Function at 0x14000ee80
Capabilities:
Execute command
Move file

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x368
mov rax, qword [0x140034040]
xor rax, rsp
mov qword [rsp + 0x350], rax
lea rcx, [0x14000ee60]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, 0x104
lea rdx, [rsp + 0x240]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rsp + 0xb0]
lea rcx, [0x14002fa88]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xe
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 0xd
movsx eax, byte [rsp + rax + 0xb0]
test eax, eax
je 0x14000ef0b
mov dword [rsp + 0x64], 1
jmp 0x14000ef13
mov dword [rsp + 0x64], 0
movzx eax, byte [rsp + 0x64]
test eax, eax
je 0x14000ef75
mov dword [rsp + 0x30], 0
jmp 0x14000ef30
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xe
jge 0x14000ef75
movsxd rax, dword [rsp + 0x30]
movsx eax, byte [rsp + rax + 0xb0]
mov dword [rsp + 0xac], eax
mov eax, dword [rsp + 0x30]
cdq
mov ecx, 0x34
idiv ecx
mov eax, edx
add eax, 0x37
mov ecx, dword [rsp + 0xac]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x30]
mov byte [rsp + rcx + 0xb0], al
jmp 0x14000ef26
lea rax, [rsp + 0xb0]
mov rdx, rax
lea rcx, [rsp + 0x240]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
call fcn.1400173c0
mov byte [rsp + 0x20], al
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0xf0], rax
lea rax, [rsp + 0xc0]
lea rcx, str.WXexOWI_3bydE
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 0xe
movsx eax, byte [rsp + rax + 0xc0]
test eax, eax
je 0x14000efe1
mov dword [rsp + 0x68], 1
jmp 0x14000efe9
mov dword [rsp + 0x68], 0
movzx eax, byte [rsp + 0x68]
test eax, eax
je 0x14000f04b
mov dword [rsp + 0x34], 0
jmp 0x14000f006
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0xf
jge 0x14000f04b
movsxd rax, dword [rsp + 0x34]
movsx eax, byte [rsp + rax + 0xc0]
mov dword [rsp + 0x88], eax
mov eax, dword [rsp + 0x34]
cdq
mov ecx, 0x34
idiv ecx
mov eax, edx
add eax, 0x37
mov ecx, dword [rsp + 0x88]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x34]
mov byte [rsp + rcx + 0xc0], al
jmp 0x14000effc
lea rax, [rsp + 0xc0]
mov qword [rsp + 0xe8], rax
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xf0]
call fcn.140012af0
mov qword [rsp + 0xf8], rax
movzx edx, byte [rsp + 0x20]
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___bool____ptr64]
mov qword [rsp + 0x108], rax
movzx eax, word [0x14002faa0]
mov word [rsp + 0x24], ax
mov eax, 1
imul rax, rax, 1
movsx eax, byte [rsp + rax + 0x24]
test eax, eax
je 0x14000f0bb
mov dword [rsp + 0x6c], 1
jmp 0x14000f0c3
mov dword [rsp + 0x6c], 0
movzx eax, byte [rsp + 0x6c]
test eax, eax
je 0x14000f11f
mov dword [rsp + 0x38], 0
jmp 0x14000f0e0
mov eax, dword [rsp + 0x38]
inc eax
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 2
jge 0x14000f11f
movsxd rax, dword [rsp + 0x38]
movsx eax, byte [rsp + rax + 0x24]
mov dword [rsp + 0x8c], eax
mov eax, dword [rsp + 0x38]
cdq
mov ecx, 0x34
idiv ecx
mov eax, edx
add eax, 0x37
mov ecx, dword [rsp + 0x8c]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x38]
mov byte [rsp + rcx + 0x24], al
jmp 0x14000f0d6
lea rax, [rsp + 0x24]
mov qword [rsp + 0x100], rax
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x108]
call fcn.140012af0
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14000f2d3
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x118], rax
lea rax, [rsp + 0x180]
lea rcx, str.qYPVX
mov rdi, rax
mov rsi, rcx
mov ecx, 0x17
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 0x16
movsx eax, byte [rsp + rax + 0x180]
test eax, eax
je 0x14000f198
mov dword [rsp + 0x70], 1
jmp 0x14000f1a0
mov dword [rsp + 0x70], 0
movzx eax, byte [rsp + 0x70]
test eax, eax
je 0x14000f202
mov dword [rsp + 0x3c], 0
jmp 0x14000f1bd
mov eax, dword [rsp + 0x3c]
inc eax
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0x17
jge 0x14000f202
movsxd rax, dword [rsp + 0x3c]
movsx eax, byte [rsp + rax + 0x180]
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0x3c]
cdq
mov ecx, 0x34
idiv ecx
mov eax, edx
add eax, 0x37
mov ecx, dword [rsp + 0x90]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x3c]
mov byte [rsp + rcx + 0x180], al
jmp 0x14000f1b3
lea rax, [rsp + 0x180]
mov qword [rsp + 0x110], rax
mov rdx, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x118]
call fcn.140012af0
lea rax, [rsp + 0x54]
lea rcx, str.GYLI_
mov rdi, rax
mov rsi, rcx
mov ecx, 6
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 5
movsx eax, byte [rsp + rax + 0x54]
test eax, eax
je 0x14000f25c
mov dword [rsp + 0x74], 1
jmp 0x14000f264
mov dword [rsp + 0x74], 0
movzx eax, byte [rsp + 0x74]
test eax, eax
je 0x14000f2c0
mov dword [rsp + 0x40], 0
jmp 0x14000f281
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 6
jge 0x14000f2c0
movsxd rax, dword [rsp + 0x40]
movsx eax, byte [rsp + rax + 0x54]
mov dword [rsp + 0x94], eax
mov eax, dword [rsp + 0x40]
cdq
mov ecx, 0x34
idiv ecx
mov eax, edx
add eax, 0x37
mov ecx, dword [rsp + 0x94]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x40]
mov byte [rsp + rcx + 0x54], al
jmp 0x14000f277
lea rax, [rsp + 0x54]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x14000f70c
lea rax, [rsp + 0x228]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rax, [rsp + 0x228]
mov qword [rsp + 0x120], rax
mov rax, qword [rsp + 0x120]
mov rcx, rax
call fcn.14000dc50
lea rax, [rsp + 0x228]
mov qword [rsp + 0x1b8], rax
lea rax, [rsp + 0x198]
lea rcx, str.zQZHTORXK
mov rdi, rax
mov rsi, rcx
mov ecx, 0x20
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0xf
movzx eax, word [rsp + rax + 0x198]
test eax, eax
je 0x14000f352
mov dword [rsp + 0x78], 1
jmp 0x14000f35a
mov dword [rsp + 0x78], 0
movzx eax, byte [rsp + 0x78]
test eax, eax
je 0x14000f3bd
mov dword [rsp + 0x44], 0
jmp 0x14000f377
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0x10
jge 0x14000f3bd
movsxd rax, dword [rsp + 0x44]
movzx eax, word [rsp + rax*2 + 0x198]
mov dword [rsp + 0x98], eax
mov eax, dword [rsp + 0x44]
cdq
mov ecx, 0x34
idiv ecx
mov eax, edx
add eax, 0x37
mov ecx, dword [rsp + 0x98]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x44]
mov word [rsp + rcx*2 + 0x198], ax
jmp 0x14000f36d
lea rax, [rsp + 0x198]
mov rdx, rax
lea rcx, [rsp + 0x1c0]
call fcn.140011570
nop
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x1c0]
call fcn.14000ec20
nop
lea rcx, [rsp + 0x1c0]
call fcn.140002620
lea rcx, [rsp + 0x1e0]
call fcn.140009e30
lea rcx, [rsp + 0x200]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x20
rep movsb byte [rdi], byte [rsi]
lea rdx, str.EntryData.KernelEntryDataOut
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012af0
mov qword [rsp + 0x128], rax
mov rdx, qword [rsp + 0x218]
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
lea rdx, [0x14002e9fc]
mov rcx, rax
call fcn.140012af0
mov rax, qword [rsp + 0x228]
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x138], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x140], rax
lea r8, [rsp + 0x220]
mov rdx, qword [rsp + 0x218]
mov rcx, qword [rsp + 0x140]
call fcn.1400145e0
lea rdx, str.Status_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012af0
mov qword [rsp + 0x148], rax
mov eax, dword [rsp + 0x220]
mov dword [rsp + 0x9c], eax
mov edx, dword [rsp + 0x9c]
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, str._Success_:
mov rcx, rax
call fcn.140012af0
mov qword [rsp + 0x178], rax
cmp dword [rsp + 0x220], 0
jl 0x14000f50e
mov byte [rsp + 0x21], 1
jmp 0x14000f513
mov byte [rsp + 0x21], 0
movzx edx, byte [rsp + 0x21]
mov rcx, qword [rsp + 0x178]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___bool____ptr64]
lea rdx, [0x14002ea20]
mov rcx, rax
call fcn.140012af0
lea rcx, [rsp + 0x200]
call fcn.140009db0
call fcn.1400194a0
mov byte [rsp + 0x2c], al
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0xd0]
lea rcx, str.sJPLN
mov rdi, rax
mov rsi, rcx
mov ecx, 0x11
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 0x10
movsx eax, byte [rsp + rax + 0xd0]
test eax, eax
je 0x14000f595
mov dword [rsp + 0x7c], 1
jmp 0x14000f59d
mov dword [rsp + 0x7c], 0
movzx eax, byte [rsp + 0x7c]
test eax, eax
je 0x14000f5ff
mov dword [rsp + 0x48], 0
jmp 0x14000f5ba
mov eax, dword [rsp + 0x48]
inc eax
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0x11
jge 0x14000f5ff
movsxd rax, dword [rsp + 0x48]
movsx eax, byte [rsp + rax + 0xd0]
mov dword [rsp + 0xa0], eax
mov eax, dword [rsp + 0x48]
cdq
mov ecx, 0x34
idiv ecx
mov eax, edx
add eax, 0x37
mov ecx, dword [rsp + 0xa0]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x48]
mov byte [rsp + rcx + 0xd0], al
jmp 0x14000f5b0
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x150], rax
mov rdx, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x158]
call fcn.140012af0
mov qword [rsp + 0x160], rax
movzx edx, byte [rsp + 0x2c]
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___bool____ptr64]
mov qword [rsp + 0x170], rax
movzx eax, word [0x14002faa0]
mov word [rsp + 0x28], ax
mov eax, 1
imul rax, rax, 1
movsx eax, byte [rsp + rax + 0x28]
test eax, eax
je 0x14000f672
mov dword [rsp + 0x80], 1
jmp 0x14000f67d
mov dword [rsp + 0x80], 0
movzx eax, byte [rsp + 0x80]
test eax, eax
je 0x14000f6dc
mov dword [rsp + 0x4c], 0
jmp 0x14000f69d
mov eax, dword [rsp + 0x4c]
inc eax
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x4c], 2
jge 0x14000f6dc
movsxd rax, dword [rsp + 0x4c]
movsx eax, byte [rsp + rax + 0x28]
mov dword [rsp + 0xa4], eax
mov eax, dword [rsp + 0x4c]
cdq
mov ecx, 0x34
idiv ecx
mov eax, edx
add eax, 0x37
mov ecx, dword [rsp + 0xa4]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x4c]
mov byte [rsp + rcx + 0x28], al
jmp 0x14000f693
lea rax, [rsp + 0x28]
mov qword [rsp + 0x168], rax
mov rdx, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x170]
call fcn.140012af0
nop
lea rcx, [rsp + 0x228]
call fcn.140011990
lea rax, [rsp + 0x5c]
lea rcx, str.GYLI_
mov rdi, rax
mov rsi, rcx
mov ecx, 6
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 5
movsx eax, byte [rsp + rax + 0x5c]
test eax, eax
je 0x14000f744
mov dword [rsp + 0x84], 1
jmp 0x14000f74f
mov dword [rsp + 0x84], 0
movzx eax, byte [rsp + 0x84]
test eax, eax
je 0x14000f7ae
mov dword [rsp + 0x50], 0
jmp 0x14000f76f
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 6
jge 0x14000f7ae
movsxd rax, dword [rsp + 0x50]
movsx eax, byte [rsp + rax + 0x5c]
mov dword [rsp + 0xa8], eax
mov eax, dword [rsp + 0x50]
cdq
mov ecx, 0x34
idiv ecx
mov eax, edx
add eax, 0x37
mov ecx, dword [rsp + 0xa8]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x50]
mov byte [rsp + rcx + 0x5c], al
jmp 0x14000f765
lea rax, [rsp + 0x5c]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.14002b1c0
add rsp, 0x368
pop rdi
pop rsi
ret