Function at 0x140088420
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x240
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1402120d8]
xor rax, rsp
mov qword [rbp + 0x130], rax
cmp qword [rcx + 0x10], 0
je 0x140088f16
movdqa xmm0, xmmword [0x1401e37a0]
movdqu xmmword [rbp + 0x60], xmm0
mov byte [rbp + 0x50], 0
movdqu xmmword [rbp + 0x120], xmm0
mov byte [rbp + 0x110], 0
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], 0
movdqu xmmword [rbp + 0x20], xmm0
mov byte [rbp + 0x10], 0
xor r13d, r13d
mov r12d, r13d
mov qword [rbp + 0xc0], r13
mov qword [rbp + 0xc8], reloc.WSOCK32.dll_ntohs
mov byte [rbp + 0xb0], r12b
mov rdx, rcx
lea rcx, [rbp + 0xf0]
call fcn.140089df0
nop
lea rcx, [rbp + 0xf0]
cmp qword [rbp + 0x108], 8
cmovae rcx, qword [rbp + 0xf0]
lea rdx, [0x1401dd688]
call fcn.14017f744
mov r15, rax
test rax, rax
je 0x140088b4a
xor edx, edx
lea r8d, [r13 + 2]
mov rcx, rax
call fcn.140180c8c
mov rcx, r15
call fcn.14018133c
lea ebx, [rax + 1]
movsxd rdi, ebx
mov rcx, rdi
call fcn.140157908
mov r14, rax
test rax, rax
je 0x140088b42
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.140175ab0
xor r8d, r8d
xor edx, edx
mov rcx, r15
call fcn.140180c8c
mov r8, r15
mov edx, ebx
mov rcx, r14
call fcn.140181410
test rax, rax
je 0x140088b3a
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], rax
movdqa xmm0, xmmword [0x1401e37a0]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], al
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [r14 + r8], al
jne 0x1400885a0
mov rdx, r14
lea rcx, [rsp + 0x40]
call fcn.140050e90
nop
lea rax, vtable.neb::CJsonObject.0
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], r13
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], reloc.WSOCK32.dll_ntohs
mov byte [rbp - 0x48], 0
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], r13
mov ecx, Ordinal_50
call fcn.140157540
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
mov ecx, 0x48
call fcn.140157540
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp - 0x10], rax
mov rcx, qword [rbp - 0x28]
mov qword [rbp - 0x18], rcx
mov qword [rbp], rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x70]
call fcn.14008f5b0
nop
lea rcx, [rsp + 0x40]
call fcn.140050e10
movdqa xmm0, xmmword [0x1401e37a0]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov r8d, 7
lea rdx, str.ok_path
lea rcx, [rsp + 0x68]
call fcn.140050e90
nop
mov rbx, qword [rbp - 0x68]
test rbx, rbx
je 0x1400886ca
cmp dword [rbx + 0x18], 7
jne 0x140088734
lea rsi, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rsi, qword [rsp + 0x68]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x140088734
mov rdx, rsi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x14008870a
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400886b0
jmp 0x14008870a
mov rbx, qword [rbp - 0x60]
test rbx, rbx
je 0x140088734
cmp dword [rbx + 0x18], 7
jne 0x140088734
lea rsi, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rsi, qword [rsp + 0x68]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x140088734
mov rdx, rsi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x14008870a
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400886f2
test rbx, rbx
je 0x140088734
cmp dword [rbx + 0x18], 5
jne 0x140088734
mov rdx, qword [rbx + 0x20]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140088720
lea rcx, [rbp + 0x50]
call fcn.140050e90
nop
lea rcx, [rsp + 0x68]
call fcn.140050e10
movdqa xmm0, xmmword [0x1401e37a0]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov r8d, 7
lea rdx, str.version
lea rcx, [rsp + 0x68]
call fcn.140050e90
nop
mov rbx, qword [rbp - 0x68]
test rbx, rbx
je 0x1400887ba
cmp dword [rbx + 0x18], 7
jne 0x140088827
lea rsi, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rsi, qword [rsp + 0x68]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x140088827
nop dword [rax]
mov rdx, rsi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x1400887fa
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400887a0
jmp 0x1400887fa
mov rbx, qword [rbp - 0x60]
test rbx, rbx
je 0x140088827
cmp dword [rbx + 0x18], 7
jne 0x140088827
lea rsi, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rsi, qword [rsp + 0x68]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x140088827
mov rdx, rsi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x1400887fa
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400887e2
test rbx, rbx
je 0x140088827
cmp dword [rbx + 0x18], 5
jne 0x140088827
mov rdx, qword [rbx + 0x20]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140088810
lea rcx, [rbp + 0x110]
call fcn.140050e90
nop
lea rcx, [rsp + 0x68]
call fcn.140050e10
movdqa xmm0, xmmword [0x1401e37a0]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov r8d, 8
lea rdx, str.is_force
lea rcx, [rsp + 0x68]
call fcn.140050e90
nop
mov rbx, qword [rbp - 0x68]
test rbx, rbx
je 0x1400888aa
cmp dword [rbx + 0x18], 7
jne 0x140088914
lea rsi, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rsi, qword [rsp + 0x68]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x140088914
nop dword [rax]
mov rdx, rsi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x1400888ea
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140088890
jmp 0x1400888ea
mov rbx, qword [rbp - 0x60]
test rbx, rbx
je 0x140088914
cmp dword [rbx + 0x18], 7
jne 0x140088914
lea rsi, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rsi, qword [rsp + 0x68]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x140088914
mov rdx, rsi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x1400888ea
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400888d2
test rbx, rbx
je 0x140088914
cmp dword [rbx + 0x18], 5
jne 0x140088914
mov rdx, qword [rbx + 0x20]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140088900
lea rcx, [rbp + 0x30]
call fcn.140050e90
nop
lea rcx, [rsp + 0x68]
call fcn.140050e10
movdqa xmm0, xmmword [0x1401e37a0]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov r8d, 0xa
lea rdx, str.is_silence
lea rcx, [rsp + 0x68]
call fcn.140050e90
nop
mov rbx, qword [rbp - 0x68]
test rbx, rbx
je 0x14008899a
cmp dword [rbx + 0x18], 7
jne 0x140088a04
lea rsi, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rsi, qword [rsp + 0x68]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x140088a04
nop dword [rax]
mov rdx, rsi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x1400889da
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140088980
jmp 0x1400889da
mov rbx, qword [rbp - 0x60]
test rbx, rbx
je 0x140088a04
cmp dword [rbx + 0x18], 7
jne 0x140088a04
lea rsi, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rsi, qword [rsp + 0x68]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x140088a04
mov rdx, rsi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x1400889da
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400889c2
test rbx, rbx
je 0x140088a04
cmp dword [rbx + 0x18], 5
jne 0x140088a04
mov rdx, qword [rbx + 0x20]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400889f0
lea rcx, [rbp + 0x10]
call fcn.140050e90
nop
lea rcx, [rsp + 0x68]
call fcn.140050e10
movdqa xmm0, xmmword [0x1401e37a0]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov r8d, 9
lea rdx, str.patch_url
lea rcx, [rsp + 0x68]
call fcn.140050e90
nop
mov rbx, qword [rbp - 0x68]
test rbx, rbx
je 0x140088a8a
cmp dword [rbx + 0x18], 7
jne 0x140088aff
lea rsi, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rsi, qword [rsp + 0x68]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x140088aff
nop dword [rax]
mov rdx, rsi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x140088aca
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140088a70
jmp 0x140088aca
mov rbx, qword [rbp - 0x60]
test rbx, rbx
je 0x140088aff
cmp dword [rbx + 0x18], 7
jne 0x140088aff
lea rsi, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rsi, qword [rsp + 0x68]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x140088aff
mov rdx, rsi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x140088aca
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140088ab2
test rbx, rbx
je 0x140088aff
cmp dword [rbx + 0x18], 5
jne 0x140088aff
mov rdx, qword [rbx + 0x20]
nop dword [rax]
inc rdi
cmp byte [rdx + rdi], 0
jne 0x140088ae0
mov r8, rdi
lea rcx, [rbp + 0xb0]
call fcn.140050e90
mov r12, qword [rbp + 0xc0]
lea rcx, [rsp + 0x68]
call fcn.140050e10
nop
lea rax, vtable.neb::CJsonObject.0
mov qword [rbp - 0x70], rax
lea rcx, [rbp - 0x70]
call fcn.14008f6f0
lea rcx, [rbp - 0x10]
call fcn.140058c60
lea rcx, [rbp - 0x28]
call fcn.140090a00
lea rcx, [rbp - 0x48]
call fcn.140050e10
nop
mov rcx, r14
call fcn.14015757c
mov rcx, r15
call fcn.14017f550
lea rcx, [rbp + 0x70]
call fcn.14008b390
nop
lea rdx, [rbp + 0x70]
lea rcx, [rsp + 0x68]
call fcn.140089df0
mov rbx, rax
movdqa xmm0, xmmword [0x1401e3790]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r13w
mov r8d, 0xa
lea rdx, str.OldVersion
lea rcx, [rsp + 0x40]
call fcn.1400550f0
mov r8, rbx
mov edx, 1
lea rcx, [rsp + 0x40]
call fcn.14008cd20
movzx ebx, al
lea rcx, [rsp + 0x40]
call fcn.140050da0
nop
lea rcx, [rsp + 0x68]
call fcn.140050da0
test bl, bl
jne 0x140088c04
mov rax, qword [0x14021d9a8]
test rax, rax
je 0x140088c04
mov rax, qword [rax]
mov rdi, qword [rax]
lea rbx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae rbx, qword [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov qword [rsp + 0x20], rbx
mov r9d, eax
lea r8, str._ERROR___d___upgrade__write_old_version__s__failed.
mov edx, 1
mov rcx, qword [0x14021d9a8]
call rdi
call fcn.140073c40
mov r10, rax
test r12, r12
sete dl
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
cmp qword [rbp + 0x20], 1
jne 0x140088c3e
cmp byte [rcx], 0x31
jne 0x140088c31
mov eax, r13d
jmp 0x140088c36
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140088c3e
mov cl, 1
jmp 0x140088c40
xor cl, cl
lea rax, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rax, qword [rbp + 0x30]
cmp qword [rbp + 0x40], 1
jne 0x140088c6d
cmp byte [rax], 0x31
jne 0x140088c5f
mov eax, r13d
jmp 0x140088c64
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140088c6d
mov r9b, 1
jmp 0x140088c70
xor r9b, r9b
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], dl
mov byte [rsp + 0x20], cl
lea r8, [rbp + 0x110]
lea rdx, [rbp + 0x70]
mov rcx, r10
call fcn.140075350
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, str..PipeEA2F5A1F_7EEB_4333_9727_C5DE84FC08C2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140088d09
mov rax, qword [0x14021d9a8]
test rax, rax
je 0x140088de8
mov rax, qword [rax]
mov rdi, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x20], ebx
mov r9d, eax
lea r8, str._WARN___d___create_pipe_failed._err__d_.
lea edx, [rsi + 3]
mov rcx, qword [0x14021d9a8]
call rdi
jmp 0x140088de8
mov dword [rbp - 0x78], r13d
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], reloc.WSOCK32.dll_ntohs
mov byte [rsp + 0x68], 0
mov r8d, 4
lea rdx, str.stop
lea rcx, [rsp + 0x68]
call fcn.140050e90
nop
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rdx, qword [rsp + 0x68]
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x78]
mov r8d, dword [rsp + 0x78]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
mov rax, qword [0x14021d9a8]
je 0x140088d9f
test rax, rax
je 0x140088d92
mov rax, qword [rax]
mov rbx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
lea r8, str._INFO___d___write_data_to_pipe.
mov edx, 3
mov rcx, qword [0x14021d9a8]
call rbx
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140088dd4
test rax, rax
je 0x140088dd4
mov rax, qword [rax]
mov rdi, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x20], ebx
mov r9d, eax
lea r8, str._ERROR___d___write_pipe_failed._err__d_.
mov edx, 1
mov rcx, qword [0x14021d9a8]
call rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x68]
call fcn.140050e10
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x90]
call fcn.140089df0
nop
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0xd0]
call fcn.140089ef0
nop
lea rax, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 8
cmovae rax, qword [rbp + 0xd0]
lea r8, [rbp + 0x90]
cmp qword [rbp + 0xa8], 8
cmovae r8, qword [rbp + 0x90]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
lea r9, str._VERYSILENT__SILENTUPGRADE
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov r14, rax
mov rcx, qword [0x14021d9a8]
test rcx, rcx
je 0x140088eae
mov rcx, qword [rcx]
mov rsi, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdi, [rbp + 0x50]
cmp qword [rbp + 0x68], 0x10
cmovae rdi, qword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rdi
mov r9d, eax
lea r8, str._INFO___d___upgrade__install_path__s___result__d___err__d_.
mov edx, 3
mov rcx, qword [0x14021d9a8]
call rsi
nop
lea rcx, [rbp + 0xd0]
call fcn.140050da0
nop
lea rcx, [rbp + 0x90]
call fcn.140050da0
nop
lea rcx, [rbp + 0x70]
call fcn.140050e10
nop
lea rcx, [rbp + 0xf0]
call fcn.140050da0
nop
lea rcx, [rbp + 0xb0]
call fcn.140050e10
nop
lea rcx, [rbp + 0x10]
call fcn.140050e10
nop
lea rcx, [rbp + 0x30]
call fcn.140050e10
nop
lea rcx, [rbp + 0x110]
call fcn.140050e10
nop
lea rcx, [rbp + 0x50]
call fcn.140050e10
mov al, 1
mov rcx, qword [rbp + 0x130]
xor rcx, rsp
call fcn.1401571e0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret