Function at 0x140034920
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create process suspended
Read file on windows
Self delete

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1370]
mov eax, 0x1470
call fcn.14004e370
sub rsp, rax
mov rax, qword [0x140078040]
xor rax, rsp
mov qword [rbp + 0x1360], rax
mov qword [rbp - 0x40], rdx
mov ebx, ecx
xor r15d, r15d
mov dword [rsp + 0x58], r15d
xorps xmm0, xmm0
movups xmmword [rbp + 0x2b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2c0], xmm1
lea r8d, [r15 + 4]
lea rdx, str._jar
lea rcx, [rbp + 0x2b0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2e0], xmm1
lea r8d, [r15 + 0x13]
lea rdx, [0x1400566c0]
lea rcx, [rbp + 0x2d0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x300], xmm1
lea r8d, [r15 + 4]
lea rdx, str..bat
lea rcx, [rbp + 0x2f0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x310], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x320], xmm1
lea r8d, [r15 + 0x13]
lea rdx, [0x1400566c0]
lea rcx, [rbp + 0x310]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r15
lfence
mov ecx, 0x80
call fcn.1400069a0
mov rdi, rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
lea rcx, [rax + 0x80]
mov qword [rbp - 0x50], rcx
lea rax, [rbp - 0x60]
mov qword [rsp + 0x60], rax
lea rsi, [rbp + 0x2b0]
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], rdi
lea rax, [rbp - 0x60]
mov qword [rbp - 0x70], rax
nop
mov qword ds:[rsp + 0x58], rdi
mov rdx, rsi
mov rcx, rdi
call fcn.140005560
nop
lea rcx, [rdi + 0x20]
lea rdx, [rsi + 0x20]
call fcn.140005560
nop
add rdi, 0x40
mov qword [rbp - 0x78], rdi
add rsi, 0x40
lea rax, [rbp + 0x330]
cmp rsi, rax
jne 0x140034a70
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x58], rdi
mov qword [rsp + 0x60], r15
lea r9, [0x14001dec0]
mov edx, 0x40
lea r8d, [rdx - 0x3e]
lea rcx, [rbp + 0x2b0]
call fcn.14004daac
lea rdx, str.__A_Z_:______.exe_...__s_
lea rcx, [rbp + 0x180]
call fcn.14002b3a0
nop
lea r9, [rbp + 0x35a]
sub r9, 2
mov eax, 0xcccccccd
mul ebx
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub bx, cx
add bx, 0x30
mov word [r9], bx
mov ebx, edx
test edx, edx
jne 0x140034af0
xorps xmm0, xmm0
movups xmmword [rbp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x258], xmm1
lea rax, [rbp + 0x35a]
cmp r9, rax
jne 0x140034b57
movdqa xmm0, xmmword [0x1400677a0]
movdqu xmmword [rbp + 0x258], xmm0
mov word [rbp + 0x248], r15w
jmp 0x140034b73
lea r8, [rbp + 0x35a]
sub r8, r9
sar r8, 1
mov rdx, r9
lea rcx, [rbp + 0x248]
call fcn.1400066a0
mov dword [rsp + 0x58], 6
mov r14d, 0xe
mov r9d, r14d
lea r8, str.memory.exe__p
lea rcx, [rbp + 0x248]
call fcn.14001e7c0
xorps xmm0, xmm0
movups xmmword [rbp + 0x268], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x278], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x268], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x278], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rbp + 0x260]
cmp rdx, 7
jbe 0x140034c1a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034c15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140034c15
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004d6c0
movdqa xmm0, xmmword [0x1400677a0]
movdqu xmmword [rbp + 0x258], xmm0
mov word [rbp + 0x248], r15w
mov qword [rbp - 0x38], 0x18
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x30], r15
xor r9d, r9d
lea r8, [rbp - 0x38]
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov dword ds:[rbp + 0x110], 0x68
xorps xmm0, xmm0
movups xmmword [rbp + 0x118], xmm0
movups xmmword [rbp + 0x128], xmm0
movups xmmword [rbp + 0x138], xmm0
movups xmmword [rbp + 0x148], xmm0
movups xmmword [rbp + 0x158], xmm0
movups xmmword [rbp + 0x168], xmm0
mov rax, qword [rbp - 0x48]
mov qword [rbp + 0x168], rax
psrldq xmm0, 4
movd eax, xmm0
or eax, 0x101
mov dword [rbp + 0x14c], eax
mov word [rbp + 0x150], r15w
lea rdx, [rbp + 0x268]
cmp qword [rbp + 0x280], 7
cmova rdx, qword [rbp + 0x268]
lea rax, [rbp]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x110]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400355f1
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x360]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x68]
mov r8d, 0x1000
lea rdx, [rbp + 0x360]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400355ce
lea rsi, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
movabs r13, 0x7fffffffffffffff
lea r12, str.Winmgmt
nop
cmp dword [rsp + 0x68], 0
je 0x1400355ce
lea rax, [rbp + 0x360]
mov r9, 0xffffffffffffffff
nop dword [rax]
inc r9
cmp byte [rax + r9], 0
jne 0x140034db0
lea rax, [rbp + 0x360]
add rax, r9
xorps xmm0, xmm0
movups xmmword [rbp + 0x228], xmm0
mov qword [rbp + 0x238], r15
mov qword [rbp + 0x240], r15
lea rcx, [rbp + 0x360]
cmp rcx, rax
jne 0x140034e08
mov rbx, r15
mov qword [rbp + 0x238], rbx
mov edi, 7
mov qword [rbp + 0x240], rdi
mov word [rbp + 0x228], r15w
jmp 0x140034e29
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0x228]
call fcn.14001b2c0
mov rdi, qword [rbp + 0x240]
mov rbx, qword [rbp + 0x238]
lea rax, [0x140062368]
mov qword ds:[rbp + 0x20], rax
lea rcx, [rbp + 0xb0]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
nop
or r14d, 1
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x58], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x20]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__::constructor_class_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx + 0x20], rax
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x90]
mov dword [rbp + rcx + 0x1c], edx
lea rax, [rbp + 0x30]
mov qword [rbp - 0x80], rax
lea rcx, [rbp + 0x30]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
nop
mov qword [rbp + 0x30], rsi
lea rsi, [rbp + 0x228]
cmp rdi, 7
cmova rsi, qword [rbp + 0x228]
mov eax, 2
cmp rbx, 0x7fffffff
ja 0x1400355c7
test rbx, rbx
je 0x140034f3a
cmp rbx, r13
ja 0x140035688
lfence
mov rax, qword [rbp + 0x238]
lea rdi, [rax + rax]
mov rcx, rdi
call fcn.1400069a0
mov rbx, rax
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
mov qword [rbp + 0x98], rcx
mov rcx, qword [rbp + 0x48]
mov qword [rcx], rbx
mov rcx, qword [rbp + 0x68]
mov qword [rcx], rbx
sar rdi, 1
mov rax, qword [rbp + 0x80]
mov dword [rax], edi
mov eax, 3
mov ecx, dword [rsp + 0x58]
mov qword [rsp + 0x60], rcx
jmp 0x140034f41
mov qword [rbp + 0x98], r15
mov dword ds:[rbp + 0xa0], eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e8], xmm0
mov qword [rbp + 0x1f8], r15
mov qword [rbp + 0x200], 7
mov word [rbp + 0x1e8], r15w
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x20]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
movzx r8d, ax
lea rdx, [rbp + 0x1e8]
lea rcx, [rbp + 0x20]
call fcn.14002c7c0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x140035510
mov byte [rsp + 0x50], 0
mov rbx, qword [rbp - 0x60]
mov r14, qword [rbp - 0x58]
mov qword [rsp + 0x58], r14
cmp rbx, r14
je 0x140035270
nop dword [rax]
lea r13, [rbx + 0x20]
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x140034feb
mov rcx, qword [rbx]
lea r8, [rcx + rax*2]
mov rdx, rcx
jmp 0x140034ff2
lea r8, [rbx + rax*2]
mov rdx, rbx
xorps xmm0, xmm0
movups xmmword [rbp + 0x208], xmm0
mov qword [rbp + 0x218], r15
mov qword [rbp + 0x220], r15
cmp rdx, r8
jne 0x14003502f
mov rdi, r15
mov qword [rbp + 0x218], r15
mov esi, 7
mov qword [rbp + 0x220], rsi
mov word [rbp + 0x208], r15w
jmp 0x140035053
sub r8, rdx
sar r8, 1
lea rcx, [rbp + 0x208]
call fcn.1400066a0
mov rsi, qword [rbp + 0x220]
mov rdi, qword [rbp + 0x218]
lea rax, [rbp + 0x1e8]
cmp qword [rbp + 0x200], 7
cmova rax, qword [rbp + 0x1e8]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp + 0x1f8]
mov qword [rbp - 0x18], rax
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x80], xmm0
lea rcx, [rbp - 0x80]
call fcn.140004d80
mov r12, qword [rbp + 0x208]
test al, al
jne 0x1400351f0
lea r11, [rbp + 0x208]
cmp rsi, 7
cmova r11, r12
lea r14, [rbp + 0x1e8]
cmp qword [rbp + 0x200], 7
cmova r14, qword [rbp + 0x1e8]
mov rax, qword [rbp + 0x1f8]
cmp rdi, rax
ja 0x1400351eb
sub rax, rdi
test rdi, rdi
je 0x14003516a
inc rax
lea r15, [r14 + rax*2]
mov rax, r14
movzx r10d, word [r11]
nop word [rax + rax]
mov rcx, r15
sub rcx, rax
sar rcx, 1
mov edx, 0
je 0x14003511e
cmp word [rax], r10w
je 0x14003511b
cmp rcx, 1
je 0x14003511e
dec rcx
add rax, 2
cmp word [rax], r10w
jne 0x140035108
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x1400351eb
mov r8, rdi
mov rdx, r11
test rdi, rdi
je 0x140035158
mov r9, rax
sub r9, r11
nop dword [rax + rax]
movzx ecx, word [rdx + r9]
cmp cx, word [rdx]
jne 0x1400351e2
add rdx, 2
sub r8, 1
jne 0x140035140
sub rax, r14
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x1400351eb
mov r8, qword [r13 + 0x10]
cmp qword [r13 + 0x18], 7
jbe 0x140035179
mov r13, qword [r13]
mov rdx, r13
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140008ee0
lea rdx, [rbp + 0x1e8]
cmp qword [rbp + 0x200], 7
cmova rdx, qword [rbp + 0x1e8]
mov r8, qword [rbp + 0x1f8]
mov rcx, rax
call fcn.140008ee0
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dil, 1
mov byte [rsp + 0x50], dil
lea r8, [rbp + 0x1e8]
lea rdx, [rbp + 0x1a8]
call fcn.140006140
mov r14, qword ds:[rsp + 0x58]
jmp 0x1400351f5
add rax, 2
jmp 0x1400350f0
mov r14, qword [rsp + 0x58]
movzx edi, byte [rsp + 0x50]
cmp rsi, 7
jbe 0x140035232
lea rdx, [rsi*2 + 2]
mov rax, r12
cmp rdx, 0x1000
jb 0x14003522a
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400355ba
mov rcx, r12
call fcn.14004d6c0
xor r15d, r15d
mov qword [rbp + 0x218], r15
mov qword [rbp + 0x220], 7
mov word [rbp + 0x208], r15w
add rbx, 0x40
cmp rbx, r14
jne 0x140034fd0
nop dword [rax]
test dil, dil
jne 0x1400354b8
lea r12, str.Winmgmt
mov r14, qword [rbp - 0x40]
mov r8, r14
cmp qword [r14 + 0x18], 7
jbe 0x140035281
mov r8, qword [r14]
cmp qword [r14 + 0x10], 7
jne 0x1400352ac
mov edx, 7
mov rcx, r12
sub r8, r12
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x1400352ac
add rcx, 2
sub rdx, 1
jne 0x140035293
jmp 0x1400354b8
lea rcx, ds:[rbp + 0x1e8]
cmp qword [rbp + 0x200], 7
cmova rcx, qword [rbp + 0x1e8]
mov rax, qword [rbp + 0x1f8]
lea rdx, [rcx + rax*2]
mov dword [rsp + 0x20], 0x10
lea r9, [rbp + 0x180]
call fcn.14002c9a0
test al, al
je 0x1400354b8
lea rax, [rbp + 0x1e8]
cmp qword [rbp + 0x200], 7
cmova rax, qword [rbp + 0x1e8]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x1f8]
mov qword [rbp - 8], rax
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x80], xmm0
lea rcx, [rbp - 0x80]
call fcn.140004d80
test al, al
jne 0x1400354b8
lea rcx, [rbp + 0x1e8]
cmp qword [rbp + 0x200], 7
seta r10b
mov r9, qword [rbp + 0x1e8]
cmova rcx, r9
cmp word [rcx], 0x5c
je 0x1400354b8
mov r8, qword ds:[rbp + 0x1f8]
cmp r8, 2
jbe 0x1400354a5
lea rax, ds:[rbp + 0x1e8]
test r10b, r10b
cmovne rax, r9
cmp word [rax + 4], 0x5c
jne 0x1400354a5
lea rdx, [rbp + 0x1e8]
test r10b, r10b
cmovne rdx, r9
xorps xmm0, xmm0
movups xmmword [rbp + 0x288], xmm0
mov qword [rbp + 0x298], r15
mov qword [rbp + 0x2a0], r15
lea rcx, [rbp + 0x288]
call fcn.1400066a0
or dword [rsp + 0x60], 0x30
lea rcx, [rbp + 0x288]
call fcn.140004c60
movzx ebx, al
lea rcx, [rbp + 0x288]
call fcn.1400058e0
test bl, bl
je 0x140035444
lea rdx, [rbp + 0x1e8]
call fcn.14004b8e0
test al, al
jne 0x1400354a5
lea rdx, [0x1400572d8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
nop
call fcn.1400064a0
lea rdx, [rbp + 0x1e8]
cmp qword [rbp + 0x200], 7
cmova rdx, qword [rbp + 0x1e8]
mov r8, qword [rbp + 0x1f8]
mov rcx, rax
call fcn.140008ee0
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [rbp + 0x1b8]
jmp 0x140035494
lea rdx, [0x1400577a8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400064a0
lea rdx, [rbp + 0x1e8]
cmp qword [rbp + 0x200], 7
cmova rdx, qword [rbp + 0x1e8]
mov r8, qword [rbp + 0x1f8]
mov rcx, rax
call fcn.140008ee0
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [rbp + 0x1c8]
lea r8, ds:[rbp + 0x1e8]
call fcn.140006140
lea r8, [rbp + 0x1e8]
lea rdx, [rbp + 0x1d8]
call fcn.140006140
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x20]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
movzx r8d, ax
lea rdx, [rbp + 0x1e8]
lea rcx, [rbp + 0x20]
call fcn.14002c7c0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
lea r12, str.Winmgmt
jne 0x140034fb2
movabs r13, 0x7fffffffffffffff
lea rcx, [rbp + 0x1e8]
call fcn.1400058e0
nop
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx + 0x20], rax
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x90]
mov dword [rbp + rcx + 0x1c], edx
lea rsi, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + 0x30], rsi
lea rcx, [rbp + 0x30]
call fcn.140036bc0
lea rcx, ds:[rbp + 0x30]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea rcx, [rbp + 0x38]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x228]
call fcn.1400058e0
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x68]
mov r8d, 0x1000
lea rdx, [rbp + 0x360]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400355ce
mov r14, qword [rsp + 0x60]
jmp 0x140034d90
nop word [rax + rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_alloc_void_]
nop
mov edx, 0xffffffff
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x268]
call fcn.1400058e0
nop
lea rcx, [rbp + 0x180]
call fcn.140021420
mov rcx, qword ds:[rbp + 0x1a0]
test rcx, rcx
je 0x14003564f
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140054de8]
mov r8, rax
test rax, rax
je 0x14003564f
mov rcx, qword [rax]
mov rax, qword [rcx]
mov edx, 1
mov rcx, r8
call qword [0x140054de8]
nop
lea rcx, [rbp - 0x60]
call fcn.14001e500
mov rcx, qword [rbp + 0x1360]
xor rcx, rsp
call fcn.14004d6a0
lea r11, [rsp + 0x1470]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140003ed0
nop
int3