Function at 0x1400fe150
Capabilities:
Create process on windows
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2f0]
sub rsp, 0x3f0
mov rax, qword [0x140214ba0]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
mov qword [rbp - 0x48], r9
mov r14, r8
mov rbx, rdx
mov rax, qword [rbp + 0x350]
mov qword [rbp - 0x40], rax
test rax, rax
jne 0x1400fe1ca
lea rax, str.invalid_substitutor
mov qword [rsp + 0x20], rax
mov r9d, 0x62
lea r8, str.NWebAdvisor::NXmlUpdater::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.c:jenkinsworkspacemer_WebAdvisor_XMLUpdater_master_srcXmlUpdaterExecuteLocalCommand.cpp
lea ecx, [r9 - 0x61]
call fcn.1400ebbc0
xor al, al
jmp 0x1400fe855
cmp byte [rbp + 0x368], 0
je 0x1400fe242
mov rcx, rbx
cmp qword [rdx + 0x18], 8
jb 0x1400fe1e0
mov rcx, qword [rdx]
mov r8, qword [0x140223ed0]
test r8, r8
je 0x1400fe1fa
mov rax, qword [r8]
mov rdx, rcx
mov rcx, r8
call qword [rax + VariantCopy]
jmp 0x1400fe1ff
call fcn.14010c7f0
test al, al
jne 0x1400fe242
cmp qword [rbx + 0x18], 8
jb 0x1400fe20d
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rbx
lea rax, str.Signature_check_failed_for_command__s
mov qword [rsp + 0x20], rax
mov r9d, 0x67
lea r8, str.NWebAdvisor::NXmlUpdater::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.c:jenkinsworkspacemer_WebAdvisor_XMLUpdater_master_srcXmlUpdaterExecuteLocalCommand.cpp
lea ecx, [r9 - 0x66]
call fcn.1400ebbc0
xor al, al
jmp 0x1400fe855
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], rax
movups xmmword [rbp + 0x34], xmm0
movups xmmword [rbp + 0x44], xmm0
movups xmmword [rbp + 0x54], xmm0
movups xmmword [rbp + 0x64], xmm0
movups xmmword [rbp + 0x74], xmm0
movups xmmword [rbp + 0x84], xmm0
mov dword [rbp + 0x94], eax
mov dword [rbp + 0x30], 0x68
xor ecx, ecx
cmp byte [rbp + 0x358], al
je 0x1400fe28c
mov dword [rbp + 0x6c], 1
mov word [rbp + 0x70], cx
mov r15, qword [rbx + 0x10]
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
sub rax, r15
cmp rax, 1
jb 0x1400fe885
mov qword [rsp + 0x70], rbx
cmp qword [rbx + 0x18], 8
jb 0x1400fe2be
mov rax, qword [rbx]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rcx
lea r13, [r15 + 1]
mov esi, 7
lea r12, [rsp + 0x50]
lea rdi, [rsi - 8]
cmp r13, rsi
jbe 0x1400fe31e
mov rsi, r13
or rsi, 7
cmp rsi, rdx
jbe 0x1400fe2f5
mov rsi, rdx
jmp 0x1400fe301
mov eax, 0xa
cmp rsi, rax
cmovb rsi, rax
mov rdx, rsi
add rdx, 1
cmovb rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.140026380
mov r12, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], rsi
mov eax, 0x22
mov word [r12], ax
lea rcx, [r12 + 2]
lea r8, [r15 + r15]
mov rdx, qword [rsp + 0x70]
call fcn.140152550
xor r15d, r15d
mov word [r12 + r13*2], r15w
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
mov rax, r8
sub rax, rdx
cmp rax, 2
jb 0x1400fe38e
lea rcx, [rdx + 2]
mov qword [rsp + 0x60], rcx
lea rax, [rsp + 0x50]
cmp r8, 8
cmovae rax, qword [rsp + 0x50]
mov dword [rax + rdx*2], 0x200022
mov word [rax + rcx*2], r15w
lea rax, [rsp + 0x50]
jmp 0x1400fe3af
mov qword [rsp + 0x20], 2
lea r9, [0x1401cc23c]
xor r8d, r8d
lea edx, [r8 + 2]
lea rcx, [rsp + 0x50]
call fcn.140024050
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov r8, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 8
jb 0x1400fe3ea
mov r14, qword [r14]
mov rdx, r14
lea rcx, [rsp + 0x78]
call fcn.1400237f0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x18], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x1400fe457
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fe452
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fe88b
call fcn.14014f900
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r15w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1400fe4ab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fe4a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fe891
call fcn.14014f900
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r15w
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xd0]
call fcn.140152110
lea r8, [rbp + 8]
mov rsi, qword [rbp + 8]
mov r14, qword [rbp + 0x20]
cmp r14, 8
cmovae r8, rsi
mov edx, 0x104
lea rcx, [rbp + 0xd0]
lea rax, [rbp + 0xd0]
sub r8, rax
nop dword [rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x1400fe523
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1400fe523
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400fe500
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r15w
mov rax, qword [rbp - 0x48]
cmp qword [rax + 0x18], 8
jb 0x1400fe540
mov rax, qword [rax]
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x30]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0xd0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400fe5c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x28], rax
lea rax, str.Unable_to_run__s__error___d_
mov qword [rsp + 0x20], rax
mov r9d, 0x79
lea r8, str.NWebAdvisor::NXmlUpdater::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.c:jenkinsworkspacemer_WebAdvisor_XMLUpdater_master_srcXmlUpdaterExecuteLocalCommand.cpp
lea ecx, [r9 - 0x78]
call fcn.1400ebbc0
xor bl, bl
jmp 0x1400fe7fc
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400fe5f6
cmp qword [rbx + 0x18], 8
jb 0x1400fe5e2
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rbx
lea rax, str.Wait_for_process_failed_for_command__s
mov r9d, 0x7f
jmp 0x1400fe623
mov dword [rbp - 0x18], r15d
lea rdx, [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x1400fe647
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.Failed_to_get_process_exit_code___d_
mov r9d, 0x86
mov qword [rsp + 0x20], rax
lea r8, str.NWebAdvisor::NXmlUpdater::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.c:jenkinsworkspacemer_WebAdvisor_XMLUpdater_master_srcXmlUpdaterExecuteLocalCommand.cpp
mov ecx, 1
call fcn.1400ebbc0
xor bl, bl
jmp 0x1400fe7fc
cmp byte [rbp + 0x360], 0
je 0x1400fe69b
cmp qword [rbx + 0x18], 8
jb 0x1400fe65a
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400fe69b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.Failed_to_delete_executable___d_
mov qword [rsp + 0x20], rax
mov r9d, 0x8e
lea r8, str.NWebAdvisor::NXmlUpdater::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.c:jenkinsworkspacemer_WebAdvisor_XMLUpdater_master_srcXmlUpdaterExecuteLocalCommand.cpp
mov ecx, 1
call fcn.1400ebbc0
lea r9, [rbp + 0xca]
mov r8d, dword [rbp - 0x18]
nop word [rax + rax]
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x1400fe6b0
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x20], 7
mov word [rbp - 0x38], r15w
lea rax, [rbp + 0xca]
cmp r9, rax
je 0x1400fe71b
lea r8, [rbp + 0xca]
sub r8, r9
sar r8, 1
mov rdx, r9
lea rcx, [rbp - 0x38]
call fcn.1400260f0
nop
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r15w
mov rdx, qword [0x140214788]
nop word [rax + rax]
inc rdi
cmp word [rdx + rdi*2], 0
jne 0x1400fe740
mov r8, rdi
lea rcx, [rbp - 0x68]
call fcn.1400260f0
nop
lea r8, [rbp - 0x38]
lea rdx, [rbp - 0x68]
mov rcx, qword [rbp - 0x40]
call fcn.1400e42f0
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x1400fe7a9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fe7a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fe897
call fcn.14014f900
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r15w
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x1400fe7fa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fe7f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fe89d
call fcn.14014f900
mov bl, 1
cmp r14, 8
jb 0x1400fe834
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400fe82b
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fe87f
mov rcx, rsi
call fcn.14014f900
nop
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x1400fe843
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400fe852
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.14014f8e0
mov rbx, qword [rsp + 0x430]
add rsp, 0x3f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140156b00
nop
call fcn.140020840
nop
call fcn.140156b00
nop
call fcn.140156b00
nop
call fcn.140156b00
nop
call fcn.140156b00
int3