Function at 0x14015b214
Capabilities:
Create process on windows
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x248]
sub rsp, 0x310
mov rdi, rdx
xor r15d, r15d
mov rax, qword [rdx + 8]
cmp qword [rdx], rax
je 0x14015b942
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], 6
lea r13d, [r15 + 0xf]
mov qword [rbp - 0x38], r13
mov eax, dword [str.SPURDO]
mov dword [rbp - 0x50], eax
movzx eax, word [0x140d869c4]
mov word [rbp - 0x4c], ax
mov byte [rbp - 0x4a], r15b
lea r9, [rbp - 0x50]
lea rdx, [rbp + 0x50]
call fcn.14013b988
mov rsi, rax
mov r8, qword [0x140db8f10]
mov rdx, qword [r8 + 0x10]
movabs rbx, 0x7fffffffffffffff
mov rcx, rbx
sub rcx, rdx
lea r12d, [r15 + 0xc]
cmp rcx, r12
jb 0x14015ba35
mov r9, r8
cmp qword [r8 + 0x18], r13
jbe 0x14015b2c2
mov r9, qword [r8]
mov qword [rsp + 0x30], r12
lea rax, str.assetsmisc_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
mov dl, byte [rbp + 0x258]
lea rcx, [rbp - 0x70]
call fcn.140134824
nop
mov r9, rsi
lea r8, [rbp - 0x70]
mov dl, byte [rbp + 0x258]
lea rcx, [rbp]
call fcn.14015c0e8
nop
mov r8d, 4
lea rdx, str..exe
lea rcx, [rbp]
call fcn.14012dbbc
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r13
mov byte [rax], r15b
mov r14d, 0x1000
mov rdx, qword [rbp + 0x18]
cmp rdx, r13
jbe 0x14015b37c
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, r14
jb 0x14015b377
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14015ba3b
call fcn.140c4bba0
movdqa xmm0, xmmword [0x140d88bb0]
movdqu xmmword [rbp + 0x10], xmm0
mov byte [rbp], r15b
mov rdx, qword [rbp - 0x58]
cmp rdx, r13
jbe 0x14015b3cb
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, r14
jb 0x14015b3be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14015ba41
call fcn.140c4bba0
movdqa xmm0, xmmword [0x140d88bb0]
mov rdx, qword [rbp + 0x68]
cmp rdx, r13
jbe 0x14015b409
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, r14
jb 0x14015b3fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14015ba47
call fcn.140c4bba0
movdqa xmm0, xmmword [0x140d88bb0]
movdqu xmmword [rbp + 0x60], xmm0
mov byte [rbp + 0x50], r15b
mov r8, qword [0x140db8f10]
mov rax, qword [r8 + 0x10]
sub rbx, rax
cmp rbx, r12
jb 0x14015ba4d
mov r9, r8
cmp qword [r8 + 0x18], r13
jbe 0x14015b435
mov r9, qword [r8]
mov qword [rsp + 0x30], r12
lea rcx, str.assetsmisc_
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov dl, byte [rbp + 0x258]
lea rcx, [rbp - 0x70]
call fcn.140134824
nop
lea rax, [rbp - 0x70]
cmp qword [rbp - 0x58], r13
cmova rax, qword [rbp - 0x70]
mov qword [rsp + 0x50], rax
mov rax, qword [rbp - 0x60]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x30]
call fcn.14013a71c
nop
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.14015bd00
test eax, eax
jne 0x14015ba53
lea rcx, [rbp + 0x30]
call fcn.140139d28
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, r13
jbe 0x14015b4ef
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, r14
jb 0x14015b4ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14015ba66
call fcn.140c4bba0
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x14015b502
lock inc dword [rbx + 8]
mov rbx, qword [rsp + 0x68]
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x50], xmm0
test rbx, rbx
je 0x14015b51b
lock inc dword [rbx + 8]
mov rbx, qword [rsp + 0x68]
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
or r12, 0xffffffffffffffff
test rbx, rbx
je 0x14015b568
mov eax, r12d
lock xadd dword [rbx + 8], eax
add eax, r12d
jne 0x14015b563
mov rbx, qword [rsp + 0x68]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r12d
lock xadd dword [rbx + 0xc], eax
add eax, r12d
jne 0x14015b563
mov rbx, qword [rsp + 0x68]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x14015b568
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
test rsi, rsi
je 0x14015b62c
add rsi, 0x20
lea rdx, [rbp - 0x70]
mov rcx, rsi
call fcn.140137afc
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], r13
jbe 0x14015b593
mov rax, qword [rax]
mov qword [rsp + 0x20], 6
lea r9, str.dv.bin
xor r8d, r8d
mov rcx, rax
call fcn.1401510b0
mov r14, rax
mov rdx, qword [rbp - 0x58]
cmp rdx, r13
jbe 0x14015b5eb
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14015b5e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14015ba6c
call fcn.140c4bba0
cmp r14, r12
jne 0x14015b615
mov rcx, rsi
cmp qword [rsi + 0x18], 7
jbe 0x14015b5fd
mov rcx, qword [rsi]
call fcn.140c49bc8
mov qword [rbp + 0x250], rax
shr rax, 0x20
test eax, eax
jne 0x14015ba72
lea rcx, [rsp + 0x50]
call fcn.14015ada4
test eax, eax
jne 0x14015b934
jmp 0x14015b568
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14015b66d
mov eax, r12d
lock xadd dword [rcx + 8], eax
add eax, r12d
jne 0x14015b668
mov rbx, qword [rsp + 0x58]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r12d
lock xadd dword [rbx + 0xc], eax
add eax, r12d
jne 0x14015b668
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x14015b6a4
mov eax, r12d
lock xadd dword [rbx + 8], eax
add eax, r12d
jne 0x14015b6a4
mov rbx, qword [rsp + 0x68]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r12d
lock xadd dword [rbx + 0xc], eax
add eax, r12d
jne 0x14015b6a4
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x90]
call fcn.14013e080
nop
mov rax, qword [rbp + 0x90]
movsxd rcx, dword [rax + 4]
test byte [rbp + rcx + 0xa0], 6
jne 0x14015ba88
mov r8, qword [rdi + 8]
sub r8, qword [rdi]
mov rdx, qword [rdi]
lea rcx, [rbp + 0x90]
call fcn.14013f8d8
lea rcx, [rbp + 0x90]
call fcn.14013df64
mov dword [rbp + 0x1a0], WSAGetLastError
xor edx, edx
lea r8d, [rdx + 0x60]
lea rcx, [rbp + 0x1a8]
call fcn.140c85fe0
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], r13
cmova rcx, qword [rsp + 0x70]
lea rax, [rbp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x14015b832
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], r13
cmova rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
lea rcx, [rbp + 0x138]
call fcn.14013e000
nop
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x138], rax
lea rcx, [rbp + 0x138]
call fcn.140c4a428
nop
mov rdx, qword [rbp - 0x78]
mov r14d, 0x1000
cmp rdx, r13
jbe 0x14015b7d9
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r14
jb 0x14015b7d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14015b92e
call fcn.140c4bba0
movdqa xmm0, xmmword [0x140d88bb0]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], r15b
mov rcx, qword [rdi]
test rcx, rcx
je 0x14015b82b
mov rdx, qword [rdi + 0x10]
sub rdx, rcx
cmp rdx, r14
jb 0x14015b81b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14015b93c
mov rcx, r8
call fcn.140c4bba0
mov qword [rdi], r15
mov qword [rdi + 8], r15
mov qword [rdi + 0x10], r15
xor eax, eax
jmp 0x14015b913
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], r13
cmova rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, dword [rbp + 0x80]
lea rcx, [rbp + 0x138]
call fcn.14013e000
nop
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x138], rax
lea rcx, [rbp + 0x138]
call fcn.140c4a428
nop
mov rdx, qword [rbp - 0x78]
mov r14d, 0x1000
cmp rdx, r13
jbe 0x14015b8c2
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r14
jb 0x14015b8bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14015b92e
call fcn.140c4bba0
movdqa xmm0, xmmword [0x140d88bb0]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], r15b
mov rcx, qword [rdi]
test rcx, rcx
je 0x14015b910
mov rdx, qword [rdi + 0x10]
sub rdx, rcx
cmp rdx, r14
jb 0x14015b900
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14015b93c
mov rcx, r8
call fcn.140c4bba0
mov qword [rdi], r15
mov qword [rdi + 8], r15
mov qword [rdi + 0x10], r15
mov rax, rbx
mov rbx, qword [rsp + 0x360]
add rsp, 0x310
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140c5acfc
nop
mov edx, eax
call fcn.14015ace8
nop
call fcn.140c5acfc
nop
movabs rax, 0x62c3d91bb4c1e95f
mov qword [rbp - 0x50], rax
movabs rax, 0x3fce4e59d0e2c65a
mov qword [rbp - 0x48], rax
movabs rax, 0x53121bfc733e026e
mov qword [rbp - 0x40], rax
movabs rax, 0xb8a9668144077a52
mov qword [rbp - 0x38], rax
movabs rcx, 0x42f9ab7ed0a08613
mov qword [rbp - 0x20], rcx
movabs rcx, 0x56ee372bb18caf18
mov qword [rbp - 0x18], rcx
movabs rcx, 0x726b6f8c1e5b221d
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rax
movdqa xmm0, xmmword [rbp - 0x20]
xorps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [rbp - 0x40]
xorps xmm1, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x40], xmm1
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14012d810
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.140135d64
movups xmm1, xmmword [rax]
movdqu xmmword [rsp + 0x50], xmm1
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x30]
call fcn.140135d64
movups xmm1, xmmword [rax]
movdqu xmmword [rsp + 0x50], xmm1
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x50]
call fcn.14015bddc
nop
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.140135d10
lea rdx, [0x140db1a28]
lea rcx, [rbp - 0x70]
call fcn.140c4d970
nop
call fcn.1401295bc
nop
call fcn.140c5acfc
nop
call fcn.140c5acfc
nop
call fcn.140c5acfc
int3
call fcn.1401295bc
nop
lea r8, [rbp + 0x30]
mov edx, eax
lea rcx, str.directory_iterator::directory_iterator
call fcn.14015ad44
nop
call fcn.140c5acfc
nop
call fcn.140c5acfc
int3
mov r8, rsi
mov edx, dword [rbp + 0x254]
lea rcx, str.remove
call fcn.14015ad44
nop
movabs rax, 0x62c3d91bb4c1e95f
mov qword [rbp], rax
movabs rax, 0x21ce534edde5ce5e
mov qword [rbp + 8], rax
movabs rax, 0x52041bac7b2f4b6f
mov qword [rbp + 0x10], rax
movabs rax, 0xcadb23a1216b1334
mov qword [rbp + 0x18], rax
movabs rax, 0xa9b8c471fd91bcc8
mov qword [rbp + 0x20], rax
movabs rdx, 0x530df0e77d167fec
mov qword [rbp + 0x28], rdx
movabs rcx, 0x42f9ab7ed0a08613
mov qword [rbp - 0x50], rcx
movabs rcx, 0x56ee372bb18caf18
mov qword [rbp - 0x48], rcx
movabs rcx, 0x726b6f8c1e5b221d
mov qword [rbp - 0x40], rcx
movabs rax, 0xb8a9668144077a52
mov qword [rbp - 0x38], rax
movabs rax, 0xa9b8b90addabcea7
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp], xmm0
movdqa xmm1, xmmword [rbp + 0x10]
xorps xmm1, xmmword [rbp - 0x40]
movdqa xmmword [rbp + 0x10], xmm1
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x20], xmm0
lea rdx, [rbp]
lea rcx, [rbp + 0x30]
call fcn.14012d810
movups xmm0, xmmword [rax]
movdqu xmmword [rbp - 0x20], xmm0
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x50]
call fcn.140135d64
movups xmm1, xmmword [rax]
movdqu xmmword [rbp - 0x20], xmm1
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x60]
call fcn.140135d64
movups xmm1, xmmword [rax]
movdqu xmmword [rbp - 0x20], xmm1
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x50]
call fcn.14015bddc
nop
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.140135d10
lea rdx, [0x140db1a28]
lea rcx, [rbp - 0x70]
call fcn.140c4d970
int3