Function at 0x140005ef0
Capabilities:
Create process on windows
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x140032040]
xor rax, rsp
mov qword [rbp + 0x78], rax
mov r13, r8
mov rsi, rdx
mov r12, rcx
xor r15d, r15d
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
mov rdi, qword [rdx + 0x10]
mov r14, rdx
cmp qword [rdx + 0x18], 7
jbe 0x1400053f6
mov r14, qword [rdx]
movabs rbx, 0x7ffffffffffffffe
cmp rdi, rbx
ja 0x140005deb
movabs rdx, 0x7fffffffffffffff
cmp rdi, 7
ja 0x140005432
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], 7
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x28], xmm0
jmp 0x1400054ca
mov rax, rdi
or rax, 7
cmp rax, rbx
jbe 0x140005444
lea rcx, [rdx + rdx]
jmp 0x14000546c
mov rbx, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, rdx
ja 0x140005de5
add rcx, rcx
cmp rcx, 0x1000
jb 0x14000549b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005de5
mov rcx, rax
call fcn.14000652c
mov rcx, rax
test rax, rax
je 0x140005ddf
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400054aa
test rcx, rcx
je 0x1400054a7
call fcn.14000652c
jmp 0x1400054aa
mov rax, r15
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], rbx
lea r8, [rdi*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.140021880
nop
call fcn.140005e90
mov ecx, 0x78
call fcn.14000652c
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140005553
mov qword [rax], r15
mov qword [0x140032ce0], rax
lea r9, [0x140032ce8]
cmp qword [0x140032d00], 7
cmova r9, qword [0x140032ce8]
xor r8d, r8d
lea edx, [r8 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xorps xmm0, xmm0
movups xmmword [rdi + 8], xmm0
movups xmmword [rdi + 0x18], xmm0
movups xmmword [rdi + 0x28], xmm0
movups xmmword [rdi + 0x38], xmm0
movups xmmword [rdi + 0x48], xmm0
movups xmmword [rdi + 0x58], xmm0
movups xmmword [rdi + 0x68], xmm0
mov dword [rdi + 8], 0x70
jmp 0x140005556
mov rdi, r15
mov rcx, r13
cmp qword [r13 + 0x18], 7
jbe 0x140005564
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, [0x140032ce8]
lea rdx, str.__service
lea rcx, [rbp + 0x58]
call fcn.140004ad0
mov rbx, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0xf
jb 0x1400055ce
lea r15, [rcx + 0xf]
mov qword [rbx + 0x10], r15
mov r14, rbx
cmp rdx, 7
jbe 0x1400055ac
mov r14, qword [rbx]
lea rcx, [r14 + rcx*2]
mov r8d, 0x1e
lea rdx, str.___log_append__
call fcn.140021880
xor eax, eax
mov word [r14 + r15*2], ax
xor r15d, r15d
jmp 0x1400055f0
mov qword [rsp + 0x20], 0xf
lea r9, str.___log_append__
xor r8d, r8d
lea edx, [r8 + 0xf]
mov rcx, rbx
call fcn.140004c40
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x48], xmm1
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x38], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x48], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, r13
cmp qword [r13 + 0x18], 7
jbe 0x14000562c
mov rdx, qword [r13]
mov r8, qword [r13 + 0x10]
lea rcx, [rbp + 0x38]
call fcn.140004ea0
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14000569d
lea rax, [rcx + 1]
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x48]
cmp rdx, 7
cmova rax, qword [rbp - 0x48]
mov dword [rax + rcx*2], 0x22
lea rax, [rbp - 0x48]
jmp 0x1400056bd
mov qword [rsp + 0x20], 1
lea r9, [0x140024dc8]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x48]
call fcn.140004c40
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov r14, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
sub rax, r14
cmp rax, 0xb
jb 0x140005736
lea rax, [r14 + 0xb]
mov qword [rbp - 0x58], rax
lea rbx, [rbp - 0x68]
cmp rcx, 7
cmova rbx, qword [rbp - 0x68]
lea rcx, [rbx + r14*2]
mov r8d, 0x16
lea rdx, str.___config__
call fcn.140021880
mov word [rbx + r14*2 + 0x16], r15w
lea rax, [rbp - 0x68]
jmp 0x140005756
mov qword [rsp + 0x20], 0xb
lea r9, str.___config__
xor r8d, r8d
lea edx, [r8 + 0xb]
lea rcx, [rbp - 0x68]
call fcn.140004c40
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x28], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x28], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 7
jbe 0x140005792
mov rsi, qword [rsi]
mov rdx, rsi
lea rcx, [rbp + 0x18]
call fcn.140004ea0
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rcx, qword [rbp - 0x78]
mov rdx, qword [rbp - 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140005807
lea rax, [rcx + 1]
mov qword [rbp - 0x78], rax
lea rax, [rsp + 0x78]
cmp rdx, 7
cmova rax, qword [rsp + 0x78]
mov dword [rax + rcx*2], 0x22
lea rax, [rsp + 0x78]
jmp 0x140005828
mov qword [rsp + 0x20], 1
lea r9, [0x140024dc8]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x78]
call fcn.140004c40
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rsi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
sub rax, rsi
cmp rax, 0xf
jb 0x1400058ab
lea rax, [rsi + 0xf]
mov qword [rsp + 0x68], rax
lea rbx, [rsp + 0x58]
cmp rcx, 7
cmova rbx, qword [rsp + 0x58]
lea rcx, [rbx + rsi*2]
mov r8d, 0x1e
lea rdx, str.___auth_nocache
call fcn.140021880
mov word [rbx + rsi*2 + 0x1e], r15w
lea rax, [rsp + 0x58]
jmp 0x1400058cc
mov qword [rsp + 0x20], 0xf
lea r9, str.___auth_nocache
xor r8d, r8d
lea edx, [r8 + 0xf]
lea rcx, [rsp + 0x58]
call fcn.140004c40
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 8], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rsp + 0x70]
cmp rdx, 7
jbe 0x14000593c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005937
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005df1
call fcn.140006568
movdqa xmm0, xmmword [0x140024870]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r15w
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x140005991
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000598c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005df7
call fcn.140006568
movdqa xmm0, xmmword [0x140024870]
movdqu xmmword [rbp - 0x78], xmm0
mov word [rsp + 0x78], r15w
mov rdx, qword [rbp + 0x30]
cmp rdx, 7
jbe 0x1400059e4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400059df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005dfd
call fcn.140006568
movdqa xmm0, xmmword [0x140024870]
movdqu xmmword [rbp + 0x28], xmm0
mov word [rbp + 0x18], r15w
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x140005a36
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a31
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e03
call fcn.140006568
movdqa xmm0, xmmword [0x140024870]
movdqu xmmword [rbp - 0x58], xmm0
mov word [rbp - 0x68], r15w
mov rdx, qword [rbp - 0x30]
cmp rdx, 7
jbe 0x140005a88
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e09
call fcn.140006568
movdqa xmm0, xmmword [0x140024870]
movdqu xmmword [rbp - 0x38], xmm0
mov word [rbp - 0x48], r15w
mov rdx, qword [rbp + 0x50]
cmp rdx, 7
jbe 0x140005ada
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ad5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e0f
call fcn.140006568
movdqa xmm0, xmmword [0x140024870]
movdqu xmmword [rbp + 0x48], xmm0
mov word [rbp + 0x38], r15w
mov rdx, qword [rbp + 0x70]
cmp rdx, 7
jbe 0x140005b2c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005b27
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e15
call fcn.140006568
movdqa xmm0, xmmword [0x140024870]
movdqu xmmword [rbp + 0x68], xmm0
mov word [rbp + 0x58], r15w
lea rcx, [rdi + 8]
mov dword [rcx + 4], 0x100040
mov qword [rcx + 8], r15
lea rax, str.runas
mov qword [rcx + 0x10], rax
cmp qword [r12 + 0x18], 7
jbe 0x140005b64
mov r12, qword [r12]
mov qword [rcx + 0x18], r12
lea rax, [rbp - 8]
cmp qword [rbp + 0x10], 7
cmova rax, qword [rbp - 8]
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], r15
mov dword [rcx + 0x30], r15d
mov qword [rcx + 0x38], r15
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x140005e1b
mov esi, r15d
mov byte [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.140004f20
test al, al
jne 0x140005d16
movabs rbx, 0x7fffffffc46535ff
movabs r14, 0x4e94914f0000
movabs r12, 0x431bde82d7b634db
nop
cmp esi, 0x3c
jg 0x140005e67
cmp byte [rsp + 0x30], 0
jne 0x140005e44
lea rcx, [rsp + 0x38]
call fcn.1400052c0
mov rax, qword [rsp + 0x38]
cmp rax, rbx
lea rdi, [rax + 0x3b9aca00]
jl 0x140005c09
movabs rdi, 0x7fffffffffffffff
movabs r15, 0xb2f4fc0794908cf3
call fcn.1400063c4
mov rbx, rax
call fcn.1400063a8
mov rcx, rax
cmp rbx, 0x989680
jne 0x140005c32
imul rax, rcx, 0x64
jmp 0x140005ca1
cmp rbx, 0x16e3600
jne 0x140005c86
mov rax, r15
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul r8, rdx, 0x3b9aca00
imul rax, rdx, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, r15
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rax, rdx
add rax, r8
jmp 0x140005ca1
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, rdi
jge 0x140005cef
mov rcx, rdi
sub rcx, rax
cmp rcx, r14
jl 0x140005cc0
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x140005c13
mov rax, r12
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140005ce3
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x140005c13
inc esi
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.140004f20
test al, al
movabs rbx, 0x7fffffffc46535ff
mov r15d, 0
je 0x140005bd0
mov rdx, qword [rbp + 0x10]
cmp rdx, 7
jbe 0x140005d56
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005d51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e3e
call fcn.140006568
movdqa xmm0, xmmword [0x140024870]
movdqu xmmword [rbp + 8], xmm0
mov word [rbp - 8], r15w
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 7
cmova rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rbp - 0x10]
cmp rdx, 7
jbe 0x140005db8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005db3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005ddf
call fcn.140006568
mov rcx, qword [rbp + 0x78]
xor rcx, rsp
call fcn.140006840
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14000d0dc
int3
call fcn.140002e50
int3
call fcn.140002e90
nop
call fcn.14000d0dc
nop
call fcn.14000d0dc
nop
call fcn.14000d0dc
nop
call fcn.14000d0dc
nop
call fcn.14000d0dc
nop
call fcn.14000d0dc
nop
call fcn.14000d0dc
int3
lea rdx, str.cant_start_openvpn
lea rcx, [rsp + 0x40]
call fcn.1400047e0
lea rdx, [0x140030398]
lea rcx, [rsp + 0x40]
call fcn.1400073d0
nop
call fcn.14000d0dc
nop
lea rdx, str.openvpn_error
lea rcx, [rsp + 0x40]
call fcn.1400047e0
lea rdx, [0x140030398]
lea rcx, [rsp + 0x40]
call fcn.1400073d0
int3
lea rdx, str.openvpn_timeout
lea rcx, [rsp + 0x40]
call fcn.1400047e0
lea rdx, [0x140030398]
lea rcx, [rsp + 0x40]
call fcn.1400073d0
int3
jmp 0x1400053a0