Function at 0x5640d0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes
Execute shell command and capture output
Read file on windows
Read pipe
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ab3d4
mov eax, dword fs:[0]
push eax
sub esp, 0x2a4
mov eax, dword [0x5f300c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x154], esi
mov dword [ebp - 0x158], 0
mov eax, dword [esi + 0x34]
cmp eax, 2
jne 0x564195
lea edx, [esi + 0x1c]
lea ecx, [ebp - 0xec]
call fcn.00560610
mov dword [ebp - 4], 0
lea eax, [ebp - 0xec]
cmp dword [ebp - 0xd8], 0x10
jb 0x564145
mov eax, dword [ebp - 0xec]
push eax
push esi
mov ecx, edi
call fcn.00564f60
mov edx, dword [ebp - 0xd8]
cmp edx, 0x10
jb 0x56418a
mov ecx, dword [ebp - 0xec]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x564180
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x564180
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0059e222
add esp, 8
mov eax, dword [ebp - 0x158]
jmp 0x564f3c
cmp eax, 4
jne 0x5641b3
cmp dword [esi + 0x14], 0x10
jb 0x5641a2
mov esi, dword [esi]
push esi
call fcn.00563320
mov eax, dword [ebp - 0x158]
jmp 0x564f3c
cmp eax, 5
jne 0x5641d1
cmp dword [esi + 0x14], 0x10
jb 0x5641c0
mov esi, dword [esi]
push esi
call fcn.005631b0
mov eax, dword [ebp - 0x158]
jmp 0x564f3c
cmp eax, 6
jne 0x5642db
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x5641e4
mov eax, dword [esi]
mov cl, byte [eax]
test cl, cl
je 0x56418a
xor ebx, ebx
cmp cl, 0x77
sete bl
cmp byte [eax + 1], 0x63
jne 0x5641fb
or ebx, 2
cmp byte [eax + 2], 0x64
jne 0x564204
or ebx, 8
cmp byte [eax + 3], 0x62
jne 0x56420d
or ebx, 0x10
lea esi, [eax + 5]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x564215
sub ecx, edx
lea eax, [esi + 1]
add eax, ecx
cmp dword [edi + 0x12c0], 1
mov dword [ebp - 0x174], eax
jne 0x564235
or ebx, 0x20
push 0
push 0
push 0x7d8
push dword [edi + 0x7d4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
mov dword [ebp - 0x15c], eax
lea ecx, [ebp - 0x11c]
call fcn.00560450
mov ecx, eax
mov dword [ebp - 4], 1
cmp dword [ecx + 0x14], 8
jb 0x56426e
mov ecx, dword [ecx]
mov eax, dword [ebp - 0x154]
add eax, 0x1c
cmp dword [eax + 0x14], 8
jb 0x56427f
mov eax, dword [eax]
lea edx, [ebp - 0x15c]
push edx
push dword [ebp - 0x174]
push ecx
push eax
push ebx
mov ecx, edi
call fcn.00552a10
lea ecx, [ebp - 0x11c]
call fcn.0040ab30
test bl, 0x20
je 0x56418a
cmp byte [edi + 0xa10], 0
je 0x56418a
push 0
push dword [ebp - 0x15c]
push 0x7e9
push dword [edi + 0x7d4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x158]
jmp 0x564f3c
push 0
push 0
push 0x859
push dword [edi + 0x7d4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
cmp ebx, 0xfde9
je 0x564309
mov ecx, dword [edi + 0x680]
mov edx, ebx
call fcn.00563da0
mov ebx, eax
mov eax, dword [edi]
mov ecx, edi
push 0xffffffffffffffff
push 0x5d6f34
mov dword [ebp - 0x1b8], 0xc
mov dword [ebp - 0x1b4], 0
mov dword [ebp - 0x1b0], 1
call dword [eax + 0xf0]
mov edx, esi
lea ecx, [ebp - 0x134]
call fcn.00560530
push ebx
push eax
mov ecx, edi
mov dword [ebp - 4], 2
call fcn.00563e50
lea ecx, [ebp - 0x134]
mov dword [ebp - 4], 0xffffffff
call fcn.0040ab30
mov eax, dword [edi]
mov ecx, edi
push 0xffffffffffffffff
push 0x5d6f30
call dword [eax + 0xf0]
mov esi, dword [sym.imp.KERNEL32.dll_CreatePipe]
lea eax, [ebp - 0x1b8]
push 0x10000
push eax
lea eax, [ebp - 0x17c]
mov dword [ebp - 0x17c], 0
push eax
lea eax, [ebp - 0x170]
mov dword [ebp - 0x170], 0
push eax
call esi
push 0x10000
lea ecx, [ebp - 0x1b8]
mov dword [edi + 0x12c8], 0
lea eax, [edi + 0x12c8]
mov dword [edi + 0x12cc], 0
push ecx
push eax
lea eax, [ebp - 0x180]
mov dword [ebp - 0x180], 0
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 0
push 1
push dword [ebp - 0x170]
call esi
push 0
push 1
push dword [edi + 0x12c8]
call esi
mov esi, dword [ebp - 0x154]
xor eax, eax
mov dword [ebp - 0x1f8], 0
mov dword [ebp - 0x1f4], 0
mov dword [ebp - 0x1f0], 0
mov dword [ebp - 0x1ec], 0
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 0
mov dword [ebp - 0x1e0], 0
mov dword [ebp - 0x1dc], 0
mov dword [ebp - 0x1d8], 0
mov dword [ebp - 0x1d4], 0
mov dword [ebp - 0x1ca], 0
mov word [ebp - 0x1c6], ax
mov dword [ebp - 0x1fc], 0x44
mov dword [ebp - 0x1d0], 0x101
cmp dword [esi + 0x34], eax
je 0x5644a1
mov eax, 5
mov word [ebp - 0x1cc], ax
lea ecx, [esi + 0x18]
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x1c0], eax
mov dword [ebp - 0x1bc], eax
lea eax, [ebp - 0x5c]
push eax
call fcn.00518c80
xor eax, eax
mov dword [ebp - 4], 3
mov edx, esi
mov dword [ebp - 0x190], eax
lea ecx, [ebp - 0xd4]
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x184], eax
call fcn.00560530
mov byte [ebp - 4], 4
lea edx, [ebp - 0xd4]
mov esi, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xd4]
cmp esi, 8
jb 0x56451d
mov edx, ecx
mov eax, dword [ebp - 0xc4]
lea edx, [edx + eax*2]
add edx, 2
lea eax, [ebp - 0xd4]
cmp esi, 8
jb 0x564536
mov eax, ecx
push dword [ebp - 0x174]
lea ecx, [ebp - 0x1ac]
mov dword [ebp - 0x1ac], 0
push edx
push eax
mov dword [ebp - 0x1a8], 0
mov dword [ebp - 0x1a4], 0
call fcn.00436f60
mov byte [ebp - 4], 5
cmp dword [ebp - 0x48], 0
jbe 0x56457f
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
jb 0x564581
mov eax, dword [ebp - 0x58]
jmp 0x564581
xor eax, eax
lea ecx, [ebp - 0x190]
push ecx
lea ecx, [ebp - 0x1fc]
push ecx
push eax
push 0
push 0x200
push 1
push 0
push 0
push dword [ebp - 0x1ac]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
mov dword [ebp - 0x164], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x564743
mov esi, dword [ebp - 0x154]
cmp dword [esi + 0x34], 0
jne 0x5646f1
cmp eax, 2
je 0x5645e1
cmp eax, 0xc1
jne 0x5646f1
push 0xb
push str.cmd.exe__c
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.0040af10
push esi
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 6
call fcn.004501c0
push eax
lea ecx, [ebp - 0x40]
call fcn.00450240
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x74]
call fcn.00560530
mov byte [ebp - 4], 7
lea edx, [ebp - 0x74]
mov esi, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x74]
cmp esi, 8
jb 0x564637
mov edx, ecx
mov eax, dword [ebp - 0x64]
lea edx, [edx + eax*2]
add edx, 2
lea eax, [ebp - 0x74]
cmp esi, 8
jb 0x56464a
mov eax, ecx
push ecx
push edx
push eax
lea ecx, [ebp - 0x208]
call fcn.00437b00
cmp dword [ebp - 0x48], 0
jbe 0x56466c
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
jb 0x56466e
mov eax, dword [ebp - 0x58]
jmp 0x56466e
xor eax, eax
lea ecx, [ebp - 0x190]
push ecx
lea ecx, [ebp - 0x1fc]
push ecx
push eax
push 0
push 0x200
push 1
push 0
push 0
push dword [ebp - 0x208]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x164], esi
call fcn.00414470
lea ecx, [ebp - 0x74]
call fcn.0040ab30
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x5646ed
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5646e3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x5646e3
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0059e222
add esp, 8
test esi, esi
jne 0x564743
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
mov esi, eax
push 0xffffffffffffffff
push 0x5d7050
mov edx, dword [ecx + 0xf0]
mov ecx, edi
call edx
mov edx, esi
lea ecx, [ebp - 0x14c]
call fcn.00560eb0
push ebx
push eax
mov ecx, edi
mov byte [ebp - 4], 0xf
call fcn.00563e50
lea ecx, [ebp - 0x14c]
mov byte [ebp - 4], 5
call fcn.0040ab30
mov eax, dword [edi]
mov ecx, edi
push 6
call dword [eax + 0x60]
jmp 0x564edc
mov eax, dword [ebp - 0x188]
mov dword [edi + 0x12cc], eax
mov byte [ebp - 0x14e], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov ebx, dword [ebp - 0x154]
xor edx, edx
mov byte [ebp - 4], 8
mov dword [ebp - 0x160], edx
mov eax, dword [ebx + 0x50]
test al, 2
je 0x56478a
mov edx, dword [ebx + 0x48]
mov dword [ebp - 0x160], edx
lea ecx, [ebx + 0x38]
test edx, edx
je 0x56492d
test al, 4
jne 0x56492d
push ecx
lea ecx, [ebp - 0xbc]
call fcn.004146c0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xa4]
push 4
push str._n__
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 0xf
mov byte [ebp - 0xa4], 0
call fcn.0040af10
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x8c]
push 1
push 0x5d6f08
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0xf
mov byte [ebp - 0x8c], 0
call fcn.0040af10
lea eax, [ebp - 0xa4]
mov byte [ebp - 4], 0xb
push eax
lea edx, [ebp - 0x8c]
lea ecx, [ebp - 0xbc]
call fcn.0055c0b0
mov byte [ebp - 4], 0xa
add esp, 4
mov edx, dword [ebp - 0x78]
cmp edx, 0x10
jb 0x564861
mov ecx, dword [ebp - 0x8c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x564857
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x564857
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0059e222
add esp, 8
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x90]
cmp edx, 0x10
jb 0x5648a1
mov ecx, dword [ebp - 0xa4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x564897
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x564897
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0059e222
add esp, 8
mov eax, dword [edi]
mov ecx, edi
push 0xffffffffffffffff
push 0x5d6f04
call dword [eax + 0xf0]
cmp dword [ebp - 0xa8], 0x10
mov eax, dword [edi]
mov edx, dword [eax + 0xf0]
lea eax, [ebp - 0xbc]
jb 0x5648cf
mov eax, dword [ebp - 0xbc]
push 0xffffffffffffffff
push eax
mov ecx, edi
call edx
mov eax, dword [edi]
mov ecx, edi
push 0xffffffffffffffff
push 0x5d6f98
call dword [eax + 0xf0]
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0xa8]
cmp edx, 0x10
jb 0x564927
mov ecx, dword [ebp - 0xbc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x56491d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x56491d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0059e222
add esp, 8
mov edx, dword [ebp - 0x160]
xor eax, eax
test esi, esi
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x194], eax
mov byte [ebp - 0x14d], al
je 0x564cbd
mov ebx, dword [ebp - 0x154]
mov ecx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp eax, edx
jb 0x564984
mov esi, dword [ebp - 0x194]
cmp esi, 0xa
jle 0x56496e
push 0x64
jmp 0x564975
cmp esi, 2
jle 0x564977
push 0xa
call ecx
inc esi
mov dword [ebp - 0x194], esi
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [ebp - 0x14d], 0
jne 0x5649a2
push 0
push dword [ebp - 0x190]
call esi
test eax, eax
jne 0x5649a2
mov byte [ebp - 0x14d], 1
push ecx
push 0x10000
lea ecx, [ebp - 0x1a0]
mov dword [ebp - 0x16c], 0
mov dword [ebp - 0x178], 0
call fcn.0040a750
push 0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x178]
mov eax, dword [ebp - 0x1a0]
mov esi, dword [ebp - 0x19c]
push ecx
lea ecx, [ebp - 0x16c]
mov dword [ebp - 0x15c], eax
push ecx
sub esi, eax
push esi
push eax
push dword [ebp - 0x170]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x564a09
mov dword [ebp - 0x178], eax
jmp 0x564a1a
mov eax, dword [ebp - 0x178]
cmp eax, 0x3e8
jae 0x564c07
cmp dword [edi + 0x12c8], 0xffffffff
je 0x564c07
mov edx, dword [ebp - 0x168]
cmp edx, dword [ebp - 0x160]
jae 0x564c07
add ebx, 0x38
mov ecx, ebx
cmp dword [ebx + 0x14], 0x10
jb 0x564a46
mov ecx, dword [ebx]
push 1
push 0x5d6f94
push edx
mov edx, dword [ebx + 0x10]
call fcn.00474420
mov esi, eax
add esp, 0xc
mov eax, dword [ebp - 0x168]
cmp esi, 0xffffffff
jne 0x564a70
mov esi, dword [ebp - 0x160]
sub esi, eax
jmp 0x564a73
sub esi, eax
inc esi
cmp esi, 0xfa
jbe 0x564a80
mov esi, 0xfa
cmp dword [ebx + 0x14], 0x10
mov dword [ebp - 0x174], 0
jb 0x564a92
mov ebx, dword [ebx]
push 0
lea ecx, [ebp - 0x174]
add eax, ebx
push ecx
push esi
push eax
push dword [edi + 0x12c8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x564bdb
mov ebx, dword [ebp - 0x168]
mov eax, ebx
and eax, 0xfffffc00
lea ecx, [esi + ebx]
and ecx, 0xfffffc00
cmp ecx, eax
jbe 0x564ad5
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
add ebx, dword [ebp - 0x174]
mov dword [ebp - 0x168], ebx
cmp ebx, dword [ebp - 0x160]
jb 0x564aff
push dword [edi + 0x12c8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x12c8], 0xffffffff
mov ebx, dword [ebp - 0x154]
mov esi, dword [ebp - 0x15c]
push 0
lea ecx, [edi + 0xa14]
call fcn.0051dca0
test al, al
je 0x564b61
push 0x1f4
push dword [ebp - 0x190]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x564b50
mov eax, dword [edi]
mov ecx, edi
push 0xffffffffffffffff
push str._n_Process_failed_to_respond__forcing_abrupt_termination..._n
call dword [eax + 0xf0]
push 1
push dword [ebp - 0x190]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x164], 0
mov byte [ebp - 0x14e], 1
mov byte [ebp - 4], 8
test esi, esi
je 0x564bb7
mov ecx, dword [ebp - 0x198]
mov eax, esi
sub ecx, esi
cmp ecx, 0x1000
jb 0x564b8f
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x56417a
push ecx
push esi
call fcn.0059e222
add esp, 8
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x19c], 0
mov dword [ebp - 0x198], 0
cmp dword [ebp - 0x164], 0
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
je 0x564cbd
mov eax, dword [ebp - 0x168]
mov edx, dword [ebp - 0x160]
jmp 0x564955
push dword [edi + 0x12c8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi]
mov ecx, edi
push 0xffffffffffffffff
push str._n_Input_pipe_closed_due_to_write_failure._n
mov dword [edi + 0x12c8], 0xffffffff
call dword [eax + 0xf0]
jmp 0x564aff
test eax, eax
je 0x564ca6
push 0
lea eax, [ebp - 0x16c]
push eax
push esi
mov esi, dword [ebp - 0x15c]
push esi
push dword [ebp - 0x170]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x564c97
mov ecx, dword [ebp - 0x16c]
test ecx, ecx
je 0x564c97
mov eax, dword [ebx + 0x50]
test al, 0x30
je 0x564c54
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00415c30
mov eax, dword [ebx + 0x50]
mov ecx, dword [ebp - 0x16c]
test al, 4
jne 0x564c84
cmp byte [edi + 0x12bc], 0
jne 0x564c78
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x150]
mov ecx, dword [ebp - 0x16c]
mov byte [edi + 0x12bc], 1
mov eax, dword [edi]
push ecx
push esi
mov ecx, edi
call dword [eax + 0xf0]
mov ecx, edi
call fcn.00563920
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x564b0b
mov dword [ebp - 0x164], 0
jmp 0x564b0b
xor eax, eax
cmp byte [ebp - 0x14d], al
setne al
dec eax
and dword [ebp - 0x164], eax
jmp 0x564b05
push 0x3e8
push dword [ebp - 0x190]
call esi
test eax, eax
je 0x564ced
mov eax, dword [edi]
mov ecx, edi
push 0xffffffffffffffff
push str._n_Process_failed_to_respond__forcing_abrupt_termination...
call dword [eax + 0xf0]
push 2
push dword [ebp - 0x190]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0x158]
push eax
push dword [ebp - 0x190]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
sub esp, 8
lea ecx, [ebp - 0x2b0]
call fcn.00514ce0
mov edx, str._Exit_code:
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x2b0]
call fcn.00515470
push dword [ebp - 0x158]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
mov al, byte [edi + 0xa5d]
test al, al
je 0x564d99
mov edx, str.____Time:
lea ecx, [ebp - 0x2b0]
call fcn.00515470
push 0
lea eax, [ebp - 0x218]
push 4
push eax
call dword [sym.imp.MSVCP140.dll_struct_std::_Smanip_long_long___int64_____cdecl_std::setprecision_long_long___int64__]
lea edx, [ebp - 0x2b0]
push dword [eax + 0xc]
mov ecx, dword [eax]
push dword [eax + 8]
mov eax, dword [ebp - 0x2b0]
mov eax, dword [eax + 4]
add eax, edx
push eax
call ecx
add esp, 0x18
lea ecx, [edi + 0x1298]
push 0
call fcn.0051c0d0
sub esp, 8
lea ecx, [ebp - 0x2b0]
fstp qword [esp]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___double_]
mov edx, 0x5d6f84
lea ecx, [ebp - 0x2b0]
call fcn.00515470
mov eax, dword [edi]
lea ecx, [ebp - 0x2b0]
mov esi, dword [eax + 0xf0]
lea eax, [ebp - 0x104]
push eax
call fcn.00514c20
mov byte [ebp - 4], 0xe
cmp dword [eax + 0x14], 0x10
jb 0x564dcf
mov eax, dword [eax]
push 0xffffffffffffffff
push eax
mov ecx, edi
call esi
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0xf0]
cmp edx, 0x10
jb 0x564e16
mov ecx, dword [ebp - 0x104]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x564e0c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x564e0c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0059e222
add esp, 8
push dword [ebp - 0x190]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x18c]
call esi
cmp byte [ebp - 0x14e], 0
jne 0x564e92
mov eax, dword [ebx + 0x50]
test al, 0x10
jne 0x564e49
test al, 0x20
je 0x564e92
cmp dword [ebp - 0x158], 0
jne 0x564e92
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x85f
push dword [edi + 0x7c0]
call ebx
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov esi, eax
jb 0x564e6e
mov ecx, dword [ebp - 0x28]
push ecx
push 0
push 0x87a
push dword [edi + 0x7c0]
call ebx
mov eax, dword [ebp - 0x18]
add eax, esi
push eax
push esi
push 0x870
push dword [edi + 0x7c0]
call ebx
mov eax, dword [edi]
mov ecx, edi
push 5
call dword [eax + 0x60]
lea ecx, [ebp - 0x2b0]
call fcn.00514b90
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x564edc
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x564ed2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x564ed2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0059e222
add esp, 8
push dword [ebp - 0x170]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [ebp - 0x17c]
call ebx
push dword [ebp - 0x180]
call ebx
push dword [edi + 0x12c8]
call ebx
mov esi, dword [ebp - 0x158]
lea ecx, [ebp - 0x1ac]
mov dword [edi + 0x12c8], 0
mov dword [edi + 0x12cc], 0
call fcn.00414470
lea ecx, [ebp - 0xd4]
call fcn.0040ab30
lea ecx, [ebp - 0x58]
call fcn.0040ab30
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059df64
mov esp, ebp
pop ebp
ret 4