Function at 0x1400011c0
Capabilities:
Create process on windows
Get common file path
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov rbx, rdx
mov qword [rsp + 0x30], rdx
mov edi, ecx
mov dword [rsp + 0x58], ecx
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], 0
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
movabs rsi, 0x7fffffffffffffff
movabs rcx, 0x8000000000000000
mov edx, 0x16
lea r14, [rdx - 0x17]
cmp edi, 1
jle 0x14000146d
mov r12d, 1
lea r13d, [rdx - 0x14]
nop dword [rax]
mov r15, qword [rbx + r12*8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov rbx, r14
nop
inc rbx
cmp byte [r15 + rbx], 0
jne 0x140001270
cmp rbx, rsi
ja 0x140001b77
cmp rbx, 0xf
ja 0x1400012c0
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], 0xf
mov r8, rbx
mov rdx, r15
lea rcx, [rsp + 0x38]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x38], 0
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x38]
jmp 0x140001348
mov rdi, rbx
or rdi, 0xf
cmp rdi, rsi
jbe 0x1400012d5
mov rdi, rsi
lea rax, [rcx + 0x27]
jmp 0x1400012f7
cmp rdi, 0x16
cmovb rdi, rdx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140001316
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001b5f
mov rcx, rax
call fcn.140002150
test rax, rax
je 0x140001ad9
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001327
test rcx, rcx
je 0x140001325
call fcn.140002150
mov rsi, rax
jmp 0x140001327
xor esi, esi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rdi
mov r8, rbx
mov rdx, r15
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
lea rcx, [rsp + 0x38]
cmp rdi, 0xf
seta r15b
cmova rcx, rsi
cmp rbx, 0xa
jne 0x140001376
mov r8, rbx
lea rdx, str.__fileName
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140001376
mov bl, 1
jmp 0x140001378
xor bl, bl
test r15b, r15b
je 0x1400013ae
lea rdx, [rdi + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400013a6
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001ad9
mov rcx, rsi
call fcn.14000218c
test bl, bl
je 0x140001406
cmp r13d, dword [rsp + 0x58]
jge 0x140001447
mov rbx, qword [rsp + 0x30]
mov r9, qword [rbx + r12*8 + 8]
mov rdi, r14
nop word [rax + rax]
inc rdi
cmp byte [r9 + rdi], 0
jne 0x1400013d0
mov rax, qword [rbp - 0x48]
cmp rdi, rax
ja 0x140001439
lea rbx, [rbp - 0x60]
cmp rax, 0xf
cmova rbx, qword [rbp - 0x60]
mov qword [rbp - 0x50], rdi
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
mov rbx, qword [rsp + 0x30]
inc r13d
inc r12
movsxd rcx, dword [rsp + 0x58]
movabs rsi, 0x7fffffffffffffff
cmp r12, rcx
jge 0x14000146d
movabs rcx, 0x8000000000000000
mov edx, 0x16
jmp 0x140001260
mov rdx, rdi
lea rcx, [rbp - 0x60]
call fcn.140001f70
jmp 0x14000140b
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001bf0
lea rdx, [0x140001da0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ebx, 1
jmp 0x140001ae9
lea rdx, [rbp]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
lea rax, [rbp]
nop word [rax + rax]
inc r14
cmp byte [rax + r14], 0
jne 0x1400014a0
cmp r14, rsi
ja 0x140001b77
mov qword [rsp + 0x78], 0xf
cmp r14, 0xf
ja 0x1400014f2
mov qword [rsp + 0x70], r14
mov r8, r14
lea rdx, [rbp]
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + r14 + 0x60], 0
mov rdi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x60]
jmp 0x14000158b
mov rdi, r14
or rdi, 0xf
cmp rdi, rsi
jbe 0x14000152e
mov rdi, rsi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002150
test rax, rax
je 0x140001ad9
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001568
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140001557
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001b5f
jmp 0x14000150f
test rcx, rcx
je 0x140001566
call fcn.140002150
mov rsi, rax
jmp 0x140001568
xor esi, esi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], rdi
mov r8, r14
lea rdx, [rbp]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r14], 0
movabs rcx, 0x7fffffffffffffff
mov r12, rcx
sub r12, r14
cmp r12, 0x12
jb 0x140001b7d
lea rax, [rsp + 0x60]
cmp rdi, 0xf
cmova rax, rsi
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
lea r13, [r14 + 0x12]
mov ebx, 0xf
lea r15, [rbp - 0x20]
cmp r13, rbx
jbe 0x140001661
mov rbx, r13
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000161d
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002150
test rax, rax
je 0x140001a91
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
mov rax, qword [rsp + 0x30]
jmp 0x14000165d
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001646
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001b65
jmp 0x1400015f9
test rcx, rcx
je 0x14000165a
call fcn.140002150
mov r15, rax
mov rax, qword [rsp + 0x30]
jmp 0x14000165d
xor r15d, r15d
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], rbx
mov r8, r14
mov rdx, rax
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.__unknown3304.exe]
movups xmmword [r15 + r14], xmm0
movzx eax, word [0x140004440]
mov word [r15 + r14 + 0x10], ax
mov byte [r15 + r13], 0
cmp r12, 0x16
jb 0x140001b59
lea r13, [rsp + 0x60]
cmp rdi, 0xf
cmova r13, rsi
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
lea r12, [r14 + 0x16]
mov ebx, 0xf
lea r15, [rbp - 0x40]
cmp r12, rbx
jbe 0x140001756
mov rbx, r12
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x140001717
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002150
test rax, rax
je 0x140001a42
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x140001752
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001740
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001b6b
jmp 0x1400016f8
test rcx, rcx
je 0x14000174f
call fcn.140002150
mov r15, rax
jmp 0x140001752
xor r15d, r15d
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], rbx
mov r8, r14
mov rdx, r13
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.__loader_old_3304.exe]
movups xmmword [r15 + r14], xmm0
mov eax, dword [0x140004458]
mov dword [r15 + r14 + 0x10], eax
movzx eax, word [0x14000445c]
mov word [r15 + r14 + 0x14], ax
mov byte [r15 + r12], 0
lea r13, [rsp + 0x60]
cmp rdi, 0xf
cmova r13, rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
lea r12, [r14 + 1]
mov ebx, 0xf
lea r15, [rsp + 0x38]
cmp r12, rbx
jbe 0x140001850
mov rbx, r12
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x140001810
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002150
test rax, rax
je 0x140001944
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x14000184b
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001839
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001b71
jmp 0x1400017f1
test rcx, rcx
je 0x140001848
call fcn.140002150
mov r15, rax
jmp 0x14000184b
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], rbx
mov r8, r14
mov rdx, r13
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [r15 + r14], 0x5c
mov byte [r15 + r12], 0
mov r14, qword [rbp - 0x50]
lea r9, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova r9, qword [rbp - 0x60]
mov r15, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
sub rax, r15
cmp r14, rax
ja 0x1400018d0
lea rax, [r15 + r14]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x38]
cmp rcx, 0xf
cmova rbx, qword [rsp + 0x38]
lea rcx, [rbx + r15]
mov r8, r14
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [r14 + rbx]
mov byte [rax + r15], 0
lea rax, [rsp + 0x38]
jmp 0x1400018e2
mov qword [rsp + 0x20], r14
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.140001de0
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x140001950
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000194b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000194b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000218c
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova rcx, qword [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova rdx, qword [rbp - 0x80]
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rcx, qword [rbp - 0x20]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
lea r8, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova r8, qword [rbp - 0x80]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x1400019ff
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400019fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000218c
movdqa xmm0, xmmword [0x140004470]
movdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x80], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140001a4e
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a49
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001a49
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000218c
movdqa xmm0, xmmword [0x140004470]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140001a9d
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a98
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001a98
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000218c
movdqa xmm0, xmmword [0x140004470]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
cmp rdi, 0xf
jbe 0x140001ae9
lea rdx, [rdi + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140001ae0
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ae0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14000218c
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140001b27
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b22
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001b22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000218c
mov eax, ebx
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.140002130
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011a0
nop
call fcn.140001100
nop
call fcn.140001100
nop
call fcn.140001100
nop
call fcn.140001100
nop
call fcn.1400011a0
nop
call fcn.1400011a0
int3