Function at 0x1402380c0
Capabilities:
Create process on windows
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x1403ceac0]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov qword [rbp - 0x70], r9
mov r14, r8
mov rbx, rdx
mov rax, qword [rbp + 0x100]
mov qword [rbp - 0x68], rax
test rax, rax
jne 0x14023813a
lea rax, str.invalid_substitutor
mov qword [rsp + 0x20], rax
mov r9d, 0x62
lea r8, str.XMLUpdater::v2::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.E:BT0a209782_47a3_49ff_a189_59d4c06152f0WebAdvisor_XmlUpdater_srcXmlUpdaterExecuteLocalCommand.cpp
lea ecx, [r9 - 0x61]
call fcn.140213350
xor al, al
jmp 0x1402387de
cmp byte [rbp + 0x118], 0
je 0x140238198
mov rcx, rbx
cmp qword [rdx + 0x18], 8
jb 0x140238150
mov rcx, qword [rdx]
call fcn.140237030
test al, al
jne 0x140238198
cmp qword [rbx + 0x18], 8
jb 0x140238163
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rbx
lea rax, str.Signature_check_failed_for_command__s
mov qword [rsp + 0x20], rax
mov r9d, 0x67
lea r8, str.XMLUpdater::v2::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.E:BT0a209782_47a3_49ff_a189_59d4c06152f0WebAdvisor_XmlUpdater_srcXmlUpdaterExecuteLocalCommand.cpp
lea ecx, [r9 - 0x66]
call fcn.140213350
xor al, al
jmp 0x1402387de
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rax
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
movups xmmword [rbp + 0x44], xmm0
mov dword [rbp + 0x54], eax
mov dword [rbp - 0x10], 0x68
xor ecx, ecx
cmp byte [rbp + 0x108], al
je 0x1402381dc
mov dword [rbp + 0x2c], 1
mov word [rbp + 0x30], cx
mov r15, qword [rbx + 0x10]
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
sub rax, r15
cmp rax, 1
jb 0x14023880e
mov qword [rbp - 0x40], rbx
cmp qword [rbx + 0x18], 8
jb 0x14023820c
mov rax, qword [rbx]
mov qword [rbp - 0x40], rax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rcx
lea r12, [r15 + 1]
mov edi, 7
lea r13, [rsp + 0x50]
lea rsi, [rdi - 8]
cmp r12, rdi
jbe 0x140238267
mov rdi, r12
or rdi, 7
cmp rdi, rdx
jbe 0x14023823e
mov rdi, rdx
jmp 0x14023824a
mov eax, 0xa
cmp rdi, rax
cmovb rdi, rax
mov rdx, rdi
add rdx, 1
cmovb rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.14002bf30
mov r13, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], rdi
mov eax, 0x22
mov word [r13], ax
lea rcx, [r13 + 2]
lea r8, [r15 + r15]
mov rdx, qword [rbp - 0x40]
call fcn.1402b53e0
xor eax, eax
mov word [r13 + r12*2], ax
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
mov rax, r8
sub rax, rdx
cmp rax, 2
jb 0x1402382d8
lea rcx, [rdx + 2]
mov qword [rsp + 0x60], rcx
lea rax, [rsp + 0x50]
cmp r8, 8
cmovae rax, qword [rsp + 0x50]
mov dword [rax + rdx*2], 0x200022
xor r13d, r13d
mov word [rax + rcx*2], r13w
lea rax, [rsp + 0x50]
jmp 0x1402382fc
mov qword [rsp + 0x20], 2
lea r9, [0x14030d168]
xor r8d, r8d
lea edx, [r8 + 2]
lea rcx, [rsp + 0x50]
call fcn.140030e60
xor r13d, r13d
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov r8, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 8
jb 0x140238332
mov r14, qword [r14]
mov rdx, r14
lea rcx, [rsp + 0x70]
call fcn.140030de0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14023839f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14023839a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140238814
call fcn.140296f94
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r13w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1402383f3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1402383ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14023881a
call fcn.140296f94
mov rdi, qword [rbp - 0x28]
inc rdi
mov eax, 2
mul rdi
cmovo rax, rsi
lea rdx, [0x14030f110]
mov rcx, rax
call fcn.1402979b4
mov r14, rax
mov qword [rbp - 0x40], rax
mov r12, qword [rbp - 0x20]
mov r15, qword [rbp - 0x38]
test rax, rax
jne 0x140238457
lea rax, str.Failed_to_allocate_memory_for_cmdLine.
mov qword [rsp + 0x20], rax
lea r9d, [r14 + 0x77]
lea r8, str.XMLUpdater::v2::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.E:BT0a209782_47a3_49ff_a189_59d4c06152f0WebAdvisor_XmlUpdater_srcXmlUpdaterExecuteLocalCommand.cpp
lea ecx, [r14 + 1]
call fcn.140213350
xor bl, bl
jmp 0x140238777
lea rdx, [rbp - 0x38]
cmp r12, 8
cmovae rdx, r15
lea rax, [rdi - 1]
mov r8d, 0x7ffffffe
cmp rax, r8
ja 0x1402384b0
mov rcx, r14
sub r8, rdi
sub rdx, r14
nop dword [rax + rax]
lea rax, [r8 + rdi]
test rax, rax
je 0x14023849f
movzx eax, word [rdx + rcx]
test ax, ax
je 0x14023849f
mov word [rcx], ax
add rcx, 2
sub rdi, 1
jne 0x140238480
lea rax, [rcx - 2]
test rdi, rdi
cmovne rax, rcx
mov word [rax], r13w
jmp 0x1402384b9
test rdi, rdi
je 0x1402384b9
mov word [r14], r13w
mov rax, qword [rbp - 0x70]
cmp qword [rax + 0x18], 8
jb 0x1402384c7
mov rax, qword [rax]
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140238541
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r14
lea rax, str.Unable_to_run__s__error___d_
mov qword [rsp + 0x20], rax
mov r9d, 0x7e
lea r8, str.XMLUpdater::v2::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.E:BT0a209782_47a3_49ff_a189_59d4c06152f0WebAdvisor_XmlUpdater_srcXmlUpdaterExecuteLocalCommand.cpp
lea ecx, [r9 - 0x7d]
call fcn.140213350
xor bl, bl
jmp 0x140238777
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140238572
cmp qword [rbx + 0x18], 8
jb 0x14023855e
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rbx
lea rax, str.Wait_for_process_failed_for_command__s
mov r9d, 0x84
jmp 0x14023859f
mov dword [rbp - 0x60], r13d
lea rdx, [rbp - 0x60]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x1402385c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.Failed_to_get_process_exit_code___d_
mov r9d, 0x8b
mov qword [rsp + 0x20], rax
lea r8, str.XMLUpdater::v2::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.E:BT0a209782_47a3_49ff_a189_59d4c06152f0WebAdvisor_XmlUpdater_srcXmlUpdaterExecuteLocalCommand.cpp
mov ecx, 1
call fcn.140213350
xor bl, bl
jmp 0x140238777
cmp byte [rbp + 0x110], 0
je 0x140238617
cmp qword [rbx + 0x18], 8
jb 0x1402385d6
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140238617
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.Failed_to_delete_executable___d_
mov qword [rsp + 0x20], rax
mov r9d, DllRegisterServer
lea r8, str.XMLUpdater::v2::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.E:BT0a209782_47a3_49ff_a189_59d4c06152f0WebAdvisor_XmlUpdater_srcXmlUpdaterExecuteLocalCommand.cpp
mov ecx, 1
call fcn.140213350
lea r9, [rbp + 0x8a]
mov r8d, dword [rbp - 0x60]
nop dword [rax]
nop word [rax + rax]
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x140238630
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r13w
lea rax, [rbp + 0x8a]
cmp r9, rax
je 0x14023869b
lea r8, [rbp + 0x8a]
sub r8, r9
sar r8, 1
mov rdx, r9
lea rcx, [rsp + 0x50]
call fcn.14002b640
nop
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r13w
mov rdx, qword [0x1403ce850]
inc rsi
cmp word [rdx + rsi*2], 0
jne 0x1402386b4
mov r8, rsi
lea rcx, [rsp + 0x70]
call fcn.14002b640
nop
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x70]
mov rcx, qword [rbp - 0x68]
call fcn.140214cd0
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x140238721
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14023871c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140238820
call fcn.140296f94
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r13w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140238775
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140238770
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140238826
call fcn.140296f94
mov bl, 1
test r14, r14
je 0x140238785
mov rcx, r14
call fcn.140296f94
nop
cmp r12, 8
jb 0x1402387bd
lea rdx, [r12*2 + 2]
mov rax, r15
cmp rdx, 0x1000
jb 0x1402387b4
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140238808
mov rcx, r15
call fcn.140296f94
nop
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x1402387cc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1402387db
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.140296f70
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1402ba3ec
nop
call fcn.14002c880
nop
call fcn.1402ba3ec
nop
call fcn.1402ba3ec
nop
call fcn.1402ba3ec
nop
call fcn.1402ba3ec
int3