Function at 0x140002550
Capabilities:
Acquire debug privileges
Check if file exists
Execute command
Get file attributes

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x2d0
lea rdi, [rsp + 0x50]
mov ecx, 0xa0
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x2e0]
cmp dword [rsp + 0x2e0], 3
jne 0x1400025c5
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x2e8]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x50], rax
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rsp + 0x2e8]
mov rcx, qword [rcx + rax]
call fcn.140002470
mov dword [rsp + 0x58], eax
jmp 0x14000271e
cmp dword [rsp + 0x2e0], 2
jne 0x1400026f2
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x2e8]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x68]
call fcn.140003ba0
nop
lea rcx, str.Process_Name:_n
call fcn.140002310
lea rdx, [rsp + 0x68]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140003770
lea rcx, [rsp + 0x68]
call fcn.1400056b0
mov qword [rsp + 0x98], rax
mov rcx, qword [rsp + 0x98]
call sub.ucrtbased.dll_strlen
inc rax
mov qword [rsp + 0x2b0], rax
mov eax, 2
mov rcx, qword [rsp + 0x2b0]
mul rcx
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov rcx, rax
call fcn.1400075d0
mov qword [rsp + 0x270], rax
mov rax, qword [rsp + 0x270]
mov qword [rsp + 0xa0], rax
mov rcx, qword [rsp + 0x98]
call sub.ucrtbased.dll_strlen
mov qword [rsp + 0x2b8], rax
mov rcx, qword [rsp + 0x98]
call sub.ucrtbased.dll_strlen
inc rax
mov qword [rsp + 0x2c0], rax
mov rax, qword [rsp + 0x2b8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x98]
mov r8, qword [rsp + 0x2c0]
mov rdx, qword [rsp + 0xa0]
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_mbstowcs_s]
mov rcx, qword [rsp + 0xa0]
call fcn.140002470
mov dword [rsp + 0x58], eax
lea rcx, [rsp + 0x68]
call fcn.140004130
nop
jmp 0x14000271e
lea rcx, str.Invalid_Params_n
call fcn.140002310
lea rcx, str.Usage:_dll_path__process_name__n
call fcn.140002310
lea rcx, [0x14000bf90]
call qword [sym.imp.ucrtbased.dll_system]
xor eax, eax
jmp 0x140002c3b
cmp dword [rsp + 0x58], 0
jne 0x140002748
lea rcx, str.Process_not_found_n
call fcn.140002310
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
mov eax, 0xffffffff
jmp 0x140002c3b
mov edx, dword [rsp + 0x58]
lea rcx, str.Process_pid:__d_n
call fcn.140002310
lea rax, [rsp + 0xb8]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov qword [rsp + 0xe8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0xe8]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000281f
mov dword [rsp + 0xb8], 1
mov eax, 0xc
imul rax, rax, 0
mov dword [rsp + rax + 0xc4], 2
mov eax, 0xc
imul rax, rax, 0
lea rax, [rsp + rax + 0xbc]
mov r8, rax
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140002810
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0xb8]
xor edx, edx
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
nop
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r8d, dword [rsp + 0x58]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xf8], rax
cmp qword [rsp + 0xf8], 0
jne 0x14000287b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x100], eax
mov edx, dword [rsp + 0x100]
lea rcx, str.OpenProcess_failed:_0x_X_n
call fcn.140002310
lea rcx, [0x14000c014]
call qword [sym.imp.ucrtbased.dll_system]
mov eax, 0xfffffffe
jmp 0x140002c3b
mov rcx, qword [rsp + 0xf8]
call fcn.1400023b0
movzx eax, al
test eax, eax
jne 0x1400028c0
lea rcx, str.Invalid_Process_Architecture._n
call fcn.140002310
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14000c040]
call qword [sym.imp.ucrtbased.dll_system]
mov eax, 0xfffffffd
jmp 0x140002c3b
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140002901
lea rcx, str.Dll_file_doesnt_exist_n
call fcn.140002310
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14000c060]
call qword [sym.imp.ucrtbased.dll_system]
mov eax, 0xfffffffc
jmp 0x140002c3b
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x24
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x120]
call fcn.140003a60
nop
mov rax, qword [rsp + 0x120]
movsxd rax, dword [rax + 4]
lea rax, [rsp + rax + 0x120]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_bool___cdecl_std::ios_base::fail_void_const___ptr64]
movzx eax, al
test eax, eax
je 0x1400029c4
mov rax, qword [rsp + 0x120]
movsxd rax, dword [rax + 4]
lea rax, [rsp + rax + 0x120]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::ios_base::rdstate_void_const___ptr64]
mov edx, eax
lea rcx, str.Opening_the_file_failed:__X_n
call fcn.140002310
lea rcx, [rsp + 0x120]
call fcn.140005760
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14000c088]
call qword [sym.imp.ucrtbased.dll_system]
nop
mov dword [rsp + 0x278], 0xfffffffb
lea rcx, [rsp + 0x120]
call fcn.140004530
mov eax, dword [rsp + 0x278]
jmp 0x140002c3b
lea rdx, [rsp + 0x248]
lea rcx, [rsp + 0x120]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::fpos_struct__Mbstatet____cdecl_std::basic_istream_char__struct_std::char_traits_char__::tellg_void____ptr64]
nop
lea rcx, [rsp + 0x248]
call fcn.1400043e0
cmp rax, 0x1000
jge 0x140002a49
lea rcx, str.Filesize_invalid._n
call fcn.140002310
lea rcx, [rsp + 0x120]
call fcn.140005760
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14000c0a4]
call qword [sym.imp.ucrtbased.dll_system]
nop
mov dword [rsp + 0x27c], 0xfffffffa
lea rcx, [rsp + 0x120]
call fcn.140004530
mov eax, dword [rsp + 0x27c]
jmp 0x140002c3b
lea rcx, [rsp + 0x248]
call fcn.1400043e0
mov rcx, rax
call fcn.1400075d0
mov qword [rsp + 0x280], rax
mov rax, qword [rsp + 0x280]
mov qword [rsp + 0x268], rax
cmp qword [rsp + 0x268], 0
jne 0x140002ada
lea rcx, str.Cant_allocate_dll_file._n
call fcn.140002310
lea rcx, [rsp + 0x120]
call fcn.140005760
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14000c0cc]
call qword [sym.imp.ucrtbased.dll_system]
nop
mov dword [rsp + 0x288], 0xfffffff9
lea rcx, [rsp + 0x120]
call fcn.140004530
mov eax, dword [rsp + 0x288]
jmp 0x140002c3b
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x120]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int____ptr64]
lea rcx, [rsp + 0x248]
call fcn.1400043e0
mov r8, rax
mov rdx, qword [rsp + 0x268]
lea rcx, [rsp + 0x120]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::read_char____ptr64__long_long___int64_____ptr64]
lea rcx, [rsp + 0x120]
call fcn.140005760
lea rcx, str.Mapping..._n
call fcn.140002310
nop
lea rcx, [rsp + 0x248]
call fcn.1400043e0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 1
mov r9b, 1
mov r8, rax
mov rdx, qword [rsp + 0x268]
mov rcx, qword [rsp + 0xf8]
call fcn.140001020
movzx eax, al
test eax, eax
jne 0x140002be3
mov rax, qword [rsp + 0x268]
mov qword [rsp + 0x290], rax
mov rcx, qword [rsp + 0x290]
call fcn.1400075f0
nop
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Error_while_mapping._n
call fcn.140002310
lea rcx, str.PAUSE
call qword [sym.imp.ucrtbased.dll_system]
nop
mov dword [rsp + 0x298], 0xfffffff8
lea rcx, [rsp + 0x120]
call fcn.140004530
mov eax, dword [rsp + 0x298]
jmp 0x140002c3b
mov rax, qword [rsp + 0x268]
mov qword [rsp + 0x2a0], rax
mov rcx, qword [rsp + 0x2a0]
call fcn.1400075f0
nop
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14000be94]
call fcn.140002310
nop
mov dword [rsp + 0x2a8], 0
lea rcx, [rsp + 0x120]
call fcn.140004530
mov eax, dword [rsp + 0x2a8]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x14000c380]
call fcn.140007320
mov rax, rdi
add rsp, 0x2d0
pop rdi
ret