Function at 0x140002530
Capabilities:
Acquire debug privileges
Check if file exists
Execute command
Get file attributes

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x2d0
lea rdi, [rsp + 0x50]
mov ecx, 0xa0
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x2e0]
cmp dword [rsp + 0x2e0], 3
jne 0x1400025a5
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x2e8]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x50], rax
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rsp + 0x2e8]
mov rcx, qword [rcx + rax]
call fcn.140002450
mov dword [rsp + 0x58], eax
jmp 0x1400026fd
cmp dword [rsp + 0x2e0], 2
jne 0x1400026d1
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x2e8]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x68]
call fcn.140003b60
nop
lea rcx, str.Process_Name:_n
call fcn.1400022f0
lea rdx, [rsp + 0x68]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140003710
lea rcx, [rsp + 0x68]
call fcn.140005610
mov qword [rsp + 0x98], rax
mov rcx, qword [rsp + 0x98]
call sub.ucrtbased.dll_strlen
inc rax
mov qword [rsp + 0x2b0], rax
mov eax, 2
mov rcx, qword [rsp + 0x2b0]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400074f0
mov qword [rsp + 0x270], rax
mov rax, qword [rsp + 0x270]
mov qword [rsp + 0xa0], rax
mov rcx, qword [rsp + 0x98]
call sub.ucrtbased.dll_strlen
mov qword [rsp + 0x2b8], rax
mov rcx, qword [rsp + 0x98]
call sub.ucrtbased.dll_strlen
inc rax
mov qword [rsp + 0x2c0], rax
mov rax, qword [rsp + 0x2b8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x98]
mov r8, qword [rsp + 0x2c0]
mov rdx, qword [rsp + 0xa0]
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_mbstowcs_s]
mov rcx, qword [rsp + 0xa0]
call fcn.140002450
mov dword [rsp + 0x58], eax
lea rcx, [rsp + 0x68]
call fcn.140004120
jmp 0x1400026fd
lea rcx, str.Invalid_Params_n
call fcn.1400022f0
lea rcx, str.Usage:_dll_path__process_name__n
call fcn.1400022f0
lea rcx, [0x14000bed8]
call qword [sym.imp.ucrtbased.dll_system]
xor eax, eax
jmp 0x140002c0f
cmp dword [rsp + 0x58], 0
jne 0x140002727
lea rcx, str.Process_not_found_n
call fcn.1400022f0
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
mov eax, 0xffffffff
jmp 0x140002c0f
mov edx, dword [rsp + 0x58]
lea rcx, str.Process_pid:__d_n
call fcn.1400022f0
lea rax, [rsp + 0xb8]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov qword [rsp + 0xe8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0xe8]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400027fc
mov dword [rsp + 0xb8], 1
mov eax, 0xc
imul rax, rax, 0
mov dword [rsp + rax + 0xc4], 2
mov eax, 0xc
imul rax, rax, 0
lea rax, [rsp + rax + 0xbc]
mov r8, rax
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1400027ee
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0xb8]
xor edx, edx
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rsp + 0x58]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xf8], rax
cmp qword [rsp + 0xf8], 0
jne 0x140002858
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x100], eax
mov edx, dword [rsp + 0x100]
lea rcx, str.OpenProcess_failed:_0x_X_n
call fcn.1400022f0
lea rcx, [0x14000bf14]
call qword [sym.imp.ucrtbased.dll_system]
mov eax, 0xfffffffe
jmp 0x140002c0f
mov rcx, qword [rsp + 0xf8]
call fcn.140002390
movzx eax, al
test eax, eax
jne 0x14000289d
lea rcx, str.Invalid_Process_Architecture._n
call fcn.1400022f0
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14000bf88]
call qword [sym.imp.ucrtbased.dll_system]
mov eax, 0xfffffffd
jmp 0x140002c0f
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400028de
lea rcx, str.Dll_file_doesnt_exist_n
call fcn.1400022f0
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14000bfa8]
call qword [sym.imp.ucrtbased.dll_system]
mov eax, 0xfffffffc
jmp 0x140002c0f
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x24
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x120]
call fcn.140003a20
nop
mov rax, qword [rsp + 0x120]
movsxd rax, dword [rax + 4]
lea rax, [rsp + rax + 0x120]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_bool___cdecl_std::ios_base::fail_void_const___ptr64]
movzx eax, al
test eax, eax
je 0x1400029a0
mov rax, qword [rsp + 0x120]
movsxd rax, dword [rax + 4]
lea rax, [rsp + rax + 0x120]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::ios_base::rdstate_void_const___ptr64]
mov edx, eax
lea rcx, str.Opening_the_file_failed:__X_n
call fcn.1400022f0
lea rcx, [rsp + 0x120]
call fcn.1400056c0
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14000bfd0]
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rsp + 0x278], 0xfffffffb
lea rcx, [rsp + 0x120]
call fcn.140004510
mov eax, dword [rsp + 0x278]
jmp 0x140002c0f
lea rdx, [rsp + 0x248]
lea rcx, [rsp + 0x120]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::fpos_struct__Mbstatet____cdecl_std::basic_istream_char__struct_std::char_traits_char__::tellg_void____ptr64]
lea rcx, [rsp + 0x248]
call fcn.1400043c0
cmp rax, 0x1000
jge 0x140002a23
lea rcx, str.Filesize_invalid._n
call fcn.1400022f0
lea rcx, [rsp + 0x120]
call fcn.1400056c0
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14000bfec]
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rsp + 0x27c], 0xfffffffa
lea rcx, [rsp + 0x120]
call fcn.140004510
mov eax, dword [rsp + 0x27c]
jmp 0x140002c0f
lea rcx, [rsp + 0x248]
call fcn.1400043c0
mov rcx, rax
call fcn.1400074f0
mov qword [rsp + 0x280], rax
mov rax, qword [rsp + 0x280]
mov qword [rsp + 0x268], rax
cmp qword [rsp + 0x268], 0
jne 0x140002ab3
lea rcx, str.Cant_allocate_dll_file._n
call fcn.1400022f0
lea rcx, [rsp + 0x120]
call fcn.1400056c0
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14000c014]
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rsp + 0x288], 0xfffffff9
lea rcx, [rsp + 0x120]
call fcn.140004510
mov eax, dword [rsp + 0x288]
jmp 0x140002c0f
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x120]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int____ptr64]
lea rcx, [rsp + 0x248]
call fcn.1400043c0
mov r8, rax
mov rdx, qword [rsp + 0x268]
lea rcx, [rsp + 0x120]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::read_char____ptr64__long_long___int64_____ptr64]
lea rcx, [rsp + 0x120]
call fcn.1400056c0
lea rcx, str.Mapping..._n
call fcn.1400022f0
lea rcx, [rsp + 0x248]
call fcn.1400043c0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 1
mov r9b, 1
mov r8, rax
mov rdx, qword [rsp + 0x268]
mov rcx, qword [rsp + 0xf8]
call fcn.140001020
movzx eax, al
test eax, eax
jne 0x140002bb9
mov rax, qword [rsp + 0x268]
mov qword [rsp + 0x290], rax
mov rcx, qword [rsp + 0x290]
call fcn.140007510
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Error_while_mapping._n
call fcn.1400022f0
lea rcx, str.PAUSE
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rsp + 0x298], 0xfffffff8
lea rcx, [rsp + 0x120]
call fcn.140004510
mov eax, dword [rsp + 0x298]
jmp 0x140002c0f
mov rax, qword [rsp + 0x268]
mov qword [rsp + 0x2a0], rax
mov rcx, qword [rsp + 0x2a0]
call fcn.140007510
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14000be5c]
call fcn.1400022f0
mov dword [rsp + 0x2a8], 0
lea rcx, [rsp + 0x120]
call fcn.140004510
mov eax, dword [rsp + 0x2a8]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x14000c2d8]
call fcn.140007250
mov rax, rdi
add rsp, 0x2d0
pop rdi
ret