Function at 0x140001d20
Capabilities:
Execute command

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x618]
sub rsp, 0x6f0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x140016020]
xor rax, rsp
mov qword [rbp + 0x5c0], rax
mov r13, rcx
mov qword [rsp + 0x58], rcx
mov qword [rbp - 0x78], rcx
mov dword [rsp + 0x30], 1
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xor r12d, r12d
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], r12
lea r8d, [r12 + 9]
lea rdx, str.diagtrack
lea rcx, [rbp + 0x40]
call fcn.1400062e0
nop
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13], r12
mov qword [r13 + 8], r12
mov qword [r13 + 0x10], r12
mov dword [rsp + 0x30], 1
mov r14, qword [rbp + 0x50]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 0x1f
jb 0x140002fc8
lea r15, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae r15, qword [rbp + 0x40]
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
lea rsi, [r14 + 0x1f]
mov edi, 0xf
lea rbx, [rsp + 0x38]
lea eax, [rdi + 7]
lea rdx, [rdi - 0x10]
cmp rsi, rdi
jbe 0x140001e7d
mov rdi, rsi
or rdi, 0xf
cmp rdi, rcx
jbe 0x140001e1c
mov rdi, rcx
jmp 0x140001e23
cmp rdi, rax
cmovb rdi, rax
mov rcx, rdi
add rcx, 1
cmovb rcx, rdx
cmp rcx, 0x1000
jb 0x140001e66
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002fce
mov rcx, rax
call fcn.14000ea9c
test rax, rax
je 0x140001e5f
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140001e78
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001e75
call fcn.14000ea9c
mov rbx, rax
jmp 0x140001e78
mov rbx, r12
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
movups xmm0, xmmword [str.tasklist__svc__fi__SERVICES_eq]
movups xmmword [rbx], xmm0
movsd xmm0, qword [0x140010e70]
movsd qword [rbx + 0x10], xmm0
mov eax, dword [0x140010e78]
mov dword [rbx + 0x18], eax
movzx eax, word [0x140010e7c]
mov word [rbx + 0x1c], ax
movzx eax, byte [0x140010e7e]
mov byte [rbx + 0x1e], al
lea rcx, [rbx + 0x1f]
mov r8, r14
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
mov dword [rsp + 0x30], 5
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rax, rdx
sub rax, rcx
cmp rax, 0x16
jb 0x140001f28
lea rax, [rcx + 0x16]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x38]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x38]
add rbx, rcx
mov r8d, 0x16
lea rdx, str.___find__svchost.exe_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x16], 0
lea rax, [rsp + 0x38]
jmp 0x140001f47
mov qword [rsp + 0x20], 0x16
lea r9, str.___find__svchost.exe_
mov edx, 0x16
lea rcx, [rsp + 0x38]
call fcn.140006760
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x30], 0xd
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140001fbc
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001fb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001fb7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ead8
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
movups xmmword [rbp + 0xd0], xmm0
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
lea rdx, [0x140010e80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__popen]
mov rbx, rax
mov qword [rsp + 0x60], rax
mov rax, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__pclose]
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], rbx
test rbx, rbx
je 0x140002fa5
mov r8, rbx
mov edx, 0x80
lea rcx, [rbp + 0x330]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
test rax, rax
je 0x14000206a
nop word [rax + rax]
lea rdx, [rbp + 0x330]
lea rcx, [rbp + 0x10]
call fcn.140005660
mov r8, rbx
mov edx, 0x80
lea rcx, [rbp + 0x330]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
test rax, rax
jne 0x140002040
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0x130]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x140011660]
mov qword [rbp + 0x130], rax
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x30], 0x1d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x130]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x130], rdi
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x90]
mov dword [rbp + rcx + 0x12c], edx
lea rax, [rbp + 0x140]
mov qword [rbp - 0x70], rax
lea rcx, [rbp + 0x140]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + 0x140], rax
lea rdx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rdx, qword [rbp + 0x10]
mov r9d, 2
mov r8, qword [rbp + 0x20]
lea rcx, [rbp + 0x140]
call fcn.140005bb0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x130]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x130]
call fcn.140006ba0
mov rdx, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdx
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x140002dfa
lea rsi, [rbp - 0x30]
mov r15, qword [rbp - 0x30]
mov r12, qword [rbp - 0x18]
cmp r12, 0x10
cmovae rsi, r15
mov rdi, qword [rbp - 0x20]
cmp rdi, 0xb
jb 0x14000221c
lea r14, [rsi + rdi]
lea r8, [r14 - 0xa]
sub r8, rsi
mov edx, 0x73
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x14000221c
nop dword [rax]
mov r8d, 0xb
lea rdx, str.svchost.exe
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140002293
inc rbx
lea r8, [r14 - 0xa]
sub r8, rbx
mov edx, 0x73
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x1400021e0
mov rbx, 0xffffffffffffffff
cmp rbx, 0xffffffffffffffff
je 0x140002deb
add rbx, 0xb
lea rcx, [rbp - 0x30]
cmp r12, 0x10
cmovae rcx, r15
cmp rbx, rdi
jae 0x14000225d
lea rax, [rdi + rcx]
add rbx, rcx
cmp rbx, rax
jae 0x14000225d
nop
cmp byte [rbx], 0x20
jne 0x140002298
inc rbx
cmp rbx, rax
jb 0x140002250
mov rbx, 0xffffffffffffffff
lea rsi, [rbp - 0x30]
cmp r12, 0x10
cmovae rsi, r15
cmp rbx, rdi
jae 0x14000229d
sub rdi, rbx
lea rcx, [rbx + rsi]
mov r8, rdi
mov edx, 0x20
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14000229d
sub rax, rsi
jmp 0x1400022a4
sub rbx, rsi
jmp 0x140002223
sub rbx, rcx
jmp 0x140002264
mov rax, 0xffffffffffffffff
sub rax, rbx
mov r9, rax
mov r8, rbx
lea rdx, [rbp + 0xe0]
lea rcx, [rbp - 0x30]
call fcn.140005520
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rdi, rax
lea rbx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0x10
cmovae rbx, qword [rbp + 0xe0]
xor r12d, r12d
mov dword [rax], r12d
lea r8d, [r12 + 0xa]
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov esi, eax
cmp rbx, qword [rbp - 0x70]
jne 0x14000230c
lea rcx, str.invalid_stoi_argument
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const____ptr64_]
int3
cmp dword [rdi], 0x22
jne 0x14000231f
lea rcx, str.stoi_argument_out_of_range
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x140002363
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000235e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000235e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ead8
cmp esi, 0xffffffff
je 0x140002dee
mov edx, esi
lea rcx, [rsp + 0x68]
call fcn.140005e20
mov dword [rsp + 0x30], 0x3d
mov r8, qword [rsp + 0x78]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
sub rax, r8
mov esi, 0x14
cmp rax, rsi
jb 0x140002420
lea rax, [r8 + 0x14]
mov qword [rsp + 0x78], rax
lea rbx, [rsp + 0x68]
cmp rcx, 0x10
cmovae rbx, qword [rsp + 0x68]
lea rax, [0x140010efc]
lea r14, str.strings2__f__s__pid
cmp rax, rbx
jbe 0x1400023e3
lea rax, [rbx + r8]
cmp r14, rax
ja 0x1400023e3
cmp rbx, r14
ja 0x1400023db
mov rdi, r12
jmp 0x1400023e6
mov rdi, rbx
sub rdi, r14
jmp 0x1400023e6
mov rdi, rsi
lea rcx, [rbx + 0x14]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
sub rsi, rdi
lea rdx, [r14 + 0x14]
add rdx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x68]
jmp 0x140002432
mov qword [rsp + 0x28], rsi
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.140007650
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x30], 0x7d
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rax, rdx
sub rax, rcx
cmp rax, 0x16
jb 0x1400024bc
lea rax, [rcx + 0x16]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x38]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x38]
add rbx, rcx
mov r8d, 0x16
lea rdx, str.___process_strings.txt
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x16], 0
lea rax, [rsp + 0x38]
jmp 0x1400024db
mov qword [rsp + 0x20], 0x16
lea r9, str.___process_strings.txt
mov edx, 0x16
lea rcx, [rsp + 0x38]
call fcn.140006760
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov edi, 0xfd
mov dword [rsp + 0x30], edi
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x140002538
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002533
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002533
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ead8
movups xmmword [rbp - 0x10], xmm6
movups xmmword [rbp], xmm7
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140002580
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000257b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000257b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ead8
movdqa xmm0, xmmword [0x1400116b0]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x1400025d2
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400025cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400025cd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ead8
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x220]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x220]
call fcn.140004810
nop
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
mov ecx, 0x40
call fcn.14000ea9c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x30], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], rax
lea rcx, [rbp + 0x100]
call fcn.140003a20
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0x60], r12
mov byte [rbp + 0x68], 0
movdqa xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x80], xmm1
mov qword [rbp + 0x90], r12
mov byte [rbp + 0x98], 0
movdqa xmmword [rbp + 0xa0], xmm0
mov byte [rbp + 0xb0], 0
mov qword [rbp + 0xb8], r12
mov qword [rbp + 0xc0], r12
mov byte [rbp + 0xc8], 0
mov rax, qword [rbp + 0x220]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x220]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x220]
call fcn.140006ba0
mov rdx, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdx
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x140002a5b
movabs rbx, 0x2aaaaaaaaaaaaaab
nop dword [rax]
nop word [rax + rax]
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
setae cl
mov r10, qword [rbp - 0x30]
cmovae rdx, r10
lea r8, [rbp - 0x30]
test cl, cl
mov rcx, qword [rbp - 0x20]
je 0x140002745
add rcx, r10
jmp 0x14000274c
add rcx, r8
lea r10, [rbp - 0x30]
mov qword [rsp + 0x28], rdx
lea r9, [rbp + 0x100]
lea r8, [rbp + 0x60]
mov rdx, rcx
mov rcx, r10
call fcn.140006d40
test al, al
je 0x140002a0f
mov rcx, qword [rbp + 0x78]
sub rcx, qword [rbp + 0x70]
mov rax, rbx
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rax, [rbp + 0xb8]
cmovne rax, qword [rbp + 0x70]
cmp byte [rax + 0x10], 0
je 0x1400027a6
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
jmp 0x1400027ae
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r12
mov rdx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x68]
cmp rdx, r8
jne 0x1400027e1
mov rbx, r12
mov qword [rbp - 0x40], rbx
mov r15d, 0xf
mov qword [rbp - 0x38], r15
mov byte [rbp - 0x50], 0
jmp 0x1400027f5
sub r8, rdx
lea rcx, [rbp - 0x50]
call fcn.1400062e0
mov r15, qword [rbp - 0x38]
mov rbx, qword [rbp - 0x40]
or edi, 2
mov dword [rsp + 0x30], edi
mov r14, qword [rbp - 0x50]
test rbx, rbx
je 0x1400028df
lea rax, [rbp - 0x50]
cmp r15, 0x10
setae cl
cmovae rax, r14
cmp byte [rax], 0x22
jne 0x140002867
mov r9, r12
mov edx, 1
test cl, cl
je 0x140002838
mov rax, rbx
sub rax, r12
cmp rax, rdx
cmovb rdx, rax
jmp 0x140002843
cmp rbx, rdx
cmovb rdx, rbx
lea r14, [rbp - 0x50]
lea rcx, [r9 + r14]
sub rbx, rdx
mov r8, rbx
sub r8, r9
inc r8
add rdx, rcx
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x40], rbx
mov r15, qword [rbp - 0x38]
mov r14, qword [rbp - 0x50]
test rbx, rbx
je 0x1400028df
lea rax, [rbp - 0x50]
cmp r15, 0x10
setae cl
cmovae rax, r14
cmp byte [rax + rbx - 1], 0x22
jne 0x1400028df
lea rdx, [rbp - 0x50]
mov r9, rbx
mov rax, rbx
test cl, cl
je 0x14000289b
sub r9, r14
dec r9
add r9, r14
jmp 0x1400028ac
lea rcx, [rbp - 0x50]
sub r9, rcx
dec rdx
add r9, rdx
lea r14, [rbp - 0x50]
mov edx, 1
sub rax, r9
cmp rax, rdx
cmovb rdx, rax
lea rcx, [r14 + r9]
sub rbx, rdx
mov r8, rbx
sub r8, r9
inc r8
add rdx, rcx
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x40], rbx
mov r15, qword [rbp - 0x38]
mov r14, qword [rbp - 0x50]
mov r12, qword [rbp + 0x30]
mov rdi, qword [r12 + 8]
mov r13, r12
cmp byte [rdi + 0x19], 0
jne 0x14000295e
nop dword [rax]
nop word [rax + rax]
lea rcx, [rdi + 0x20]
lea rdx, [rbp - 0x50]
cmp r15, 0x10
cmovae rdx, r14
mov rsi, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x14000291e
mov rcx, qword [rcx]
mov r8, rsi
cmp rbx, rsi
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140002945
cmp rsi, rbx
jae 0x14000293d
mov eax, 0xffffffff
jmp 0x140002945
xor eax, eax
cmp rsi, rbx
seta al
shr eax, 0x1f
test al, al
je 0x140002952
mov rdi, qword [rdi + 0x10]
jmp 0x140002958
mov r13, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], 0
je 0x140002900
cmp byte [r13 + 0x19], 0
jne 0x140002cc5
lea rdx, [r13 + 0x20]
mov rdi, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14000297b
mov rdx, qword [rdx]
lea rcx, [rbp - 0x50]
cmp r15, 0x10
cmovae rcx, r14
mov r8, rbx
cmp rdi, rbx
cmovb r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400029ae
cmp rbx, rdi
jae 0x1400029a6
mov eax, 0xffffffff
jmp 0x1400029ae
xor eax, eax
cmp rbx, rdi
seta al
shr eax, 0x1f
test al, al
jne 0x140002cc5
cmp r13, r12
je 0x140002cc5
cmp r15, 0x10
jb 0x1400029f9
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400029f1
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002de4
mov rcx, r14
call fcn.14000ead8
mov r13, qword [rsp + 0x58]
movabs rbx, 0x2aaaaaaaaaaaaaab
xor r12d, r12d
mov edi, dword [rsp + 0x30]
mov rax, qword [rbp + 0x220]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x220]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x220]
call fcn.140006ba0
mov rdx, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdx
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
jne 0x140002720
lea rcx, [rbp + 0x230]
call fcn.140005af0
test rax, rax
jne 0x140002a8e
mov rax, qword [rbp + 0x220]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x220]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov dword [rsp + 0x30], r12d
lea rcx, [rbp + 0x70]
call fcn.140003960
nop
lea rcx, [rbp + 0x100]
call fcn.140005980
mov rcx, qword [rbp + 0x120]
test rcx, rcx
je 0x140002ace
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rax
test rax, rax
je 0x140002ace
mov rax, qword [rax]
mov edx, 1
call qword [rax]
nop
mov r8, qword [rbp + 0x30]
mov r8, qword [r8 + 8]
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x30]
call fcn.1400072e0
mov edx, 0x40
mov rcx, qword [rbp + 0x30]
call fcn.14000ead8
nop
lea rcx, [rbp + 0x220]
call fcn.140003040
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140002b3a
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b35
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002e4b
call fcn.14000ead8
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x130], rax
mov rax, qword [rbp + 0x130]
movsxd rdx, dword [rax + 4]
lea r8d, [rdx - 0x90]
mov dword [rbp + rdx + 0x12c], r8d
lea rcx, [rbp + 0x140]
call fcn.140004fe0
lea rcx, [rbp + 0x148]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140002bb6
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__pclose]
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140002bf1
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002bec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002ef5
call fcn.14000ead8
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x140002c3c
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002f43
call fcn.14000ead8
movdqa xmm0, xmmword [0x1400116b0]
movdqu xmmword [rbp], xmm0
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x140002c88
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002f9e
call fcn.14000ead8
mov rax, r13
mov rcx, qword [rbp + 0x5c0]
xor rcx, rsp
call fcn.14000e7e0
lea r11, [rsp + 0x6f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea r8, [rbp - 0x50]
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x30]
call fcn.140006f40
mov r8, qword [rbp - 0x40]
inc r8
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs]
lea rcx, [rbp + 0x3b0]
call fcn.140001a80
test eax, eax
je 0x140002d98
lea rdx, [rbp + 0x3b0]
lea rcx, [rbp - 0x70]
call fcn.1400053d0
nop
mov r13, qword [rsp + 0x58]
mov rdx, qword [r13 + 8]
cmp rdx, qword [r13 + 0x10]
je 0x140002d4e
movups xmm0, xmmword [rbp - 0x70]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x60]
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
xor eax, eax
mov word [rbp - 0x70], ax
add qword [r13 + 8], 0x20
jmp 0x140002d5e
lea r8, [rbp - 0x70]
mov rcx, r13
call fcn.1400073a0
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x140002d9d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d91
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002ddd
call fcn.14000ead8
jmp 0x140002d9d
mov r13, qword [rsp + 0x58]
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400029fe
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002dd3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002de4
call fcn.14000ead8
jmp 0x1400029fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
xor r12d, r12d
lea rdi, vtable.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov rbx, qword [rsp + 0x60]
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae rdx, qword [rbp + 0x40]
lea rcx, str.Failed_to_find_the_PID_for_service__s._n
call fcn.1400010e0
mov dword [rsp + 0x30], r12d
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140002e57
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002e52
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ead8
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x130], rdi
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x90]
mov dword [rbp + rcx + 0x12c], edx
lea rcx, [rbp + 0x140]
call fcn.140004fe0
lea rcx, [rbp + 0x148]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__pclose]
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140002f01
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002efc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002efc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ead8
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x140002f4f
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002f4a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ead8
movdqa xmm0, xmmword [0x1400116b0]
movdqu xmmword [rbp], xmm0
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x140002c88
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002c83
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, str.popen___failed_
lea rcx, [rsp + 0x38]
call fcn.140001300
lea rdx, [0x140014470]
lea rcx, [rsp + 0x38]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call fcn.1400012e0
int3
call fcn.140001240
int3