Function at 0x140015160
Capabilities:
Execute command
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x78]
sub rsp, 0x150
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140033040]
xor rax, rsp
mov qword [rbp + 0x30], rax
xor r13d, r13d
lea rcx, str.python___version___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
jne 0x140015531
call fcn.140014de0
mov rbx, rax
mov r8, rax
shr r8, 0x20
cmp eax, 3
jne 0x140015531
cmp r8d, 0xa
jl 0x140015522
lea r9, [rbp + 0x25]
nop dword [rax]
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x1400151e0
lea r8, [rbp + 0x25]
mov rdx, r9
lea rcx, [rsp + 0x68]
call fcn.14001b370
nop
lea r9, [rbp + 0x25]
test ebx, ebx
jns 0x140015260
neg ebx
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul ebx
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [r9], bl
mov ebx, edx
test edx, edx
jne 0x140015230
dec r9
mov byte [r9], 0x2d
jmp 0x140015286
dec r9
mov eax, 0xcccccccd
mul ebx
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [r9], bl
mov ebx, edx
test edx, edx
jne 0x140015260
lea r8, [rbp + 0x25]
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.14001b370
nop
mov r8d, 1
lea rdx, [0x14002a96c]
lea rcx, [rsp + 0x48]
call fcn.140018780
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r9, [rsp + 0x68]
lea r8, [rbp + 0x10]
lea rcx, [rsp + 0x28]
call fcn.14001ae70
nop
lea rdx, str.Found_Python
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140018dc0
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0xf
cmova rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x38]
mov rcx, rax
call fcn.14001b6b0
lea rdx, str.._This_version_needs_to_be_removed_from_PATH_for_the_application_to_work_properly._n
mov rcx, rax
call fcn.140018dc0
lea rdx, str.Do_you_give_permission_to_modify_PATH___y_n_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140018dc0
lea rdx, [rsp + 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140019610
movsx ecx, byte [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
cmp eax, 0x79
je 0x1400153f0
lea rdx, str.Warning:_The_application_may_not_work_correctly_without_removing_Python
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140018dc0
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0xf
cmova rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x38]
mov rcx, rax
call fcn.14001b6b0
lea rdx, str._from_PATH._n
mov rcx, rax
call fcn.140018dc0
lea rdx, str.Are_you_sure_you_want_to_continue___y_n_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140018dc0
lea rdx, [rsp + 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140019610
movsx ecx, byte [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
cmp eax, 0x79
je 0x1400153ec
lea rdx, str.Exiting_application..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140018dc0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor bl, bl
jmp 0x1400153ff
lea rcx, str.powershell__Command___Environment_::SetEnvironmentVariable_PATH___Environment_::GetEnvironmentVariable_PATH__Machine_.Replace___USERPROFILE_AppDataLocalProgramsPythonPython_____Machine__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov bl, 1
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x14001543f
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001543a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001543a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400247e0
movdqa xmm6, xmmword [0x14002b230]
movdqu xmmword [rsp + 0x38], xmm6
mov byte [rsp + 0x28], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x140015491
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001548b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001548b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400247e0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x1400154d1
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400154cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400154cc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400247e0
movdqu xmmword [rsp + 0x58], xmm6
mov byte [rsp + 0x48], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x140015be2
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015bdd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140015bdd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test r8d, r8d
js 0x140015531
call fcn.140015080
jmp 0x140015be5
lea rcx, [rsp + 0x48]
call fcn.140003f40
nop
lea rdx, [rbp - 0x18]
mov rcx, rax
call fcn.140001fa0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x14001558e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015589
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140015589
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400247e0
movdqa xmm0, xmmword [0x14002b220]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], r13w
mov rsi, qword [rbp - 8]
movabs r12, 0x7fffffffffffffff
mov rax, r12
sub rax, rsi
cmp rax, 0x17
jb 0x140015c3f
lea r15, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova r15, qword [rbp - 0x18]
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], r13
lea r14, [rsi + 0x17]
mov ebx, 0xf
lea rdi, [rbp - 0x78]
movabs rax, 0x8000000000000000
mov ecx, 0x16
cmp r14, rbx
jbe 0x140015669
mov rbx, r14
or rbx, 0xf
cmp rbx, r12
jbe 0x140015630
mov rbx, r12
add rax, 0x27
mov rcx, rax
call fcn.1400248cc
test rax, rax
je 0x140015b88
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140015665
cmp rbx, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140015645
mov rdi, r13
jmp 0x140015665
cmp rcx, 0x1000
jb 0x14001565d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140015c2d
jmp 0x140015611
call fcn.1400248cc
mov rdi, rax
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], rbx
mov r8, rsi
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.python_3.9.6_amd64.exe]
movups xmmword [rdi + rsi], xmm0
mov eax, dword [0x14002a980]
mov dword [rdi + rsi + 0x10], eax
movzx eax, word [0x14002a984]
mov word [rdi + rsi + 0x14], ax
movzx eax, byte [0x14002a986]
mov byte [rdi + rsi + 0x16], al
mov byte [rdi + r14], 0
mov r15, qword [rbp - 0x68]
mov rax, r12
sub rax, r15
cmp rax, 0x80
jb 0x140015c45
lea r14, [rbp - 0x78]
cmp qword [rbp - 0x60], 0xf
cmova r14, qword [rbp - 0x78]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
lea rsi, [r15 + 0x80]
mov ebx, 0xf
lea rdi, [rsp + 0x28]
cmp rsi, rbx
jbe 0x14001577a
mov rbx, rsi
or rbx, 0xf
cmp rbx, r12
jbe 0x140015733
mov rbx, r12
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400248cc
test rax, rax
je 0x140015766
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140015775
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x14001574e
mov rdi, r13
jmp 0x140015775
cmp rcx, 0x1000
jb 0x14001576d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140015c33
jmp 0x140015718
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400248cc
mov rdi, rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rbx
movaps xmm0, xmmword [str.powershell__Command___New_Object_Net.WebClient_.DownloadFile_https:__www.python.org_ftp_python_3.9.6_python_3.9.6_amd64.exe__]
movups xmmword [rdi], xmm0
movaps xmm1, xmmword [0x14002a9a0]
movups xmmword [rdi + 0x10], xmm1
movaps xmm0, xmmword [0x14002a9b0]
movups xmmword [rdi + 0x20], xmm0
movaps xmm1, xmmword [0x14002a9c0]
movups xmmword [rdi + 0x30], xmm1
movaps xmm0, xmmword [0x14002a9d0]
movups xmmword [rdi + 0x40], xmm0
movaps xmm1, xmmword [0x14002a9e0]
movups xmmword [rdi + 0x50], xmm1
movaps xmm0, xmmword [0x14002a9f0]
movups xmmword [rdi + 0x60], xmm0
movaps xmm1, xmmword [0x14002aa00]
movups xmmword [rdi + 0x70], xmm1
lea rcx, [rdi + 0x80]
mov r8, r15
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov r8d, 3
lea rdx, [0x14002a988]
lea rcx, [rsp + 0x28]
call fcn.140018780
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x140015875
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015870
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140015870
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400247e0
movdqa xmm6, xmmword [0x14002b230]
movdqu xmmword [rsp + 0x38], xmm6
mov byte [rsp + 0x28], 0
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0xf
cmova rcx, qword [rbp - 0x38]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r14, qword [rbp - 0x68]
mov rax, r12
sub rax, r14
cmp rax, 1
jb 0x140015c4b
lea r15, [rbp - 0x78]
cmp qword [rbp - 0x60], 0xf
cmova r15, qword [rbp - 0x78]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
lea rsi, [r14 + 1]
mov ebx, 0xf
lea rdi, [rsp + 0x48]
cmp rsi, rbx
jbe 0x140015961
mov rbx, rsi
or rbx, 0xf
cmp rbx, r12
jbe 0x14001591a
mov rbx, r12
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400248cc
test rax, rax
je 0x14001594d
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14001595c
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140015935
mov rdi, r13
jmp 0x14001595c
cmp rcx, 0x1000
jb 0x140015954
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140015c39
jmp 0x1400158ff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400248cc
mov rdi, rax
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rbx
mov byte [rdi], 0x22
lea rcx, [rdi + 1]
mov r8, r14
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov r8d, 0x37
lea rdx, str.___quiet_InstallAllUsers1_PrependPath1_Include_test0
lea rcx, [rsp + 0x48]
call fcn.140018780
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x48], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x140015a05
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015a00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140015a00
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400247e0
movdqu xmmword [rsp + 0x58], xmm6
mov byte [rsp + 0x48], 0
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0xf
cmova rcx, qword [rbp - 0x58]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rbp - 0x78]
cmp qword [rbp - 0x60], 0xf
cmova rax, qword [rbp - 0x78]
mov qword [rbp + 0x10], rax
mov rax, qword [rbp - 0x68]
mov qword [rbp + 0x18], rax
movaps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x10], xmm0
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x28]
call fcn.14001cae0
nop
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 7
cmova rcx, qword [rsp + 0x28]
call fcn.1400242f8
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140015c17
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x140015ac0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015abb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140015abb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400247e0
call fcn.140015080
movzx ebx, al
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x140015b06
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015b01
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140015b01
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400247e0
movdqu xmmword [rbp - 0x48], xmm6
mov byte [rbp - 0x58], 0
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x140015b4d
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015b48
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140015b48
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400247e0
movdqu xmmword [rbp - 0x28], xmm6
mov byte [rbp - 0x38], 0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x140015b94
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015b8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140015b8f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400247e0
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], 0
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x140015be2
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015bdd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140015bdd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400247e0
movzx eax, bl
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.1400247c0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
shr rdx, 0x20
lea r8, [rsp + 0x28]
lea rcx, str.remove
call fcn.140002d30
nop
call fcn.1400011e0
nop
call fcn.1400011e0
nop
call fcn.1400011e0
nop
call fcn.140001280
nop
call fcn.140001280
nop
call fcn.140001280
int3