Function at 0x140038c60
Capabilities:
Terminate process

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x2a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x220], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp + 0x180]
call fcn.14003a1b0
mov rdx, qword [rbp + 0x180]
mov rax, qword [rbp + 0x188]
mov rcx, rdx
neg rcx
mov ecx, dword [rbp + 0x190]
jno 0x140038d97
mov qword [rbp + 0x160], rax
mov dword [rbp + 0x168], ecx
lea rax, [rbp + 0x160]
mov qword [rbp + 0x50], rax
lea rax, [0x14027f670]
mov qword [rbp + 0x58], rax
lea rax, [0x1403028a0]
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], 1
mov qword [rbp + 0x90], 0
lea rax, [rbp + 0x50]
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], 1
lea rcx, [rbp + 0x1c0]
lea rdx, [rbp + 0x70]
call fcn.1402db0a0
mov rax, qword [rbp + 0x1c0]
mov qword [rbp + 0x1f0], rax
mov rcx, qword [rbp + 0x1c8]
mov rdx, qword [rbp + 0x1d0]
mov qword [rbp + 0x1f8], rcx
call fcn.14003ad10
mov rdx, qword [rbp + 0x1f0]
test rdx, rdx
je 0x140038d5e
mov r8d, 1
mov rcx, qword [rbp + 0x1f8]
call fcn.140061f30
call fcn.14027f3b0
mov rdi, rax
mov ebx, edx
cmp qword [rbp + 0x160], 0
je 0x140038d7e
lea rcx, [rbp + 0x160]
call fcn.14027fa60
mov qword [rsi + 8], rdi
mov dword [rsi + 0x10], ebx
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x140039895
mov r8d, dword [rbp + 0x19c]
mov dword [rbp + 0x17c], r8d
mov r8, qword [rbp + 0x194]
mov qword [rbp + 0x174], r8
mov qword [rbp + 0x160], rdx
mov qword [rbp + 0x168], rax
mov dword [rbp + 0x170], ecx
call fcn.140277e20
mov qword [rbp + 0x180], 1
mov qword [rbp + 0x188], rax
mov qword [rbp + 0x190], 0xa
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 1
mov qword [rbp + 0x80], 0
mov byte [rbp + 0x20c], 1
mov qword [rsp + 0x20], 1
lea rcx, [rbp + 0x70]
mov r8d, 0xa
mov r9d, 1
xor edx, edx
call fcn.1402eaf00
mov byte [rbp + 0x20c], 0
lea rdi, [rbp + 0x180]
lea rdx, [rbp + 0x70]
mov rcx, rdi
call fcn.14005d610
mov rbx, qword [rbp + 0x80]
mov qword [rbp + 0x1d0], rbx
movups xmm0, xmmword [rbp + 0x70]
movaps xmmword [rbp + 0x1c0], xmm0
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
sub rax, rbx
cmp rax, 3
ja 0x140038eac
mov qword [rsp + 0x20], 1
lea rcx, [rbp + 0x1c0]
mov r8d, 4
mov r9d, 1
mov rdx, rbx
call fcn.1402eaf00
mov rax, qword [rbp + 0x1c0]
mov qword [rbp + 0x1f8], rax
mov rbx, qword [rbp + 0x1d0]
jmp 0x140038eb3
mov qword [rbp + 0x1f8], rcx
mov rax, qword [rbp + 0x1c8]
mov qword [rbp + 0x1f0], rax
mov dword [rax + rbx], 0x6578652e
lea rdx, str.C:WindowsSystem32File_already_exists_at___deleting_it_first.
lea rcx, [rbp + 0x70]
mov r8d, 0x13
call fcn.1402bf990
add rbx, 4
movups xmm0, xmmword [rbp + 0x70]
movups xmm1, xmmword [rbp + 0x80]
movaps xmmword [rbp + 0x60], xmm1
movaps xmmword [rbp + 0x50], xmm0
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x1f0]
mov r8, rbx
call case.0x1402bae44.82
lea rbx, [rbp + 0x50]
mov rcx, rbx
call fcn.1402d1700
mov r8, rdx
lea rcx, [rbp + 0x70]
mov rdx, rax
call fcn.1402c5d80
cmp dword [rbp + 0x70], 2
jne 0x140038fad
mov rax, qword [rbp + 0x78]
mov ecx, eax
and ecx, 3
cmp ecx, 1
jne 0x140039169
lea rcx, [rax - 1]
mov qword [rbp + 0x200], rcx
mov rcx, qword [rax - 1]
mov qword [rbp + 0x218], rcx
mov rax, qword [rax + 7]
mov qword [rbp + 0x210], rax
mov rax, qword [rax]
test rax, rax
je 0x140038f71
mov rcx, qword [rbp + 0x218]
call rax
mov rcx, qword [rbp + 0x218]
mov rax, qword [rbp + 0x210]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140038f91
mov r8, qword [rax + 0x10]
call fcn.140061f30
mov edx, 0x18
mov r8d, 8
mov rcx, qword [rbp + 0x200]
call fcn.140061f30
jmp 0x140039169
mov qword [rbp + 0x180], rbx
lea r14, [0x1402bf970]
mov qword [rbp + 0x188], r14
lea rax, [0x140302768]
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], 2
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x80], rdi
mov qword [rbp + 0x88], 1
lea rcx, [rbp + 8]
lea rdx, [rbp + 0x70]
call fcn.1402db0a0
mov rax, qword [rbp + 8]
mov qword [rbp + 0x218], rax
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
mov qword [rbp + 0x210], rcx
call fcn.14003ad10
mov rdx, qword [rbp + 0x218]
test rdx, rdx
je 0x14003903c
mov r8d, 1
mov rcx, qword [rbp + 0x210]
call fcn.140061f30
mov rcx, rbx
call fcn.1402d1700
mov rcx, rax
call fcn.1402c5910
test rax, rax
je 0x140039169
mov qword [rbp + 0x1c0], rax
mov qword [rbp + 0x180], rbx
mov qword [rbp + 0x188], r14
lea rax, [rbp + 0x1c0]
mov qword [rbp + 0x190], rax
lea rax, [0x1402baad0]
mov qword [rbp + 0x198], rax
lea rax, str.Failed_to_delete_existing_file_at_:
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], 2
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x80], rdi
mov qword [rbp + 0x88], 2
lea rcx, [rbp - 0x10]
lea rdx, [rbp + 0x70]
call fcn.1402db0a0
mov rax, qword [rbp - 0x10]
mov qword [rbp + 0x218], rax
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp]
mov qword [rbp + 0x210], rcx
call fcn.14003ad10
mov rdx, qword [rbp + 0x218]
test rdx, rdx
je 0x140039100
mov r8d, 1
mov rcx, qword [rbp + 0x210]
call fcn.140061f30
call fcn.14027f3b0
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], edx
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rax, qword [rbp + 0x1c0]
mov ecx, eax
and ecx, 3
cmp ecx, 1
jne 0x14003983b
lea rcx, [rax - 1]
mov qword [rbp + 0x200], rcx
mov rcx, qword [rax - 1]
mov qword [rbp + 0x218], rcx
mov rax, qword [rax + 7]
mov qword [rbp + 0x210], rax
mov rax, qword [rax]
test rax, rax
je 0x1400392b9
mov rcx, qword [rbp + 0x218]
call rax
jmp 0x1400392b9
lea rcx, [rbp + 0x160]
call fcn.1402d1700
mov r14, rax
mov r15, rdx
mov rcx, rbx
call fcn.1402d1700
mov r9, rdx
mov rcx, r14
mov rdx, r15
mov r8, rax
call case.0x1402e54a3.276
test rax, rax
je 0x140039365
cmp rax, 1
jne 0x1400392f0
mov qword [rbp + 0x1c0], rdx
mov qword [rbp + 0x180], rbx
lea rax, [0x1402bf970]
mov qword [rbp + 0x188], rax
lea rax, [rbp + 0x1c0]
mov qword [rbp + 0x190], rax
lea rax, [0x1402baad0]
mov qword [rbp + 0x198], rax
lea rax, str.Failed_to_copy_the_module_to
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], 2
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x80], rdi
mov qword [rbp + 0x88], 2
lea rcx, [rbp - 0x28]
lea rdx, [rbp + 0x70]
call fcn.1402db0a0
mov rax, qword [rbp - 0x28]
mov qword [rbp + 0x218], rax
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov qword [rbp + 0x210], rcx
call fcn.14003ad10
mov rdx, qword [rbp + 0x218]
test rdx, rdx
je 0x140039259
mov r8d, 1
mov rcx, qword [rbp + 0x210]
call fcn.140061f30
call fcn.14027f3b0
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], edx
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rax, qword [rbp + 0x1c0]
mov ecx, eax
and ecx, 3
cmp ecx, 1
jne 0x14003983b
lea rcx, [rax - 1]
mov qword [rbp + 0x200], rcx
mov rcx, qword [rax - 1]
mov qword [rbp + 0x218], rcx
mov rax, qword [rax + 7]
mov qword [rbp + 0x210], rax
mov rax, qword [rax]
test rax, rax
je 0x1400392b9
mov rcx, qword [rbp + 0x218]
call rax
mov rcx, qword [rbp + 0x218]
mov rax, qword [rbp + 0x210]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400392d9
mov r8, qword [rax + 0x10]
call fcn.140061f30
mov edx, 0x18
mov r8d, 8
mov rcx, qword [rbp + 0x200]
jmp 0x140039836
mov eax, edx
and eax, 3
cmp eax, 1
jne 0x140039365
mov rax, rdx
dec rax
mov qword [rbp + 0x200], rax
mov rax, qword [rdx - 1]
mov qword [rbp + 0x218], rax
mov rax, qword [rdx + 7]
mov qword [rbp + 0x210], rax
mov rax, qword [rax]
test rax, rax
je 0x14003932e
mov rcx, qword [rbp + 0x218]
call rax
mov rcx, qword [rbp + 0x218]
mov rax, qword [rbp + 0x210]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14003934e
mov r8, qword [rax + 0x10]
call fcn.140061f30
mov edx, 0x18
mov r8d, 8
mov rcx, qword [rbp + 0x200]
call fcn.140061f30
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call fcn.1402d1700
mov r8, rdx
lea rcx, [rbp + 0x70]
mov rdx, rax
call fcn.1402b9ce0
test byte [rbp + 0x70], 1
je 0x140039411
lea rax, [rbp + 0x30]
mov qword [rbp + 0x1c0], rax
lea rax, [0x14005e850]
mov qword [rbp + 0x1c8], rax
lea rax, str.Invalid_path:
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], 1
mov qword [rbp + 0x90], 0
lea rax, [rbp + 0x1c0]
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], 1
lea rcx, [rbp + 0x180]
lea rdx, [rbp + 0x70]
call fcn.1402db0a0
movups xmm0, xmmword [rbp + 0x180]
mov rax, qword [rbp + 0x190]
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], rax
lea rcx, [rbp + 0x70]
call fcn.1402daa50
jmp 0x140039728
movups xmm0, xmmword [rbp + 0x78]
movups xmmword [rbp + 0x20], xmm0
lea rax, [rbp + 0x20]
mov qword [rbp + 0x180], rax
lea rax, [0x1400509c0]
mov qword [rbp + 0x188], rax
lea rax, str.Launching_new_process_with:
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], 1
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x80], rdi
mov qword [rbp + 0x88], 1
lea rcx, [rbp - 0x58]
lea rdx, [rbp + 0x70]
call fcn.1402db0a0
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x218], rax
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
mov qword [rbp + 0x210], rcx
call fcn.14003ad10
mov rdx, qword [rbp + 0x218]
test rdx, rdx
je 0x1400394ac
mov r8d, 1
mov rcx, qword [rbp + 0x210]
call fcn.140061f30
mov rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x28]
lea rcx, [rbp + 0x70]
call fcn.1402c8eb0
lea rcx, [rbp + 0x180]
lea rdx, [rbp + 0x70]
call fcn.1402c08c0
mov byte [rbp + 0x20f], 1
mov byte [rbp + 0x20e], 1
lea rcx, [rbp + 0x70]
call fcn.140001f40
cmp dword [rbp + 0x180], 2
jne 0x1400395d8
mov rax, qword [rbp + 0x188]
mov qword [rbp + 0x148], rax
lea rax, [rbp + 0x148]
mov qword [rbp + 0x38], rax
lea rax, [0x1402baad0]
mov qword [rbp + 0x40], rax
lea rax, str.P0_
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], 1
mov qword [rbp + 0x90], 0
lea rax, [rbp + 0x38]
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], 1
mov byte [rbp + 0x20d], 1
lea rcx, [rbp + 0x1c0]
lea rdx, [rbp + 0x70]
call fcn.1402db0a0
mov rax, qword [rbp + 0x1c0]
mov qword [rbp + 0x218], rax
mov rcx, qword [rbp + 0x1c8]
mov rdx, qword [rbp + 0x1d0]
mov qword [rbp + 0x210], rcx
call fcn.14003ad10
mov rdx, qword [rbp + 0x218]
test rdx, rdx
je 0x1400395a6
mov r8d, 1
mov rcx, qword [rbp + 0x210]
call fcn.140061f30
mov rbx, qword [rbp + 0x148]
mov qword [rbp + 0x70], rbx
movzx eax, byte [0x14049f3b5]
mov ecx, 8
mov edx, 8
call fcn.140061f20
test rax, rax
je 0x1400398c1
mov qword [rax], rbx
jmp 0x140039721
movups xmm0, xmmword [rbp + 0x180]
movups xmm1, xmmword [rbp + 0x190]
movups xmm2, xmmword [rbp + 0x1a0]
movups xmm3, xmmword [rbp + 0x1b0]
movaps xmmword [rbp + 0xa0], xmm3
movaps xmmword [rbp + 0x90], xmm2
movaps xmmword [rbp + 0x80], xmm1
movaps xmmword [rbp + 0x70], xmm0
lea rcx, [rbp + 0x70]
call fcn.1402c0ff0
mov dword [rbp + 0x15c], eax
lea rax, [rbp + 0x15c]
mov qword [rbp + 0x148], rax
lea rax, [0x1402e94b0]
mov qword [rbp + 0x150], rax
lea rax, str.Successfully_launched_new_process_with_PID:
mov qword [rbp + 0x1c0], rax
mov qword [rbp + 0x1c8], 1
mov qword [rbp + 0x1e0], 0
lea rax, [rbp + 0x148]
mov qword [rbp + 0x1d0], rax
mov qword [rbp + 0x1d8], 1
lea rcx, [rbp + 0x38]
lea rdx, [rbp + 0x1c0]
call fcn.1402db0a0
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x218], rax
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
mov qword [rbp + 0x210], rcx
call fcn.14003ad10
mov rdx, qword [rbp + 0x218]
test rdx, rdx
je 0x1400396c2
mov r8d, 1
mov rcx, qword [rbp + 0x210]
call fcn.140061f30
mov rcx, qword [rbp + 0xa0]
mov rbx, qword [rbp + 0xa8]
mov r14, qword [sym.imp.kernel32.dll_CloseHandle]
call r14
mov rcx, rbx
call r14
cmp qword [rbp + 0x70], 0
je 0x1400396f1
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.kernel32.dll_CloseHandle]
cmp qword [rbp + 0x80], 0
je 0x140039708
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.kernel32.dll_CloseHandle]
cmp qword [rbp + 0x90], 0
je 0x14003971f
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
lea rdx, fcn.140001e70
test rax, rax
je 0x1400398a8
mov qword [rbp + 0x1c0], rax
mov qword [rbp + 0x1c8], rdx
lea rax, [rbp + 0x1c0]
mov qword [rbp + 0x180], rax
lea rax, [0x1400478a0]
mov qword [rbp + 0x188], rax
lea rax, str.Failed_to_launch_new_instance:
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], 1
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x80], rdi
mov qword [rbp + 0x88], 1
lea rcx, [rbp - 0x40]
lea rdx, [rbp + 0x70]
call fcn.1402db0a0
mov rax, qword [rbp - 0x40]
mov qword [rbp + 0x218], rax
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
mov qword [rbp + 0x210], rcx
call fcn.14003ad10
mov rdx, qword [rbp + 0x218]
test rdx, rdx
je 0x1400397d5
mov r8d, 1
mov rcx, qword [rbp + 0x210]
call fcn.140061f30
call fcn.14027f3b0
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], edx
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rax, qword [rbp + 0x1c0]
mov qword [rbp + 0x218], rax
mov rax, qword [rbp + 0x1c8]
mov qword [rbp + 0x210], rax
mov rax, qword [rax]
test rax, rax
je 0x14003981b
mov rcx, qword [rbp + 0x218]
call rax
mov rcx, qword [rbp + 0x218]
mov rax, qword [rbp + 0x210]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14003983b
mov r8, qword [rax + 0x10]
call fcn.140061f30
mov rdi, qword [rbp + 0x1f8]
mov rbx, qword [rbp + 0x1f0]
mov rdx, qword [rbp + 0x50]
test rdx, rdx
je 0x140039861
mov rcx, qword [rbp + 0x58]
mov r8d, 1
call fcn.140061f30
test rdi, rdi
je 0x140039877
mov r8d, 1
mov rcx, rbx
mov rdx, rdi
call fcn.140061f30
mov rdx, qword [rbp + 0x160]
test rdx, rdx
je 0x140039895
mov rcx, qword [rbp + 0x168]
mov r8d, 1
call fcn.140061f30
mov rax, rsi
add rsp, 0x2a8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea rcx, str.Exiting_current_process_to_pass_control_to_the_new_instance.Failed_to_get_current_module_path:
mov edx, 0x3c
call fcn.14003ad10
xor ecx, ecx
call qword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, 8
mov edx, 8
call fcn.1402fb06f
ud2