Function at 0x4ba7a0
Capabilities:
Create process on windows
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x288
mov ebx, ecx
mov qword [rsp + 0x2d8], rdx
call fcn.0040d690
cmp ebx, 2
jg 0x4ba7dd
xor eax, eax
add rsp, 0x288
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x2d8]
lea r12, [rsp + 0x60]
mov rcx, r12
mov rdx, qword [rax + 8]
call fcn.00401580
lea rdx, str.do_rename
mov rcx, r12
call fcn.00432db0
test eax, eax
je 0x4ba828
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x70]
cmp rcx, rax
je 0x4ba7c7
mov rax, qword [rsp + 0x70]
lea rdx, [rax + 1]
call fcn.004b9d10
jmp 0x4ba7c7
lea rbp, [rsp + 0x170]
mov r8d, 0x104
xor ecx, ecx
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rcx, rbp
lea r13, [rsp + 0xd0]
call sub.msvcrt.dll_strlen
mov rcx, r13
mov qword [rsp + 0xd8], 0
mov word [rsp + 0xe0], 0
mov r12, rax
lea rax, [rsp + 0xe0]
mov rdx, r12
mov qword [rsp + 0x30], rax
mov qword [rsp + 0xd0], rax
call fcn.004aa550
add r12, rbp
cmp r12, rbp
jbe 0x4baa9c
xor esi, esi
xor edi, edi
lea r15, [0x004ce8c0]
jmp 0x4ba98f
xor ecx, ecx
test edi, edi
je 0x4baa3d
cmp edi, 8
je 0x4ba9e7
lea eax, [rcx + 0x10]
lea ecx, [rdi*4]
shl esi, 6
and edx, 0x3f
and eax, 0x3f
or esi, edx
mov edi, dword [r15 + rax*4]
shr edi, cl
and edi, 0xf
jne 0x4ba9e2
mov rbx, qword [rsp + 0xd8]
lea rax, [rbx + 1]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xd0]
cmp esi, 0xffff
jbe 0x4baa48
sub esi, 0x10000
mov r14d, esi
shr r14d, 0xa
sub r14w, 0x2800
cmp rax, qword [rsp + 0x30]
je 0x4bb342
lea rdx, [rbx + 1]
cmp qword [rsp + 0xe0], rdx
jb 0x4bb277
lea rdx, [rbx + rbx]
lea rcx, [rbx + 1]
mov word [rax + rbx*2], r14w
and si, 0x3ff
mov qword [rsp + 0xd8], rcx
lea r14, [rdx + 2]
sub si, 0x2400
add rbx, 2
mov word [rax + rdx + 2], 0
mov rdx, qword [rsp + 0xe0]
cmp rbx, rdx
ja 0x4bb24e
mov word [rax + r14], si
xor esi, esi
mov qword [rsp + 0xd8], rbx
mov word [rax + rbx*2], 0
cmp rbp, r12
je 0x4baa94
movzx edx, byte [rbp]
add rbp, 1
test dl, dl
jns 0x4ba8a6
mov eax, edx
movzx r8d, dl
shr al, 3
lea ecx, [r8*4]
and eax, 0xf
and ecx, 0x1c
mov eax, dword [r15 + rax*4]
shr eax, cl
mov ecx, eax
and ecx, 0xf
test edi, edi
jne 0x4ba8b0
mov esi, 0xff
shr esi, cl
add ecx, 0x10
and ecx, 0x3f
and esi, r8d
mov edi, dword [r15 + rcx*4]
and edi, 0xf
je 0x4baa40
cmp edi, 8
jne 0x4ba986
mov rbx, qword [rsp + 0xd8]
mov rax, qword [rsp + 0x30]
lea rsi, [rbx + 1]
cmp qword [rsp + 0xd0], rax
je 0x4bb3bf
mov rax, qword [rsp + 0xe0]
cmp rsi, rax
ja 0x4bb3a0
mov rax, qword [rsp + 0xd0]
xor edi, edi
mov word [rax + rbx*2], 0xfffd
mov qword [rsp + 0xd8], rsi
xor esi, esi
mov word [rax + rbx*2 + 2], 0
jmp 0x4ba986
movzx esi, dl
mov rbx, qword [rsp + 0xd8]
mov rax, qword [rsp + 0x30]
lea rdi, [rbx + 1]
cmp qword [rsp + 0xd0], rax
je 0x4bb338
mov rax, qword [rsp + 0xe0]
cmp rdi, rax
ja 0x4bb22f
mov rax, qword [rsp + 0xd0]
mov word [rax + rbx*2], si
xor esi, esi
mov qword [rsp + 0xd8], rdi
xor edi, edi
mov word [rax + rbx*2 + 2], 0
jmp 0x4ba986
test edi, edi
jne 0x4bb2e6
mov edx, 2
mov rcx, r13
mov qword [rsp + 0xf0], 0
call fcn.0041bdf0
lea rbx, [rsp + 0x100]
mov rdx, r13
mov rcx, rbx
mov qword [rsp + 0x48], rbx
call fcn.00425070
lea rax, [rsp + 0xa0]
mov rdx, rbx
mov rcx, rax
mov qword [rsp + 0x58], rax
call fcn.00419eb0
mov rcx, qword [rsp + 0x100]
lea rax, [rsp + 0x110]
mov qword [rsp + 0x50], rax
cmp rcx, rax
je 0x4bab13
mov rax, qword [rsp + 0x110]
lea rdx, [rax + 1]
add rdx, rdx
call fcn.004b9d10
mov rcx, qword [rsp + 0xd0]
cmp rcx, qword [rsp + 0x30]
je 0x4bab36
mov rax, qword [rsp + 0xe0]
lea rdx, [rax + 1]
add rdx, rdx
call fcn.004b9d10
lea rax, str.libomp.dll
lea r15, [0x004ce8c0]
mov qword [rsp + 0x40], rax
nop dword [rax]
mov rax, qword [rsp + 0x40]
xor r14d, r14d
mov rbp, qword [rax]
test rbp, rbp
je 0x4bab6b
mov rcx, rbp
call sub.msvcrt.dll_strlen
mov r14, rax
mov rax, qword [rsp + 0x30]
xor ebx, ebx
mov rdx, r14
mov rcx, r13
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xd0], rax
mov word [rsp + 0xe0], bx
call fcn.004aa550
add r14, rbp
xor esi, esi
xor edi, edi
cmp rbp, r14
jb 0x4bac96
jmp 0x4badb1
xor ecx, ecx
test edi, edi
je 0x4bb070
cmp edi, 8
je 0x4bacf8
lea eax, [rcx + 0x10]
lea ecx, [rdi*4]
shl esi, 6
and edx, 0x3f
and eax, 0x3f
or esi, edx
mov edi, dword [r15 + rax*4]
shr edi, cl
and edi, 0xf
jne 0x4baced
mov rbx, qword [rsp + 0xd8]
mov rax, qword [rsp + 0xd0]
cmp esi, 0xffff
jbe 0x4bb07b
sub esi, 0x10000
lea rdx, [rbx + 1]
mov r12d, esi
mov qword [rsp + 0x38], rdx
shr r12d, 0xa
sub r12w, 0x2800
cmp rax, qword [rsp + 0x30]
je 0x4bb190
cmp rdx, qword [rsp + 0xe0]
ja 0x4bb10a
mov rcx, rdx
mov word [rax + rbx*2], r12w
lea rdx, [rbx + rbx]
and si, 0x3ff
mov qword [rsp + 0xd8], rcx
xor ecx, ecx
lea r12, [rdx + 2]
sub si, 0x2400
mov word [rax + rdx + 2], cx
add rbx, 2
mov rdx, qword [rsp + 0xe0]
cmp rbx, rdx
ja 0x4bb0e1
xor r10d, r10d
mov word [rax + r12], si
xor esi, esi
mov qword [rsp + 0xd8], rbx
mov word [rax + rbx*2], r10w
cmp rbp, r14
je 0x4bad60
movzx edx, byte [rbp]
add rbp, 1
test dl, dl
jns 0x4babb0
mov eax, edx
movzx r8d, dl
shr al, 3
lea ecx, [r8*4]
and eax, 0xf
and ecx, 0x1c
mov eax, dword [r15 + rax*4]
shr eax, cl
mov ecx, eax
and ecx, 0xf
test edi, edi
jne 0x4babba
mov esi, 0xff
shr esi, cl
add ecx, 0x10
and ecx, 0x3f
and esi, r8d
mov edi, dword [r15 + rcx*4]
and edi, 0xf
je 0x4bb073
cmp edi, 8
jne 0x4bac8d
nop word [rax + rax]
mov rbx, qword [rsp + 0xd8]
mov rax, qword [rsp + 0x30]
lea rsi, [rbx + 1]
cmp qword [rsp + 0xd0], rax
je 0x4bb206
mov rax, qword [rsp + 0xe0]
cmp rsi, rax
ja 0x4bb1e7
mov rax, qword [rsp + 0xd0]
mov r8d, 0xfffffffd
xor r9d, r9d
xor edi, edi
mov word [rax + rbx*2], r8w
mov qword [rsp + 0xd8], rsi
xor esi, esi
mov word [rax + rbx*2 + 2], r9w
cmp rbp, r14
jne 0x4bac96
nop dword [rax]
test edi, edi
je 0x4badb1
mov rbx, qword [rsp + 0xd8]
mov rax, qword [rsp + 0x30]
lea rsi, [rbx + 1]
cmp qword [rsp + 0xd0], rax
je 0x4bb2dc
mov rax, qword [rsp + 0xe0]
cmp rsi, rax
ja 0x4bb210
mov rax, qword [rsp + 0xd0]
mov word [rax + rbx*2], 0xfffd
mov qword [rsp + 0xd8], rsi
mov word [rax + rbx*2 + 2], 0
mov edx, 2
mov rcx, r13
mov qword [rsp + 0xf0], 0
call fcn.0041bdf0
mov rbx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x58]
mov r8, r13
mov rcx, rbx
call fcn.00422460
lea r12, [rsp + 0x80]
mov rdx, rbx
mov rcx, r12
call fcn.0041ece0
mov rcx, qword [rsp + 0x100]
cmp rcx, qword [rsp + 0x50]
je 0x4bae15
mov rax, qword [rsp + 0x110]
lea rdx, [rax + 1]
add rdx, rdx
call fcn.004b9d10
mov rcx, qword [rsp + 0xd0]
cmp rcx, qword [rsp + 0x30]
je 0x4bae38
mov rax, qword [rsp + 0xe0]
lea rdx, [rax + 1]
add rdx, rdx
call fcn.004b9d10
mov rcx, qword [rsp + 0x48]
lea r8, str..old
mov rdx, r12
call fcn.004b7820
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x80]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov rcx, qword [rsp + 0x100]
cmp rcx, qword [rsp + 0x50]
je 0x4bae88
mov rax, qword [rsp + 0x110]
lea rdx, [rax + 1]
call fcn.004b9d10
mov rcx, qword [rsp + 0x80]
lea rbx, [rsp + 0x90]
cmp rcx, rbx
je 0x4bb170
mov rax, qword [rsp + 0x90]
lea rdi, [0x004c01c0]
lea rdx, [rax + 1]
call fcn.004b9d10
add qword [rsp + 0x40], 8
mov rax, qword [rsp + 0x40]
cmp rdi, rax
jne 0x4bab50
mov rax, qword [rsp + 0x2d8]
mov rcx, r12
mov rdx, qword [rax + 0x10]
call fcn.00401580
mov rdi, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x58]
mov rcx, rdi
call fcn.0041ece0
lea r9, [0x004c00e3]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], 3
call fcn.004a4c70
mov rdi, qword [rsp + 0x30]
lea rdx, [rax + 0x10]
mov qword [rsp + 0xd0], rdi
mov rcx, qword [rax]
cmp rcx, rdx
je 0x4bb38e
mov qword [rsp + 0xd0], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xe0], rcx
mov rcx, qword [rax + 8]
mov qword [rsp + 0xd8], rcx
mov qword [rax], rdx
mov byte [rax + 0x10], 0
mov rcx, qword [rsp + 0x100]
mov qword [rax + 8], 0
cmp rcx, qword [rsp + 0x50]
je 0x4baf7c
mov rax, qword [rsp + 0x110]
lea rdx, [rax + 1]
call fcn.004b9d10
xor eax, eax
lea rdi, [rsp + 0x108]
mov ecx, 0x1a
rep stosd dword [rdi], eax
mov rax, qword [0x004c01c0]
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x130], 1
mov qword [rsp + 0x100], rax
lea rax, str.open
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x118], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x120], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x168]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x168]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xd0]
cmp rcx, qword [rsp + 0x30]
je 0x4bb020
mov rax, qword [rsp + 0xe0]
lea rdx, [rax + 1]
call fcn.004b9d10
mov rcx, qword [rsp + 0x80]
cmp rcx, rbx
je 0x4bb03e
mov rax, qword [rsp + 0x90]
lea rdx, [rax + 1]
call fcn.004b9d10
mov rcx, qword [rsp + 0xa0]
lea rax, [rsp + 0xb0]
cmp rcx, rax
je 0x4ba809
mov rax, qword [rsp + 0xb0]
lea rdx, [rax + 1]
add rdx, rdx
call fcn.004b9d10
jmp 0x4ba809
movzx esi, dl
mov rbx, qword [rsp + 0xd8]
mov rax, qword [rsp + 0x30]
lea rdi, [rbx + 1]
cmp qword [rsp + 0xd0], rax
je 0x4bb1dd
mov rax, qword [rsp + 0xe0]
cmp rdi, rax
ja 0x4bb0c5
mov rax, qword [rsp + 0xd0]
xor r11d, r11d
mov word [rax + rbx*2], si
xor esi, esi
mov qword [rsp + 0xd8], rdi
xor edi, edi
mov word [rax + rbx*2 + 2], r11w
jmp 0x4bac8d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
mov qword [rsp + 0x20], 1
call fcn.004aa8f0
jmp 0x4bb09f
mov rdx, qword [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov rcx, r13
mov qword [rsp + 0x20], 1
call fcn.004aa8f0
mov rax, qword [rsp + 0xd0]
jmp 0x4bac76
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
mov qword [rsp + 0x20], 1
call fcn.004aa8f0
mov rcx, qword [rsp + 0x38]
lea rdx, [rbx + rbx]
and si, 0x3ff
mov rax, qword [rsp + 0xd0]
sub si, 0x2400
mov word [rax + rbx*2], r12w
lea r12, [rdx + 2]
add rbx, 2
mov qword [rsp + 0xd8], rcx
mov word [rax + rdx + 2], 0
cmp rax, qword [rsp + 0x30]
jne 0x4bac65
mov edx, 7
jmp 0x4bac6d
add qword [rsp + 0x40], 8
mov rax, qword [rsp + 0x40]
lea rdi, [0x004c01c0]
cmp rax, rdi
jne 0x4bab50
jmp 0x4baecd
cmp qword [rsp + 0x38], 7
ja 0x4bb10a
lea rdx, [rbx + rbx]
mov rcx, qword [rsp + 0x38]
and si, 0x3ff
add rbx, 2
mov word [rsp + rdx + 0xe0], r12w
lea r12, [rdx + 2]
sub si, 0x2400
mov edx, 7
mov qword [rsp + 0xd8], rcx
mov word [rsp + r12 + 0xe0], 0
jmp 0x4bac6d
mov eax, 7
jmp 0x4bb09a
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
mov qword [rsp + 0x20], 1
call fcn.004aa8f0
jmp 0x4bad28
mov eax, 7
jmp 0x4bad1f
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
mov qword [rsp + 0x20], 1
call fcn.004aa8f0
jmp 0x4bad94
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
mov qword [rsp + 0x20], 1
call fcn.004aa8f0
jmp 0x4baa70
mov rdx, qword [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov rcx, r13
mov qword [rsp + 0x20], 1
call fcn.004aa8f0
mov rax, qword [rsp + 0xd0]
jmp 0x4ba971
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
mov qword [rsp + 0x20], 1
call fcn.004aa8f0
mov rax, qword [rsp + 0xd0]
lea rdx, [rbx + rbx]
lea rcx, [rbx + 1]
and si, 0x3ff
sub si, 0x2400
mov word [rax + rbx*2], r14w
lea r14, [rdx + 2]
add rbx, 2
mov qword [rsp + 0xd8], rcx
mov word [rax + rdx + 2], 0
cmp rax, qword [rsp + 0x30]
jne 0x4ba960
mov edx, 7
jmp 0x4ba968
mov eax, 7
jmp 0x4bad8b
mov rbx, qword [rsp + 0xd8]
mov rax, qword [rsp + 0x30]
lea rsi, [rbx + 1]
cmp qword [rsp + 0xd0], rax
je 0x4bb3e8
mov rax, qword [rsp + 0xe0]
cmp rsi, rax
ja 0x4bb3c9
mov rax, qword [rsp + 0xd0]
mov word [rax + rbx*2], 0xfffd
mov qword [rsp + 0xd8], rsi
mov word [rax + rbx*2 + 2], 0
jmp 0x4baa9c
mov eax, 7
jmp 0x4baa67
cmp qword [rsp + 0x38], 7
ja 0x4bb277
lea rdx, [rbx + rbx]
lea rcx, [rbx + 1]
and si, 0x3ff
add rbx, 2
mov word [rsp + rdx + 0xe0], r14w
lea r14, [rdx + 2]
sub si, 0x2400
mov edx, 7
mov qword [rsp + 0xd8], rcx
mov word [rsp + r14 + 0xe0], 0
jmp 0x4ba968
movdqu xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0xe0], xmm0
jmp 0x4baf41
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
mov qword [rsp + 0x20], 1
call fcn.004aa8f0
jmp 0x4baa17
mov eax, 7
jmp 0x4baa0e
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
mov qword [rsp + 0x20], 1
call fcn.004aa8f0
jmp 0x4bb316
mov eax, 7
jmp 0x4bb30d