Function at 0x140001a10
Capabilities:
Create thread
Execute command
Self delete

Disassembly:
sub rsp, 0x38
test ecx, ecx
jne 0x140001c50
lea rcx, str.cd_C:WindowsPrefetch__del_ANYDESK__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_ATX__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_DXDIAG__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_LOGONUI__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_REG__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_REGEDIT__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_REGSCANNER__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_RG__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_SEARCHAPP__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_SMARTSCREEN__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_TASKMGR__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_TASKKILL__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_TRACKER__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_CLEANER__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_LAUNCHER__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_SCHTASKS__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_TRACKER__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_WEVTUTIL__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_IP__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_TASKLIST__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_CL__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_LOADER__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_POWERSHELL__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_CMD__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_EXPLORER__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_INJECT__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_PURPLERAIN__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_TASK__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_LNV_TOOL__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_LAST__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_EXECUTED__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_EVERYTHING__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_REGSCANNER__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_SHELL__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_USB__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_RECOVER__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_X64LAUNCHER__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_SPOTIFY__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_SPOTIFYINSTALLER__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_SPOTIFYSETUP__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_JSON__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_POWERSHELL__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsPrefetch__del_CMD__Q__F
add rsp, 0x38
jmp qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp ecx, 1
jne 0x140002393
mov qword [rsp + 0x30], rbx
lea r9, str.cd_C:WindowsPrefetch__del_ANYDESK__Q__F
xor ebx, ebx
lea r8, [0x140001060]
mov qword [rsp + 0x28], rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140001c8f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_ATX__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140001cbe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_DXDIAG__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140001ced
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_LOGONUI__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140001d1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_REG__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140001d4b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_REGEDIT__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140001d7a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_REGSCANNER__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140001da9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_RG__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140001dd8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_SEARCHAPP__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140001e07
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_SMARTSCREEN__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140001e36
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_TASKMGR__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140001e65
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_TASKKILL__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140001e94
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_TASKLIST__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140001ec3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_TRACKER__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140001ef2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_CLEANER__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140001f21
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_LAUNCHER__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140001f50
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_SCHTASKS__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140001f7f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_TRACKER__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140001fae
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_WEVTUTIL__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140001fdd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_IP__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14000200c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_CL__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14000203b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_LOADER__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14000206a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_EXPLORER__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140002099
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_INJECT__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1400020c8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_PURPLERAIN__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1400020f7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_TASK__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140002126
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_X64LAUNCHER__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140002155
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_LAST__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140002184
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_EXECUTED__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1400021b3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_EVERYTHING__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1400021e2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_REGSCANNER__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140002211
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_SHELL__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140002240
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_USB__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14000226f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_RECOVER__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14000229e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_SPOTIFYINSTALLER__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1400022cd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_SPOTIFYSETUP__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1400022fc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_JSON__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14000232b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_POWERSHELL__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14000235a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:WindowsPrefetch__del_CMD__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x30]
test rax, rax
je 0x140002393
mov rcx, rax
add rsp, 0x38
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x38
ret