Function at 0x14002ae40
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create process suspended
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1320]
mov eax, 0x1420
call fcn.14004a560
sub rsp, rax
mov rax, qword [0x14006c040]
xor rax, rsp
mov qword [rbp + 0x1310], rax
mov rdi, rdx
mov qword [rsp + 0x60], rdx
mov ebx, ecx
xor r14d, r14d
mov dword [rsp + 0x54], r14d
xorps xmm0, xmm0
movups xmmword [rbp + 0x290], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2a0], xmm1
lea r8d, [r14 + 4]
lea rdx, str._jar
lea rcx, [rbp + 0x290]
call fcn.140006ca0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2c0], xmm1
lea r8d, [r14 + 0x13]
lea rdx, str.___Executed_file:
lea rcx, [rbp + 0x2b0]
call fcn.140006ca0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2e0], xmm1
lea r8d, [r14 + 4]
lea rdx, str..bat
lea rcx, [rbp + 0x2d0]
call fcn.140006ca0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x300], xmm1
lea r8d, [r14 + 0x13]
lea rdx, str.___Executed_file:
lea rcx, [rbp + 0x2f0]
call fcn.140006ca0
nop
lea rax, [rbp + 0x290]
mov qword [rbp - 0x20], rax
lea rax, [rbp + 0x310]
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x50]
call fcn.140012620
nop
lea r9, [0x1400125e0]
lea edx, [r14 + 0x40]
lea r8d, [r14 + 2]
lea rcx, [rbp + 0x290]
call fcn.140049dbc
mov qword [rbp - 0x78], r14
lea rax, [rbp - 0x70]
mov qword [rsp + 0x70], rax
mov cl, 1
call qword [sym.imp.MSVCP140.dll_private:_static_class_std::locale::_Locimp____ptr64___cdecl_std::locale::_Init_bool_]
mov qword [rbp - 0x58], rax
lea rcx, [rbp - 0x60]
call fcn.140022a20
mov qword [rbp - 0x70], rax
lea rcx, [rbp - 0x60]
call fcn.140008e80
mov qword [rbp - 0x68], rax
lea r8, [0x140058d40]
lea rdx, str.__A_Z_:______.exe_...__s_
lea rcx, [rbp - 0x78]
call fcn.1400221a0
nop
mov edx, ebx
lea rcx, [rbp + 0x270]
call fcn.1400117c0
nop
lea r9d, [r14 + 0xe]
lea r8, str.memory.exe__p
mov rcx, rax
call fcn.1400127e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x250], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x260], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x250], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x260], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov esi, 2
mov dword [rsp + 0x54], esi
mov rdx, qword [rbp + 0x288]
cmp rdx, 7
jbe 0x14002b08c
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword ds:[rbp + 0x270]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b087
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002b087
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400499d0
movdqa xmm0, xmmword [0x14005d490]
movdqu xmmword [rbp + 0x280], xmm0
mov word [rbp + 0x270], r14w
mov qword [rbp - 0x38], 0x18
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x30], r14
xor r9d, r9d
lea r8, [rbp - 0x38]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov dword [rbp + 0x100], 0x68
xorps xmm0, xmm0
movups xmmword [rbp + 0x108], xmm0
movups xmmword [rbp + 0x118], xmm0
movups xmmword [rbp + 0x128], xmm0
movups xmmword [rbp + 0x138], xmm0
movups xmmword [rbp + 0x148], xmm0
movups xmmword [rbp + 0x158], xmm0
mov rax, qword [rsp + 0x78]
mov qword [rbp + 0x158], rax
psrldq xmm0, 4
movd eax, xmm0
or eax, 0x101
mov dword [rbp + 0x13c], eax
mov word [rbp + 0x140], r14w
lea rdx, [rbp + 0x250]
cmp qword [rbp + 0x268], 7
cmova rdx, qword [rbp + 0x250]
lea rax, [rbp - 0x10]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x100]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rbx, 0xffffffffffffffff
test eax, eax
je 0x14002bbf1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x310]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x58]
mov r8d, 0x1000
lea rdx, [rbp + 0x310]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002bbce
lea r13, vtable.std::basic_istringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
lea r12, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
lea r15, str.Winmgmt
nop word [rax + rax]
cmp dword [rsp + 0x58], 0
je 0x14002bbce
lea rax, [rbp + 0x310]
mov r9, rbx
inc r9
cmp byte [rax + r9], 0
jne 0x14002b225
lea rax, [rbp + 0x310]
add rax, r9
xorps xmm0, xmm0
movups xmmword [rbp + 0x230], xmm0
mov qword [rbp + 0x240], r14
mov qword [rbp + 0x248], r14
lea rcx, [rbp + 0x310]
cmp rcx, rax
jne 0x14002b27c
mov rbx, r14
mov qword [rbp + 0x240], rbx
mov qword [rbp + 0x248], 7
mov word [rbp + 0x230], r14w
jmp 0x14002b296
lea rdx, [rbp + 0x310]
lea rcx, [rbp + 0x230]
call fcn.140012900
mov rbx, qword [rbp + 0x240]
lea rax, [0x140059080]
mov qword [rbp + 0x10], rax
lea rcx, [rbp + 0xa0]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
nop
or esi, 1
mov dword [rsp + 0x54], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x10]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__::constructor_class_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x10]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x10], r13
mov rax, qword [rbp + 0x10]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x90]
mov dword [rbp + rcx + 0xc], edx
lea rax, [rbp + 0x20]
mov qword [rsp + 0x70], rax
lea rcx, [rbp + 0x20]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
nop
mov qword [rbp + 0x20], r12
lea rsi, [rbp + 0x230]
mov r14, qword [rbp + 0x230]
mov qword [rbp - 0x80], r14
cmp qword [rbp + 0x248], 7
cmova rsi, r14
mov eax, 2
cmp rbx, 0x7fffffff
ja 0x14002bbc7
test rbx, rbx
je 0x14002b3b1
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x14002bd8e
lfence
mov rax, qword [rbp + 0x240]
lea rdi, [rax + rax]
mov rcx, rdi
call fcn.140006f80
mov rbx, rax
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rdi + rbx]
mov qword [rbp + 0x88], rcx
mov rcx, qword [rbp + 0x38]
mov qword [rcx], rbx
mov rcx, qword [rbp + 0x58]
mov qword [rcx], rbx
sar rdi, 1
mov rax, qword [rbp + 0x70]
mov dword [rax], edi
mov eax, 3
mov rcx, qword [rbp + 0x230]
mov qword [rbp - 0x80], rcx
mov rdi, qword [rsp + 0x60]
xor esi, esi
jmp 0x14002b3ba
xor esi, esi
mov qword [rbp + 0x88], rsi
mov dword [rbp + 0x90], eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
mov qword [rbp + 0x1c0], rsi
mov qword [rbp + 0x1c8], 7
mov word [rbp + 0x1b0], si
mov rax, qword [rbp + 0x10]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x10]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
movzx r8d, ax
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x10]
call fcn.140022be0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
nop
test al, al
je 0x14002ba6b
nop dword [rax + rax]
mov byte [rsp + 0x50], 0
mov r14, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
mov qword [rsp + 0x70], rax
cmp r14, rax
je 0x14002b7f0
nop dword [rax + rax]
lea r13, [r14 + 0x20]
mov rax, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 7
jbe 0x14002b46b
mov rcx, qword [r14]
lea r8, [rcx + rax*2]
mov rdx, rcx
jmp 0x14002b472
lea r8, [r14 + rax*2]
mov rdx, r14
xorps xmm0, xmm0
movups xmmword [rbp + 0x210], xmm0
mov qword [rbp + 0x220], rsi
mov qword [rbp + 0x228], rsi
cmp rdx, r8
jne 0x14002b4af
mov r15, rsi
mov qword [rbp + 0x220], rsi
mov r12d, 7
mov qword [rbp + 0x228], r12
mov word [rbp + 0x210], si
jmp 0x14002b4d3
sub r8, rdx
sar r8, 1
lea rcx, [rbp + 0x210]
call fcn.140006ca0
mov r12, qword [rbp + 0x228]
mov r15, qword [rbp + 0x220]
lea rdx, [rbp + 0x1b0]
cmp qword [rbp + 0x1c8], 7
cmova rdx, qword [rbp + 0x1b0]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
mov qword [rbp + 0x1e0], rsi
mov qword [rbp + 0x1e8], rsi
mov r8, qword [rbp + 0x1c0]
lea rcx, [rbp + 0x1d0]
call fcn.140006ca0
mov rdi, rsi
lea rbx, [rbp + 0x1d0]
cmp qword [rbp + 0x1e8], 7
seta r8b
cmova rbx, qword [rbp + 0x1d0]
lea rcx, [rbp + 0x1d0]
test r8b, r8b
cmovne rcx, qword [rbp + 0x1d0]
mov rax, qword [rbp + 0x1e0]
lea rsi, [rcx + rax*2]
cmp rbx, rsi
je 0x14002b571
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
movsxd rcx, eax
imul rdi, rdi, 0x1f
add rdi, rcx
add rbx, 2
cmp rbx, rsi
jne 0x14002b555
mov r9, rdi
lea r8, [rbp + 0x1d0]
lea rdx, [rbp + 0x170]
call fcn.140007100
mov rcx, qword [rax + 8]
mov rdi, qword [0x14006f918]
mov rbx, rdi
test rcx, rcx
cmovne rbx, rcx
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 7
jbe 0x14002b5ef
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b5ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002bb9e
call fcn.1400499d0
xor edx, edx
mov qword [rbp + 0x1e0], rdx
mov qword [rbp + 0x1e8], 7
mov word [rbp + 0x1d0], dx
mov rsi, qword [rbp + 0x210]
cmp rbx, rdi
jne 0x14002b765
lea r11, [rbp + 0x210]
cmp r12, 7
cmova r11, rsi
lea rbx, [rbp + 0x1b0]
cmp qword [rbp + 0x1c8], 7
cmova rbx, qword [rbp + 0x1b0]
mov rax, qword [rbp + 0x1c0]
cmp r15, rax
ja 0x14002b765
sub rax, r15
test r15, r15
je 0x14002b6e6
inc rax
lea rdi, [rbx + rax*2]
mov rax, rbx
movzx r10d, word [r11]
nop word [rax + rax]
mov rcx, rdi
sub rcx, rax
sar rcx, 1
je 0x14002b69c
nop dword [rax + rax]
cmp word [rax], r10w
je 0x14002b699
cmp rcx, 1
je 0x14002b69c
dec rcx
add rax, 2
cmp word [rax], r10w
jne 0x14002b686
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x14002b765
mov r8, r15
mov rdx, r11
test r15, r15
je 0x14002b6d8
mov r9, rax
sub r9, r11
nop word [rax + rax]
movzx ecx, word [r9 + rdx]
cmp cx, word [rdx]
jne 0x14002b756
add rdx, 2
sub r8, 1
jne 0x14002b6c0
sub rax, rbx
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x14002b765
mov r8, qword [r13 + 0x10]
cmp qword [r13 + 0x18], 7
jbe 0x14002b6f5
mov r13, qword [r13]
mov rdx, r13
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400095a0
lea rdx, [rbp + 0x1b0]
cmp qword [rbp + 0x1c8], 7
cmova rdx, qword [rbp + 0x1b0]
mov r8, qword [rbp + 0x1c0]
mov rcx, rax
call fcn.1400095a0
lea rdx, [0x140008b60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov bl, 1
mov byte [rsp + 0x50], bl
lea r8, [rbp + 0x1b0]
lea rdx, [rbp + 0x180]
call fcn.140006820
jmp 0x14002b76a
add rax, 2
xor edx, edx
jmp 0x14002b670
movzx ebx, byte [rsp + 0x50]
cmp r12, 7
jbe 0x14002b7b2
lea rdx, ds:[r12*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14002b7aa
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002bba7
mov rcx, rsi
call fcn.1400499d0
xor esi, esi
mov qword [rbp + 0x220], rsi
mov qword [rbp + 0x228], 7
mov word [rbp + 0x210], si
add r14, 0x40
cmp r14, qword [rsp + 0x70]
jne 0x14002b450
mov rdi, qword [rsp + 0x60]
test bl, bl
jne 0x14002ba13
lea r15, str.Winmgmt
mov rdx, qword [rdi + 0x10]
mov r8, rdi
cmp qword [rdi + 0x18], 7
jbe 0x14002b801
mov r8, qword [rdi]
cmp rdx, 7
jne 0x14002b82b
mov rcx, r15
sub r8, r15
nop dword [rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x14002b82b
add rcx, 2
sub rdx, 1
jne 0x14002b810
jmp 0x14002ba13
lea rcx, [rbp + 0x1b0]
cmp qword [rbp + 0x1c8], 7
cmova rcx, qword [rbp + 0x1b0]
mov rax, qword [rbp + 0x1c0]
lea rdx, [rcx + rax*2]
mov dword [rsp + 0x20], 0x10
lea r9, [rbp - 0x78]
call fcn.140022dc0
nop
test al, al
je 0x14002ba13
lea rdx, [rbp + 0x1b0]
cmp qword [rbp + 0x1c8], 7
cmova rdx, qword [rbp + 0x1b0]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
mov qword [rbp + 0x200], rsi
mov qword [rbp + 0x208], rsi
mov r8, qword [rbp + 0x1c0]
lea rcx, [rbp + 0x1f0]
call fcn.140006ca0
mov rdi, rsi
lea rbx, [rbp + 0x1f0]
cmp qword [rbp + 0x208], 7
seta r8b
cmova rbx, qword [rbp + 0x1f0]
lea rcx, [rbp + 0x1f0]
test r8b, r8b
cmovne rcx, qword [rbp + 0x1f0]
mov rax, qword [rbp + 0x200]
lea rsi, [rcx + rax*2]
cmp rbx, rsi
je 0x14002b90c
nop word [rax + rax]
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
movsxd rcx, eax
imul rdi, rdi, 0x1f
add rdi, rcx
add rbx, 2
cmp rbx, rsi
jne 0x14002b8f0
mov r9, rdi
lea r8, [rbp + 0x1f0]
lea rdx, [rbp + 0x190]
call fcn.140007100
mov rcx, qword [rax + 8]
mov rdi, qword [0x14006f918]
mov rbx, rdi
test rcx, rcx
cmovne rbx, rcx
mov rdx, qword [rbp + 0x208]
cmp rdx, 7
jbe 0x14002b98f
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rbp + 0x1f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b98a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002bbae
call fcn.1400499d0
xor esi, esi
mov qword [rbp + 0x200], rsi
mov qword [rbp + 0x208], 7
mov word [rbp + 0x1f0], si
cmp rbx, rdi
jne 0x14002ba0e
lea rdx, str.___Executed_file_with_modified_extension:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
nop dword [rax]
call fcn.140006aa0
lea rdx, [rbp + 0x1b0]
cmp qword [rbp + 0x1c8], 7
cmova rdx, qword [rbp + 0x1b0]
mov r8, qword [rbp + 0x1c0]
mov rcx, rax
call fcn.1400095a0
lea rdx, [0x140008b60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, [rbp + 0x1b0]
lea rdx, [rbp + 0x1a0]
call fcn.140006820
mov rdi, qword [rsp + 0x60]
mov rax, qword [rbp + 0x10]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x10]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
movzx r8d, ax
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x10]
call fcn.140022be0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
lea r15, str.Winmgmt
jne 0x14002b430
lea r12, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
lea r13, vtable.std::basic_istringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 7
jbe 0x14002bab1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002baac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002bbb5
call fcn.1400499d0
mov qword [rbp + 0x1c0], rsi
mov qword [rbp + 0x1c8], 7
mov word [rbp + 0x1b0], si
mov rax, qword [rbp + 0x10]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x10], r13
mov rax, qword [rbp + 0x10]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x90]
mov dword [rbp + rcx + 0xc], edx
mov qword [rbp + 0x20], r12
lea rcx, [rbp + 0x20]
call fcn.14002d220
lea rcx, ds:[rbp + 0x20]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea rcx, [rbp + 0x28]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
nop
mov rax, qword [rbp + 0x248]
cmp rax, 7
jbe 0x14002bb65
lea rdx, ds:[rax*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002bb5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002bbbc
nop
call fcn.1400499d0
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x58]
mov r8d, 0x1000
lea rdx, [rbp + 0x310]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbx, 0xffffffffffffffff
xor r14d, r14d
test eax, eax
je 0x14002bbce
mov esi, dword [rsp + 0x54]
jmp 0x14002b210
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_alloc_void_]
nop
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x268]
cmp rdx, 7
jbe 0x14002bc4c
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rbp + 0x250]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002bc47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002bc47
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400499d0
movdqa xmm0, xmmword [0x14005d490]
movdqu xmmword [rbp + 0x260], xmm0
mov word [rbp + 0x250], r14w
mov rax, qword [rbp - 0x78]
test rax, rax
je 0x14002bcb3
lock xadd dword [rax + 0x2c], ebx
cmp ebx, 1
jne 0x14002bcb3
mov rbx, qword ds:[rbp - 0x78]
test rbx, rbx
je 0x14002bcb3
nop word [rax + rax]
mov rcx, rbx
lea rax, [rbx + 0x10]
mov rbx, qword [rax]
mov qword [rax], r14
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [0x140050d48]
test rbx, rbx
jne 0x14002bc90
mov qword ds:[rbp - 0x78], r14
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x14002bcef
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140050d48]
mov r8, rax
test rax, rax
je 0x14002bcef
mov rcx, qword [rax]
mov rax, qword [rcx]
mov edx, 1
mov rcx, r8
call qword [0x140050d48]
nop
mov rbx, qword [rbp - 0x50]
test rbx, rbx
je 0x14002bd5e
mov rdi, qword ds:[rbp - 0x48]
cmp rbx, rdi
je 0x14002bd23
lea rcx, [rbx + 0x20]
call fcn.140005e20
mov rcx, rbx
call fcn.140005e20
add rbx, 0x40
cmp rbx, rdi
jne 0x14002bd05
mov rbx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x40]
sub rdx, rbx
and rdx, 0xffffffffffffffc0
mov rax, rbx
cmp rdx, 0x1000
jb 0x14002bd56
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002bd56
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400499d0
mov rcx, qword [rbp + 0x1310]
xor rcx, rsp
call fcn.1400499b0
lea r11, [rsp + 0x1420]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140003ed0
nop
int3