Function at 0x1403998f0
Capabilities:
Create process on windows
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1403a2010]
xor rax, rsp
mov qword [rbp], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x70], 0x68
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x68], xmm0
xor esi, esi
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], rsi
lea r14, [0x1403a2068]
cmp qword [0x1403a2080], 0x10
cmovae r14, qword [0x1403a2068]
mov rdi, qword [0x1403a2078]
movabs rbx, 0x7fffffffffffffff
cmp rdi, rbx
ja 0x140399c3e
mov ecx, 0xf
mov qword [rbp - 0x80], rcx
cmp rdi, 0x10
jae 0x1403999b3
mov qword [rsp + 0x78], rdi
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x68], xmm0
jmp 0x140399a4e
mov rax, rdi
or rax, rcx
cmp rax, rbx
jbe 0x1403999ee
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14039bdd0
mov rcx, rax
test rax, rax
je 0x140399c07
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140399a28
mov rbx, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140399a19
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140399c44
jmp 0x1403999cc
test rcx, rcx
je 0x140399a25
call fcn.14039bdd0
jmp 0x140399a28
mov rax, rsi
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbp - 0x80]
mov rdi, qword [rsp + 0x78]
mov rax, rcx
sub rax, rdi
cmp rax, 1
jb 0x140399a7a
lea rax, [rdi + 1]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x68]
cmp rcx, 0x10
cmovae rax, qword [rsp + 0x68]
mov word [rax + rdi], 0x20
jmp 0x140399a99
mov qword [rsp + 0x20], 1
lea r9, [0x14039e610]
mov edx, 1
lea rcx, [rsp + 0x68]
call fcn.14039bb80
mov rdx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x80]
mov rax, r8
sub rax, rdx
lea rcx, [rsp + 0x68]
cmp rax, 8
jb 0x140399ad8
lea rax, [rdx + 8]
mov qword [rsp + 0x78], rax
cmp r8, 0x10
cmovae rcx, qword [rsp + 0x68]
mov rax, qword [0x14039e5e0]
mov qword [rcx + rdx], rax
mov byte [rcx + rdx + 8], 0
jmp 0x140399af2
mov qword [rsp + 0x20], 8
lea r9, [0x14039e5e0]
mov edx, 8
call fcn.14039bb80
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rdx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test eax, eax
je 0x140399b84
lea rdx, str.Program_started_successfully.
call fcn.14039b530
mov rcx, rax
lea rdx, [0x14039b700]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140399ba0
lea rdx, str.Error_starting_the_program.
call fcn.14039b530
mov rcx, rax
lea rdx, [0x14039b700]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.sus.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
test eax, eax
jne 0x140399bc2
lea rcx, [0x14039e5e0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
test eax, eax
je 0x140399bd4
lea rcx, str.Error_removing_the_file
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov esi, 1
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x140399c13
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140399c0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140399c0e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14039c05c
mov eax, esi
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.14039bdb0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1403994a0
int3
call fcn.140399400
int3