Function at 0x1400044b0
Capabilities:
Delete file
Enumerate process modules
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1120]
mov eax, 0x1220
call fcn.14002b890
sub rsp, rax
mov rax, qword [0x14006cfd8]
xor rax, rsp
mov qword [rbp + 0x1110], rax
xor esi, esi
lea r8, str.APPDATA
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x60]
call fcn.140033bc8
test eax, eax
jne 0x140004b82
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov rdx, qword [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], sil
jne 0x140004530
lea rcx, [rsp + 0x20]
call fcn.140008150
nop
mov r8d, 9
lea rdx, str.Spotify_
lea rcx, [rsp + 0x20]
call fcn.140006f90
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], rsi
mov r14d, 0xf
mov qword [rax + 0x18], r14
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400045c7
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400045c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004bb8
call fcn.14002b520
movdqa xmm0, xmmword [0x140063d70]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
mov rdi, qword [rbp - 0x68]
lea rbx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rbx, qword [rbp - 0x78]
call fcn.14002a050
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rdi
lea r8, [rsp + 0x70]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.1400021b0
nop
lea rcx, [rsp + 0x40]
call fcn.140002bb0
movzx ebx, al
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14000465c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004657
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004bbe
call fcn.14002b520
test bl, bl
jne 0x14000466f
mov rcx, qword [rsp + 0x60]
call fcn.140032c0c
jmp 0x140004b4b
mov r15, qword [rbp - 0x68]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 0xa
jb 0x140004bc4
lea r13, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae r13, qword [rbp - 0x78]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
lea r12, [r15 + 0xa]
mov rbx, r14
lea rdi, [rbp - 0x38]
mov eax, 0x16
cmp r12, rbx
jbe 0x140004734
mov rbx, r12
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400046d0
mov rbx, rcx
jmp 0x1400046d7
cmp rbx, rax
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x14000471e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004bca
mov rcx, rax
call fcn.14002b528
test rax, rax
je 0x140004bee
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140004730
test rcx, rcx
je 0x14000472d
call fcn.14002b528
mov rdi, rax
jmp 0x140004730
mov rdi, rsi
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], rbx
mov r8, r15
mov rdx, r13
mov rcx, rdi
call fcn.14002d500
movsd xmm0, qword [str.libcef.dll]
movsd qword [rdi + r15], xmm0
movzx eax, word [0x140063b28]
mov word [rdi + r15 + 8], ax
mov byte [rdi + r12], 0
mov r13, qword [rbp - 0x68]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 0xa
jb 0x140004bd0
lea r15, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae r15, qword [rbp - 0x78]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x48], xmm1
lea rdi, [r13 + 0xa]
lea rbx, [rbp - 0x58]
cmp rdi, 0xf
jbe 0x14000483c
mov r14, rdi
or r14, 0xf
cmp r14, rcx
jbe 0x1400047c8
mov r14, rcx
jmp 0x1400047d5
cmp r14, 0x16
mov eax, 0x16
cmovb r14, rax
mov rcx, r14
add rcx, 1
mov r12, 0xffffffffffffffff
cmovb rcx, r12
cmp rcx, 0x1000
jb 0x140004820
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004bd6
mov rcx, rax
call fcn.14002b528
test rax, rax
je 0x140004be8
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
mov qword [rbp - 0x58], rbx
jmp 0x140004843
test rcx, rcx
je 0x140004833
call fcn.14002b528
mov rbx, rax
mov qword [rbp - 0x58], rax
jmp 0x140004843
mov rbx, rsi
mov qword [rbp - 0x58], rbx
jmp 0x140004843
mov r12, 0xffffffffffffffff
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x40], r14
mov r8, r13
mov rdx, r15
mov rcx, rbx
call fcn.14002d500
movsd xmm0, qword [0x140063b30]
movsd qword [rbx + r13], xmm0
movzx eax, word [0x140063b38]
mov word [rbx + r13 + 8], ax
mov byte [rbx + rdi], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rsi
mov r8d, 7
lea rdx, str.Spotify
lea rcx, [rsp + 0x20]
call fcn.140008150
lea r8, [rbp - 0x80]
mov edx, 0x1000
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
mov r15, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x20]
test eax, eax
je 0x14000499d
mov eax, dword [rbp - 0x80]
shr eax, 2
mov dword [rbp - 0x80], eax
test eax, eax
je 0x14000499d
mov r14, qword [rsp + 0x30]
nop dword [rax]
mov eax, esi
mov r8d, dword [rbp + rax*4]
test r8d, r8d
je 0x140004992
xor edx, edx
mov ecx, 0x411
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140004992
lea r9, [rbp - 0x18]
mov r8d, 8
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x140004989
mov r9d, 0x104
lea r8, [rbp + 0x1000]
mov rdx, qword [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
lea rcx, [rbp + 0x1000]
mov rax, r12
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140004950
lea rcx, [rsp + 0x20]
cmp r15, 0x10
cmovae rcx, rdi
cmp r14, rax
jne 0x140004989
mov r8, r14
lea rdx, [rbp + 0x1000]
call fcn.14002d400
test eax, eax
jne 0x140004989
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [rbp - 0x80]
jb 0x1400048e0
cmp r15, 0x10
jb 0x1400049d4
lea rdx, [r15 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400049cc
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004bdc
mov rcx, rdi
call fcn.14002b520
lea rcx, [rbp - 0x38]
call fcn.140003750
test al, al
je 0x140004ab3
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, 0x3a
lea rdx, str.https:__github.com_spotify_luigi_files_15370515_update.zip
lea rcx, [rsp + 0x20]
call fcn.140008150
nop
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x20]
call fcn.140002e90
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140004a5a
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004a55
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004be2
call fcn.14002b520
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x58]
call fcn.1400031e0
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140004ab3
lea rdx, str.Failed_to_delete_update.zip
call fcn.140007a40
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140007760
movzx edx, al
mov rcx, rbx
call fcn.140008920
mov rcx, rbx
call fcn.140007310
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140004aee
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004ae9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004be8
call fcn.14002b520
movdqa xmm0, xmmword [0x140063d70]
movdqu xmmword [rbp - 0x48], xmm0
mov byte [rbp - 0x58], 0
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140004b3a
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004b35
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004bee
call fcn.14002b520
movdqa xmm0, xmmword [0x140063d70]
movdqu xmmword [rbp - 0x28], xmm0
mov byte [rbp - 0x38], 0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x140004b82
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004b7d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004bb2
call fcn.14002b520
mov rcx, qword [rbp + 0x1110]
xor rcx, rsp
call fcn.14002b500
lea r11, [rsp + 0x1220]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140033840
nop
call fcn.140033840
nop
call fcn.140033840
int3
call fcn.1400012e0
int3
call fcn.140001240
nop
call fcn.1400012e0
int3
call fcn.140001240
nop
call fcn.140033840
int3
call fcn.140033840
nop
call fcn.140033840
nop
call fcn.140033840
int3