Function at 0x1400ed1a0
Capabilities:
Create process on windows
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x14035dc30]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov qword [rbp - 0x70], r9
mov r14, r8
mov rbx, rdx
mov rax, qword [rbp + 0x100]
mov qword [rbp - 0x68], rax
test rax, rax
jne 0x1400ed21a
lea rax, str.invalid_substitutor
mov qword [rsp + 0x20], rax
mov r9d, 0x62
lea r8, str.XMLUpdater::v2::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.E:BT42dac55d_4355_4669_9ab8_31cc00ddc957WebAdvisor_XmlUpdater_srcXmlUpdaterExecuteLocalCommand.cpp
lea ecx, [r9 - 0x61]
call fcn.1400bfe30
xor al, al
jmp 0x1400ed8ca
cmp byte [rbp + 0x118], 0
je 0x1400ed278
mov rcx, rbx
cmp qword [rdx + 0x18], 8
jb 0x1400ed230
mov rcx, qword [rdx]
call fcn.1400ec0c0
test al, al
jne 0x1400ed278
cmp qword [rbx + 0x18], 8
jb 0x1400ed243
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rbx
lea rax, str.Signature_check_failed_for_command__s
mov qword [rsp + 0x20], rax
mov r9d, 0x67
lea r8, str.XMLUpdater::v2::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.E:BT42dac55d_4355_4669_9ab8_31cc00ddc957WebAdvisor_XmlUpdater_srcXmlUpdaterExecuteLocalCommand.cpp
lea ecx, [r9 - 0x66]
call fcn.1400bfe30
xor al, al
jmp 0x1400ed8ca
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rax
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
movups xmmword [rbp + 0x44], xmm0
mov dword [rbp + 0x54], eax
mov dword [rbp - 0x10], 0x68
xor ecx, ecx
cmp byte [rbp + 0x108], al
je 0x1400ed2bc
mov dword [rbp + 0x2c], 1
mov word [rbp + 0x30], cx
mov r15, qword [rbx + 0x10]
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
sub rax, r15
cmp rax, 1
jb 0x1400ed8fa
mov qword [rbp - 0x40], rbx
cmp qword [rbx + 0x18], 8
jb 0x1400ed2ec
mov rax, qword [rbx]
mov qword [rbp - 0x40], rax
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rcx
lea r13, [r15 + 1]
mov edi, 7
lea r12, [rsp + 0x50]
lea rsi, [rdi - 8]
cmp r13, rdi
jbe 0x1400ed34c
mov rdi, r13
or rdi, 7
cmp rdi, rdx
jbe 0x1400ed323
mov rdi, rdx
jmp 0x1400ed32f
mov eax, 0xa
cmp rdi, rax
cmovb rdi, rax
mov rdx, rdi
add rdx, 1
cmovb rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140026230
mov r12, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], rdi
mov eax, 0x22
mov word [r12], ax
lea rcx, [r12 + 2]
lea r8, [r15 + r15]
mov rdx, qword [rbp - 0x40]
call fcn.14026bb50
xor eax, eax
mov word [r12 + r13*2], ax
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
mov rax, r8
sub rax, rdx
cmp rax, 2
jb 0x1400ed3bd
lea rcx, [rdx + 2]
mov qword [rsp + 0x60], rcx
lea rax, [rsp + 0x50]
cmp r8, 8
cmovae rax, qword [rsp + 0x50]
mov dword [rax + rdx*2], 0x200022
xor r13d, r13d
mov word [rax + rcx*2], r13w
lea rax, [rsp + 0x50]
jmp 0x1400ed3e1
mov qword [rsp + 0x20], 2
lea r9, [0x1402be450]
xor r8d, r8d
lea edx, [r8 + 2]
lea rcx, [rsp + 0x50]
call fcn.1400325d0
xor r13d, r13d
mov qword [rsp + 0x70], r13
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov r8, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 8
jb 0x1400ed41c
mov r14, qword [r14]
mov rdx, r14
lea rcx, [rsp + 0x70]
call fcn.140032240
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x1400ed489
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ed484
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ed900
call fcn.140269844
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r13w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1400ed4dd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ed4d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ed906
call fcn.140269844
mov rdi, qword [rbp - 0x28]
inc rdi
mov eax, 2
mul rdi
cmovo rax, rsi
lea rdx, [0x1402e7374]
mov rcx, rax
call fcn.14026a000
mov r14, rax
mov qword [rbp - 0x40], rax
mov r12, qword [rbp - 0x20]
mov r15, qword [rbp - 0x38]
test rax, rax
jne 0x1400ed541
lea rax, str.Failed_to_allocate_memory_for_cmdLine.
mov qword [rsp + 0x20], rax
lea r9d, [r14 + 0x77]
lea r8, str.XMLUpdater::v2::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.E:BT42dac55d_4355_4669_9ab8_31cc00ddc957WebAdvisor_XmlUpdater_srcXmlUpdaterExecuteLocalCommand.cpp
lea ecx, [r14 + 1]
call fcn.1400bfe30
xor bl, bl
jmp 0x1400ed863
lea rdx, [rbp - 0x38]
cmp r12, 8
cmovae rdx, r15
lea rax, [rdi - 1]
mov r8d, 0x7ffffffe
cmp rax, r8
ja 0x1400ed595
mov rcx, r14
sub r8, rdi
sub rdx, r14
lea rax, [r8 + rdi]
test rax, rax
je 0x1400ed584
movzx eax, word [rdx + rcx]
test ax, ax
je 0x1400ed584
mov word [rcx], ax
add rcx, 2
sub rdi, 1
jne 0x1400ed565
lea rax, [rcx - 2]
test rdi, rdi
cmovne rax, rcx
mov word [rax], r13w
jmp 0x1400ed59e
test rdi, rdi
je 0x1400ed59e
mov word [r14], r13w
mov rax, qword [rbp - 0x70]
cmp qword [rax + 0x18], 8
jb 0x1400ed5ac
mov rax, qword [rax]
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400ed626
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r14
lea rax, str.Unable_to_run__s__error___d_
mov qword [rsp + 0x20], rax
mov r9d, 0x7e
lea r8, str.XMLUpdater::v2::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.E:BT42dac55d_4355_4669_9ab8_31cc00ddc957WebAdvisor_XmlUpdater_srcXmlUpdaterExecuteLocalCommand.cpp
lea ecx, [r9 - 0x7d]
call fcn.1400bfe30
xor bl, bl
jmp 0x1400ed863
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400ed657
cmp qword [rbx + 0x18], 8
jb 0x1400ed643
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rbx
lea rax, str.Wait_for_process_failed_for_command__s
mov r9d, 0x84
jmp 0x1400ed684
mov dword [rbp - 0x60], r13d
lea rdx, [rbp - 0x60]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x1400ed6a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.Failed_to_get_process_exit_code___d_
mov r9d, 0x8b
mov qword [rsp + 0x20], rax
lea r8, str.XMLUpdater::v2::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.E:BT42dac55d_4355_4669_9ab8_31cc00ddc957WebAdvisor_XmlUpdater_srcXmlUpdaterExecuteLocalCommand.cpp
mov ecx, 1
call fcn.1400bfe30
xor bl, bl
jmp 0x1400ed863
cmp byte [rbp + 0x110], 0
je 0x1400ed6fc
cmp qword [rbx + 0x18], 8
jb 0x1400ed6bb
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400ed6fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.Failed_to_delete_executable___d_
mov qword [rsp + 0x20], rax
mov r9d, 0x93
lea r8, str.XMLUpdater::v2::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.E:BT42dac55d_4355_4669_9ab8_31cc00ddc957WebAdvisor_XmlUpdater_srcXmlUpdaterExecuteLocalCommand.cpp
mov ecx, 1
call fcn.1400bfe30
lea r9, [rbp + 0x8a]
mov r8d, dword [rbp - 0x60]
nop word [rax + rax]
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x1400ed710
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r13w
lea rax, [rbp + 0x8a]
cmp r9, rax
je 0x1400ed780
lea r8, [rbp + 0x8a]
sub r8, r9
sar r8, 1
mov rdx, r9
lea rcx, [rsp + 0x50]
call fcn.140025e70
nop
mov qword [rsp + 0x70], r13
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r13w
mov rdx, qword [0x14035a958]
nop
inc rsi
cmp word [rdx + rsi*2], 0
jne 0x1400ed7a0
mov r8, rsi
lea rcx, [rsp + 0x70]
call fcn.140025e70
nop
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x70]
mov rcx, qword [rbp - 0x68]
call fcn.1400c19c0
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x1400ed80d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ed808
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ed90c
call fcn.140269844
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r13w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1400ed861
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ed85c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ed912
call fcn.140269844
mov bl, 1
test r14, r14
je 0x1400ed871
mov rcx, r14
call fcn.140269844
nop
cmp r12, 8
jb 0x1400ed8a9
lea rdx, [r12*2 + 2]
mov rax, r15
cmp rdx, 0x1000
jb 0x1400ed8a0
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ed8f4
mov rcx, r15
call fcn.140269844
nop
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x1400ed8b8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1400ed8c7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.140269300
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140277ff8
nop
call fcn.1400255b0
nop
call fcn.140277ff8
nop
call fcn.140277ff8
nop
call fcn.140277ff8
nop
call fcn.140277ff8
int3