Function at 0x140009870
Capabilities:
Delete file
Execute command

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x78]
sub rsp, 0x150
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x140019040]
xor rax, rsp
mov qword [rbp + 0x28], rax
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], recv
mov byte [rbp - 0x60], dil
test ecx, ecx
je 0x1400098eb
cmp ecx, 1
jne 0x140009931
mov rbx, qword [0x140019d20]
lea r9, [0x140019d10]
cmp qword [0x140019d28], 0xf
cmova r9, qword [0x140019d10]
jmp 0x140009909
mov rbx, qword [0x140019d00]
lea r9, [0x140019cf0]
cmp qword [0x140019d08], 0xf
cmova r9, qword [0x140019cf0]
lea rcx, [rbp - 0x60]
cmp rbx, 0xf
ja 0x140009929
mov qword [rbp - 0x50], rbx
mov r8, rbx
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rbx - 0x60], 0
jmp 0x140009931
mov rdx, rbx
call fcn.140001ee0
lea r8, str.USERPROFILE
lea rdx, [rbp]
lea rcx, [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__dupenv_s]
test eax, eax
jne 0x140009eba
mov rdx, qword [rsp + 0x78]
test rdx, rdx
je 0x140009eba
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140009975
lea rcx, [rsp + 0x40]
call fcn.14000de00
nop
mov r8d, 0x29
lea rdx, str..lunarclientofflinemultiveroverrides_
lea rcx, [rsp + 0x40]
call fcn.14000b8b0
movups xmm7, xmmword [rax]
movups xmmword [rbp + 8], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0x18], xmm6
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], recv
mov byte [rax], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400099ff
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400099fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400099fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001039c
movdqa xmm0, xmmword [0x140013ee0]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
sub rax, qword [rbp - 0x50]
cmp rax, 4
jb 0x140009f65
lea r9, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova r9, qword [rbp - 0x60]
mov qword [rsp + 0x30], 4
lea rax, str..jar
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 0x20]
call fcn.14000e880
nop
mov rax, rbx
movq r15, xmm6
sub rax, r15
mov r13, qword [rbp - 0x10]
cmp rax, r13
jb 0x140009f6b
lea rax, [rbp + 8]
movq rsi, xmm7
psrldq xmm6, 8
movq rcx, xmm6
mov qword [rsp + 0x70], rcx
cmp rcx, 0xf
cmova rax, rsi
mov qword [rsp + 0x60], rax
lea rcx, [rbp - 0x20]
mov r14, qword [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rcx, r14
mov qword [rsp + 0x68], rcx
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rdi
lea r12, [r15 + r13]
mov ebx, recv
lea rdi, [rbp - 0x80]
movabs rdx, 0x8000000000000000
lea r8d, [rbx + 7]
cmp r12, rbx
jbe 0x140009b63
mov rbx, r12
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
jbe 0x140009b26
mov rbx, rcx
lea rax, [rdx + 0x27]
mov rcx, rax
call fcn.140010360
test rax, rax
je 0x140009e1f
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov rax, qword [rsp + 0x60]
jmp 0x140009b5f
cmp rbx, r8
cmovb rbx, r8
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140009b49
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140009f59
jmp 0x140009b02
test rcx, rcx
je 0x140009b5d
call fcn.140010360
mov rdi, rax
mov rax, qword [rsp + 0x60]
jmp 0x140009b5f
xor edi, edi
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], rbx
mov r8, r15
mov rdx, rax
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [r15 + rdi]
mov r8, r13
mov rdx, qword [rsp + 0x68]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r12], 0
mov r13, qword [rbp - 0x70]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 0xe
jb 0x140009f53
lea r12, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova r12, qword [rbp - 0x80]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea r15, [r13 + 0xe]
mov ebx, recv
lea rdi, [rsp + 0x40]
cmp r15, rbx
jbe 0x140009c5d
mov rbx, r15
or rbx, 0xf
cmp rbx, rcx
jbe 0x140009c17
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140010360
test rax, rax
je 0x140009c40
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140009c58
cmp rbx, 0x16
mov eax, socket
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140009c47
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140009f5f
jmp 0x140009bfc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140009c56
call fcn.140010360
mov rdi, rax
jmp 0x140009c58
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rbx
movsd xmm0, qword [str.attrib__h__s__]
movsd qword [rdi], xmm0
mov eax, dword [0x140013b10]
mov dword [rdi + 8], eax
movzx eax, word [0x140013b14]
mov word [rdi + 0xc], ax
lea rcx, [rdi + 0xe]
mov r8, r13
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r15], 0
mov r8d, 1
lea rdx, [0x140013b04]
lea rcx, [rsp + 0x40]
call fcn.14000b8b0
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], recv
mov byte [rax], bl
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140009d20
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009d1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009d1b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001039c
movdqa xmm0, xmmword [0x140013ee0]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rcx, qword [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova rcx, qword [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
test eax, eax
jne 0x140009d6f
lea rdx, str.____Client_deleted_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
jmp 0x140009d7d
lea rdx, str.____Failed_to_delete_client_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000d750
lea rdx, [0x14000d920]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140009ddc
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009dd7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009dd7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001039c
movdqa xmm0, xmmword [0x140013ee0]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140009e2b
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009e26
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009e26
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001039c
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], recv
mov byte [rbp - 0x80], 0
mov rax, qword [rbp - 8]
cmp rax, 0xf
jbe 0x140009e7a
lea rdx, [rax + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140009e71
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009e71
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14001039c
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140009ede
inc rdx
mov rax, rsi
cmp rdx, 0x1000
jb 0x140009eb0
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009eb0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14001039c
jmp 0x140009ede
lea rdx, str.Failed_to_retrieve_the_USERPROFILE_environment_variable.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000d750
lea rdx, [0x14000d920]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140009f1c
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009f17
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009f17
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001039c
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.140010340
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001220
nop
call fcn.140001180
nop
call fcn.140001180
nop
call fcn.140001220
nop
call fcn.140001220
int3