Function at 0x140004eb0
Capabilities:
Patch process command line
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov esi, dword [rcx + 8]
xorps xmm0, xmm0
mov r8d, esi
mov ecx, 0x410
xor edx, edx
movups xmmword [rsp + 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x140004ef7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Could_not_open_process___d_n
call fcn.140002b10
xor al, al
add rsp, 0x78
pop rdi
pop rsi
ret
lea rcx, [0x140008c88]
mov qword [rsp + 0x70], rbp
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtQueryInformationProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebp, ebp
lea r8, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x20], rbp
mov rcx, rdi
lea r9d, [rbp + 0x30]
call rax
mov rdx, qword [rsp + 0x48]
lea r9d, [rbp + 8]
add rdx, 0x20
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0x98]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x140004f79
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Could_not_read_the_address_of_ProcessParameters___d_n
call fcn.140002b10
mov rbp, qword [rsp + 0x70]
xor al, al
add rsp, 0x78
pop rdi
pop rsi
ret
mov rdx, qword [rsp + 0x98]
lea r8, [rsp + 0x30]
add rdx, 0x70
mov qword [rsp + 0x20], rbp
mov r9d, 0x10
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x140004fc4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Could_not_read_CommandLine___d_n
call fcn.140002b10
mov rbp, qword [rsp + 0x70]
xor al, al
add rsp, 0x78
pop rdi
pop rsi
ret
movzx ecx, word [rsp + 0x30]
mov eax, 2
inc ecx
mov qword [rsp + 0xa0], rbx
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140006778
movzx ecx, word [rsp + 0x30]
xor edx, edx
mov rbx, rax
lea r8d, [rcx*2 + 2]
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
movzx r9d, word [rsp + 0x30]
mov r8, rbx
mov rdx, qword [rsp + 0x38]
dec r9
mov rcx, rdi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x140005044
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Could_not_read_the_command_line_string___d_n
call fcn.140002b10
jmp 0x140005105
cmp word [rsp + 0x30], 0x50
jae 0x1400050f9
lea r8, [0x140008d3c]
lea rdx, str.Out.LastEpoch.Remote.Native.dll
lea rcx, [rsp + 0x90]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov rcx, qword [rsp + 0x90]
xor edx, edx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov rcx, qword [rsp + 0x90]
xor r8d, r8d
xor edx, edx
movsxd rbx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
lea edx, [rbx + 1]
movsxd rcx, edx
call fcn.140006778
mov r9, qword [rsp + 0x90]
mov rdx, rbx
mov r8d, 1
mov rcx, rax
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r8, rdi
mov ecx, esi
call fcn.140004d40
mov rcx, rdi
mov ebx, eax
call fcn.140006744
shr ebx, 0x1f
xor bl, 1
movzx eax, bl
jmp 0x140005107
lea rcx, str.Could_not_find_proper_process_n
call fcn.140002b10
xor al, al
mov rbx, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
pop rdi
pop rsi
ret