Function at 0x14002d2c0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create process suspended
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1330]
mov eax, 0x1430
call fcn.14004a410
sub rsp, rax
mov rax, qword [0x140072040]
xor rax, rsp
mov qword [rbp + 0x1320], rax
mov r14, rdx
mov qword [rbp - 0x48], rdx
mov ebx, ecx
xor edi, edi
mov dword [rsp + 0x58], edi
xorps xmm0, xmm0
movups xmmword [rbp + 0x270], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x280], xmm1
lea r8d, [rdi + 4]
lea rdx, str._jar
lea rcx, [rbp + 0x270]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x290], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2a0], xmm1
lea r8d, [rdi + 0x13]
lea rdx, [0x140051680]
lea rcx, [rbp + 0x290]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2c0], xmm1
lea r8d, [rdi + 4]
lea rdx, str..bat
lea rcx, [rbp + 0x2b0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2e0], xmm1
lea r8d, [rdi + 0x13]
lea rdx, [0x140051680]
lea rcx, [rbp + 0x2d0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rdi
lfence
mov ecx, 0x80
call fcn.1400069a0
mov rdi, rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
lea rcx, [rax + 0x80]
mov qword [rbp - 0x80], rcx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x68], rax
lea rsi, [rbp + 0x270]
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rdi
lea rax, [rsp + 0x70]
mov qword [rbp - 0x60], rax
nop
mov qword [rsp + 0x58], rdi
mov rdx, rsi
mov rcx, rdi
call fcn.140005560
nop
lea rcx, [rdi + 0x20]
lea rdx, [rsi + 0x20]
call fcn.140005560
nop
add rdi, 0x40
mov qword [rbp - 0x68], rdi
add rsi, 0x40
lea rax, [rbp + 0x2f0]
cmp rsi, rax
jne 0x14002d420
mov qword ds:[rbp - 0x70], rdi
mov qword [rsp + 0x78], rdi
xor esi, esi
mov qword [rsp + 0x68], rsi
lea r9, [0x1400162e0]
lea edx, [rsi + 0x40]
lea r8d, [rsi + 2]
lea rcx, [rbp + 0x270]
call fcn.140049b4c
lea rdx, str.__A_Z_:______.exe_...__s_
lea rcx, [rbp + 0x180]
call fcn.140023b60
nop
lea r9, [rbp + 0x31a]
sub r9, 2
mov eax, 0xcccccccd
mul ebx
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub bx, cx
add bx, 0x30
mov word [r9], bx
mov ebx, edx
test edx, edx
jne 0x14002d4a0
xorps xmm0, xmm0
movups xmmword [rbp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x258], xmm1
lea rax, [rbp + 0x31a]
cmp r9, rax
jne 0x14002d506
movdqa xmm0, xmmword [0x1400621c0]
movdqu xmmword [rbp + 0x258], xmm0
mov word [rbp + 0x248], si
jmp 0x14002d525
lea r8, ds:[rbp + 0x31a]
sub r8, r9
sar r8, 1
mov rdx, r9
lea rcx, [rbp + 0x248]
call fcn.1400066a0
mov dword [rsp + 0x58], 0xc
mov r15d, 0xe
mov r9d, r15d
lea r8, str.memory.exe__p
lea rcx, [rbp + 0x248]
call fcn.140016be0
xorps xmm0, xmm0
movups xmmword [rbp + 0x228], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x238], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x228], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x238], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rcx, [rbp + 0x248]
call fcn.1400058e0
mov qword [rbp - 0x40], 0x18
mov qword [rbp - 0x30], 1
mov qword [rbp - 0x38], rsi
xor r9d, r9d
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xor r8d, r8d
lea edx, [r15 - 0xd]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov dword [rbp + 0x110], 0x68
xorps xmm0, xmm0
movups xmmword [rbp + 0x118], xmm0
movups xmmword [rbp + 0x128], xmm0
movups xmmword [rbp + 0x138], xmm0
movups xmmword [rbp + 0x148], xmm0
movups xmmword [rbp + 0x158], xmm0
movups xmmword [rbp + 0x168], xmm0
mov rax, qword [rbp - 0x50]
mov qword [rbp + 0x168], rax
psrldq xmm0, 4
movd eax, xmm0
or eax, 0x101
mov dword [rbp + 0x14c], eax
mov word [rbp + 0x150], si
lea rdx, [rbp + 0x228]
cmp qword [rbp + 0x240], 7
cmova rdx, qword [rbp + 0x228]
lea rax, [rbp]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x110]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
nop dword [rax + rax]
test eax, eax
je 0x14002dd90
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x320]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x50]
mov r8d, 0x1000
lea rdx, [rbp + 0x320]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002dd67
lea r13, vtable.std::basic_istringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
lea r12, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
nop
cmp dword [rsp + 0x50], 0
je 0x14002dd67
lea rax, [rbp + 0x320]
mov r9, 0xffffffffffffffff
nop dword [rax]
inc r9
cmp byte [rax + r9], 0
jne 0x14002d700
lea rax, [rbp + 0x320]
add rax, r9
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e8], xmm0
mov qword [rbp + 0x1f8], rsi
mov qword [rbp + 0x200], rsi
lea rcx, [rbp + 0x320]
cmp rcx, rax
jne 0x14002d757
mov rbx, rsi
mov qword [rbp + 0x1f8], rbx
mov edi, 7
mov qword [rbp + 0x200], rdi
mov word [rbp + 0x1e8], si
jmp 0x14002d778
lea rdx, [rbp + 0x320]
lea rcx, [rbp + 0x1e8]
call fcn.1400138e0
mov rdi, qword [rbp + 0x200]
mov rbx, qword [rbp + 0x1f8]
lea rax, [0x14005cd20]
mov qword [rbp + 0x20], rax
lea rcx, [rbp + 0xb0]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
nop
or r15d, 1
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x58], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x20]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__::constructor_class_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x20], r13
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x90]
mov dword [rbp + rcx + 0x1c], edx
lea rax, [rbp + 0x30]
mov qword [rbp - 0x70], rax
lea rcx, [rbp + 0x30]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
nop
mov qword [rbp + 0x30], r12
lea rsi, [rbp + 0x1e8]
cmp rdi, 7
cmova rsi, qword [rbp + 0x1e8]
mov eax, 2
cmp rbx, 0x7fffffff
ja 0x14002dd5c
test rbx, rbx
je 0x14002d887
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x14002de29
lfence
mov rax, qword [rbp + 0x1f8]
lea rdi, [rax + rax]
mov rcx, rdi
call fcn.1400069a0
mov rbx, rax
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rdi + rbx]
mov qword [rbp + 0x98], rcx
mov rcx, qword [rbp + 0x48]
mov qword [rcx], rbx
mov rcx, qword [rbp + 0x68]
mov qword [rcx], rbx
sar rdi, 1
mov rax, qword [rbp + 0x80]
mov dword [rax], edi
mov eax, 3
mov ecx, dword [rsp + 0x58]
mov qword [rsp + 0x68], rcx
xor esi, esi
jmp 0x14002d890
xor esi, esi
mov qword [rbp + 0x98], rsi
mov dword [rbp + 0xa0], eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c8], xmm0
mov qword [rbp + 0x1d8], rsi
mov qword [rbp + 0x1e0], 7
mov word [rbp + 0x1c8], si
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x20]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
movzx r8d, ax
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp + 0x20]
call fcn.140025340
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x14002dcc5
nop dword [rax]
xor r13b, r13b
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
cmp rdi, r12
je 0x14002db49
nop word [rax + rax]
lea r15, [rdi + 0x20]
mov rax, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 7
jbe 0x14002d93b
mov rcx, qword [rdi]
lea r8, [rcx + rax*2]
mov rdx, rcx
jmp 0x14002d942
lea r8, [rdi + rax*2]
mov rdx, rdi
xorps xmm0, xmm0
movups xmmword [rbp + 0x208], xmm0
mov qword [rbp + 0x218], rsi
mov qword [rbp + 0x220], rsi
cmp rdx, r8
jne 0x14002d97d
mov qword [rbp + 0x218], rsi
mov ebx, 7
mov qword [rbp + 0x220], rbx
xor eax, eax
mov word [rbp + 0x208], ax
jmp 0x14002d99d
sub r8, rdx
sar r8, 1
lea rcx, [rbp + 0x208]
call fcn.1400066a0
mov rbx, qword [rbp + 0x220]
mov rsi, qword [rbp + 0x218]
lea rax, [rbp + 0x1c8]
cmp qword [rbp + 0x1e0], 7
cmova rax, qword [rbp + 0x1c8]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp + 0x1d8]
mov qword [rbp - 0x18], rax
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x70], xmm0
lea rcx, [rbp - 0x70]
call fcn.140004d80
test al, al
jne 0x14002db1e
lea r11, [rbp + 0x208]
cmp rbx, 7
cmova r11, qword [rbp + 0x208]
lea rbx, [rbp + 0x1c8]
cmp qword [rbp + 0x1e0], 7
cmova rbx, qword [rbp + 0x1c8]
mov rax, qword [rbp + 0x1d8]
cmp rsi, rax
ja 0x14002db1e
sub rax, rsi
test rsi, rsi
je 0x14002dab4
inc rax
lea r14, [rbx + rax*2]
mov rax, rbx
movzx r10d, word [r11]
nop word [rax + rax]
mov rcx, r14
sub rcx, rax
sar rcx, 1
mov edx, 0
je 0x14002da6c
cmp word [rax], r10w
je 0x14002da69
cmp rcx, 1
je 0x14002da6c
dec rcx
add rax, 2
cmp word [rax], r10w
jne 0x14002da56
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x14002db1e
mov r8, rsi
mov rdx, r11
test rsi, rsi
je 0x14002daa8
mov r9, rax
sub r9, r11
nop dword [rax + rax]
movzx ecx, word [r9 + rdx]
cmp cx, word [rdx]
jne 0x14002db8b
add rdx, 2
sub r8, 1
jne 0x14002da90
sub rax, rbx
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x14002db1e
mov r8, qword [r15 + 0x10]
cmp qword [r15 + 0x18], 7
jbe 0x14002dac2
mov r15, qword [r15]
mov rdx, r15
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140008ee0
lea rdx, [rbp + 0x1c8]
cmp qword [rbp + 0x1e0], 7
cmova rdx, qword [rbp + 0x1c8]
mov r8, qword [rbp + 0x1d8]
mov rcx, rax
call fcn.140008ee0
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r13b, 1
lea r8, [rbp + 0x1c8]
lea rdx, [rbp + 0x1a8]
call fcn.140006140
nop
lea rcx, [rbp + 0x208]
call fcn.1400058e0
add rdi, 0x40
cmp rdi, r12
mov esi, 0
jne 0x14002d920
mov r14, qword [rbp - 0x48]
test r13b, r13b
jne 0x14002dc6e
mov r8, r14
cmp qword [r14 + 0x18], 7
jbe 0x14002db56
mov r8, qword [r14]
cmp qword [r14 + 0x10], 7
jne 0x14002db94
mov edx, 7
lea rax, str.Winmgmt
mov rcx, rax
sub r8, rax
nop
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x14002db94
add rcx, 2
sub rdx, 1
jne 0x14002db70
jmp 0x14002dc6e
add rax, 2
jmp 0x14002da40
lea rcx, [rbp + 0x1c8]
cmp qword [rbp + 0x1e0], 7
cmova rcx, qword [rbp + 0x1c8]
mov rax, qword [rbp + 0x1d8]
lea rdx, [rcx + rax*2]
mov dword [rsp + 0x20], 0x10
lea r9, [rbp + 0x180]
call fcn.140025520
test al, al
je 0x14002dc6e
lea rax, [rbp + 0x1c8]
cmp qword [rbp + 0x1e0], 7
cmova rax, qword [rbp + 0x1c8]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x1d8]
mov qword [rbp - 8], rax
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x70], xmm0
lea rcx, [rbp - 0x70]
call fcn.140004d80
test al, al
jne 0x14002dc6e
lea rdx, str.___Executed_file_with_modified_extension:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
nop dword [rax]
call fcn.1400064a0
lea rdx, [rbp + 0x1c8]
cmp qword [rbp + 0x1e0], 7
cmova rdx, qword [rbp + 0x1c8]
mov r8, qword [rbp + 0x1d8]
mov rcx, rax
call fcn.140008ee0
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, [rbp + 0x1c8]
lea rdx, [rbp + 0x1b8]
call fcn.140006140
mov rax, qword ds:[rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x20]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
movzx r8d, ax
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp + 0x20]
call fcn.140025340
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
mov esi, 0
jne 0x14002d900
lea r12, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
lea r13, vtable.std::basic_istringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
lea rcx, [rbp + 0x1c8]
call fcn.1400058e0
nop
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x20], r13
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x90]
mov dword [rbp + rcx + 0x1c], edx
mov qword [rbp + 0x30], r12
lea rcx, [rbp + 0x30]
call fcn.14002f480
lea rcx, [rbp + 0x30]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea rcx, [rbp + 0x38]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1e8]
call fcn.1400058e0
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x50]
mov r8d, 0x1000
lea rdx, [rbp + 0x320]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002dd67
mov r15, qword [rsp + 0x68]
jmp 0x14002d6e0
nop dword [rax]
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_alloc_void_]
nop
mov edx, 0xffffffff
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword ds:[rbp]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x228]
call fcn.1400058e0
nop
lea rcx, [rbp + 0x180]
call fcn.140019840
mov rcx, qword ds:[rbp + 0x1a0]
test rcx, rcx
je 0x14002ddef
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14004fd98]
mov r8, rax
test rax, rax
je 0x14002ddef
mov rcx, qword [rax]
mov rax, qword [rcx]
mov edx, 1
mov rcx, r8
call qword [0x14004fd98]
nop
lea rcx, [rsp + 0x70]
call fcn.140016920
mov rcx, qword [rbp + 0x1320]
xor rcx, rsp
call fcn.140049740
lea r11, [rsp + 0x1430]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140003ed0
nop
int3