Function at 0x1400a4a80
Capabilities:
Create process on windows
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x1401b4a98]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov qword [rbp - 0x68], r9
mov r14, r8
mov rbx, rdx
mov rax, qword [rbp + 0x100]
mov qword [rbp - 0x60], rax
test rax, rax
jne 0x1400a4afa
lea rax, str.invalid_substitutor
mov qword [rsp + 0x20], rax
mov r9d, 0x62
lea r8, str.XMLUpdater::v2::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.E:BT5141214d_e130_48fa_889d_d54b39cac869xmlupdater_srcXmlUpdaterExecuteLocalCommand.cpp
lea ecx, [r9 - 0x61]
call fcn.14007d3e0
xor al, al
jmp 0x1400a51ba
cmp byte [rbp + 0x118], 0
je 0x1400a4b58
mov rcx, rbx
cmp qword [rdx + 0x18], 8
jb 0x1400a4b10
mov rcx, qword [rdx]
call fcn.1400a3b40
test al, al
jne 0x1400a4b58
cmp qword [rbx + 0x18], 8
jb 0x1400a4b23
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rbx
lea rax, str.Signature_check_failed_for_command__s
mov qword [rsp + 0x20], rax
mov r9d, 0x67
lea r8, str.XMLUpdater::v2::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.E:BT5141214d_e130_48fa_889d_d54b39cac869xmlupdater_srcXmlUpdaterExecuteLocalCommand.cpp
lea ecx, [r9 - 0x66]
call fcn.14007d3e0
xor al, al
jmp 0x1400a51ba
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rax
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
movups xmmword [rbp + 0x44], xmm0
mov dword [rbp + 0x54], eax
mov dword [rbp - 0x10], 0x68
xor ecx, ecx
cmp byte [rbp + 0x108], al
je 0x1400a4b9c
mov dword [rbp + 0x2c], 1
mov word [rbp + 0x30], cx
mov r15, qword [rbx + 0x10]
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
sub rax, r15
cmp rax, 1
jb 0x1400a51ea
mov qword [rbp - 0x38], rbx
cmp qword [rbx + 0x18], 8
jb 0x1400a4bcc
mov rax, qword [rbx]
mov qword [rbp - 0x38], rax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rcx
lea r13, [r15 + 1]
mov edi, 7
lea r12, [rsp + 0x58]
lea rsi, [rdi - 8]
cmp r13, rdi
jbe 0x1400a4c2c
mov rdi, r13
or rdi, 7
cmp rdi, rdx
jbe 0x1400a4c03
mov rdi, rdx
jmp 0x1400a4c0f
mov eax, 0xa
cmp rdi, rax
cmovb rdi, rax
mov rdx, rdi
add rdx, 1
cmovb rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.14000ce60
mov r12, rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], rdi
mov eax, 0x22
mov word [r12], ax
lea rcx, [r12 + 2]
lea r8, [r15 + r15]
mov rdx, qword [rbp - 0x38]
call fcn.1400fe220
xor eax, eax
mov word [r12 + r13*2], ax
mov rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
mov rax, r8
sub rax, rdx
cmp rax, 2
jb 0x1400a4c9d
lea rcx, [rdx + 2]
mov qword [rsp + 0x68], rcx
lea rax, [rsp + 0x58]
cmp r8, 8
cmovae rax, qword [rsp + 0x58]
mov dword [rax + rdx*2], 0x200022
xor r13d, r13d
mov word [rax + rcx*2], r13w
lea rax, [rsp + 0x58]
jmp 0x1400a4cc5
mov qword [rsp + 0x20], 2
lea r9, [0x140155b2c]
movzx r8d, byte [rsp + 0x50]
mov edx, 2
lea rcx, [rsp + 0x58]
call fcn.1400208c0
xor r13d, r13d
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov r8, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 8
jb 0x1400a4d00
mov r14, qword [r14]
mov rdx, r14
lea rcx, [rsp + 0x78]
call fcn.14001ff20
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x1400a4d6d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a4d68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a51f0
call fcn.140074f80
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r13w
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x1400a4dc1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a4dbc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a51f6
call fcn.140074f80
mov rdi, qword [rbp - 0x20]
inc rdi
mov eax, 2
mul rdi
cmovo rax, rsi
lea rdx, [0x14015cd70]
mov rcx, rax
call fcn.1400fc920
mov r14, rax
mov qword [rbp - 0x38], rax
mov r12, qword [rbp - 0x18]
mov r15, qword [rbp - 0x30]
test rax, rax
jne 0x1400a4e25
lea rax, str.Failed_to_allocate_memory_for_cmdLine.
mov qword [rsp + 0x20], rax
lea r9d, [r14 + 0x77]
lea r8, str.XMLUpdater::v2::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.E:BT5141214d_e130_48fa_889d_d54b39cac869xmlupdater_srcXmlUpdaterExecuteLocalCommand.cpp
lea ecx, [r14 + 1]
call fcn.14007d3e0
xor bl, bl
jmp 0x1400a5153
lea rdx, [rbp - 0x30]
cmp r12, 8
cmovae rdx, r15
lea rax, [rdi - 1]
mov r8d, 0x7ffffffe
cmp rax, r8
ja 0x1400a4e80
mov rcx, r14
sub r8, rdi
sub rdx, r14
nop dword [rax]
lea rax, [rdi + r8]
test rax, rax
je 0x1400a4e6f
movzx eax, word [rcx + rdx]
test ax, ax
je 0x1400a4e6f
mov word [rcx], ax
add rcx, 2
sub rdi, 1
jne 0x1400a4e50
lea rax, [rcx - 2]
test rdi, rdi
cmovne rax, rcx
mov word [rax], r13w
jmp 0x1400a4e89
test rdi, rdi
je 0x1400a4e89
mov word [r14], r13w
mov rax, qword [rbp - 0x68]
cmp qword [rax + 0x18], 8
jb 0x1400a4e97
mov rax, qword [rax]
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400a4f11
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r14
lea rax, str.Unable_to_run__s__error___d_
mov qword [rsp + 0x20], rax
mov r9d, 0x7e
lea r8, str.XMLUpdater::v2::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.E:BT5141214d_e130_48fa_889d_d54b39cac869xmlupdater_srcXmlUpdaterExecuteLocalCommand.cpp
lea ecx, [r9 - 0x7d]
call fcn.14007d3e0
xor bl, bl
jmp 0x1400a5153
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400a4f42
cmp qword [rbx + 0x18], 8
jb 0x1400a4f2e
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rbx
lea rax, str.Wait_for_process_failed_for_command__s
mov r9d, 0x84
jmp 0x1400a4f6f
mov dword [rbp - 0x58], r13d
lea rdx, [rbp - 0x58]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x1400a4f93
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.Failed_to_get_process_exit_code___d_
mov r9d, 0x8b
mov qword [rsp + 0x20], rax
lea r8, str.XMLUpdater::v2::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.E:BT5141214d_e130_48fa_889d_d54b39cac869xmlupdater_srcXmlUpdaterExecuteLocalCommand.cpp
mov ecx, 1
call fcn.14007d3e0
xor bl, bl
jmp 0x1400a5153
cmp byte [rbp + 0x110], 0
je 0x1400a4fe7
cmp qword [rbx + 0x18], 8
jb 0x1400a4fa6
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400a4fe7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, str.Failed_to_delete_executable___d_
mov qword [rsp + 0x20], rax
mov r9d, 0x93
lea r8, str.XMLUpdater::v2::CExecuteLocalCommand::ExecuteLocalCommand
lea rdx, str.E:BT5141214d_e130_48fa_889d_d54b39cac869xmlupdater_srcXmlUpdaterExecuteLocalCommand.cpp
mov ecx, 1
call fcn.14007d3e0
lea r9, [rbp + 0x8a]
mov r8d, dword [rbp - 0x58]
nop dword [rax]
nop word [rax + rax]
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x1400a5000
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r13w
lea rax, [rbp + 0x8a]
cmp r9, rax
je 0x1400a5070
lea r8, [rbp + 0x8a]
sub r8, r9
sar r8, 1
mov rdx, r9
lea rcx, [rsp + 0x58]
call fcn.140002fb0
nop
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r13w
mov rdx, qword [0x1401b0710]
nop
inc rsi
cmp word [rdx + rsi*2], 0
jne 0x1400a5090
mov r8, rsi
lea rcx, [rsp + 0x78]
call fcn.140002fb0
nop
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x78]
mov rcx, qword [rbp - 0x60]
call fcn.14007ede0
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x1400a50fd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a50f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a51fc
call fcn.140074f80
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r13w
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x1400a5151
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a514c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a5202
call fcn.140074f80
mov bl, 1
test r14, r14
je 0x1400a5161
mov rcx, r14
call fcn.140074f80
nop
cmp r12, 8
jb 0x1400a5199
lea rdx, [r12*2 + 2]
mov rax, r15
cmp rdx, 0x1000
jb 0x1400a5190
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a51e4
mov rcx, r15
call fcn.140074f80
nop
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1400a51a8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x1400a51b7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.1400fb890
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140103230
nop
call fcn.140001790
nop
call fcn.140103230
nop
call fcn.140103230
nop
call fcn.140103230
nop
call fcn.140103230
int3