Function at 0x180013470
Capabilities:
Create process on windows
Self delete

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x330]
sub rsp, 0x430
movaps xmmword [rsp + 0x420], xmm6
mov rax, qword [0x18006e218]
xor rax, rsp
mov qword [rbp + 0x310], rax
imul eax, r9d, 0x79a
mov esi, r9d
mov r15d, r9d
mov qword [rsp + 0x68], r8
xor r9d, r9d
mov qword [rbp - 0x78], rdx
mov rdi, rdx
mov qword [rbp - 0x80], rcx
mov r10, rcx
mov dword [rsp + 0x5c], eax
cmp esi, eax
ja 0x1800138e2
mov r14, qword [rsp + 0x68]
mov r12d, dword [rsp + 0x70]
mov r13, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x68]
mov r11d, 0x2e
movabs rdx, 0x650069006d
movabs rcx, 0x7200500020
movabs rax, 0x650062006f
cmp esi, 0x31c4
ja 0x1800136fa
je 0x1800136dd
cmp esi, 0x8e
ja 0x18001363d
je 0x18001361a
cmp esi, 0x3b
je 0x1800135c7
cmp esi, 0x4a
je 0x180013569
cmp esi, 0x5b
jne 0x1800138b4
mov eax, dword [0x180064a78]
mov dword [rbp + 0x1e8], eax
movzx eax, word [0x180064a7c]
mov word [rbp + 0x1ec], ax
jmp 0x1800138b4
test rdi, rdi
jne 0x180013597
mov dword [rsp + 0x50], r9d
lea r8, [rsp + 0x50]
lea r9, [0x180062423]
mov edx, 0xa8
lea rcx, str._li__s__li_
call fcn.1800175c0
mov r10, qword [rbp - 0x80]
xor r9d, r9d
test r10, r10
jne 0x1800138b4
mov dword [rsp + 0x50], r9d
lea r8, [rsp + 0x50]
lea r9, [0x180062423]
mov edx, 0xa8
lea rcx, str.Dell_Meters
call fcn.1800175c0
jmp 0x1800138b4
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov r8d, 0x124
call fcn.18003fab0
mov rcx, qword [rsp + 0x68]
cmp dword [rcx], eax
jb 0x1800138d8
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov r8d, 0x124
call fcn.18003fab0
mov rcx, qword [rsp + 0x68]
mov r8d, 0x52
mov rdx, qword [rbp - 0x80]
mov dword [rcx], eax
mov rcx, rdi
call fcn.180013f10
mov dword [rsp + 0x58], eax
jmp 0x1800138b4
mov dword [rbp + 0x1d0], 0x730077
mov dword [rbp + 0x1d4], 0x5f0032
mov dword [rbp + 0x1d8], 0x320033
jmp 0x1800138b4
cmp esi, 0xf9
je 0x18001368d
cmp esi, 0x2044
je case.0x180013935.0
cmp esi, 0x2878
jne 0x1800138b4
test r8, r8
jne 0x1800138b4
mov dword [rsp + 0x50], r9d
lea r8, [rsp + 0x50]
lea r9, [0x180062423]
mov edx, 0xa8
lea rcx, str.EncoderVersion
call fcn.1800175c0
jmp 0x1800138b4
mov qword [rsp + 0x20], r9
xor r8d, r8d
xor r9d, r9d
mov edx, 0x12b
mov rcx, rdi
call fcn.18000e1f0
cmp eax, 2
jne 0x1800138b4
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor eax, eax
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
lea r8d, [rax + 0x35]
call fcn.18001d9a0
jmp 0x1800138b4
mov qword [rbp + 0x1ec], rax
mov qword [rbp + 0x1f2], rcx
mov dword [rbp + 0x1f8], 0x65
jmp 0x1800138b4
cmp esi, 0x9ac2
ja 0x1800137de
je 0x180013774
cmp esi, 0x4da8
je 0x18001375d
cmp esi, 0x50a6
je 0x180013730
cmp esi, 0x632d
jne 0x1800138b4
mov qword [rbp + 0x1fa], rdx
jmp 0x1800138b4
mov eax, dword [rdi + 4]
lea r8, [rsp + 0x50]
mov r9d, 0x56
mov dword [rsp + 0x50], eax
xor edx, edx
xor ecx, ecx
call fcn.18000f390
test eax, eax
jne 0x1800138b4
mov eax, 0x10
jmp 0x18001384e
mov word [rbp + 0x1dc], r11w
mov dword [rbp + 0x1de], 0x6c0064
jmp 0x1800138b4
mov dword [rbp + 0x1e2], 0x6c
mov edi, 0x11
mov eax, edi
sub eax, 0xe
je 0x1800137b9
sub eax, 2
je 0x1800137d6
cmp eax, 1
jne 0x1800137cf
xor r8d, r8d
lea rcx, [rbp + 0x1d0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
mov edx, 0x13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
jmp 0x1800137cf
cmp byte [0x180071521], 0
je 0x1800137cf
call qword [0x180071518]
mov byte [0x180071521], 0
dec edi
cmp edi, 0xe
ja 0x180013783
mov r14, rbx
jmp 0x1800138b4
cmp esi, 0xe7dc
je 0x1800137f3
cmp esi, 0x134f6
je case.0x180013935.0
jmp 0x1800138b4
cmp qword [r10 + 0x18], 0x10
mov rdx, r10
jb 0x180013800
mov rdx, qword [r10]
mov r8d, dword [r10 + 0x10]
xor r9d, r9d
mov rcx, qword [rdi]
call r14
cmp eax, 0xffffffff
jne 0x1800138af
mov edi, 0x67
nop dword [rax + rax]
cmp edi, 0x67
je 0x180013888
cmp edi, 0xea
je 0x180013880
cmp edi, 0x16d
jne 0x18001389d
mov r8d, r12d
lea rdx, [rbp + 0x30]
mov rcx, r13
call qword [sym.imp.WINMM.dll_joyGetDevCapsA]
mov byte [rsp + 0x58], 0
mov eax, dword [rsp + 0x58]
mov rcx, qword [rbp + 0x310]
xor rcx, rsp
call fcn.18005b930
mov rbx, qword [rsp + 0x488]
movaps xmm6, xmmword [rsp + 0x420]
add rsp, 0x430
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r12d, 0x194
jmp 0x18001389d
xor edx, edx
lea rcx, [rbp + 0x30]
mov r8d, 0x194
lea r13, [rdx - 1]
call sub.VCRUNTIME140.dll_memset
add edi, 0x83
cmp edi, 0x1f0
jb 0x180013820
mov byte [rsp + 0x58], 1
mov r10, qword [rbp - 0x80]
xor r9d, r9d
mov r8, qword [rsp + 0x68]
imul eax, r15d, 0x8b
add esi, eax
cmp esi, dword [rsp + 0x5c]
ja 0x1800138e2
mov rdi, qword [rbp - 0x78]
jmp 0x1800134eb
mov eax, 0xfffffffd
jmp 0x18001384e
lea esi, [r15 - 0xe]
mov dword [rsp + 0x50], esi
cmp r15d, esi
jbe case.0x180013935.0
mov ebx, dword [rsp + 0x70]
lea r13d, [r15 - 0x45]
mov r15, qword [rsp + 0x68]
lea rdx, [0x180000000]
mov r12, qword [rsp + 0x68]
mov r14d, 0x54
mov edi, dword [rsp + 0x70]
xorps xmm6, xmm6
nop dword [rax]
cmp r13d, 0x16
ja case.0x180013935.6
mov ecx, dword [rdx + r13*4 + 0x13eac]
add rcx, rdx
jmp rcx
mov r8d, 2
lea rdx, [0x180064a9c]
lea rcx, [rbp + 0x1e8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov dword [rbp + 0x204], 0x20
lea rdx, [0x180000000]
mov dword [rbp + 0x206], 0x54
xor r9d, r9d
jmp case.0x180013935.6
lea rax, [rbp - 0x60]
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x1e8]
lea rax, [rbp - 0x40]
xor edx, edx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], r9
mov dword [rsp + 0x28], r9d
mov dword [rsp + 0x20], r9d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
lea rdx, [0x180000000]
jmp case.0x180013935.6
mov r8d, dword [rsp + 0x5c]
lea rdx, [rbp + 0x210]
lea rcx, [r8 + 1]
add rcx, r10
call sub.VCRUNTIME140.dll_memcpy
xor r9d, r9d
lea rdx, [0x180000000]
jmp case.0x180013935.6
mov edx, 0x100
mov r14d, 0x87
mov qword [rsp + 0x60], rdx
nop dword [rax]
cmp r14d, 0x11b
ja 0x180013b17
je 0x180013ab8
mov eax, r14d
sub eax, 0xe
je 0x180013a6e
sub eax, 0x79
je 0x180013a62
cmp eax, 0x5f
jne 0x180013b26
test rdx, rdx
je 0x180013a55
mov rsi, rdx
mov r8, rdx
xor edx, edx
mov rcx, r15
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov edx, eax
add r15, rsi
dec rdx
mov qword [rsp + 0x60], rdx
jmp 0x180013b26
lea r15, [rbp + 0x210]
jmp 0x180013b26
lea r8, [rsp + 0x60]
mov ecx, 0xa6
lea rdx, [rbp + 0x210]
call fcn.180058080
cmp eax, 0xffffffff
je 0x180013ab1
mov dword [rbp - 0x70], eax
lea rcx, [rbp + 0x210]
lea rax, [rbp - 0x70]
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
xor eax, eax
mov qword [rsp + 0x20], rax
lea r9d, [rax + 0x4c]
call fcn.1800293b0
mov rdx, qword [rsp + 0x60]
jmp 0x180013b26
mov ecx, 0xe8
nop dword [rax]
mov eax, ecx
sub eax, 0xe8
je 0x180013b3b
sub eax, 0x1c
je 0x180013ae2
cmp eax, 0xbd
jne 0x180013aff
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x240], xmm0
jmp 0x180013aff
movsd qword [rbp + 0x228], xmm6
mov qword [rbp + 0x220], r9
mov qword [rbp + 0x230], r9
mov dword [rbp + 0x238], r9d
add ecx, 0xbd
cmp ecx, 0x31f
jb 0x180013ac0
lea eax, [rbx + 1]
cmp eax, 2
jbe 0x180013b6f
jmp 0x180013b26
mov eax, r14d
sub eax, 0x17a
je 0x180013b26
cmp eax, 0x5f
je 0x180013b6f
add r14d, 0x5f
cmp r14d, 0x2c1
jae 0x180013b6f
xor r9d, r9d
jmp 0x180013a10
cmp dword [rbp + 0x218], 1
jne 0x180013b4b
mov ebx, 0xffffffff
jmp 0x180013b6f
cmp dword [rbp + 0x210], 1
jle 0x180013b5b
mov ebx, 1
jmp 0x180013b6f
mov rax, qword [rbp + 0x220]
cmp dword [rax], edx
jbe 0x180013b6d
mov ebx, 1
jmp 0x180013b6f
sbb ebx, ebx
mov r14, qword [rbp - 0x78]
mov rcx, qword [r14 + 0x18]
call qword [0x1800709e0]
mov ecx, dword [rsp + 0x5c]
lea rdx, [rbp + 0x210]
sub ecx, eax
mov eax, ecx
mov rcx, qword [r14 + 0x18]
add rdx, rax
call qword [0x1800709e8]
mov esi, dword [rsp + 0x50]
lea rdx, [0x180000000]
xor r9d, r9d
lea r14d, [r9 + 0x54]
jmp case.0x180013935.6
mov rax, qword [rbp - 0x78]
mov rax, qword [rax + 8]
mov r14d, dword [rax]
mov dword [rsp + 0x5c], r14d
lea eax, [r14*2 + 1]
cmp dword [r8], eax
jb 0x180013e9f
mov byte [r10], 4
mov r14d, 0x54
jmp case.0x180013935.6
mov eax, dword [0x180064aa4]
mov dword [rbp + 0x208], 0x64
mov dword [rbp + 0x20a], eax
movzx eax, word [0x180064aa8]
mov word [rbp + 0x20e], ax
jmp case.0x180013935.6
xor r9d, r9d
lea r8, [rbp - 0x68]
mov rdx, r10
mov ecx, 0x100
call fcn.180029140
test al, al
je 0x180013845
xor r9d, r9d
lea rdx, [0x180000000]
jmp case.0x180013935.6
movzx eax, word [r8]
lea rdx, [rsp + 0x60]
mov rcx, qword [rbp - 0x78]
lea r8, [rsp + 0x78]
mov word [rsp + 0x78], ax
mov eax, dword [rbp - 0x68]
mov qword [rsp + 0x20], r9
mov r9d, 0x2f
mov dword [rsp + 0x60], eax
call fcn.18001b990
mov byte [rsp + 0x58], al
lea rdx, [0x180000000]
xor r9d, r9d
jmp case.0x180013935.6
mov edx, 0x100
mov r14d, 0x87
mov qword [rsp + 0x60], rdx
nop word [rax + rax]
cmp r14d, 0x11b
ja 0x180013d97
je 0x180013d3a
mov eax, r14d
sub eax, 0xe
je 0x180013cee
sub eax, 0x79
je 0x180013ce2
cmp eax, 0x5f
jne 0x180013da6
test rdx, rdx
je 0x180013cd5
mov rsi, rdx
mov r8, rdx
xor edx, edx
mov rcx, r12
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov edx, eax
add r12, rsi
dec rdx
mov qword [rsp + 0x60], rdx
jmp 0x180013da6
lea r12, [rbp + 0x210]
jmp 0x180013da6
lea r8, [rsp + 0x60]
mov ecx, 0xa6
lea rdx, [rbp + 0x210]
call fcn.180058080
cmp eax, 0xffffffff
je 0x180013d33
mov dword [rsp + 0x70], eax
lea rcx, [rbp + 0x210]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
xor eax, eax
mov qword [rsp + 0x20], rax
lea r9d, [rax + 0x4c]
call fcn.1800293b0
mov rdx, qword [rsp + 0x60]
jmp 0x180013da6
mov ecx, 0xe8
nop
mov eax, ecx
sub eax, 0xe8
je 0x180013dbb
sub eax, 0x1c
je 0x180013d62
cmp eax, 0xbd
jne 0x180013d7f
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x240], xmm0
jmp 0x180013d7f
movsd qword [rbp + 0x228], xmm6
mov qword [rbp + 0x220], r9
mov qword [rbp + 0x230], r9
mov dword [rbp + 0x238], r9d
add ecx, 0xbd
cmp ecx, 0x31f
jb 0x180013d40
lea eax, [rdi + 1]
cmp eax, 2
jbe 0x180013def
jmp 0x180013da6
mov eax, r14d
sub eax, 0x17a
je 0x180013da6
cmp eax, 0x5f
je 0x180013def
add r14d, 0x5f
cmp r14d, 0x2c1
jae 0x180013def
xor r9d, r9d
jmp 0x180013c90
cmp dword [rbp + 0x218], 1
jne 0x180013dcb
mov edi, 0xffffffff
jmp 0x180013def
cmp dword [rbp + 0x210], 1
jle 0x180013ddb
mov edi, 1
jmp 0x180013def
mov rax, qword [rbp + 0x220]
cmp dword [rax], edx
jbe 0x180013ded
mov edi, 1
jmp 0x180013def
sbb edi, edi
mov r14, qword [rbp - 0x78]
mov rcx, qword [r14 + 0x10]
call qword [0x1800709e0]
mov esi, dword [rsp + 0x5c]
lea rdx, [rbp + 0x210]
mov ecx, esi
sub ecx, eax
mov eax, ecx
mov rcx, qword [r14 + 0x10]
add rdx, rax
call qword [0x1800709e8]
mov rcx, qword [rbp - 0x80]
lea rdx, [rbp + 0x210]
inc rcx
mov r8d, esi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x180013b99
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x58], r9d
lea eax, [rax*2 + 1]
mov dword [r8], eax
jmp case.0x180013935.6
xorps xmm0, xmm0
mov dword [rbp - 0x40], 0x68
xor eax, eax
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rax
jmp case.0x180013935.6
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp + 0x20], rax
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
dec r13d
lea eax, [r13 + 0x45]
cmp eax, esi
jbe case.0x180013935.0
mov r10, qword [rbp - 0x80]
mov r8, qword [rsp + 0x68]
jmp 0x180013920
mov dword [r8], eax
mov eax, 6
jmp 0x18001384e