Function at 0x14000a7f0
Capabilities:
Create process on windows
Create process suspended
Delete file
Get file attributes
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x730
mov rax, qword [0x140013028]
xor rax, rsp
mov qword [rsp + 0x720], rax
xor r15d, r15d
lea rdx, str.Downloading_latest_version_of_the_injector...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000236c
lea rdx, [0x140003f84]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rsp + 0x400]
call fcn.140007334
mov rbx, rax
lea rcx, [rsp + 0x3c0]
call fcn.140007334
nop
lea r9d, [r15 + 0x18]
lea r8, str.http:__mtcheats.com_api_
xor edx, edx
mov rcx, rax
call fcn.140008c94
xorps xmm0, xmm0
movups xmmword [rsp + 0x340], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x350], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x340], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x350], xmm1
mov qword [rax + 0x10], r15
lea r13d, [r15 + 0xf]
mov qword [rax + 0x18], r13
mov byte [rax], r15b
lea r14d, [r15 + 1]
mov r8d, r14d
lea rdx, [0x14000e510]
lea rcx, [rsp + 0x340]
call fcn.140007aa0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x3a0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x3b0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r13
mov byte [rax], r15b
mov r9, rbx
lea r8, [rsp + 0x3a0]
mov dl, byte [rsp + 0x50]
lea rcx, [rsp + 0x360]
call fcn.140005c2c
nop
lea rcx, [rsp + 0x610]
call fcn.140005f54
nop
mov byte [rsp + 0x611], r15b
lea rcx, [rsp + 0x360]
lea r12d, [r15 + 0x10]
cmp qword [rsp + 0x378], r12
cmovae rcx, qword [rsp + 0x360]
mov r8, qword [rsp + 0x370]
add r8, rcx
lea rdx, [rsp + 0x360]
cmp qword [rsp + 0x378], r12
cmovae rdx, qword [rsp + 0x360]
lea rcx, [rsp + 0x618]
call fcn.140004b00
nop
mov rdx, qword [rsp + 0x378]
mov edi, 0x1000
cmp rdx, r12
jb 0x14000a9be
inc rdx
mov rcx, qword [rsp + 0x360]
mov rax, rcx
cmp rdx, rdi
jb 0x14000a9b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a9b9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b6e8
movdqa xmm0, xmmword [0x14000e680]
movdqu xmmword [rsp + 0x370], xmm0
mov byte [rsp + 0x360], r15b
mov rdx, qword [rsp + 0x3b8]
cmp rdx, r12
jb 0x14000aa19
inc rdx
mov rcx, qword [rsp + 0x3a0]
mov rax, rcx
cmp rdx, rdi
jb 0x14000aa13
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000aa13
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b6e8
nop
mov rdx, qword [rsp + 0x358]
cmp rdx, r12
jb 0x14000aa5a
inc rdx
mov rcx, qword [rsp + 0x340]
mov rax, rcx
cmp rdx, rdi
jb 0x14000aa55
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000aa55
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b6e8
movdqa xmm0, xmmword [0x14000e680]
movdqu xmmword [rsp + 0x350], xmm0
mov byte [rsp + 0x340], r15b
mov rdx, qword [rsp + 0x3d8]
cmp rdx, r12
jb 0x14000aab4
inc rdx
mov rcx, qword [rsp + 0x3c0]
mov rax, rcx
cmp rdx, rdi
jb 0x14000aaaf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000aaaf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b6e8
movdqa xmm0, xmmword [0x14000e680]
movdqu xmmword [rsp + 0x3d0], xmm0
mov byte [rsp + 0x3c0], r15b
mov rdx, qword [rsp + 0x418]
cmp rdx, r12
jb 0x14000ab0e
inc rdx
mov rcx, qword [rsp + 0x400]
mov rax, rcx
cmp rdx, rdi
jb 0x14000ab09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ab09
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b6e8
or rbx, 0xffffffffffffffff
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x360], xmm0
mov qword [rsp + 0x370], r15
movups xmmword [rsp + 0x340], xmm0
mov qword [rsp + 0x350], r15
mov qword [rsp + 0x358], r13
mov byte [rsp + 0x340], r15b
movups xmmword [rsp + 0x320], xmm0
mov qword [rsp + 0x330], 3
mov qword [rsp + 0x338], r13
mov eax, dword [0x14000e534]
mov word [rsp + 0x320], ax
mov al, byte [0x14000e536]
mov byte [rsp + 0x322], al
mov byte [rsp + 0x323], r15b
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x360]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x340]
lea r8, [rsp + 0x320]
lea rdx, [rsp + 0x440]
lea rcx, [rsp + 0x610]
call fcn.14000947c
nop
mov rdx, qword [rsp + 0x338]
cmp rdx, r12
jb 0x14000abff
inc rdx
mov rcx, qword [rsp + 0x320]
mov rax, rcx
cmp rdx, rdi
jb 0x14000abf9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000abf9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b6e8
nop
mov rdx, qword [rsp + 0x358]
cmp rdx, r12
jb 0x14000ac40
inc rdx
mov rcx, qword [rsp + 0x340]
mov rax, rcx
cmp rdx, rdi
jb 0x14000ac3b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ac3b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b6e8
mov qword [rsp + 0x350], r15
mov qword [rsp + 0x358], r13
mov byte [rsp + 0x340], r15b
mov rsi, qword [rsp + 0x360]
test rsi, rsi
je 0x14000acc9
mov r14, rsi
cmp rsi, qword [rsp + 0x368]
je 0x14000ac88
mov rcx, r14
call fcn.140006ab8
add r14, 0x40
cmp r14, qword [rsp + 0x368]
jne 0x14000ac72
mov rdx, qword [rsp + 0x370]
sub rdx, rsi
and rdx, 0xffffffffffffffc0
mov rax, rsi
cmp rdx, rdi
jb 0x14000acbb
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000acbb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14000b6e8
mov r14d, 1
mov eax, 0x194
cmp word [rsp + 0x444], ax
jne 0x14000adf4
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
xorps xmm0, xmm0
movups xmmword [rsp + 0x320], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x330], xmm1
mov rdx, qword [rsp + 0x480]
mov r8, qword [rsp + 0x488]
cmp rdx, r8
jne 0x14000ad2a
movdqa xmm0, xmmword [0x14000e680]
movdqu xmmword [rsp + 0x330], xmm0
mov byte [rsp + 0x320], r15b
jmp 0x14000ad3e
mov r9, r8
sub r9, rdx
lea rcx, [rsp + 0x320]
call fcn.140002874
nop
lea rdx, [rsp + 0x320]
cmp qword [rsp + 0x338], r12
cmovae rdx, qword [rsp + 0x320]
mov r8, qword [rsp + 0x330]
mov rcx, rbx
call fcn.140003028
mov dl, 0xa
mov rcx, rax
call fcn.140002198
nop
mov rdx, qword [rsp + 0x338]
cmp rdx, r12
jb 0x14000adb3
inc rdx
mov rcx, qword [rsp + 0x320]
mov rax, rcx
cmp rdx, rdi
jb 0x14000adae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000adae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b6e8
lea rdx, str.Retry_later...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000236c
lea rdx, [0x140003f84]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rsp + 0x58], r14
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x60]
call fcn.140003938
mov rcx, rax
call fcn.1400058d4
jmp 0x14000add6
lea rcx, [rsp + 0x420]
call fcn.140007334
mov rsi, rax
lea rcx, [rsp + 0x3e0]
call fcn.140007334
nop
mov r9d, 0x18
lea r8, str.http:__mtcheats.com_lib_
xor edx, edx
mov rcx, rax
call fcn.140008c94
xorps xmm0, xmm0
movups xmmword [rsp + 0x380], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x390], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x380], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x390], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r13
mov byte [rax], r15b
mov r8, r14
lea rdx, [0x14000e510]
lea rcx, [rsp + 0x380]
call fcn.140007aa0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x3a0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x3b0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r13
mov byte [rax], r15b
mov r9, rsi
lea r8, [rsp + 0x3a0]
mov dl, byte [rsp + 0x50]
lea rcx, [rsp + 0x320]
call fcn.140005c2c
nop
lea rcx, [rsp + 0x500]
call fcn.140005f54
nop
mov byte [rsp + 0x501], r15b
lea rcx, [rsp + 0x320]
cmp qword [rsp + 0x338], r12
cmovae rcx, qword [rsp + 0x320]
mov r8, qword [rsp + 0x330]
add r8, rcx
lea rdx, [rsp + 0x320]
cmp qword [rsp + 0x338], r12
cmovae rdx, qword [rsp + 0x320]
lea rcx, [rsp + 0x508]
call fcn.140004b00
nop
mov rdx, qword [rsp + 0x338]
cmp rdx, r12
jb 0x14000af5a
inc rdx
mov rcx, qword [rsp + 0x320]
mov rax, rcx
cmp rdx, rdi
jb 0x14000af55
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000af55
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b6e8
movdqa xmm0, xmmword [0x14000e680]
movdqu xmmword [rsp + 0x330], xmm0
mov byte [rsp + 0x320], r15b
mov rdx, qword [rsp + 0x3b8]
cmp rdx, r12
jb 0x14000afb5
inc rdx
mov rcx, qword [rsp + 0x3a0]
mov rax, rcx
cmp rdx, rdi
jb 0x14000afaf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000afaf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b6e8
nop
mov rdx, qword [rsp + 0x398]
cmp rdx, r12
jb 0x14000aff6
inc rdx
mov rcx, qword [rsp + 0x380]
mov rax, rcx
cmp rdx, rdi
jb 0x14000aff1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000aff1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b6e8
movdqa xmm0, xmmword [0x14000e680]
movdqu xmmword [rsp + 0x390], xmm0
mov byte [rsp + 0x380], r15b
mov rdx, qword [rsp + 0x3f8]
cmp rdx, r12
jb 0x14000b050
inc rdx
mov rcx, qword [rsp + 0x3e0]
mov rax, rcx
cmp rdx, rdi
jb 0x14000b04b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b04b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b6e8
movdqa xmm0, xmmword [0x14000e680]
movdqu xmmword [rsp + 0x3f0], xmm0
mov byte [rsp + 0x3e0], r15b
mov rdx, qword [rsp + 0x438]
cmp rdx, r12
jb 0x14000b0aa
inc rdx
mov rcx, qword [rsp + 0x420]
mov rax, rcx
cmp rdx, rdi
jb 0x14000b0a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b0a5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b6e8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x360], xmm0
mov qword [rsp + 0x370], r15
movups xmmword [rsp + 0x340], xmm0
mov qword [rsp + 0x350], r15
mov qword [rsp + 0x358], r13
mov byte [rsp + 0x340], r15b
movups xmmword [rsp + 0x380], xmm0
mov qword [rsp + 0x390], 3
mov qword [rsp + 0x398], r13
mov eax, dword [0x14000e534]
mov word [rsp + 0x380], ax
mov al, byte [0x14000e536]
mov byte [rsp + 0x382], al
mov byte [rsp + 0x383], r15b
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x360]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x340]
lea r8, [rsp + 0x380]
lea rdx, [rsp + 0x4a0]
lea rcx, [rsp + 0x500]
call fcn.14000947c
nop
mov rdx, qword [rsp + 0x398]
cmp rdx, r12
jb 0x14000b197
inc rdx
mov rcx, qword [rsp + 0x380]
mov rax, rcx
cmp rdx, rdi
jb 0x14000b191
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b191
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b6e8
nop
mov rdx, qword [rsp + 0x358]
cmp rdx, r12
jb 0x14000b1d8
inc rdx
mov rcx, qword [rsp + 0x340]
mov rax, rcx
cmp rdx, rdi
jb 0x14000b1d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b1d3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b6e8
mov qword [rsp + 0x350], r15
mov qword [rsp + 0x358], r13
mov byte [rsp + 0x340], r15b
mov rbx, qword [rsp + 0x360]
test rbx, rbx
je 0x14000b25b
mov rsi, rbx
cmp rbx, qword [rsp + 0x368]
je 0x14000b220
mov rcx, rsi
call fcn.140006ab8
add rsi, 0x40
cmp rsi, qword [rsp + 0x368]
jne 0x14000b20a
mov rdx, qword [rsp + 0x370]
sub rdx, rbx
and rdx, 0xffffffffffffffc0
mov rax, rbx
cmp rdx, rdi
jb 0x14000b253
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b253
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14000b6e8
mov dword [rsp + 0x20], r14d
mov ebx, 0x20
lea r9d, [rbx + 0x20]
mov r8d, ebx
lea rdx, str.libcrypto_3_x64.dll
lea rcx, [rsp + 0x210]
call fcn.140005b1c
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x320], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x330], xmm1
mov rdx, qword [rsp + 0x4e0]
mov r8, qword [rsp + 0x4e8]
cmp rdx, r8
jne 0x14000b2c8
movdqa xmm0, xmmword [0x14000e680]
movdqu xmmword [rsp + 0x330], xmm0
mov byte [rsp + 0x320], r15b
jmp 0x14000b2dc
mov r9, r8
sub r9, rdx
lea rcx, [rsp + 0x320]
call fcn.140002874
nop
lea rdx, [rsp + 0x320]
cmp qword [rsp + 0x338], r12
cmovae rdx, qword [rsp + 0x320]
mov r8, qword [rsp + 0x330]
lea rcx, [rsp + 0x210]
call fcn.140003028
nop
mov rdx, qword [rsp + 0x338]
cmp rdx, r12
jb 0x14000b34c
inc rdx
mov rcx, qword [rsp + 0x320]
mov rax, rcx
cmp rdx, rdi
jb 0x14000b347
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b347
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b6e8
lea rcx, [rsp + 0x218]
call fcn.140007b94
test rax, rax
jne 0x14000b382
mov rax, qword [rsp + 0x210]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x210]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov dword [rsp + 0x20], r14d
mov r9d, 0x40
mov r8d, ebx
lea rbx, str..injector.com
mov rdx, rbx
lea rcx, [rsp + 0x100]
call fcn.140005b1c
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x320], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x330], xmm1
mov rdx, qword [rsp + 0x480]
mov r8, qword [rsp + 0x488]
cmp rdx, r8
jne 0x14000b3ef
movdqa xmm0, xmmword [0x14000e680]
movdqu xmmword [rsp + 0x330], xmm0
mov byte [rsp + 0x320], r15b
jmp 0x14000b403
mov r9, r8
sub r9, rdx
lea rcx, [rsp + 0x320]
call fcn.140002874
nop
lea rdx, [rsp + 0x320]
cmp qword [rsp + 0x338], r12
cmovae rdx, qword [rsp + 0x320]
mov r8, qword [rsp + 0x330]
lea rcx, [rsp + 0x100]
call fcn.140003028
nop
mov rdx, qword [rsp + 0x338]
cmp rdx, r12
jb 0x14000b473
inc rdx
mov rcx, qword [rsp + 0x320]
mov rax, rcx
cmp rdx, rdi
jb 0x14000b46e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b46e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b6e8
lea rcx, [rsp + 0x108]
call fcn.140007b94
test rax, rax
jne 0x14000b4a9
mov rax, qword [rsp + 0x100]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x100]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea edx, [rax + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor edx, edx
lea r8d, [rdx + 0x64]
lea rcx, [rsp + 0x94]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x90], WSAGetLastError
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
or edx, 0xffffffff
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
lea rcx, [rsp + 0x100]
call fcn.1400071cc
nop
lea rcx, [rsp + 0x210]
call fcn.1400071cc
nop
lea rcx, [rsp + 0x4a0]
call fcn.140006c40
nop
lea rcx, [rsp + 0x508]
call fcn.140006d04
cmp byte [rsp + 0x500], r15b
je 0x14000b59d
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop
lea rcx, [rsp + 0x440]
call fcn.140006c40
nop
lea rcx, [rsp + 0x618]
call fcn.140006d04
cmp byte [rsp + 0x610], r15b
je 0x14000b5c9
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop
xor eax, eax
mov rcx, qword [rsp + 0x720]
xor rcx, rsp
call fcn.14000bab0
lea r11, [rsp + 0x730]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret