Function at 0x140098782
Capabilities:
Delete file
Delete service
Get common file path

Disassembly:
push rax
pushf
mov eax, 0x8f22cde3
pushf
not eax
add eax, 0x2d23079f
xor eax, 0x4f7e4974
rol eax, 5
popf
pushf
not eax
add eax, 0x7b08ec91
xor eax, 0x4b3ad296
rol eax, 0x40
popf
cmp eax, 0x17
jne 0x1400987bf
popf
pop rax
jmp 0x140099856
cmp eax, 0x10
jne 0x1400987ce
popf
pop rax
jmp 0x140099557
cmp eax, 0x1a
jne 0x1400987dd
popf
pop rax
jmp 0x140099a28
cmp eax, 0
jne 0x1400987ec
popf
pop rax
jmp 0x140098963
cmp eax, 8
jne 0x1400987fb
popf
pop rax
jmp 0x140098f64
cmp eax, 7
jne 0x14009880a
popf
pop rax
jmp 0x140098ec4
cmp eax, 6
jne 0x140098819
popf
pop rax
jmp 0x140098e2d
cmp eax, 0xb
jne 0x140098828
popf
pop rax
jmp 0x140099094
cmp eax, 5
jne 0x140098837
popf
pop rax
jmp 0x140098dca
cmp eax, 0x12
jne 0x140098846
popf
pop rax
jmp 0x1400995ef
cmp eax, 0x11
jne 0x140098855
popf
pop rax
jmp 0x140099591
cmp eax, 0x15
jne 0x140098864
popf
pop rax
jmp 0x1400997d1
cmp eax, 1
jne 0x140098873
popf
pop rax
jmp 0x140098b21
cmp eax, 9
jne 0x140098882
popf
pop rax
jmp 0x14009900f
cmp eax, 4
jne 0x140098891
popf
pop rax
jmp 0x140098d8d
cmp eax, 0x1b
jne 0x1400988a0
popf
pop rax
jmp 0x140099a88
cmp eax, 0xe
jne 0x1400988af
popf
pop rax
jmp 0x1400993e6
cmp eax, 0xf
jne 0x1400988be
popf
pop rax
jmp 0x1400994ac
cmp eax, 0x16
jne 0x1400988cd
popf
pop rax
jmp 0x14009980b
cmp eax, 0xd
jne 0x1400988dc
popf
pop rax
jmp 0x1400991fc
cmp eax, 0x14
jne 0x1400988eb
popf
pop rax
jmp 0x140099739
cmp eax, 0x18
jne 0x1400988fa
popf
pop rax
jmp 0x1400998f0
cmp eax, 0x19
jne 0x140098909
popf
pop rax
jmp 0x14009997d
cmp eax, 0xa
jne 0x140098918
popf
pop rax
jmp 0x140099049
cmp eax, 0x13
jne 0x140098927
popf
pop rax
jmp 0x140099699
cmp eax, 0x1c
jne 0x140098936
popf
pop rax
jmp 0x140099ac0
cmp eax, 3
jne 0x140098945
popf
pop rax
jmp 0x140098d2a
cmp eax, 0xc
jne 0x140098954
popf
pop rax
jmp 0x140099179
cmp eax, 2
jne 0x140098963
popf
pop rax
jmp 0x140098c34
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x14003f040]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov rbx, rcx
call fcn.14009ec71
mov rcx, rbx
jmp 0x14009899a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, 0xc374ed95
pushf
not r8d
add r8d, 0xdb91ec
xor r8d, 0x57f3d34c
rol r8d, 9
popf
pushf
not r8d
add r8d, 0x1da53677
xor r8d, 0x5c195acd
rol r8d, 0x7b
popf
pushf
not r8d
add r8d, 0x1e6330f5
xor r8d, 0x661c1587
rol r8d, 0x76
popf
pushf
not r8d
add r8d, 0x5a1aa929
xor r8d, 0x7262e7be
rol r8d, 0xd8
popf
lea rdx, [0x1931af8d5]
pushf
sub rdx, 0x5317ed8d
popf
lea rcx, [rsp + 0x20]
call fcn.140093b46
xor edx, edx
xor ecx, ecx
mov r8d, 0xb73abb6a
pushf
not r8d
add r8d, 0x1689d464
xor r8d, 0x5144c870
rol r8d, 0x74
popf
pushf
not r8d
add r8d, 0xe25ec1b
xor r8d, 0x5940b5d
rol r8d, 0x91
popf
jmp 0x140098a74
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x140098adb
push rax
pushf
mov eax, 0xb780ccc2
pushf
not eax
add eax, 0x387472c0
xor eax, 0x2ed57db0
rol eax, 7
popf
pushf
not eax
add eax, 0x7fc2492b
xor eax, 0x4610f737
rol eax, 0x94
popf
pushf
not eax
add eax, 0x7dc361ce
xor eax, 0x6cace2a8
rol eax, 0xf
popf
pushf
not eax
add eax, 0x7d23abb4
xor eax, 0x4d3f8e1d
rol eax, 0xf5
popf
jmp 0x1400987b0
push rax
pushf
mov eax, 0x9cd793ce
pushf
not eax
add eax, 0x34986976
xor eax, 0x2bc5533d
rol eax, 0x87
popf
pushf
not eax
add eax, 0x7e5e2caa
xor eax, 0x4749e1c4
rol eax, 0x78
popf
pushf
not eax
add eax, 0x54c9c5
xor eax, 0x1117f686
rol eax, 0x84
popf
jmp 0x1400987b0
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdx, qword [rsp + 0x20]
mov r8d, 0x1971bccf
pushf
not r8d
add r8d, 0x5efd7365
xor r8d, 0x77c8d6ac
rol r8d, 0xee
popf
pushf
not r8d
add r8d, 0x739b87d8
xor r8d, 0x65afc6da
rol r8d, 0x59
popf
pushf
not r8d
add r8d, 0x78efc6c3
xor r8d, 0x3cb380c5
rol r8d, 0x4f
popf
mov rcx, rax
jmp 0x140098b87
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rax, rax
je 0x140098bdb
push rax
pushf
mov eax, 0x32ecd44f
pushf
not eax
add eax, 0x324a39a
xor eax, 0x5418e4a8
rol eax, 0xe5
popf
pushf
not eax
add eax, 0x2c03a527
xor eax, 0x5813a9a8
rol eax, 0xc1
popf
pushf
not eax
add eax, 0x29a7b88a
xor eax, 0x3d8cb58c
rol eax, 0x45
popf
jmp 0x1400987b0
push rax
pushf
mov eax, 0x8a48b07c
pushf
not eax
add eax, 0x25f9070d
xor eax, 0x75bb7ee2
rol eax, 0xfd
popf
pushf
not eax
add eax, 0x6f31ce70
xor eax, 0x27bf46a7
rol eax, 0xac
popf
pushf
not eax
add eax, 0x5b010568
xor eax, 0x8ee5222
rol eax, 0xa1
popf
pushf
not eax
add eax, 0x1715b7e6
xor eax, 0x553fd063
rol eax, 0x5c
popf
jmp 0x1400987b0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], eax
lea r8, [rsp + 0x48]
mov edx, 0x142e1022
pushf
not edx
add edx, 0x7ed50bff
xor edx, 0x1afe6c0
rol edx, 0
popf
pushf
not edx
add edx, 0x13d7e26d
xor edx, 0x6ce831cd
rol edx, 0xf4
popf
pushf
not edx
add edx, 0x7269a29f
xor edx, 0x288de02f
rol edx, 0xd1
popf
mov rcx, rbx
jmp 0x140098c94
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140098cf7
push rax
pushf
mov eax, 0xcf0c6ec
pushf
not eax
add eax, 0x6564281b
xor eax, 0x791e5181
rol eax, 0xbf
popf
pushf
not eax
add eax, 0x6389325
xor eax, 0x54e65b7f
rol eax, 0x56
popf
pushf
not eax
add eax, 0x51d93042
xor eax, 0x552bbfe7
rol eax, 0x9b
popf
pushf
not eax
add eax, 0x6431269
xor eax, 0x1cbf371b
rol eax, 0x86
popf
jmp 0x1400987b0
push rax
pushf
mov eax, 0x8dd3ce8f
pushf
not eax
add eax, 0x24758971
xor eax, 0x7de1eeca
rol eax, 0x59
popf
pushf
not eax
add eax, 0x68e8f939
xor eax, 0x10127890
rol eax, 0x6a
popf
jmp 0x1400987b0
mov rcx, rbx
jmp 0x140098d2e
call qword [sym.imp.ADVAPI32.dll_DeleteService]
push rax
pushf
mov eax, 0x3954c198
pushf
not eax
add eax, 0x119b6406
xor eax, 0x3350de0
rol eax, 0xcb
popf
pushf
not eax
add eax, 0x1e473e09
xor eax, 0x7d8dc15d
rol eax, 0xd3
popf
pushf
not eax
add eax, 0x316558c4
xor eax, 0x103e4b4a
rol eax, 0xf5
popf
pushf
not eax
add eax, 0x332ee42b
xor eax, 0x7af923c6
rol eax, 0xf8
popf
jmp 0x1400987b0
mov rcx, rbx
jmp 0x140098d91
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push rax
pushf
mov eax, 0x41ad308a
pushf
not eax
add eax, 0x3c84cfc4
xor eax, 0x16be1e56
rol eax, 0x1d
popf
pushf
not eax
add eax, 0x2b8f544f
xor eax, 0x2e022424
rol eax, 0x20
popf
jmp 0x1400987b0
mov rcx, rdi
jmp 0x140098dce
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push rax
pushf
mov eax, 0x81f58013
pushf
not eax
add eax, 0x1c34a188
xor eax, 0x6501aac5
rol eax, 0xf6
popf
pushf
not eax
add eax, 0x78f98e96
xor eax, 0x49dfa9c4
rol eax, 0x2e
popf
pushf
not eax
add eax, 0x112f19a3
xor eax, 0xa80f140
rol eax, 0x75
popf
pushf
not eax
add eax, 0x715bdb79
xor eax, 0x422b933d
rol eax, 0x37
popf
jmp 0x1400987b0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140098e6b
push rax
pushf
mov eax, 0xf0f5474f
pushf
not eax
add eax, 0x376c6fd9
xor eax, 0x65f30104
rol eax, 0xa4
popf
pushf
not eax
add eax, 0x5d02fab1
xor eax, 0x24c061d9
rol eax, 0xa0
popf
jmp 0x1400987b0
push rax
pushf
mov eax, 0xe64bd98e
pushf
not eax
add eax, 0x6d9de7ae
xor eax, 0x22d9f52d
rol eax, 0x8b
popf
pushf
not eax
add eax, 0x448a70a7
xor eax, 0x3090788
rol eax, 0x38
popf
pushf
not eax
add eax, 0x4f99f039
xor eax, 0x4b4cc2a5
rol eax, 0x7a
popf
pushf
not eax
add eax, 0x1746c517
xor eax, 0x3766c943
rol eax, 0x69
popf
jmp 0x1400987b0
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140098f31
push rax
pushf
mov eax, 0xebff459c
pushf
not eax
add eax, 0x51f148e
xor eax, 0x7d213581
rol eax, 0xb0
popf
pushf
not eax
add eax, 0x44f26ec6
xor eax, 0x68bf123f
rol eax, 0xb9
popf
pushf
not eax
add eax, 0x58376643
xor eax, 0x61c54009
rol eax, 0x37
popf
pushf
not eax
add eax, 0x19b3368c
xor eax, 0x2d701db5
rol eax, 0x26
popf
jmp 0x1400987b0
push rax
pushf
mov eax, 0xa0c66d58
pushf
not eax
add eax, 0x3010e01d
xor eax, 0x52105699
rol eax, 0x3b
popf
pushf
not eax
add eax, 0x3f9429c6
xor eax, 0x50a9588b
rol eax, 0x1e
popf
jmp 0x1400987b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
push rcx
not rcx
add rax, rcx
pop rcx
add rax, 1
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140098fb5
push rax
pushf
mov eax, 0x3515635d
pushf
not eax
add eax, 0x74f69313
xor eax, 0x7a99a99a
rol eax, 0xb2
popf
pushf
not eax
add eax, 0x7020e3a9
xor eax, 0x5763cd8e
rol eax, 0x5d
popf
jmp 0x1400987b0
push rax
pushf
mov eax, 0xf2335b75
pushf
not eax
add eax, 0x295c1d55
xor eax, 0x46f0710
rol eax, 0xff
popf
pushf
not eax
add eax, 0x385237bf
xor eax, 0x47f0861b
rol eax, 0x27
popf
pushf
not eax
add eax, 0x6dc2644c
xor eax, 0x2d606564
rol eax, 0x50
popf
pushf
not eax
add eax, 0x7e422e66
xor eax, 0x25869b8c
rol eax, 0xfc
popf
jmp 0x1400987b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140114059
push rax
pushf
mov eax, 0x648bbffe
pushf
not eax
add eax, 0x25144d93
xor eax, 0x7b9d4fa9
rol eax, 0xa
popf
pushf
not eax
add eax, 0x61d00796
xor eax, 0xba710f0
rol eax, 0xd4
popf
pushf
not eax
add eax, 0x7874e711
xor eax, 0x64e4d110
rol eax, 0x27
popf
jmp 0x1400987b0
xor edx, edx
mov r8d, 0xd4042e33
pushf
not r8d
add r8d, 0x171537fe
xor r8d, 0x2ffc6767
rol r8d, 0xb8
popf
pushf
not r8d
add r8d, 0x1f5b252c
xor r8d, 0x12f810d4
rol r8d, 0xc1
popf
pushf
not r8d
add r8d, 0x633a9016
xor r8d, 0x1f0e4143
rol r8d, 0x29
popf
lea rcx, [rbp - 0x70]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp - 0x70]
mov ecx, 0x527039b9
pushf
not ecx
add ecx, 0x4455edd0
xor ecx, 0x5b5b680c
rol ecx, 0x2c
popf
pushf
not ecx
add ecx, 0x1e5be895
xor ecx, 0x389a3deb
rol ecx, 0xc7
popf
jmp 0x140099124
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rax, [rbp - 0x70]
mov r8, 0xffffffffffffffff
push rax
pushf
mov eax, 0xccef0659
pushf
not eax
add eax, 0x70d68ad3
xor eax, 0x317c6593
rol eax, 0x15
popf
pushf
not eax
add eax, 0x60b6951a
xor eax, 0x2364415d
rol eax, 0x9c
popf
jmp 0x1400987b0
inc r8
cmp byte [rax + r8], 0
jne 0x1400991b6
push rax
pushf
mov eax, 0xcbbab611
pushf
not eax
add eax, 0x46dd41cb
xor eax, 0x312f5142
rol eax, 0xc2
popf
pushf
not eax
add eax, 0x3785c7b7
xor eax, 0xf4e5a69
rol eax, 0xbb
popf
jmp 0x1400987b0
push rax
pushf
mov eax, 0xde46c3a6
pushf
not eax
add eax, 0x7912dfad
xor eax, 0x276e6024
rol eax, 0xce
popf
pushf
not eax
add eax, 0x27c1d22a
xor eax, 0x3c415d19
rol eax, 0xfd
popf
pushf
not eax
add eax, 0x57c3f6cd
xor eax, 0x412566d1
rol eax, 0x33
popf
jmp 0x1400987b0
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x20]
call fcn.140093b46
nop
mov r8d, 0xf5caf524
pushf
not r8d
add r8d, 0x6a2230b9
xor r8d, 0x567589e
rol r8d, 0xa8
popf
pushf
not r8d
add r8d, 0x580cd78
xor r8d, 0x3f64567d
rol r8d, 0x46
popf
pushf
not r8d
add r8d, 0x60a98387
xor r8d, 0x67c89b62
rol r8d, 0x15
popf
pushf
not r8d
add r8d, 0x3cde39a5
xor r8d, 0x3f098809
rol r8d, 0x7e
popf
lea rdx, [0x187f05c66]
pushf
sub rdx, 0x47ed5112
popf
lea rcx, [rsp + 0x20]
call fcn.14009fdfe
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], 0
mov byte [rax], 0
mov r8d, 0x55061b09
pushf
not r8d
add r8d, 0x71e83925
xor r8d, 0x4ae37f54
rol r8d, 0x65
popf
pushf
not r8d
add r8d, 0x1e3364a
xor r8d, 0x57b70c5f
rol r8d, 0x87
popf
lea rdx, [0x1a5ef9207]
pushf
sub rdx, 0x65ec86bf
popf
lea rcx, [rsp + 0x48]
call fcn.14009fdfe
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x14009938d
push rax
pushf
mov eax, 0x6fb9157f
pushf
not eax
add eax, 0x401c7c20
xor eax, 0x2af531b9
rol eax, 0x29
popf
pushf
not eax
add eax, 0x5ec38024
xor eax, 0x32154dee
rol eax, 0x3b
popf
jmp 0x1400987b0
push rax
pushf
mov eax, 0xd8acb0d6
pushf
not eax
add eax, 0x5048d00a
xor eax, 0x504c32a9
rol eax, 0x90
popf
pushf
not eax
add eax, 0x489fddd0
xor eax, 0x38b459c2
rol eax, 0x8e
popf
pushf
not eax
add eax, 0x2e62f7db
xor eax, 0x6bad6ec1
rol eax, 0xb6
popf
pushf
not eax
add eax, 0x13aba884
xor eax, 0x79168d3
rol eax, 0x8f
popf
jmp 0x1400987b0
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140099453
push rax
pushf
mov eax, 0xa4f62ad6
pushf
not eax
add eax, 0x5da3927c
xor eax, 0x6fc6493
rol eax, 0xa6
popf
pushf
not eax
add eax, 0x5f454dc6
xor eax, 0x64bf6bcb
rol eax, 0x8f
popf
pushf
not eax
add eax, 0x31d1f7a
xor eax, 0x6d1fdfa9
rol eax, 0x1a
popf
pushf
not eax
add eax, 0x443aeb87
xor eax, 0x6eba5d26
rol eax, 0x75
popf
jmp 0x1400987b0
push rax
pushf
mov eax, 0x958394ce
pushf
not eax
add eax, 0x2b6689d9
xor eax, 0x5c52af58
rol eax, 0x50
popf
pushf
not eax
add eax, 0xe96541a
xor eax, 0x4b107ff9
rol eax, 0x94
popf
pushf
not eax
add eax, 0xe0a0646
xor eax, 0x2e0ebed8
rol eax, 0xdf
popf
pushf
not eax
add eax, 0x6a980328
xor eax, 0xc1dab38
rol eax, 0x48
popf
jmp 0x1400987b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
push rcx
not rcx
add rax, rcx
pop rcx
add rax, 1
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400994fd
push rax
pushf
mov eax, 0x38c0e095
pushf
not eax
add eax, 0x1dbd0968
xor eax, 0x6c014004
rol eax, 0x33
popf
pushf
not eax
add eax, 0x6e073029
xor eax, 0x2742e83d
rol eax, 0x70
popf
jmp 0x1400987b0
push rax
pushf
mov eax, 0x2ec49791
pushf
not eax
add eax, 0x5461a78d
xor eax, 0x1cc7b464
rol eax, 0xb2
popf
pushf
not eax
add eax, 0x6c9567a2
xor eax, 0x16bf0da0
rol eax, 0x95
popf
pushf
not eax
add eax, 0x1bed627
xor eax, 0x66d77247
rol eax, 0x57
popf
pushf
not eax
add eax, 0x35be89cb
xor eax, 0x7d9a8671
rol eax, 0x8c
popf
jmp 0x1400987b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140114059
push rax
pushf
mov eax, 0xaa3bf5e2
pushf
not eax
add eax, 0x74debf9c
xor eax, 0x407660c4
rol eax, 0xe7
popf
pushf
not eax
add eax, 0x22d4d4e3
xor eax, 0x6888e633
rol eax, 0xc
popf
pushf
not eax
add eax, 0x280d7dbf
xor eax, 0x66f59a76
rol eax, 0x90
popf
pushf
not eax
add eax, 0x4834e585
xor eax, 0x3d4fe585
rol eax, 0xcf
popf
jmp 0x1400987b0
movdqa xmm0, xmmword [0x140039620]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140099666
push rax
pushf
mov eax, 0x7aaa422
pushf
not eax
add eax, 0x63bac8de
xor eax, 0x57781b34
rol eax, 0x5e
popf
pushf
not eax
add eax, 0x6e55c915
xor eax, 0xcc45b05
rol eax, 3
popf
pushf
not eax
add eax, 0x70e3e85d
xor eax, 0x16a07a8d
rol eax, 0x11
popf
pushf
not eax
add eax, 0x6ae4abda
xor eax, 0x12704550
rol eax, 0x37
popf
jmp 0x1400987b0
push rax
pushf
mov eax, 0xd6d8dde3
pushf
not eax
add eax, 0x66ee0911
xor eax, 0x16baa470
rol eax, 0xc3
popf
pushf
not eax
add eax, 0x6c114428
xor eax, 0x3694c84b
rol eax, 0x1c
popf
jmp 0x1400987b0
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140099706
push rax
pushf
mov eax, 0xad0a8fa6
pushf
not eax
add eax, 0x6f8331a2
xor eax, 0x70adb156
rol eax, 0x87
popf
pushf
not eax
add eax, 0x340b1cc6
xor eax, 0x3bdb7034
rol eax, 0x6d
popf
pushf
not eax
add eax, 0x1f0d61d4
xor eax, 0x5fe7006a
rol eax, 0x6a
popf
pushf
not eax
add eax, 0x28a4e8a5
xor eax, 0x53bd5dc6
rol eax, 0x6f
popf
jmp 0x1400987b0
push rax
pushf
mov eax, 0xbf0edf10
pushf
not eax
add eax, 0x1111905e
xor eax, 0x2de732b3
rol eax, 0x21
popf
pushf
not eax
add eax, 0x70b6bc3b
xor eax, 0x70ebec3e
rol eax, 0x36
popf
jmp 0x1400987b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
push rcx
not rcx
add rax, rcx
pop rcx
add rax, 1
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009978a
push rax
pushf
mov eax, 0x8cca3fac
pushf
not eax
add eax, 0x3d8cd30a
xor eax, 0x403b7102
rol eax, 0x3c
popf
pushf
not eax
add eax, 0x318f12a7
xor eax, 0x30df7481
rol eax, 0x4b
popf
jmp 0x1400987b0
push rax
pushf
mov eax, 0x8330998
pushf
not eax
add eax, 0x793a0f03
xor eax, 0x68b38573
rol eax, 0x2c
popf
pushf
not eax
add eax, 0x469a9b48
xor eax, 0x3114ec
rol eax, 0xa9
popf
pushf
not eax
add eax, 0x7bfe9004
xor eax, 0x2bc40f66
rol eax, 0xfc
popf
jmp 0x1400987b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140114059
push rax
pushf
mov eax, 0x8d41fafd
pushf
not eax
add eax, 0x43a9feb5
xor eax, 0x38b0e16
rol eax, 0xef
popf
pushf
not eax
add eax, 0x3bce7bf8
xor eax, 0x2a2b2ab0
rol eax, 0x80
popf
pushf
not eax
add eax, 0x1c3cfc1f
xor eax, 0xd667069
rol eax, 0x64
popf
jmp 0x1400987b0
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rcx, qword [rsp + 0x68]
jmp 0x140099867
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x1400998bd
push rax
pushf
mov eax, 0x2f3e7d2e
pushf
not eax
add eax, 0x4bae3000
xor eax, 0x70a5db01
rol eax, 0x63
popf
pushf
not eax
add eax, 0x78176a4b
xor eax, 0x2ae350fc
rol eax, 0x7c
popf
pushf
not eax
add eax, 0x2374c5a6
xor eax, 0x6fc25172
rol eax, 0x3c
popf
jmp 0x1400987b0
push rax
pushf
mov eax, 0x88ea7780
pushf
not eax
add eax, 0x45830a0e
xor eax, 0x2529677
rol eax, 0x33
popf
pushf
not eax
add eax, 0x63c29023
xor eax, 0x3be299d2
rol eax, 0x31
popf
jmp 0x1400987b0
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009994a
push rax
pushf
mov eax, 0xc930e4a6
pushf
not eax
add eax, 0x8e60a8a
xor eax, 0x5110de
rol eax, 0xfd
popf
pushf
not eax
add eax, 0x4a8e774f
xor eax, 0x48b9523c
rol eax, 0x58
popf
pushf
not eax
add eax, 0x6a371c7
xor eax, 0x6ab95024
rol eax, 0xf8
popf
jmp 0x1400987b0
push rax
pushf
mov eax, 0x4eb93597
pushf
not eax
add eax, 0x60d987a4
xor eax, 0x3687404f
rol eax, 0x57
popf
pushf
not eax
add eax, 0x6bb36200
xor eax, 0x4a20be76
rol eax, 0x94
popf
jmp 0x1400987b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
push rcx
not rcx
add rax, rcx
pop rcx
add rax, 1
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400999e1
push rax
pushf
mov eax, 0xa944140
pushf
not eax
add eax, 0x1a26f955
xor eax, 0x511e649d
rol eax, 0x22
popf
pushf
not eax
add eax, 0x3b463e02
xor eax, 0x457b0b4d
rol eax, 0x62
popf
pushf
not eax
add eax, 0x2beb58a5
xor eax, 0x1a47165e
rol eax, 0xd3
popf
jmp 0x1400987b0
push rax
pushf
mov eax, 0xde36bb9e
pushf
not eax
add eax, 0x742d2f67
xor eax, 0x77737379
rol eax, 0x6f
popf
pushf
not eax
add eax, 0x1e89d031
xor eax, 0xdba2451
rol eax, 0x14
popf
pushf
not eax
add eax, 0x38798241
xor eax, 0x3c804990
rol eax, 0x44
popf
jmp 0x1400987b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140114059
push rax
pushf
mov eax, 0x1bf523ab
pushf
not eax
add eax, 0x7ea9a60f
xor eax, 0xf5e27c6
rol eax, 0xe9
popf
pushf
not eax
add eax, 0x2a9647bf
xor eax, 0x554a1ce3
rol eax, 0x55
popf
jmp 0x1400987b0
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.140112590
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret