Function at 0x140004880
Capabilities:
Accept command line arguments
Acquire debug privileges
Check if file exists
Delete file
Hide graphical window

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x3c8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x340], 0xfffffffffffffffe
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x80000000
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
xor ecx, ecx
xor edx, edx
xor r8d, r8d
mov r9d, 0x8000000
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.140014d20
mov byte [0x14009065c], al
call fcn.140014d80
mov byte [0x14009065d], al
lea rcx, str.SeDebugPrivilege
call fcn.140006140
mov dword [0x140090658], eax
call fcn.140014d90
lea rdx, [0x14008f260]
lea rsi, [rbp + 0x2f8]
mov rcx, rsi
mov r8d, 0x1e
call fcn.140006940
nop
cmp qword [rbp + 0x310], 8
jb 0x140004948
mov rsi, qword [rbp + 0x2f8]
mov qword [rbp + 0x2d0], rsi
lea rax, [0x140003560]
mov qword [rbp + 0x2d8], rax
lea rcx, [rbp + 0x2d0]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
xor ecx, ecx
call fcn.140040c8c
mov ecx, eax
call fcn.140043eb0
mov ecx, 0x10
call fcn.140006cb0
nop
mov dword [rbp + 0x33c], 0
nop
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rbp + 0x33c]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rsi, rax
cmp dword [rbp + 0x33c], 2
jl 0x140004b29
nop
mov rdi, qword [rsi + 8]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
mov rcx, rdi
call fcn.1400441fc
mov rbx, rax
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jae 0x140004d3a
cmp rbx, 7
ja 0x140004a12
nop
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], 7
lea r8, [rbx + rbx]
lea rcx, [rbp - 0x20]
mov rdx, rdi
call fcn.14006d670
lea rax, [rbx*2 - 0x20]
add rax, rbp
jmp 0x140004a86
nop
mov qword [rbp - 8], 7
mov rax, rbx
or rax, 7
movabs r15, 0x7ffffffffffffffe
mov rcx, 0xfffffffffffffffe
cmp rax, r15
ja 0x140004a57
cmp rax, 0xb
mov r15d, 0xa
cmovae r15, rax
lea rcx, [r15*2 + 2]
cmp r15, 0x7ff
jb 0x140004a5e
call fcn.140005860
jmp 0x140004a63
call fcn.14001ef3c
mov r14, rax
nop
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], r15
lea r8, [rbx + rbx]
mov rcx, rax
mov rdx, rdi
call fcn.14006d670
lea rax, [r14 + rbx*2]
nop
mov word [rax], 0
nop
cmp qword [rbp - 8], 8
jb 0x140004a9a
mov rcx, qword [rbp - 0x20]
jmp 0x140004a9e
lea rcx, [rbp - 0x20]
nop
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140004ae0
nop
cmp qword [rbp - 8], 8
jb 0x140004ab8
mov rcx, qword [rbp - 0x20]
jmp 0x140004abc
lea rcx, [rbp - 0x20]
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
nop
cmp qword [rbp - 8], 8
jb 0x140004ad5
mov rcx, qword [rbp - 0x20]
jmp 0x140004ad9
lea rcx, [rbp - 0x20]
nop
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rax, qword [rbp - 8]
cmp rax, 8
jb 0x140004b29
nop
mov rcx, qword [rbp - 0x20]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140004b24
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140004d44
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.140003640
mov esi, eax
mov eax, dword [0x140090658]
test eax, eax
je 0x140004b83
cmp eax, 1
jne 0x140004b88
nop
cmp dword [rbp + 0x33c], 1
jg 0x140004b7c
lea rdx, str.5___
lea rcx, [rbp + 0x1f0]
mov r8d, 5
call fcn.140006940
lea rcx, [rbp + 0x1f0]
call fcn.140002580
call fcn.140002700
call fcn.140002330
jmp 0x140004b88
call fcn.140003170
and esi, 5
cmp esi, 1
je 0x140004c04
nop
cmp dword [0x140090658], 1
je 0x140004ca2
call fcn.140016710
nop
mov rax, qword [rbp + 0x310]
cmp rax, 8
jb 0x140004bf2
nop
mov rcx, qword [rbp + 0x2f8]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140004bed
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140004d3f
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
xor eax, eax
add rsp, 0x3c8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea rdx, [rbp - 0x20]
xor ecx, ecx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [0x140070796]
lea rcx, [rbp + 0x318]
call fcn.140004620
lea rcx, [rbp + 0x318]
lea rdx, [rbp - 0x20]
call fcn.140005150
lea rdx, [0x14007079c]
lea rcx, [rbp + 0x318]
call fcn.140005150
lea rcx, [rbp + 0x230]
lea rdx, [rbp + 0x318]
call fcn.1400051d0
lea rdx, [0x140090450]
lea rcx, [rbp + 0x250]
call fcn.140004620
lea rcx, [rbp + 0x210]
lea rdx, [rbp + 0x250]
lea r8, [rbp + 0x230]
xor r9d, r9d
call fcn.140006ed0
lea rcx, [rbp + 0x210]
call fcn.140002170
xor ecx, ecx
call fcn.14003b778
lea rdx, [0x1400707a0]
lea rcx, [rbp - 0x20]
call fcn.140004620
lea rdx, str.5___
lea rcx, [rbp + 0x318]
mov r8d, 5
call fcn.140006940
lea rcx, [rbp - 0x20]
lea rdx, [rbp + 0x318]
call fcn.1400030f0
lea rcx, [rbp + 0x318]
call fcn.140002170
lea rcx, [rbp + 0x290]
lea rdx, [rbp - 0x20]
call fcn.1400051d0
lea rdx, str.net.exe
lea rcx, [rbp + 0x2b0]
call fcn.140004620
lea rcx, [rbp + 0x270]
lea rdx, [rbp + 0x2b0]
lea r8, [rbp + 0x290]
xor r9d, r9d
call fcn.140006ed0
lea rcx, [rbp + 0x270]
call fcn.140002170
xor ecx, ecx
call fcn.14003b778
call fcn.140005840
call fcn.14003f990
call fcn.14003f990
int3