Function at 0x1400f9100
Capabilities:
Create process on windows
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x14039bc30]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov qword [rbp - 0x70], r9
mov r14, r8
mov rbx, rdx
mov rax, qword [rbp + 0x100]
mov qword [rbp - 0x68], rax
test rax, rax
jne 0x1400f917a
lea rax, str.invalid_substitutor
mov qword [rsp + 0x20], rax
mov r9d, 0x62
lea r8, str.XMLUpdater::v2::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.E:BT71e4c9fa_1978_4386_a3da_49ea31fa22b7WebAdvisor_XmlUpdater_srcXmlUpdaterExecuteLocalCommand.cpp
lea ecx, [r9 - 0x61]
call fcn.1400da630
xor al, al
jmp 0x1400f982a
cmp byte [rbp + 0x118], 0
je 0x1400f91d8
mov rcx, rbx
cmp qword [rdx + 0x18], 8
jb 0x1400f9190
mov rcx, qword [rdx]
call fcn.1400f74d0
test al, al
jne 0x1400f91d8
cmp qword [rbx + 0x18], 8
jb 0x1400f91a3
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rbx
lea rax, str.Signature_check_failed_for_command__s
mov qword [rsp + 0x20], rax
mov r9d, 0x67
lea r8, str.XMLUpdater::v2::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.E:BT71e4c9fa_1978_4386_a3da_49ea31fa22b7WebAdvisor_XmlUpdater_srcXmlUpdaterExecuteLocalCommand.cpp
lea ecx, [r9 - 0x66]
call fcn.1400da630
xor al, al
jmp 0x1400f982a
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rax
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
movups xmmword [rbp + 0x44], xmm0
mov dword [rbp + 0x54], eax
mov dword [rbp - 0x10], 0x68
xor ecx, ecx
cmp byte [rbp + 0x108], al
je 0x1400f921c
mov dword [rbp + 0x2c], 1
mov word [rbp + 0x30], cx
mov r15, qword [rbx + 0x10]
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
sub rax, r15
cmp rax, 1
jb 0x1400f985a
mov qword [rbp - 0x40], rbx
cmp qword [rbx + 0x18], 8
jb 0x1400f924c
mov rax, qword [rbx]
mov qword [rbp - 0x40], rax
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rcx
lea r13, [r15 + 1]
mov edi, 7
lea r12, [rsp + 0x50]
lea rsi, [rdi - 8]
cmp r13, rdi
jbe 0x1400f92ac
mov rdi, r13
or rdi, 7
cmp rdi, rdx
jbe 0x1400f9283
mov rdi, rdx
jmp 0x1400f928f
mov eax, 0xa
cmp rdi, rax
cmovb rdi, rax
mov rdx, rdi
add rdx, 1
cmovb rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140033890
mov r12, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], rdi
mov eax, 0x22
mov word [r12], ax
lea rcx, [r12 + 2]
lea r8, [r15 + r15]
mov rdx, qword [rbp - 0x40]
call fcn.14013d0f0
xor eax, eax
mov word [r12 + r13*2], ax
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
mov rax, r8
sub rax, rdx
cmp rax, 2
jb 0x1400f931d
lea rcx, [rdx + 2]
mov qword [rsp + 0x60], rcx
lea rax, [rsp + 0x50]
cmp r8, 8
cmovae rax, qword [rsp + 0x50]
mov dword [rax + rdx*2], 0x200022
xor r13d, r13d
mov word [rax + rcx*2], r13w
lea rax, [rsp + 0x50]
jmp 0x1400f9341
mov qword [rsp + 0x20], 2
lea r9, [0x1402ee008]
xor r8d, r8d
lea edx, [r8 + 2]
lea rcx, [rsp + 0x50]
call fcn.1400322e0
xor r13d, r13d
mov qword [rsp + 0x70], r13
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov r8, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 8
jb 0x1400f937c
mov r14, qword [r14]
mov rdx, r14
lea rcx, [rsp + 0x70]
call fcn.140032440
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x1400f93e9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f93e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400f9860
call fcn.14013afa0
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r13w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1400f943d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f9438
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400f9866
call fcn.14013afa0
mov rdi, qword [rbp - 0x28]
inc rdi
mov eax, 2
mul rdi
cmovo rax, rsi
lea rdx, [0x1402fcee0]
mov rcx, rax
call fcn.14013b758
mov r14, rax
mov qword [rbp - 0x40], rax
mov r12, qword [rbp - 0x20]
mov r15, qword [rbp - 0x38]
test rax, rax
jne 0x1400f94a1
lea rax, str.Failed_to_allocate_memory_for_cmdLine.
mov qword [rsp + 0x20], rax
lea r9d, [r14 + 0x77]
lea r8, str.XMLUpdater::v2::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.E:BT71e4c9fa_1978_4386_a3da_49ea31fa22b7WebAdvisor_XmlUpdater_srcXmlUpdaterExecuteLocalCommand.cpp
lea ecx, [r14 + 1]
call fcn.1400da630
xor bl, bl
jmp 0x1400f97c3
lea rdx, [rbp - 0x38]
cmp r12, 8
cmovae rdx, r15
lea rax, [rdi - 1]
mov r8d, 0x7ffffffe
cmp rax, r8
ja 0x1400f94f5
mov rcx, r14
sub r8, rdi
sub rdx, r14
lea rax, [r8 + rdi]
test rax, rax
je 0x1400f94e4
movzx eax, word [rdx + rcx]
test ax, ax
je 0x1400f94e4
mov word [rcx], ax
add rcx, 2
sub rdi, 1
jne 0x1400f94c5
lea rax, [rcx - 2]
test rdi, rdi
cmovne rax, rcx
mov word [rax], r13w
jmp 0x1400f94fe
test rdi, rdi
je 0x1400f94fe
mov word [r14], r13w
mov rax, qword [rbp - 0x70]
cmp qword [rax + 0x18], 8
jb 0x1400f950c
mov rax, qword [rax]
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400f9586
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r14
lea rax, str.Unable_to_run__s__error___d_
mov qword [rsp + 0x20], rax
mov r9d, 0x7e
lea r8, str.XMLUpdater::v2::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.E:BT71e4c9fa_1978_4386_a3da_49ea31fa22b7WebAdvisor_XmlUpdater_srcXmlUpdaterExecuteLocalCommand.cpp
lea ecx, [r9 - 0x7d]
call fcn.1400da630
xor bl, bl
jmp 0x1400f97c3
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400f95b7
cmp qword [rbx + 0x18], 8
jb 0x1400f95a3
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rbx
lea rax, str.Wait_for_process_failed_for_command__s
mov r9d, 0x84
jmp 0x1400f95e4
mov dword [rbp - 0x60], r13d
lea rdx, [rbp - 0x60]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x1400f9608
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.Failed_to_get_process_exit_code___d_
mov r9d, 0x8b
mov qword [rsp + 0x20], rax
lea r8, str.XMLUpdater::v2::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.E:BT71e4c9fa_1978_4386_a3da_49ea31fa22b7WebAdvisor_XmlUpdater_srcXmlUpdaterExecuteLocalCommand.cpp
mov ecx, 1
call fcn.1400da630
xor bl, bl
jmp 0x1400f97c3
cmp byte [rbp + 0x110], 0
je 0x1400f965c
cmp qword [rbx + 0x18], 8
jb 0x1400f961b
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400f965c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.Failed_to_delete_executable___d_
mov qword [rsp + 0x20], rax
mov r9d, 0x93
lea r8, str.XMLUpdater::v2::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.E:BT71e4c9fa_1978_4386_a3da_49ea31fa22b7WebAdvisor_XmlUpdater_srcXmlUpdaterExecuteLocalCommand.cpp
mov ecx, 1
call fcn.1400da630
lea r9, [rbp + 0x8a]
mov r8d, dword [rbp - 0x60]
nop word [rax + rax]
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x1400f9670
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r13w
lea rax, [rbp + 0x8a]
cmp r9, rax
je 0x1400f96e0
lea r8, [rbp + 0x8a]
sub r8, r9
sar r8, 1
mov rdx, r9
lea rcx, [rsp + 0x50]
call fcn.140032810
nop
mov qword [rsp + 0x70], r13
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r13w
mov rdx, qword [0x14039b900]
nop
inc rsi
cmp word [rdx + rsi*2], 0
jne 0x1400f9700
mov r8, rsi
lea rcx, [rsp + 0x70]
call fcn.140032810
nop
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x70]
mov rcx, qword [rbp - 0x68]
call fcn.1400c9470
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x1400f976d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f9768
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400f986c
call fcn.14013afa0
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r13w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1400f97c1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f97bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400f9872
call fcn.14013afa0
mov bl, 1
test r14, r14
je 0x1400f97d1
mov rcx, r14
call fcn.14013afa0
nop
cmp r12, 8
jb 0x1400f9809
lea rdx, [r12*2 + 2]
mov rax, r15
cmp rdx, 0x1000
jb 0x1400f9800
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400f9854
mov rcx, r15
call fcn.14013afa0
nop
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x1400f9818
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1400f9827
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.14013af80
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1401421d8
nop
call fcn.140026750
nop
call fcn.1401421d8
nop
call fcn.1401421d8
nop
call fcn.1401421d8
nop
call fcn.1401421d8
int3