Function at 0x1400b3730
Capabilities:
Delete file
Execute command
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2d8
mov rdi, rdx
lea r12, [rsp + 0x30]
lea rsi, [rsp + 0x50]
mov ebp, ecx
call fcn.14000a960
mov rdx, qword [rdi]
mov rcx, r12
call fcn.140001450
lea rdx, str.___daemonized
mov rcx, rsi
call fcn.140001450
cmp ebp, 1
jle 0x1400b37e7
lea eax, [rbp - 2]
lea rbx, [rdi + 8]
lea rbp, [rdi + rax*8 + 0x10]
lea r13, [0x1400b8064]
movabs rdi, 0x3fffffffffffffff
nop dword [rax + rax]
cmp qword [rsp + 0x58], rdi
je 0x1400b4474
mov r8d, 1
mov rdx, r13
mov rcx, rsi
call fcn.1400a0650
mov r14, qword [rbx]
mov rcx, r14
call sub.msvcrt.dll_strlen
mov r8, rax
mov rax, rdi
sub rax, qword [rsp + 0x58]
cmp rax, r8
jb 0x1400b44a4
mov rdx, r14
mov rcx, rsi
call fcn.1400a0650
add rbx, 8
cmp rbp, rbx
jne 0x1400b3798
mov edx, 0x5c
mov rcx, r12
mov r8, 0xffffffffffffffff
call fcn.140029d90
lea rcx, [rsp + 0x70]
lea rdx, [0x1400b8040]
mov rbx, rax
call fcn.140001450
lea rbp, [rsp + 0xf0]
lea r9, [rbx + 1]
xor r8d, r8d
mov rdx, r12
mov rcx, rbp
call fcn.140029e10
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
mov rcx, rbp
call fcn.14009f220
lea rcx, [rsp + 0x90]
mov rdx, rax
lea rbx, [rsp + 0x100]
call fcn.1400a0a00
mov rcx, qword [rsp + 0xf0]
cmp rcx, rbx
je 0x1400b3865
call fcn.1400b2d70
lea rax, [rsp + 0xd0]
lea r12, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov rax, qword [0x1400be2d0]
lea r15, [rax + 0x10]
nop dword [rax]
mov rsi, qword [rsp + 0x98]
mov qword [rsp + 0xd0], r12
mov rdi, qword [rsp + 0x90]
mov qword [rsp + 0xf0], rsi
cmp rsi, 0xf
ja 0x1400b40c0
cmp rsi, 1
jne 0x1400b40a8
movzx eax, byte [rdi]
mov byte [rsp + 0xe0], al
mov rax, r12
mov qword [rsp + 0xd8], rsi
mov byte [rax + rsi], 0
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0xd8]
cmp rax, 3
jbe 0x1400b4498
mov rcx, qword [rsp + 0x20]
mov r8d, 4
lea rdx, str..upd
call fcn.1400a0650
mov rax, qword [rsp + 0xd0]
lea r13, [rsp + 0x1c0]
mov rcx, r13
mov qword [rsp + 0x28], rax
call fcn.1400aa130
pxor xmm0, xmm0
xor r8d, r8d
xor edx, edx
mov rdi, qword [0x1400bde70]
mov rsi, qword [0x1400bde70]
mov word [rsp + 0x2a0], r8w
movups xmmword [rsp + 0x2a8], xmm0
mov rdi, qword [rdi + 8]
movups xmmword [rsp + 0x2b8], xmm0
mov r14, qword [rsi + 0x10]
mov qword [rsp + 0x1c0], r15
mov rax, qword [rdi - 0x18]
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0x298], 0
mov qword [rsp + rax + 0xf0], r14
mov qword [rsp + 0xf8], 0
mov rcx, qword [rdi - 0x18]
add rcx, rbp
call fcn.1400ab1a0
mov rsi, qword [0x1400be040]
mov rcx, rbx
lea rax, [rsi + 0x18]
mov qword [rsp + 0xf0], rax
lea rax, [rsi + 0x40]
mov qword [rsp + 0x1c0], rax
call fcn.1400835b0
mov rdx, rbx
mov rcx, r13
call fcn.1400ab1a0
mov rdx, qword [rsp + 0x28]
mov r8d, 8
mov rcx, rbx
call fcn.140081c10
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [rdx - 0x18]
add rcx, rbp
test rax, rax
je 0x1400b4110
xor edx, edx
call fcn.1400ab370
mov eax, dword [rsp + 0x1e0]
mov rcx, rbx
mov dword [rsp + 0x28], eax
lea rax, [rsi + 0x18]
add rsi, 0x40
mov qword [rsp + 0xf0], rax
mov rax, qword [0x1400be020]
mov qword [rsp + 0x1c0], rsi
add rax, 0x10
mov qword [rsp + 0x100], rax
call fcn.140082060
lea rcx, [rsp + 0x148]
call fcn.14007b860
mov rax, qword [0x1400be080]
lea rcx, [rsp + 0x138]
add rax, 0x10
mov qword [rsp + 0x100], rax
call fcn.14009d020
mov rax, qword [rdi - 0x18]
mov rcx, r13
mov qword [rsp + 0xf0], rdi
mov qword [rsp + rax + 0xf0], r14
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x1c0], r15
call fcn.1400aa1d0
mov rcx, qword [rsp + 0xd0]
cmp rcx, r12
je 0x1400b3aae
call fcn.1400b2d70
mov edx, dword [rsp + 0x28]
mov rsi, qword [rsp + 0x98]
test edx, edx
jne 0x1400b3e04
mov qword [rsp + 0xf0], rbx
mov rdi, qword [rsp + 0x90]
mov qword [rsp + 0xd0], rsi
cmp rsi, 0xf
ja 0x1400b4180
cmp rsi, 1
je 0x1400b4170
test rsi, rsi
jne 0x1400b4400
mov rax, rbx
mov qword [rsp + 0xf8], rsi
mov byte [rax + rsi], 0
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0xf8]
cmp rax, 3
jbe 0x1400b44c8
lea rdi, str..bak
mov r8d, 4
mov rcx, rbp
mov rdx, rdi
call fcn.1400a0650
mov rcx, rbp
call fcn.1400014f0
mov rcx, qword [rsp + 0xf0]
mov r14d, eax
cmp rcx, rbx
je 0x1400b3b57
call fcn.1400b2d70
mov r13, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x98]
test r14b, r14b
je 0x1400b3c14
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xd0], rsi
cmp rsi, 0xf
ja 0x1400b4348
cmp rsi, 1
je 0x1400b42a0
test rsi, rsi
jne 0x1400b4453
mov rax, rbx
mov qword [rsp + 0xf8], rsi
mov byte [rax + rsi], 0
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0xf8]
cmp rax, 3
jbe 0x1400b44d4
mov r8d, 4
mov rdx, rdi
mov rcx, rbp
call fcn.1400a0650
mov rcx, qword [rsp + 0xf0]
call sub.msvcrt.dll_remove
mov rcx, qword [rsp + 0xf0]
mov r14d, eax
cmp rcx, rbx
je 0x1400b3bfb
call fcn.1400b2d70
mov r13, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x98]
test r14d, r14d
jne 0x1400b42b8
mov rsi, qword [rsp + 0x98]
mov qword [rsp + 0xf0], rbx
mov r13, qword [rsp + 0x90]
mov qword [rsp + 0xd0], rsi
cmp rsi, 0xf
ja 0x1400b41e8
cmp rsi, 1
je 0x1400b41d0
test rsi, rsi
jne 0x1400b4408
mov rax, rbx
mov qword [rsp + 0xf8], rsi
mov byte [rax + rsi], 0
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0xf8]
cmp rax, 3
jbe 0x1400b44bc
mov r8d, 4
mov rdx, rdi
mov rcx, rbp
call fcn.1400a0650
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0x90]
call sub.msvcrt.dll_rename
mov rcx, qword [rsp + 0xf0]
mov r14d, eax
cmp rcx, rbx
je 0x1400b3cb7
call fcn.1400b2d70
mov r13, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x98]
test r14d, r14d
jne 0x1400b3d71
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xd0], rsi
cmp rsi, 0xf
ja 0x1400b43a4
cmp rsi, 1
je 0x1400b4393
test rsi, rsi
jne 0x1400b445b
mov rax, rbx
mov qword [rsp + 0xf8], rsi
mov byte [rax + rsi], 0
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0xf8]
cmp rax, 3
jbe 0x1400b44e0
mov r8d, 4
lea rdx, str..upd
mov rcx, rbp
call fcn.1400a0650
mov rcx, qword [rsp + 0xf0]
mov rdx, r13
call sub.msvcrt.dll_rename
mov rcx, qword [rsp + 0xf0]
mov esi, eax
cmp rcx, rbx
je 0x1400b3d61
call fcn.1400b2d70
test esi, esi
je 0x1400b3e04
mov r13, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x98]
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xd0], rsi
cmp rsi, 0xf
ja 0x1400b4250
cmp rsi, 1
je 0x1400b4238
test rsi, rsi
jne 0x1400b444b
mov rax, rbx
mov qword [rsp + 0xf8], rsi
mov byte [rax + rsi], 0
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0xf8]
cmp rax, 3
jbe 0x1400b44ec
mov r8d, 4
mov rdx, rdi
mov rcx, rbp
call fcn.1400a0650
mov rcx, qword [rsp + 0xf0]
mov rdx, r13
call sub.msvcrt.dll_rename
mov rcx, qword [rsp + 0xf0]
cmp rcx, rbx
je 0x1400b3e04
call fcn.1400b2d70
mov rax, qword [rsp + 0x98]
lea rsi, [rsp + 0xb0]
lea rdi, [rsp + 0xc0]
mov qword [rsp + 0xb8], 0
mov rcx, rsi
mov qword [rsp + 0xb0], rdi
lea rdx, [rax + 1]
mov byte [rsp + 0xc0], 0
call fcn.1400a0510
movabs rax, 0x3fffffffffffffff
cmp qword [rsp + 0xb8], rax
je 0x1400b448c
lea r13, [0x1400b8066]
mov r8d, 1
mov rcx, rsi
mov rdx, r13
call fcn.1400a0650
mov r8, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x90]
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0xb8]
cmp rax, r8
jb 0x1400b4480
mov rcx, rsi
call fcn.1400a0650
movabs rax, 0x3fffffffffffffff
cmp qword [rsp + 0xb8], rax
je 0x1400b4468
mov r8d, 1
mov rdx, r13
mov rcx, rsi
call fcn.1400a0650
mov qword [rsp + 0xd0], r12
mov rdx, qword [rax]
lea r13, [rax + 0x10]
mov rsi, rax
mov rax, qword [rax + 8]
cmp rdx, r13
je 0x1400b4120
mov qword [rsp + 0xd0], rdx
mov rdx, qword [rsi + 0x10]
mov qword [rsp + 0xe0], rdx
mov qword [rsp + 0xd8], rax
movabs rax, 0x3fffffffffffffff
mov qword [rsi + 8], 0
mov r8, qword [rsp + 0x58]
mov byte [rsi + 0x10], 0
sub rax, qword [rsp + 0xd8]
mov qword [rsi], r13
mov rdx, qword [rsp + 0x50]
cmp rax, r8
jb 0x1400b44b0
mov rcx, qword [rsp + 0x20]
call fcn.1400a0650
mov qword [rsp + 0xf0], rbx
mov rdx, qword [rax]
lea r13, [rax + 0x10]
mov rsi, rax
mov rax, qword [rax + 8]
cmp rdx, r13
je 0x1400b4148
mov qword [rsp + 0xf0], rdx
mov rdx, qword [rsi + 0x10]
mov qword [rsp + 0x100], rdx
mov qword [rsp + 0xf8], rax
mov qword [rsi], r13
mov byte [rsi + 0x10], 0
mov rcx, qword [rsp + 0xf0]
mov qword [rsi + 8], 0
call sub.msvcrt.dll_system
mov rcx, qword [rsp + 0xf0]
mov esi, eax
cmp rcx, rbx
je 0x1400b3fb4
call fcn.1400b2d70
mov rcx, qword [rsp + 0xd0]
cmp rcx, r12
je 0x1400b3fc6
call fcn.1400b2d70
mov rcx, qword [rsp + 0xb0]
cmp rcx, rdi
je 0x1400b4020
call fcn.1400b2d70
cmp esi, 2
jbe 0x1400b402e
cmp esi, 0x16
jne 0x1400b3888
xor eax, eax
mov rbx, qword [sym.imp.msvcrt.dll__errno]
mov qword [rsp + 0xf0], 3
mov dword [rsp + 0xf8], eax
mov rdx, rbp
mov rcx, rbp
call fcn.140019dc0
cmp eax, 0xffffffff
jne 0x1400b4033
call rbx
cmp dword [rax], 4
jne 0x1400b4033
jmp 0x1400b4002
cmp esi, 0x16
je 0x1400b3fe6
cmp esi, 2
ja 0x1400b3888
cmp esi, 0x16
je 0x1400b3fe6
mov rcx, qword [rsp + 0x90]
lea rax, [rsp + 0xa0]
cmp rcx, rax
je 0x1400b404d
call fcn.1400b2d70
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x80]
cmp rcx, rax
je 0x1400b4064
call fcn.1400b2d70
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
cmp rcx, rax
je 0x1400b4078
call fcn.1400b2d70
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
cmp rcx, rax
je 0x1400b408c
call fcn.1400b2d70
xor eax, eax
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test rsi, rsi
je 0x1400b38c6
mov rcx, r12
jmp 0x1400b40eb
mov rcx, qword [rsp + 0x20]
xor r8d, r8d
mov rdx, rbp
call fcn.1400a07a0
mov qword [rsp + 0xd0], rax
mov rcx, rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0xe0], rax
mov r8, rsi
mov rdx, rdi
call sub.msvcrt.dll_memcpy
mov rsi, qword [rsp + 0xf0]
mov rax, qword [rsp + 0xd0]
jmp 0x1400b38c9
mov edx, dword [rcx + 0x20]
or edx, 4
call fcn.1400ab370
jmp 0x1400b3a01
mov r8, rax
add r8, 1
je 0x1400b3f03
mov rdx, r13
mov rcx, r12
call sub.msvcrt.dll_memcpy
mov rax, qword [rsi + 8]
jmp 0x1400b3f03
mov r8, rax
add r8, 1
je 0x1400b3f7c
mov rdx, r13
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov rax, qword [rsi + 8]
jmp 0x1400b3f7c
movzx eax, byte [rdi]
mov byte [rsp + 0x100], al
jmp 0x1400b3af7
mov rdx, qword [rsp + 0x20]
xor r8d, r8d
mov rcx, rbp
call fcn.1400a07a0
mov qword [rsp + 0xf0], rax
mov rcx, rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x100], rax
mov r8, rsi
mov rdx, rdi
call sub.msvcrt.dll_memcpy
mov rsi, qword [rsp + 0xd0]
mov rax, qword [rsp + 0xf0]
jmp 0x1400b3afa
movzx eax, byte [r13]
mov byte [rsp + 0x100], al
jmp 0x1400b3c51
mov rdx, qword [rsp + 0x20]
xor r8d, r8d
mov rcx, rbp
call fcn.1400a07a0
mov qword [rsp + 0xf0], rax
mov rcx, rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x100], rax
mov r8, rsi
mov rdx, r13
call sub.msvcrt.dll_memcpy
mov rsi, qword [rsp + 0xd0]
mov rax, qword [rsp + 0xf0]
jmp 0x1400b3c54
movzx eax, byte [r13]
mov byte [rsp + 0x100], al
jmp 0x1400b3da6
mov rdx, qword [rsp + 0x20]
xor r8d, r8d
mov rcx, rbp
call fcn.1400a07a0
mov qword [rsp + 0xf0], rax
mov rcx, rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x100], rax
mov r8, rsi
mov rdx, r13
call sub.msvcrt.dll_memcpy
mov rsi, qword [rsp + 0xd0]
mov rax, qword [rsp + 0xf0]
jmp 0x1400b3da9
movzx eax, byte [r13]
mov byte [rsp + 0x100], al
jmp 0x1400b3b9d
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xd0], rsi
cmp rsi, 0xf
ja 0x1400b4410
cmp rsi, 1
je 0x1400b43ef
test rsi, rsi
jne 0x1400b4463
mov rax, qword [rsp + 0xd0]
mov rdx, qword [rsp + 0xf0]
mov qword [rsp + 0xf8], rax
mov byte [rdx + rax], 0
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0xf8]
cmp rax, 3
jbe 0x1400b44f8
mov r8d, 4
lea rdx, str..upd
mov rcx, rbp
call fcn.1400a0650
mov rcx, qword [rsp + 0xf0]
call sub.msvcrt.dll_remove
jmp 0x1400b3df2
mov rdx, qword [rsp + 0x20]
xor r8d, r8d
mov rcx, rbp
call fcn.1400a07a0
mov qword [rsp + 0xf0], rax
mov rcx, rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x100], rax
mov r8, rsi
mov rdx, r13
call sub.msvcrt.dll_memcpy
mov rsi, qword [rsp + 0xd0]
mov rax, qword [rsp + 0xf0]
jmp 0x1400b3ba0
movzx eax, byte [r13]
mov byte [rsp + 0x100], al
jmp 0x1400b3cfd
mov rdx, qword [rsp + 0x20]
xor r8d, r8d
mov rcx, rbp
call fcn.1400a07a0
mov qword [rsp + 0xf0], rax
mov rcx, rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x100], rax
mov r8, rsi
mov rdx, r13
call sub.msvcrt.dll_memcpy
mov rsi, qword [rsp + 0xd0]
mov rax, qword [rsp + 0xf0]
jmp 0x1400b3d00
movzx eax, byte [r13]
mov byte [rsp + 0x100], al
jmp 0x1400b42e5
mov rcx, rbx
jmp 0x1400b41ab
mov rcx, rbx
jmp 0x1400b4213
mov rdx, qword [rsp + 0x20]
xor r8d, r8d
mov rcx, rbp
call fcn.1400a07a0
mov qword [rsp + 0xf0], rax
mov rcx, rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x100], rax
mov r8, rsi
mov rdx, r13
call sub.msvcrt.dll_memcpy
jmp 0x1400b42e5
mov rcx, rbx
jmp 0x1400b427b
mov rcx, rbx
jmp 0x1400b4373
mov rcx, rbx
jmp 0x1400b43cf
mov rcx, rbx
jmp 0x1400b443b
lea rcx, [0x1400b804f]
call fcn.1400b4a20
lea rcx, [0x1400b804f]
call fcn.1400b4a20
lea rcx, [0x1400b804f]
call fcn.1400b4a20
lea rcx, [0x1400b804f]
call fcn.1400b4a20
lea rcx, [0x1400b804f]
call fcn.1400b4a20
lea rcx, [0x1400b804f]
call fcn.1400b4a20
lea rcx, [0x1400b804f]
call fcn.1400b4a20
lea rcx, [0x1400b804f]
call fcn.1400b4a20
lea rcx, [0x1400b804f]
call fcn.1400b4a20
lea rcx, [0x1400b804f]
call fcn.1400b4a20
lea rcx, [0x1400b804f]
call fcn.1400b4a20
lea rcx, [0x1400b804f]
call fcn.1400b4a20
lea rcx, [0x1400b804f]
call fcn.1400b4a20
mov rcx, qword [rsp + 0xf0]
mov rsi, rax
cmp rcx, rbx
je 0x1400b4519
call fcn.1400b2d70
mov rcx, qword [rsp + 0x90]
lea rax, [rsp + 0xa0]
cmp rcx, rax
je 0x1400b4533
call fcn.1400b2d70
mov rbx, rsi
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x80]
cmp rcx, rax
je 0x1400b454d
call fcn.1400b2d70
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
cmp rcx, rax
je 0x1400b4561
call fcn.1400b2d70
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
cmp rcx, rax
je 0x1400b4575
call fcn.1400b2d70
mov rcx, rbx
call fcn.14000bd00
jmp 0x1400b4504