Function at 0x140186c7c
Capabilities:
Create process on windows
Delete file

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x340
mov r14, rdx
xor edi, edi
mov rax, qword [rdx + 8]
cmp qword [rdx], rax
je 0x1401874c6
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], 6
mov r15d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x88], r15
mov eax, dword [str.SPURDO]
mov dword [rsp + 0x70], eax
movzx eax, word [0x140f0800c]
mov word [rsp + 0x74], ax
mov byte [rsp + 0x76], dil
lea r9, [rsp + 0x70]
lea rdx, [rsp + 0x168]
call fcn.140164968
mov rsi, rax
mov r8, qword [0x140fda2b8]
mov rdx, qword [r8 + 0x10]
movabs rbx, 0x7fffffffffffffff
mov rcx, rbx
sub rcx, rdx
lea r13d, [r15 - 3]
cmp rcx, r13
jb 0x1401875e8
mov r9, r8
cmp qword [r8 + 0x18], r15
jbe 0x140186d37
mov r9, qword [r8]
mov qword [rsp + 0x30], r13
lea rax, str.assetsmisc_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
mov dl, byte [rsp + 0x378]
lea rcx, [rsp + 0x110]
call fcn.14015cfb0
nop
mov r9, rsi
lea r8, [rsp + 0x110]
mov dl, byte [rsp + 0x378]
lea rcx, [rsp + 0x130]
call fcn.14016e980
nop
mov r8d, 4
lea rdx, str..exe
lea rcx, [rsp + 0x130]
call fcn.1401562b0
xorps xmm0, xmm0
movups xmmword [rsp + 0xb0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xc0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xb0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xc0], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r15
mov byte [rax], dil
mov rdx, qword [rsp + 0x148]
mov r12d, 0x1000
cmp rdx, r15
jbe 0x140186e19
inc rdx
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, r12
jb 0x140186e14
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401875ee
call fcn.140cba258
movdqa xmm0, xmmword [0x140f11610]
movdqu xmmword [rsp + 0x140], xmm0
mov byte [rsp + 0x130], dil
mov rdx, qword [rsp + 0x128]
cmp rdx, r15
jbe 0x140186e78
inc rdx
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, r12
jb 0x140186e6b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401875f4
call fcn.140cba258
movdqa xmm0, xmmword [0x140f11610]
mov rdx, qword [rsp + 0x180]
cmp rdx, r15
jbe 0x140186ebe
inc rdx
mov rcx, qword [rsp + 0x168]
mov rax, rcx
cmp rdx, r12
jb 0x140186eb1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401875fa
call fcn.140cba258
movdqa xmm0, xmmword [0x140f11610]
movdqu xmmword [rsp + 0x178], xmm0
mov byte [rsp + 0x168], dil
mov r8, qword [0x140fda2b8]
mov rax, qword [r8 + 0x10]
sub rbx, rax
cmp rbx, r13
jb 0x140187600
mov r9, r8
cmp qword [r8 + 0x18], r15
jbe 0x140186ef2
mov r9, qword [r8]
mov qword [rsp + 0x30], r13
lea rcx, str.assetsmisc_
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov dl, byte [rsp + 0x378]
lea rcx, [rsp + 0xf0]
call fcn.14015cfb0
nop
lea rax, [rsp + 0xf0]
cmp qword [rsp + 0x108], r15
cmova rax, qword [rsp + 0xf0]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0xd8], rax
movaps xmm0, xmmword [rsp + 0xd0]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x110]
call fcn.1401632bc
nop
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x90], xmm0
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x90]
call fcn.1401878c4
test eax, eax
jne 0x140187606
lea rcx, [rsp + 0x110]
call fcn.140162944
nop
mov rdx, qword [rsp + 0x108]
cmp rdx, r15
jbe 0x140186fe4
inc rdx
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, r12
jb 0x140186fdf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14018761d
call fcn.140cba258
mov rbx, qword [rsp + 0x98]
test rbx, rbx
je 0x140186ffd
lock inc dword [rbx + 8]
mov rbx, qword [rsp + 0x98]
movaps xmm0, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0xd0], xmm0
test rbx, rbx
je 0x14018701f
lock inc dword [rbx + 8]
mov rbx, qword [rsp + 0x98]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
or rsi, 0xffffffffffffffff
test rbx, rbx
je 0x140187072
mov eax, esi
lock xadd dword [rbx + 8], eax
add eax, esi
jne 0x14018706a
mov rbx, qword [rsp + 0x98]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
add eax, esi
jne 0x14018706a
mov rbx, qword [rsp + 0x98]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x140187072
mov rbx, qword [rsp + 0x98]
mov r13, qword [rsp + 0xd0]
cmp r13, qword [rsp + 0x50]
je 0x14018714d
add r13, 0x20
lea rdx, [rsp + 0x110]
mov rcx, r13
call fcn.1401606d4
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], r15
jbe 0x1401870a6
mov rax, qword [rax]
mov qword [rsp + 0x20], 6
lea r9, str.dv.bin
xor r8d, r8d
mov rcx, rax
call fcn.14017ca30
mov qword [rsp + 0x370], rax
mov rdx, qword [rsp + 0x128]
cmp rdx, r15
jbe 0x14018710f
inc rdx
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, r12
jb 0x140187102
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140187623
call fcn.140cba258
mov rax, qword [rsp + 0x370]
cmp rax, rsi
jne 0x140187133
mov rcx, r13
cmp qword [r13 + 0x18], 7
jbe 0x140187122
mov rcx, qword [r13]
call fcn.140cbca84
shr rax, 0x20
test eax, eax
jne 0x140187629
lea rcx, [rsp + 0xd0]
call fcn.14018680c
test eax, eax
jne 0x14018763a
jmp 0x140187072
mov rcx, qword [rsp + 0xd8]
test rcx, rcx
je 0x140187196
mov eax, esi
lock xadd dword [rcx + 8], eax
add eax, esi
jne 0x14018718e
mov rbx, qword [rsp + 0xd8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
add eax, esi
jne 0x14018718e
mov rcx, qword [rsp + 0xd8]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [rsp + 0x98]
test rbx, rbx
je 0x1401871d0
mov eax, esi
lock xadd dword [rbx + 8], eax
add eax, esi
jne 0x1401871d0
mov rbx, qword [rsp + 0x98]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
add eax, esi
jne 0x1401871d0
mov rcx, qword [rsp + 0x98]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
jmp 0x1401871e6
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x1c0]
call fcn.140168bbc
nop
mov rax, qword [rsp + 0x1c0]
movsxd rcx, dword [rax + 4]
test byte [rsp + rcx + 0x1d0], 6
jne 0x140187642
mov r8, qword [r14 + 8]
sub r8, qword [r14]
mov rdx, qword [r14]
lea rcx, [rsp + 0x1c0]
call fcn.14016a92c
lea rcx, [rsp + 0x1c0]
call fcn.140168aa0
mov dword [rsp + 0x2d0], WSAGetLastError
xor edx, edx
lea r8d, [rdx + 0x60]
lea rcx, [rsp + 0x2d8]
call fcn.140cfbde0
lea rcx, [rsp + 0xb0]
cmp qword [rsp + 0xc8], r15
cmova rcx, qword [rsp + 0xb0]
lea rax, [rsp + 0x150]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1401873a0
lea rcx, [rsp + 0xb0]
cmp qword [rsp + 0xc8], r15
cmova rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
lea rcx, [rsp + 0x268]
call fcn.140168b3c
nop
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x268], rax
lea rcx, [rsp + 0x268]
call fcn.140cbd2e4
nop
mov rdx, qword [rsp + 0xc8]
cmp rdx, r15
jbe 0x140187340
inc rdx
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, r12
jb 0x14018733b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140187779
call fcn.140cba258
movdqa xmm0, xmmword [0x140f11610]
movdqu xmmword [rsp + 0xc0], xmm0
mov byte [rsp + 0xb0], dil
mov rcx, qword [r14]
test rcx, rcx
je 0x140187399
mov rdx, qword [r14 + 0x10]
sub rdx, rcx
cmp rdx, r12
jb 0x140187389
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401874c0
mov rcx, r8
call fcn.140cba258
mov qword [r14], rdi
mov qword [r14 + 8], rdi
mov qword [r14 + 0x10], rdi
xor eax, eax
jmp 0x1401874a3
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xb0]
cmp qword [rsp + 0xc8], r15
cmova rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, dword [rsp + 0x160]
lea rcx, [rsp + 0x268]
call fcn.140168b3c
nop
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x268], rax
lea rcx, [rsp + 0x268]
call fcn.140cbd2e4
nop
mov rdx, qword [rsp + 0xc8]
cmp rdx, r15
jbe 0x14018744b
inc rdx
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, r12
jb 0x140187446
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140187779
call fcn.140cba258
movdqa xmm0, xmmword [0x140f11610]
movdqu xmmword [rsp + 0xc0], xmm0
mov byte [rsp + 0xb0], dil
mov rcx, qword [r14]
test rcx, rcx
je 0x1401874a0
mov rdx, qword [r14 + 0x10]
sub rdx, rcx
cmp rdx, r12
jb 0x140187490
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401874c0
mov rcx, r8
call fcn.140cba258
mov qword [r14], rdi
mov qword [r14 + 8], rdi
mov qword [r14 + 0x10], rdi
mov rax, rbx
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.140cd6fcc
nop
movabs rax, 0x8ae3a5a5829c691
mov qword [rsp + 0x70], rax
movabs rax, 0x6f2fae4e27c1f44
mov qword [rsp + 0x78], rax
movabs rax, 0xeca3ae054375bbbc
mov qword [r11 - 0x2e8], rax
movabs rax, 0xc3ce8eac2a8f66f8
mov qword [r11 - 0x2e0], rax
movabs rcx, 0x2894483f3c48a9dd
mov qword [rsp + 0x50], rcx
movabs rcx, 0x6fd2839683127606
mov qword [rsp + 0x58], rcx
movabs rcx, 0xcddada752e109bcf
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [rsp + 0x80]
xorps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x80], xmm1
lea rdx, [rsp + 0x70]
lea rcx, [r11 - 0x298]
call fcn.140155ef0
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.14015e888
movups xmm1, xmmword [rax]
movdqu xmmword [rsp + 0x50], xmm1
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xf0]
call fcn.14015e888
movups xmm1, xmmword [rax]
movdqu xmmword [rsp + 0x50], xmm1
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x110]
call fcn.1401879a0
nop
mov rdx, rax
lea rcx, [rsp + 0x190]
call fcn.14015e834
lea rdx, [0x140f44bc0]
lea rcx, [rsp + 0x190]
call fcn.140cc0808
nop
call fcn.14015186c
nop
call fcn.140cd6fcc
nop
call fcn.140cd6fcc
nop
call fcn.140cd6fcc
nop
call fcn.14015186c
nop
lea r8, [rsp + 0x110]
mov edx, eax
lea rcx, str.directory_iterator::directory_iterator
call fcn.1401867ac
nop
call fcn.140cd6fcc
nop
call fcn.140cd6fcc
int3
mov r8, r13
mov edx, eax
lea rcx, str.remove
call fcn.1401867ac
mov edx, eax
call fcn.140186750
nop
movabs rax, 0x5fb42c5a5021c89b
mov qword [rsp + 0x70], rax
movabs rax, 0x4fbdf7b6e6661f74
mov qword [rsp + 0x78], rax
movabs rax, 0xcddada754b7cf2a9
mov qword [rsp + 0x80], rax
movabs rax, 0xc3ce8eac2a8f66f8
mov qword [rsp + 0x88], rax
movabs rcx, 0x2894483f3c48a9dd
mov qword [rsp + 0x130], rcx
movabs rcx, 0x6fd2839683127606
mov qword [rsp + 0x138], rcx
movabs rcx, 0xcddada752e109bcf
mov qword [rsp + 0x140], rcx
mov qword [rsp + 0x148], rax
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rsp + 0x130]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [rsp + 0x80]
xorps xmm1, xmmword [rsp + 0x140]
movdqa xmmword [rsp + 0x80], xmm1
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xf0]
call fcn.140155ef0
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xd0]
call fcn.14015e888
movups xmm1, xmmword [rax]
movdqu xmmword [rsp + 0x50], xmm1
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.14015e888
movups xmm1, xmmword [rax]
movdqu xmmword [rsp + 0x50], xmm1
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x110]
call fcn.1401879a0
nop
mov rdx, rax
lea rcx, [rsp + 0x1a8]
call fcn.14015e834
lea rdx, [0x140f44bc0]
lea rcx, [rsp + 0x1a8]
call fcn.140cc0808
nop
call fcn.140cd6fcc
int3