Function at 0x140001b08
Capabilities:
Acquire debug privileges
Check if file exists
Execute command
Get file attributes
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb8]
sub rsp, 0x190
xor r15d, r15d
mov qword [rsp + 0x5c], r15
mov qword [rsp + 0x50], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x50]
lea edx, [r15 + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea r12d, [r15 + 1]
lea r13d, [r15 + 2]
test eax, eax
je 0x140001bab
lea r8, [rsp + 0x5c]
mov dword [rsp + 0x58], r12d
lea rdx, str.SeDebugPrivilege
mov dword [rsp + 0x64], r13d
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140001ba0
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r15
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140001a88
test eax, eax
je 0x140001bab
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea rcx, str.C:UsersAnDesktopEnginePro.dll
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea r14, str.PAUSE
cmp eax, 0xffffffff
jne 0x140001bfe
lea rcx, str.Dll_file_doesnt_exist_n
call fcn.140001148
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [0x140008fd8]
lea rcx, [rbp + 0x30]
mov qword [rbp - 0x80], rax
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
xor r9d, r9d
lea rdx, [rbp - 0x70]
xor r8d, r8d
lea rcx, [rbp - 0x80]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x80], rax
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rsp + rcx + 0x7c], edx
lea rcx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [rbp + 0xc], r15b
lea rcx, [rbp - 0x70]
mov qword [rbp - 0x70], rax
mov byte [rbp + 1], r15b
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov rax, qword [0x14000c758]
lea rcx, str.C:UsersAnDesktopEnginePro.dll
mov edx, 0x25
mov qword [rbp + 0x10], r15
mov qword [rbp + 4], rax
mov qword [rbp - 8], r15
lea r8d, [rdx + 0x1b]
call qword [sym.imp.MSVCP140.dll_struct__iobuf____ptr64___cdecl_std::_Fiopen_wchar_t_const____ptr64__int__int_]
test rax, rax
je 0x140001d12
mov r8d, r12d
lea rcx, [rbp - 0x70]
mov rdx, rax
call fcn.140002cfc
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::locale___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::getloc_void____ptr64]
mov rcx, rax
call fcn.140002e48
mov rcx, rax
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::codecvt_base::always_noconv_void_const___ptr64]
test al, al
je 0x140001cde
mov qword [rbp - 8], r15
jmp 0x140001cec
lea rcx, [rbp - 0x70]
mov qword [rbp - 8], rbx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140001d2d
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x140001d2d
mov rcx, qword [rax]
mov edx, r12d
mov r8, qword [rcx]
mov rcx, rax
call r8
jmp 0x140001d2d
mov rax, qword [rbp - 0x80]
xor r8d, r8d
mov edx, r13d
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x80]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
mov edx, dword [rbp + rcx - 0x70]
test dl, 6
je 0x140001dff
lea rcx, str.Opening_the_file_failed:__X_n
call fcn.140001148
cmp qword [rbp + 0x10], r15
je 0x140001da5
mov rax, qword [rbp - 0x58]
lea rcx, [rbp]
cmp qword [rax], rcx
jne 0x140001d7b
mov rcx, qword [rbp + 0x18]
mov rdx, qword [rbp + 0x20]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp - 0x38]
mov qword [rax], rcx
mov rax, qword [rbp - 0x20]
mov dword [rax], edx
lea rcx, [rbp - 0x70]
call fcn.140002c54
mov rcx, qword [rbp + 0x10]
neg al
lea rax, [rbp - 0x70]
sbb rbx, rbx
and rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test eax, eax
mov rsi, r15
cmove rsi, rbx
jmp 0x140001da8
mov rsi, r15
lea rcx, [rbp - 0x70]
mov byte [rbp + 0xc], r15b
mov byte [rbp + 1], r15b
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov rax, qword [0x14000c758]
mov qword [rbp + 4], rax
mov qword [rbp + 0x10], r15
mov qword [rbp - 8], r15
test rsi, rsi
jne 0x140001ded
mov rax, qword [rbp - 0x80]
xor r8d, r8d
mov edx, r13d
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x80]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::fpos_struct__Mbstatet____cdecl_std::basic_istream_char__struct_std::char_traits_char__::tellg_void____ptr64]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
lea rax, [rcx + rdx]
cmp rax, 0x1000
jge 0x140001eef
lea rcx, str.Filesize_invalid._n
call fcn.140001148
cmp qword [rbp + 0x10], r15
je 0x140001e8b
mov rax, qword [rbp - 0x58]
lea rcx, [rbp]
cmp qword [rax], rcx
jne 0x140001e61
mov rcx, qword [rbp + 0x18]
mov rdx, qword [rbp + 0x20]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp - 0x38]
mov qword [rax], rcx
mov rax, qword [rbp - 0x20]
mov dword [rax], edx
lea rcx, [rbp - 0x70]
call fcn.140002c54
mov rcx, qword [rbp + 0x10]
neg al
lea rax, [rbp - 0x70]
sbb rbx, rbx
and rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test eax, eax
mov rsi, r15
cmove rsi, rbx
jmp 0x140001e8e
mov rsi, r15
lea rcx, [rbp - 0x70]
mov byte [rbp + 0xc], r15b
mov byte [rbp + 1], r15b
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov rax, qword [0x14000c758]
mov qword [rbp + 4], rax
mov qword [rbp + 0x10], r15
mov qword [rbp - 8], r15
test rsi, rsi
jne 0x140001ed3
mov rax, qword [rbp - 0x80]
xor r8d, r8d
mov edx, r13d
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x80]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
add rcx, rdx
call fcn.14000321c
xor r8d, r8d
lea rcx, [rbp - 0x80]
xor edx, edx
mov r14, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int____ptr64]
mov r8, qword [rsp + 0x68]
lea rcx, [rbp - 0x80]
add r8, qword [rsp + 0x70]
mov rdx, r14
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::read_char____ptr64__long_long___int64_____ptr64]
cmp qword [rbp + 0x10], r15
je 0x140001f77
mov rax, qword [rbp - 0x58]
lea rcx, [rbp]
cmp qword [rax], rcx
jne 0x140001f4d
mov rcx, qword [rbp + 0x18]
mov rdx, qword [rbp + 0x20]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp - 0x38]
mov qword [rax], rcx
mov rax, qword [rbp - 0x20]
mov dword [rax], edx
lea rcx, [rbp - 0x70]
call fcn.140002c54
mov rcx, qword [rbp + 0x10]
neg al
lea rax, [rbp - 0x70]
sbb rbx, rbx
and rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test eax, eax
mov rsi, r15
cmove rsi, rbx
jmp 0x140001f7a
mov rsi, r15
lea rcx, [rbp - 0x70]
mov byte [rbp + 0xc], r15b
mov byte [rbp + 1], r15b
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov rax, qword [0x14000c758]
mov qword [rbp + 4], rax
mov qword [rbp + 0x10], r15
mov qword [rbp - 8], r15
test rsi, rsi
jne 0x140001fbf
mov rax, qword [rbp - 0x80]
xor r8d, r8d
mov edx, r13d
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x80]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov r8, qword [rsp + 0x68]
mov r9b, r12b
add r8, qword [rsp + 0x70]
mov rdx, r14
mov qword [rsp + 0x40], r15
mov rcx, rdi
mov dword [rsp + 0x38], r12d
mov byte [rsp + 0x30], r12b
mov byte [rsp + 0x28], r12b
mov byte [rsp + 0x20], r12b
call fcn.140001384
mov rcx, rdi
test al, al
jne 0x140002020
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Map_Faild
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, r12d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, r12d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3