Function at 0x140002510
Capabilities:
Acquire debug privileges
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x2d0
lea rdi, [rsp + 0x50]
mov ecx, 0xa0
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x2e0]
cmp dword [rsp + 0x2e0], 3
jne 0x140002585
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x2e8]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x50], rax
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rsp + 0x2e8]
mov rcx, qword [rcx + rax]
call fcn.140002430
mov dword [rsp + 0x58], eax
jmp 0x14000269b
cmp dword [rsp + 0x2e0], 2
jne 0x140002694
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x2e8]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x68]
call fcn.140003700
nop
lea rcx, [rsp + 0x68]
call fcn.140004ff0
mov qword [rsp + 0x98], rax
mov rcx, qword [rsp + 0x98]
call sub.ucrtbased.dll_strlen
inc rax
mov qword [rsp + 0x2b0], rax
mov eax, 2
mov rcx, qword [rsp + 0x2b0]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140006e60
mov qword [rsp + 0x270], rax
mov rax, qword [rsp + 0x270]
mov qword [rsp + 0xa0], rax
mov rcx, qword [rsp + 0x98]
call sub.ucrtbased.dll_strlen
mov qword [rsp + 0x2b8], rax
mov rcx, qword [rsp + 0x98]
call sub.ucrtbased.dll_strlen
inc rax
mov qword [rsp + 0x2c0], rax
mov rax, qword [rsp + 0x2b8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x98]
mov r8, qword [rsp + 0x2c0]
mov rdx, qword [rsp + 0xa0]
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_mbstowcs_s]
mov rcx, qword [rsp + 0xa0]
call fcn.140002430
mov dword [rsp + 0x58], eax
lea rcx, [rsp + 0x68]
call fcn.140003bb0
jmp 0x14000269b
xor eax, eax
jmp 0x140002a97
cmp dword [rsp + 0x58], 0
jne 0x1400026ac
mov eax, 0xffffffff
jmp 0x140002a97
lea rax, [rsp + 0xb8]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov qword [rsp + 0xe8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0xe8]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140002771
mov dword [rsp + 0xb8], 1
mov eax, 0xc
imul rax, rax, 0
mov dword [rsp + rax + 0xc4], 2
mov eax, 0xc
imul rax, rax, 0
lea rax, [rsp + rax + 0xbc]
mov r8, rax
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140002763
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0xb8]
xor edx, edx
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rsp + 0x58]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xf8], rax
cmp qword [rsp + 0xf8], 0
jne 0x1400027ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x100], eax
mov eax, 0xfffffffe
jmp 0x140002a97
mov rcx, qword [rsp + 0xf8]
call fcn.140002390
movzx eax, al
test eax, eax
jne 0x1400027d9
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffffffd
jmp 0x140002a97
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140002801
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffffffc
jmp 0x140002a97
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x24
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x120]
call fcn.1400035c0
nop
mov rax, qword [rsp + 0x120]
movsxd rax, dword [rax + 4]
lea rax, [rsp + rax + 0x120]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_bool___cdecl_std::ios_base::fail_void_const___ptr64]
movzx eax, al
test eax, eax
je 0x14000288b
lea rcx, [rsp + 0x120]
call fcn.1400050a0
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x278], 0xfffffffb
lea rcx, [rsp + 0x120]
call fcn.140003ed0
mov eax, dword [rsp + 0x278]
jmp 0x140002a97
lea rdx, [rsp + 0x248]
lea rcx, [rsp + 0x120]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::fpos_struct__Mbstatet____cdecl_std::basic_istream_char__struct_std::char_traits_char__::tellg_void____ptr64]
lea rcx, [rsp + 0x248]
call fcn.140003dd0
cmp rax, 0x1000
jge 0x1400028f5
lea rcx, [rsp + 0x120]
call fcn.1400050a0
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x27c], 0xfffffffa
lea rcx, [rsp + 0x120]
call fcn.140003ed0
mov eax, dword [rsp + 0x27c]
jmp 0x140002a97
lea rcx, [rsp + 0x248]
call fcn.140003dd0
mov rcx, rax
call fcn.140006e60
mov qword [rsp + 0x280], rax
mov rax, qword [rsp + 0x280]
mov qword [rsp + 0x268], rax
cmp qword [rsp + 0x268], 0
jne 0x14000296c
lea rcx, [rsp + 0x120]
call fcn.1400050a0
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x288], 0xfffffff9
lea rcx, [rsp + 0x120]
call fcn.140003ed0
mov eax, dword [rsp + 0x288]
jmp 0x140002a97
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x120]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int____ptr64]
lea rcx, [rsp + 0x248]
call fcn.140003dd0
mov r8, rax
mov rdx, qword [rsp + 0x268]
lea rcx, [rsp + 0x120]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::read_char____ptr64__long_long___int64_____ptr64]
lea rcx, [rsp + 0x120]
call fcn.1400050a0
lea rcx, [rsp + 0x248]
call fcn.140003dd0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 1
mov r9b, 1
mov r8, rax
mov rdx, qword [rsp + 0x268]
mov rcx, qword [rsp + 0xf8]
call fcn.140001020
movzx eax, al
test eax, eax
jne 0x140002a4d
mov rax, qword [rsp + 0x268]
mov qword [rsp + 0x290], rax
mov rcx, qword [rsp + 0x290]
call fcn.140006e80
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x298], 0xfffffff8
lea rcx, [rsp + 0x120]
call fcn.140003ed0
mov eax, dword [rsp + 0x298]
jmp 0x140002a97
mov rax, qword [rsp + 0x268]
mov qword [rsp + 0x2a0], rax
mov rcx, qword [rsp + 0x2a0]
call fcn.140006e80
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x2a8], 0
lea rcx, [rsp + 0x120]
call fcn.140003ed0
mov eax, dword [rsp + 0x2a8]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x14000c280]
call fcn.140006bc0
mov rax, rdi
add rsp, 0x2d0
pop rdi
ret