049
cmp word [rcx], r10w
je 0x14002b046
cmp rax, 1
je 0x14002b049
dec rax
add rcx, 2
cmp word [rcx], r10w
jne 0x14002b031
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x14002b119
mov r8, r15
mov rdx, r11
test r15, r15
je 0x14002b088
mov r9, rcx
sub r9, r11
nop dword [rax + rax]
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x14002b10e
add rdx, 2
sub r8, 1
jne 0x14002b070
sub rcx, rbx
sar rcx, 1
cmp rcx, 0xffffffffffffffff
je 0x14002b119
mov r8, qword [r13 + 0x10]
cmp qword [r13 + 0x18], 7
jbe 0x14002b0a7
mov r13, qword [r13]
mov rdx, r13
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140009240
lea rdx, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 7
cmova rdx, qword [rbp + 0x190]
mov r8, qword [rbp + 0x1a0]
mov rcx, rax
call fcn.140009240
lea rdx, [0x140008ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov bl, 1
mov byte [rsp + 0x50], bl
lea r8, [rbp + 0x190]
lea rdx, [rbp + 0x170]
lea rcx, [0x14006f8f0]
call fcn.1400067e0
jmp 0x14002b11e
add rcx, 2
xor edx, edx
jmp 0x14002b020
movzx ebx, byte [rsp + 0x50]
nop
cmp r12, 7
jbe 0x14002b15b
lea rdx, [r12*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14002b153
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b5cc
mov rcx, rdi
call fcn.1400493f0
xor eax, eax
mov qword [rbp + 0x1c0], rax
mov qword [rbp + 0x1c8], 7
mov word [rbp + 0x1b0], ax
add r14, 0x40
cmp r14, qword [rsp + 0x70]
jne 0x14002ada0
mov rdi, qword [rsp + 0x60]
test bl, bl
jne 0x14002b41a
xor ebx, ebx
movabs r15, 0x100000001b3
movabs r12, 0xcbf29ce484222325
lea r13, str.Winmgmt
mov rdx, qword [rdi + 0x10]
mov r8, rdi
cmp qword [rdi + 0x18], 7
jbe 0x14002b1c6
mov r8, qword [rdi]
cmp rdx, 7
jne 0x14002b1eb
mov rcx, r13
sub r8, r13
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x14002b1eb
add rcx, 2
sub rdx, 1
jne 0x14002b1d2
jmp 0x14002b41a
lea rcx, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 7
cmova rcx, qword [rbp + 0x190]
mov rax, qword [rbp + 0x1a0]
lea rdx, [rcx + rax*2]
mov dword [rsp + 0x20], 0x10
lea r9, [rbp - 0x78]
call fcn.1400226c0
nop
test al, al
je 0x14002b41a
lea rdx, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 7
cmova rdx, qword [rbp + 0x190]
xorps xmm0, xmm0
movups xmmword [rbp + 0x210], xmm0
mov qword [rbp + 0x220], rbx
mov qword [rbp + 0x228], rbx
mov r8, qword [rbp + 0x1a0]
lea rcx, [rbp + 0x210]
call fcn.140006c60
lea r8, [rbp + 0x210]
mov r11, qword [rbp + 0x210]
mov rdi, qword [rbp + 0x228]
cmp rdi, 7
cmova r8, r11
mov rcx, r12
mov r10, qword [rbp + 0x220]
lea r9, [r10 + r10]
mov rdx, rbx
test r9, r9
je 0x14002b2b4
nop dword [rax]
movzx eax, byte [rdx + r8]
xor rcx, rax
imul rcx, r15
inc rdx
cmp rdx, r9
jb 0x14002b2a0
and rcx, qword [0x14006f920]
add rcx, rcx
mov rax, qword [0x14006f908]
mov r9, qword [rax + rcx*8 + 8]
mov rsi, qword [0x14006f8f8]
cmp r9, rsi
jne 0x14002b2de
mov r9, rbx
xor r14d, r14d
jmp 0x14002b34b
mov rbx, qword [rax + rcx*8]
nop dword [rax]
nop word [rax + rax]
lea rcx, [r9 + 0x10]
mov rax, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 7
jbe 0x14002b302
mov rcx, qword [rcx]
lea r8, [rbp + 0x210]
cmp rdi, 7
cmova r8, r11
cmp r10, rax
jne 0x14002b33a
mov rdx, r10
test r10, r10
je 0x14002b2d9
sub r8, rcx
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x14002b33a
add rcx, 2
sub rdx, 1
jne 0x14002b321
xor r14d, r14d
jmp 0x14002b34b
cmp r9, rbx
je 0x14002b345
mov r9, qword [r9 + 8]
jmp 0x14002b2f0
xor r14d, r14d
mov r9d, r14d
mov rbx, rsi
test r9, r9
cmovne rbx, r9
cmp rdi, 7
jbe 0x14002b392
lea rdx, [rdi*2 + 2]
mov rax, r11
cmp rdx, 0x1000
jb 0x14002b38a
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b5d3
mov rcx, r11
call fcn.1400493f0
mov qword [rbp + 0x220], r14
mov qword [rbp + 0x228], 7
mov word [rbp + 0x210], r14w
cmp rbx, rsi
jne 0x14002b415
lea rdx, str.___Executed_file_with_modified_extension:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
nop
call fcn.140006a60
lea rdx, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 7
cmova rdx, qword [rbp + 0x190]
mov r8, qword [rbp + 0x1a0]
mov rcx, rax
call fcn.140009240
lea rdx, [0x140008ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, [rbp + 0x190]
lea rdx, [rbp + 0x180]
lea rcx, [0x14006f8f0]
call fcn.1400067e0
mov rdi, qword [rsp + 0x60]
mov rax, qword [rbp + 0x10]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x10]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
movzx r8d, ax
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x10]
call fcn.1400224e0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
mov ebx, 0
movabs r15, 0x100000001b3
movabs r12, 0xcbf29ce484222325
lea r13, str.Winmgmt
jne 0x14002ad80
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 7
jbe 0x14002b4cf
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b4ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b5da
call fcn.1400493f0
mov qword ds:[rbp + 0x1a0], rbx
mov qword [rbp + 0x1a8], 7
mov word [rbp + 0x190], bx
mov rax, qword [rbp + 0x10]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx + 0x10], rax
mov rax, qword [rbp + 0x10]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x90]
mov dword [rbp + rcx + 0xc], edx
lea rax, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + 0x20], rax
lea rcx, [rbp + 0x20]
call fcn.14002cc40
lea rcx, [rbp + 0x20]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea rcx, [rbp + 0x28]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
nop
mov rax, qword [rbp + 0x1e8]
cmp rax, 7
jbe 0x14002b58b
lea rdx, [rax*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b586
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b5e7
call fcn.1400493f0
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x58]
mov r8d, 0x1000
lea rdx, [rbp + 0x2f0]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbx, 0xffffffffffffffff
xor r14d, r14d
test eax, eax
je 0x14002b5f5
mov esi, dword ds:[rsp + 0x54]
jmp 0x14002ab50
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
nop word [rax + rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_alloc_void_]
nop
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword ds:[rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x248]
cmp rdx, 7
jbe 0x14002b672
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x230]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b66d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002b66d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400493f0
movdqa xmm0, xmmword [0x14005d4a0]
movdqu xmmword [rbp + 0x240], xmm0
mov word [rbp + 0x230], r14w
mov rax, qword [rbp - 0x78]
test rax, rax
je 0x14002b6d3
lock xadd dword [rax + 0x2c], ebx
cmp ebx, 1
jne 0x14002b6d3
mov rbx, qword [rbp - 0x78]
test rbx, rbx
je 0x14002b6d3
nop word [rax + rax]
mov rcx, rbx
lea rax, [rbx + 0x10]
mov rbx, qword [rax]
mov qword [rax], r14
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [0x140050d48]
test rbx, rbx
jne 0x14002b6b0
mov qword ds:[rbp - 0x78], r14
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x14002b70f
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140050d48]
mov r8, rax
test rax, rax
je 0x14002b70f
mov rcx, qword [rax]
mov rax, qword [rcx]
mov edx, 1
mov rcx, r8
call qword [0x140050d48]
nop
mov rbx, qword [rbp - 0x50]
test rbx, rbx
je 0x14002b77e
mov rdi, qword ds:[rbp - 0x48]
cmp rbx, rdi
je 0x14002b743
lea rcx, [rbx + 0x20]
call fcn.140005dc0
mov rcx, rbx
call fcn.140005dc0
add rbx, 0x40
cmp rbx, rdi
jne 0x14002b725
mov rbx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x40]
sub rdx, rbx
and rdx, 0xffffffffffffffc0
mov rax, rbx
cmp rdx, 0x1000
jb 0x14002b776
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002b776
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400493f0
mov rcx, qword [rbp + 0x12f0]
xor rcx, rsp
call fcn.1400493d0
lea r11, [rsp + 0x1400]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140003df0
nop
int3