Function at 0x2100c7e40
Capabilities:
Create pipe
Create process on windows
Read file on windows
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x518
mov rax, qword [0x21023d810]
mov rax, qword [rax + 0x4900]
mov rsi, qword [rax]
mov rbx, rcx
mov edi, edx
test rsi, rsi
je 0x2100c7e79
cmp word [rsi + 0x1b2], 0x88
je 0x2100c7ea0
xor r14d, r14d
test dil, dil
je 0x2100c7ee0
mov eax, r14d
add rsp, 0x518
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi + 0x1d8]
mov r8d, dword [rax + 0xd4]
mov byte [rax + 0xd0], 1
test r8d, r8d
jne 0x2100c8240
mov rdx, qword [0x21024fce8]
xor r14d, r14d
mov edx, dword [rdx + 0xfd70]
mov dword [rax + 0xd4], edx
test dil, dil
jne 0x2100c7e81
nop dword [rax]
mov qword [rsp + 0x20], 0
lea r12, [rsp + 0xb0]
lea r9, str.Console
mov r8d, 0x20019
mov rdx, 0xffffffff80000001
mov rcx, r12
call method.reg_key.reg_key_HKEY____unsigned_int__..._
cmp qword [rsp + 0xb0], 0
je 0x2100c822d
mov r8d, 1
lea rdx, str.ForceV2
mov rcx, r12
call method.reg_key.get_dword_wchar_t_const__unsigned_int_
test eax, eax
je 0x2100c8220
mov rax, qword [rbx + 0x1d8]
movzx r14d, byte [rax + 0xc8]
test r14b, r14b
je 0x2100c8290
mov ecx, 0xfffffff6
call sym.GetStdHandle
lea rdx, [method.fhandler_base.get_handle__]
mov rsi, rax
mov rax, qword [rbx]
mov rax, qword [rax + 0x280]
cmp rax, rdx
jne 0x2100c8a1a
lea rax, [rbx + 0x18]
cmp rsi, qword [rax]
je 0x2100c8a45
mov rax, qword [rbx + 0x1d8]
mov r8d, dword [rax + 0xd4]
xor edx, edx
mov ecx, 0x40
call sym.OpenProcess
mov r13, rax
test rax, rax
je 0x2100c822d
call sym.GetCurrentProcess
lea r9, [rsp + 0x80]
mov rcx, r13
mov r8, rax
mov rax, qword [rbx + 0x1d8]
mov rdx, qword [rax + 0x100]
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
call sym.DuplicateHandle
call sym.GetCurrentProcess
lea r9, [rsp + 0x88]
mov rcx, r13
mov r8, rax
mov rax, qword [rbx + 0x1d8]
mov rdx, qword [rax + 0x108]
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
call sym.DuplicateHandle
mov rcx, r13
call sym.CloseHandle
mov rcx, qword [0x2102ff780]
test rcx, rcx
je 0x2100c8046
mov edx, dword [0x21024fa70]
call sym.WaitForSingleObject
call sym.FreeConsole
mov rax, qword [rbx + 0x1d8]
lea rbp, [method.fhandler_pty_slave.get_output_handle_nat__]
lea rsi, [method.fhandler_pty_slave.get_handle_nat__]
mov ecx, dword [rax + 0xd4]
call sym.AttachConsole
xor ecx, ecx
call sym.init_console_handler_bool_
mov rcx, qword [0x2102ff780]
test rcx, rcx
je 0x2100c8083
call sym.ReleaseMutex
mov rax, qword [rbx]
mov rdx, qword [rax + 0x288]
cmp rdx, rsi
jne 0x2100c8904
lea rdx, [rbx + 0x210]
mov rax, qword [rax + 0x298]
mov r15, qword [rdx]
cmp rax, rbp
jne 0x2100c8bff
lea rax, [rbx + 0x208]
mov r14, qword [rax]
mov rdi, 0xffffffffffffffff
mov r8, qword [0x21023d810]
mov ecx, dword [r8 + 0x4928]
nop
lea edx, [rdi + 1]
lea rax, [rdi*8 + 8]
jmp 0x2100c80fb
mov rdx, qword [r8 + 0x4900]
mov r13, qword [rdx + rax]
lea edx, [rdi + 1]
add rax, 8
test r13, r13
jne 0x2100c8918
movsxd rdi, edx
cmp edi, ecx
jl 0x2100c80e0
mov rcx, r15
call sym.CloseHandle
mov rcx, r14
call sym.CloseHandle
mov rax, qword [rbx + 0x1d8]
mov r8d, dword [rax + 0xd4]
test r8d, r8d
je 0x2100c816b
xor edx, edx
mov ecx, 0x1000
call sym.OpenProcess
mov r13, rax
test rax, rax
je 0x2100c8164
mov rcx, rax
lea rdx, [rsp + 0x300]
call sym.GetExitCodeProcess
mov rcx, r13
mov esi, eax
call sym.CloseHandle
test esi, esi
je 0x2100c8164
cmp dword [rsp + 0x300], 0x103
je 0x2100c817e
mov rax, qword [rbx + 0x1d8]
mov rdx, qword [0x21024fce8]
mov edx, dword [rdx + 0xfd70]
mov dword [rax + 0xd4], edx
mov rsi, qword [rsp + 0xa0]
test rsi, rsi
je 0x2100c81b6
mov rdx, qword [0x21024fce8]
mov rcx, qword [rbx + 0x1d8]
mov eax, dword [rdx + 0xfd70]
mov r8d, dword [rcx + 0xd4]
test eax, eax
jne 0x2100c81ad
mov eax, dword [rdx + 0x14]
cmp r8d, eax
je 0x2100c8c24
mov rcx, qword [0x2102ff780]
test rcx, rcx
je 0x2100c81cd
mov edx, dword [0x21024fa70]
call sym.WaitForSingleObject
mov rsi, qword [rbx + 0x1d8]
mov ecx, dword [rsi + 0x118]
test ecx, ecx
jne 0x2100c8b1b
mov ecx, dword [rsi + 0x11c]
test ecx, ecx
jne 0x2100c8b0a
mov rax, qword [0x21024fce8]
mov ebx, dword [rsi + 8]
cmp dword [rax + 0xfc20], ebx
je 0x2100c8b40
mov rcx, qword [0x2102ff780]
mov r14d, 1
test rcx, rcx
je 0x2100c8230
call sym.ReleaseMutex
jmp 0x2100c8230
test byte [0x210273880], 1
jne 0x2100c88e0
xor r14d, r14d
mov rcx, r12
call method.reg_key.reg_key__
jmp 0x2100c7e81
xor edx, edx
mov ecx, 0x1000
call sym.OpenProcess
mov r12, rax
test rax, rax
je 0x2100c8283
mov rcx, rax
lea rdx, [rsp + 0x300]
call sym.GetExitCodeProcess
mov rcx, r12
mov ebp, eax
call sym.CloseHandle
test ebp, ebp
je 0x2100c8283
cmp dword [rsp + 0x300], 0x103
je 0x2100c7e79
mov rax, qword [rsi + 0x1d8]
jmp 0x2100c7ebe
movzx edx, word [rax + 0x54]
xor ecx, ecx
movzx r13d, word [rax + 0x56]
mov qword [rsp + 0xa0], 0
lea rbp, [method.fhandler_pty_slave.get_output_handle_nat__]
shl edx, 0x10
or r13d, edx
call sym.SetLastError
mov rdx, qword [rbx]
mov rax, qword [rdx + 0x298]
cmp rax, rbp
jne 0x2100c8a38
lea rax, [rbx + 0x208]
mov r8, qword [rax]
mov rax, qword [rdx + 0x288]
lea rsi, [method.fhandler_pty_slave.get_handle_nat__]
cmp rax, rsi
jne 0x2100c8a24
lea rax, [rbx + 0x210]
lea rdx, [rsp + 0xa0]
mov r9d, 1
mov ecx, r13d
mov qword [rsp + 0x20], rdx
mov rdx, qword [rax]
call fcn.21022cf60
mov edi, eax
test eax, eax
je 0x2100c8349
call sym.GetLastError
mov dword [rsp + 0x28], edi
mov edx, 0x8000
lea r9, str.CreatePseudoConsole___failed.__08x__08x_n
mov dword [rsp + 0x20], eax
lea r8, str.bool_fhandler_pty_slave::setup_pseudoconsole_bool_
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100c8230
call sym.GetLastError
cmp eax, 0x7f
je 0x2100c8230
lea r13, [rsp + 0xa8]
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov r9, r13
lea rdi, [rsp + 0x140]
call sym.InitializeProcThreadAttributeList
xor eax, eax
mov ecx, 0xe
mov qword [rsp + 0x58], rdi
rep stosq qword [rdi], rax
mov rdi, qword [rsp + 0xa8]
mov dword [rsp + 0x140], 0x70
call sym.GetProcessHeap
mov r8, rdi
xor edx, edx
mov rcx, rax
call sym.HeapAlloc
mov qword [rsp + 0x1a8], rax
mov rcx, rax
test rax, rax
je 0x2100c89f3
xor r8d, r8d
mov r9, r13
mov edx, 2
call sym.InitializeProcThreadAttributeList
test eax, eax
je 0x2100c89d9
mov r9, qword [rsp + 0xa0]
xor edx, edx
mov qword [rsp + 0x30], 0
mov r8d, 0x20016
mov qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x1a8]
mov qword [rsp + 0x20], 8
call sym.UpdateProcThreadAttribute
test eax, eax
je 0x2100c89d9
lea rdi, [0x2102d1ce0]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rcx, rdi
call sym.CreateEventA
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rcx, rdi
mov r13, rax
call sym.CreateEventA
xor r9d, r9d
lea rdx, [rsp + 0x98]
mov r8, rdi
lea rcx, [rsp + 0x90]
mov r15, rax
call sym.CreatePipe
mov rax, qword [rsp + 0x98]
xor edx, edx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x1a8]
lea r9, [rsp + 0xe0]
mov r8d, 0x20002
mov qword [rsp + 0x20], 0x18
mov qword [rsp + 0xe0], r13
mov qword [rsp + 0x50], r15
mov qword [rsp + 0xe8], r15
mov qword [rsp + 0xf0], rax
call sym.UpdateProcThreadAttribute
test eax, eax
je 0x2100c8993
xor r9d, r9d
lea r15, [rsp + 0x1b0]
mov r8d, 0x21
mov dword [rsp + 0x1b0], 0xffffffff
lea rdx, str._bin_cygwin_console_helper.exe
mov rcx, r15
mov qword [rsp + 0x1b8], 0
mov qword [rsp + 0x1c0], 0
mov dword [rsp + 0x1c8], 0
mov dword [rsp + 0x1cc], 0
mov byte [rsp + 0x1d0], 0
mov qword [rsp + 0x220], 0
mov qword [rsp + 0x240], 0
mov qword [rsp + 0x248], 0
mov qword [rsp + 0x250], 0
mov qword [rsp + 0x258], 0
mov qword [rsp + 0x260], 0
mov dword [rsp + 0x2d0], 0
mov qword [rsp + 0x2d8], 0
mov qword [rsp + 0x2e0], 0
mov qword [rsp + 0x2e8], 0
mov qword [rsp + 0x2f0], 0
mov qword [rsp + 0x2f8], 0
call method.path_conv.check_char_const__unsigned_int__suffix_info_const_
xor edx, edx
mov rcx, r15
call method.path_conv.get_nt_native_path__UNICODE_STRING_
movzx eax, word [rsp + 0x228]
lea r10, [rsp + 0x300]
mov rdx, r10
mov qword [rsp + 0x68], r10
mov rcx, rax
shr rcx, 1
mov qword [rsp + 0x60], rcx
mov rcx, r15
call method.path_conv.get_wide_win32_path_wchar_t_
mov rax, qword [rsp + 0x98]
mov r10, qword [rsp + 0x68]
mov r8, r13
mov rcx, qword [rsp + 0x60]
mov r9, qword [rsp + 0x50]
lea rdx, str.__p__p__p
mov qword [rsp + 0x20], rax
lea rcx, [r10 + rcx*2]
mov qword [rsp + 0x60], r10
call sym.__small_swprintf_wchar_t__wchar_t_const__::_
mov ecx, 0x101
mov r9, rdi
mov r8, rdi
mov rdx, qword [0x21024fce8]
mov rax, qword [rbx + 0x1d8]
mov dword [rsp + 0x17c], 0x100
mov qword [rsp + 0x190], 0
mov edx, dword [rdx]
mov word [rax + 0xc8], cx
xor ecx, ecx
mov qword [rsp + 0x198], 0
mov dword [rax + 0xcc], edx
lea rax, [rsp + 0xc0]
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80000
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x1a0], 0
call sym.CreateProcessW
lea rcx, [rsp + 0x100]
mov qword [rsp + 0x58], rcx
test eax, eax
je 0x2100c898b
mov edx, 0x1f4
mov rcx, r13
call sym.WaitForSingleObject
test eax, eax
je 0x2100c8d60
cmp eax, 0x102
jne 0x2100c8d0b
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xc0]
mov rdx, rdi
call sym.GetExitCodeProcess
test eax, eax
je 0x2100c8d0b
mov eax, dword [rsp + 0x100]
cmp eax, 0x103
je 0x2100c86d6
test eax, eax
jne 0x2100c8d0b
mov edx, 0x1f4
mov rcx, r13
call sym.WaitForSingleObject
test eax, eax
jne 0x2100c8d0b
mov rcx, r13
call sym.CloseHandle
mov rcx, qword [rsp + 0xc8]
call sym.CloseHandle
mov rcx, qword [rsp + 0x90]
lea r9, [rsp + 0x7c]
mov rdx, rdi
mov qword [rsp + 0x20], 0
mov r8d, 0x40
call sym.ReadFile
test eax, eax
je 0x2100c8d56
lea r11, [rsp + 0x80]
mov eax, dword [rsp + 0x7c]
mov rcx, rdi
lea r13, [rsp + 0x88]
mov r9, r13
mov r8, r11
mov qword [rsp + 0x58], r11
lea rdx, str.StdHandles_p__p
mov byte [rsp + rax + 0x100], 0
call sym.sscanf_1
call sym.GetCurrentProcess
mov dword [rsp + 0x30], 2
mov r9, qword [rsp + 0x58]
mov dword [rsp + 0x28], 1
mov rdx, qword [rsp + 0x80]
mov r8, rax
mov dword [rsp + 0x20], 0
mov rcx, qword [rsp + 0xc0]
call sym.DuplicateHandle
test eax, eax
je 0x2100c8d56
call sym.GetCurrentProcess
mov dword [rsp + 0x30], 2
mov r9, r13
mov rdx, qword [rsp + 0x88]
mov dword [rsp + 0x28], 1
mov rcx, qword [rsp + 0xc0]
mov r8, rax
mov dword [rsp + 0x20], 0
call sym.DuplicateHandle
test eax, eax
je 0x2100c8d6d
mov rcx, qword [rsp + 0x90]
call sym.CloseHandle
mov rcx, qword [rsp + 0x98]
call sym.CloseHandle
mov rcx, qword [rsp + 0x1a8]
call sym.DeleteProcThreadAttributeList
mov rdi, qword [rsp + 0x1a8]
call sym.GetProcessHeap
xor edx, edx
mov r8, rdi
mov rcx, rax
call sym.HeapFree
mov ecx, dword [0x21024fa70]
call sym.acquire_attach_mutex_unsigned_int_
call sym.FreeConsole
mov ecx, dword [rsp + 0xd0]
call sym.AttachConsole
xor ecx, ecx
call sym.init_console_handler_bool_
call sym.release_attach_mutex__
mov rdi, qword [rsp + 0x50]
mov rcx, rdi
call sym.SetEvent
mov rcx, qword [rsp + 0xc0]
or edx, 0xffffffff
call sym.WaitForSingleObject
mov rcx, rdi
call sym.CloseHandle
mov rcx, qword [rsp + 0xc0]
call sym.CloseHandle
mov rcx, r15
call method.path_conv.path_conv__
jmp 0x2100c8083
lea r9, str.Pseudo_console_is_disabled_because_the_legacy_console_mode_is_enabled.
lea r8, str.bool_fhandler_pty_slave::setup_pseudoconsole_bool_
mov edx, 0x100
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100c822d
mov rcx, rbx
call rdx
mov rdx, rax
mov rax, qword [rbx]
jmp 0x2100c809d
test edi, edi
js 0x2100c8102
mov eax, dword [rbx + 0x1b0]
cmp dword [r13 + 0x1b0], eax
jne 0x2100c80d0
mov rax, qword [r13]
mov rdx, qword [rax + 0x288]
cmp rdx, rsi
jne 0x2100c8c13
lea rdx, [r13 + 0x210]
cmp qword [rdx], r15
je 0x2100c8b2c
mov rax, qword [rax + 0x298]
cmp rax, rbp
jne 0x2100c8c09
lea rax, [r13 + 0x208]
cmp qword [rax], r14
jne 0x2100c80c1
mov rax, qword [rsp + 0x88]
mov qword [r13 + 0x208], rax
jmp 0x2100c80c1
mov rcx, r15
call method.path_conv.path_conv__
mov rcx, r13
call sym.CloseHandle
mov rax, qword [rbx + 0x1d8]
xor edx, edx
mov rcx, qword [rsp + 0x50]
mov word [rax + 0xc8], dx
mov dword [rax + 0xcc], 0
call sym.CloseHandle
mov rcx, qword [rsp + 0x90]
call sym.CloseHandle
mov rcx, qword [rsp + 0x98]
call sym.CloseHandle
mov rbx, qword [rsp + 0x1a8]
call sym.GetProcessHeap
xor edx, edx
mov rcx, rax
mov r8, rbx
call sym.HeapFree
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x2100c822d
mov r13, qword [rcx + 0x10]
call fcn.21022d000
mov rcx, r13
call sym.CloseHandle
jmp 0x2100c8230
mov rcx, rbx
call rax
jmp 0x2100c7f7c
mov qword [rsp + 0x50], r8
mov rcx, rbx
call rax
mov r8, qword [rsp + 0x50]
jmp 0x2100c82f4
mov rcx, rbx
call rax
mov rdx, qword [rbx]
jmp 0x2100c82d3
mov edx, dword [0x21024fa70]
mov rcx, qword [rbx + 0x1e8]
call sym.WaitForSingleObject
mov rdx, qword [0x21024fce8]
mov rax, qword [rbx + 0x1d8]
mov edx, dword [rdx]
mov byte [rax + 0x121], 1
mov byte [rax + 0xc9], 1
mov dword [rax + 0xcc], edx
mov rax, qword [rbx]
lea rdx, [method.fhandler_termios.get_output_handle__]
mov rax, qword [rax + 0x290]
cmp rax, rdx
jne 0x2100c8d01
lea rax, [rbx + 0x1d0]
mov qword [rsp + 0x20], 0
mov rcx, qword [rax]
lea r9, [rsp + 0x300]
mov r8d, 4
lea rdx, str.e_6n
call sym.WriteFile
mov rcx, qword [rbx + 0x1e8]
call sym.ReleaseMutex
mov rax, qword [rbx + 0x1d8]
mov r9d, dword [rax + 0xcc]
test r9d, r9d
je 0x2100c7f8c
nop dword [rax]
mov ecx, 1
call sym.Sleep
mov rax, qword [rbx + 0x1d8]
mov r8d, dword [rax + 0xcc]
test r8d, r8d
jne 0x2100c8ae8
jmp 0x2100c7f8c
call sym.SetConsoleOutputCP
mov rsi, qword [rbx + 0x1d8]
jmp 0x2100c81f0
call sym.SetConsoleCP
mov rsi, qword [rbx + 0x1d8]
jmp 0x2100c81e2
mov rdx, qword [rsp + 0x80]
mov qword [r13 + 0x210], rdx
jmp 0x2100c8957
mov rcx, qword [rsp + 0x80]
lea r13, [rsp + 0x300]
mov rdx, r13
call sym.GetConsoleMode
mov edx, dword [rsp + 0x300]
and edx, 0xfffffff8
mov dword [rsp + 0x300], edx
mov eax, dword [rsi + 0x34]
test al, 4
je 0x2100c8b7a
or edx, 4
mov dword [rsp + 0x300], edx
test al, 2
je 0x2100c8b88
or edx, 2
mov dword [rsp + 0x300], edx
mov ecx, edx
and ecx, 6
cmp ecx, 4
jne 0x2100c8b9c
and edx, 0xfffffffb
mov dword [rsp + 0x300], edx
test al, 1
je 0x2100c8baa
or edx, 1
mov dword [rsp + 0x300], edx
mov rcx, qword [rsp + 0x80]
call sym.SetConsoleMode
mov rcx, qword [rsp + 0x88]
mov rdx, r13
call sym.GetConsoleMode
mov edx, dword [rsp + 0x300]
and edx, 0xfffffff7
mov dword [rsp + 0x300], edx
mov eax, dword [rsi + 0x2c]
and eax, 9
cmp eax, 9
je 0x2100c8bed
or edx, 8
mov dword [rsp + 0x300], edx
mov rcx, qword [rsp + 0x88]
call sym.SetConsoleMode
jmp 0x2100c8206
mov rcx, rbx
call rax
jmp 0x2100c80b7
mov rcx, r13
call rax
jmp 0x2100c896e
mov rcx, r13
call rdx
mov rdx, rax
mov rax, qword [r13]
jmp 0x2100c894e
mov rax, qword [rsi]
mov qword [rcx + 0xe8], rax
mov rdx, qword [rsi + 8]
mov rax, qword [rbx + 0x1d8]
mov qword [rax + 0xf0], rdx
mov rdx, qword [rsi + 0x10]
mov rax, qword [rbx + 0x1d8]
mov qword [rax + 0xf8], rdx
mov rax, qword [rbx + 0x1d8]
lea rbp, [rax + 0x100]
call sym.GetCurrentProcess
mov r13, qword [rsp + 0x80]
mov rdi, rax
call sym.GetCurrentProcess
mov r9, rbp
mov r8, rdi
mov rdx, r13
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
call sym.DuplicateHandle
mov rax, qword [rbx + 0x1d8]
lea rbp, [rax + 0x108]
call sym.GetCurrentProcess
mov r13, qword [rsp + 0x88]
mov rdi, rax
call sym.GetCurrentProcess
mov r8, rdi
mov rdx, r13
mov r9, rbp
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
call sym.DuplicateHandle
call sym.GetProcessHeap
mov r8, rsi
xor edx, edx
mov rcx, rax
call sym.HeapFree
jmp 0x2100c81b6
mov rcx, rbx
call rax
jmp 0x2100c8a9c
mov rcx, r15
call method.path_conv.path_conv__
mov rcx, r13
call sym.CloseHandle
mov rcx, qword [rsp + 0xc8]
call sym.CloseHandle
mov rcx, qword [rsp + 0x50]
call sym.SetEvent
mov rcx, qword [rsp + 0xc0]
mov edx, 0xffffffff
call sym.WaitForSingleObject
mov rcx, qword [rsp + 0xc0]
call sym.CloseHandle
jmp 0x2100c899b
mov rcx, r15
call method.path_conv.path_conv__
jmp 0x2100c8d28
lea rdi, [rsp + 0x100]
jmp 0x2100c873e
mov rcx, r15
call method.path_conv.path_conv__
mov rcx, qword [rsp + 0x80]
call sym.CloseHandle
jmp 0x2100c8d28