Function at 0x14008635c
Capabilities:
Delete file
Delete service
Get common file path

Disassembly:
push rax
pushf
mov eax, 0xc2b63ea
pushf
not eax
add eax, 0x1345f480
xor eax, 0x12fc1eb4
rol eax, 0xe0
popf
pushf
not eax
add eax, 0x64e9b72e
xor eax, 0x1216355a
rol eax, 0x64
popf
pushf
not eax
add eax, 0x1e6dd48
xor eax, 0x40eda581
rol eax, 6
popf
pushf
not eax
add eax, 0x2caadc49
xor eax, 0xe7e436c
rol eax, 0xba
popf
cmp eax, 0x13
jne 0x1400863bf
popf
pop rax
jmp 0x14008725e
cmp eax, 0x1b
jne 0x1400863ce
popf
pop rax
jmp 0x140087686
cmp eax, 0x15
jne 0x1400863dd
popf
pop rax
jmp 0x140087396
cmp eax, 0
jne 0x1400863ec
popf
pop rax
jmp 0x140086563
cmp eax, 8
jne 0x1400863fb
popf
pop rax
jmp 0x140086b1a
cmp eax, 0x12
jne 0x14008640a
popf
pop rax
jmp 0x1400871c7
cmp eax, 0xc
jne 0x140086419
popf
pop rax
jmp 0x140086d7d
cmp eax, 0x18
jne 0x140086428
popf
pop rax
jmp 0x1400874b5
cmp eax, 0x1c
jne 0x140086437
popf
pop rax
jmp 0x1400876d1
cmp eax, 3
jne 0x140086446
popf
pop rax
jmp 0x140086906
cmp eax, 0xa
jne 0x140086455
popf
pop rax
jmp 0x140086c25
cmp eax, 0x11
jne 0x140086464
popf
pop rax
jmp 0x14008718f
cmp eax, 1
jne 0x140086473
popf
pop rax
jmp 0x1400866e2
cmp eax, 4
jne 0x140086482
popf
pop rax
jmp 0x140086969
cmp eax, 7
jne 0x140086491
popf
pop rax
jmp 0x140086a8d
cmp eax, 0xf
jne 0x1400864a0
popf
pop rax
jmp 0x1400870d0
cmp eax, 5
jne 0x1400864af
popf
pop rax
jmp 0x1400869a6
cmp eax, 0xe
jne 0x1400864be
popf
pop rax
jmp 0x14008700a
cmp eax, 0x1a
jne 0x1400864cd
popf
pop rax
jmp 0x140087639
cmp eax, 0x14
jne 0x1400864dc
popf
pop rax
jmp 0x1400872eb
cmp eax, 6
jne 0x1400864eb
popf
pop rax
jmp 0x1400869f6
cmp eax, 0x16
jne 0x1400864fa
popf
pop rax
jmp 0x1400873f6
cmp eax, 0x10
jne 0x140086509
popf
pop rax
jmp 0x140087155
cmp eax, 0x17
jne 0x140086518
popf
pop rax
jmp 0x14008742e
cmp eax, 0x19
jne 0x140086527
popf
pop rax
jmp 0x140087568
cmp eax, 2
jne 0x140086536
popf
pop rax
jmp 0x1400867fb
cmp eax, 0xb
jne 0x140086545
popf
pop rax
jmp 0x140086c83
cmp eax, 9
jne 0x140086554
popf
pop rax
jmp 0x140086bc5
cmp eax, 0xd
jne 0x140086563
popf
pop rax
jmp 0x140086e26
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x14003d040]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov rbx, rcx
call fcn.14008c8d4
mov rcx, rbx
jmp 0x14008659a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, 0x43d519f7
pushf
not r8d
add r8d, 0x64e20082
xor r8d, 0x57a741af
rol r8d, 4
popf
pushf
not r8d
add r8d, 0x6e84cf40
xor r8d, 0x7ff83d3d
rol r8d, 0xc
popf
pushf
not r8d
add r8d, 0x5cbd4af4
xor r8d, 0x362ff330
rol r8d, 0xcc
popf
lea rdx, [0x19288aea2]
pushf
sub rdx, 0x5285c3b2
popf
lea rcx, [rsp + 0x20]
call fcn.140080330
xor edx, edx
xor ecx, ecx
mov r8d, 0x44ac113
pushf
not r8d
add r8d, 0x7021531e
xor r8d, 0x16de1beb
rol r8d, 0x59
popf
pushf
not r8d
add r8d, 0x144711f6
xor r8d, 0x510d00e2
rol r8d, 0x4b
popf
jmp 0x14008665b
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x14008669c
push rax
pushf
mov eax, 0x262304e5
pushf
not eax
add eax, 0x6653d791
xor eax, 0x3546c2ae
rol eax, 0x54
popf
pushf
not eax
add eax, 0xf81c43f
xor eax, 0xf2a6cdf
rol eax, 0x9f
popf
jmp 0x1400863b0
push rax
pushf
mov eax, 0x5d4e3ced
pushf
not eax
add eax, 0x6ae57795
xor eax, 0x3012e2dd
rol eax, 0x8e
popf
pushf
not eax
add eax, 0x4110d28a
xor eax, 0x494ab341
rol eax, 0x42
popf
pushf
not eax
add eax, 0x1d9df6ff
xor eax, 0xeb93558
rol eax, 0x71
popf
jmp 0x1400863b0
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdx, qword [rsp + 0x20]
mov r8d, 0x5577f001
pushf
not r8d
add r8d, 0x42a86cb2
xor r8d, 0x7f95805f
rol r8d, 0xaa
popf
pushf
not r8d
add r8d, 0x1ce045f7
xor r8d, 0x666a6cf5
rol r8d, 0xa2
popf
pushf
not r8d
add r8d, 0x1ef9c3b
xor r8d, 0x7660dd7f
rol r8d, 0x8f
popf
pushf
not r8d
add r8d, 0x1749c3f
xor r8d, 0x67de9b67
rol r8d, 0x4f
popf
mov rcx, rax
jmp 0x140086761
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rax, rax
je 0x1400867c8
push rax
pushf
mov eax, 0x3ab92fc
pushf
not eax
add eax, 0x4a5515d2
xor eax, 0x393464d7
rol eax, 0xc8
popf
pushf
not eax
add eax, 0x4ca4a7bf
xor eax, 0x8c789a0
rol eax, 0x36
popf
pushf
not eax
add eax, 0x177f0b08
xor eax, 0x33b6a211
rol eax, 0x88
popf
pushf
not eax
add eax, 0x7f08cb16
xor eax, 0x5b3a1d3b
rol eax, 0x60
popf
jmp 0x1400863b0
push rax
pushf
mov eax, 0xf3349e
pushf
not eax
add eax, 0x3e2db7c5
xor eax, 0x6c5ea56e
rol eax, 0xb0
popf
pushf
not eax
add eax, 0x72cbfce0
xor eax, 0x4c83ab53
rol eax, 0x3d
popf
jmp 0x1400863b0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], eax
lea r8, [rsp + 0x48]
mov edx, 0x84e88ff2
pushf
not edx
add edx, 0x130dcf0c
xor edx, 0x6f94dea8
rol edx, 3
popf
pushf
not edx
add edx, 0x1fffbde1
xor edx, 0x4052e3ca
rol edx, 0xbf
popf
pushf
not edx
add edx, 0x2240edec
xor edx, 0x241503c2
rol edx, 0xbe
popf
pushf
not edx
add edx, 0x279c4cd1
xor edx, 0x104dbad9
rol edx, 0x73
popf
mov rcx, rbx
jmp 0x140086870
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x1400868d3
push rax
pushf
mov eax, 0x637b06c0
pushf
not eax
add eax, 0x56f2a5fb
xor eax, 0x3ea3f9ef
rol eax, 0xae
popf
pushf
not eax
add eax, 0x5cfeeda2
xor eax, 0x4cbc30b4
rol eax, 0x92
popf
pushf
not eax
add eax, 0x30758b53
xor eax, 0x730eb06f
rol eax, 0x7c
popf
pushf
not eax
add eax, 0x79e90dc2
xor eax, 0x528f4e10
rol eax, 0x2d
popf
jmp 0x1400863b0
push rax
pushf
mov eax, 0x75c4788e
pushf
not eax
add eax, 0x4f86a3bf
xor eax, 0x4bcf95ef
rol eax, 0x78
popf
pushf
not eax
add eax, 0x1ed0fae9
xor eax, 0x3f3eed3a
rol eax, 0xfe
popf
jmp 0x1400863b0
mov rcx, rbx
jmp 0x14008690a
call qword [sym.imp.ADVAPI32.dll_DeleteService]
push rax
pushf
mov eax, 0xd07bf256
pushf
not eax
add eax, 0x3b8bc71f
xor eax, 0x404fa4d6
rol eax, 0xfa
popf
pushf
not eax
add eax, 0x690cfb6
xor eax, 0x113a185e
rol eax, 0xf5
popf
pushf
not eax
add eax, 0xc88de9a
xor eax, 0x6de83a0
rol eax, 0x52
popf
pushf
not eax
add eax, 0x7eec6dad
xor eax, 0x7aee267d
rol eax, 0x52
popf
jmp 0x1400863b0
mov rcx, rbx
jmp 0x14008696d
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push rax
pushf
mov eax, 0xd134f26a
pushf
not eax
add eax, 0x3c0e8a4a
xor eax, 0x29261507
rol eax, 0x2d
popf
pushf
not eax
add eax, 0x62b1b06f
xor eax, 0x7256a56f
rol eax, 0x59
popf
jmp 0x1400863b0
mov rcx, rdi
jmp 0x1400869aa
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push rax
pushf
mov eax, 0xcbceea42
pushf
not eax
add eax, 0x7618101f
xor eax, 0x2a9716bf
rol eax, 0xdc
popf
pushf
not eax
add eax, 0x52330c89
xor eax, 0x191206ad
rol eax, 0x93
popf
pushf
not eax
add eax, 0x7ff89d0e
xor eax, 0x18008354
rol eax, 6
popf
jmp 0x1400863b0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140086a5a
push rax
pushf
mov eax, 0x84f6a554
pushf
not eax
add eax, 0x67ee537b
xor eax, 0x75a810e
rol eax, 0x60
popf
pushf
not eax
add eax, 0x609e2c36
xor eax, 0x3d9b903c
rol eax, 0xe4
popf
pushf
not eax
add eax, 0x269be1e9
xor eax, 0x5419ed86
rol eax, 0x10
popf
pushf
not eax
add eax, 0x136d9c7b
xor eax, 0x31daa07e
rol eax, 0x4a
popf
jmp 0x1400863b0
push rax
pushf
mov eax, 0x428c9ba
pushf
not eax
add eax, 0x4454f139
xor eax, 0x6217373a
rol eax, 0x31
popf
pushf
not eax
add eax, 0x2201325d
xor eax, 0x120ede6
rol eax, 0x8d
popf
jmp 0x1400863b0
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140086ad4
push rax
pushf
mov eax, 0x781dc418
pushf
not eax
add eax, 0x2c2e57ca
xor eax, 0x310660e6
rol eax, 0x40
popf
pushf
not eax
add eax, 0x2414a015
xor eax, 0x1efdacbd
rol eax, 0xc4
popf
jmp 0x1400863b0
push rax
pushf
mov eax, 0xfbaf669b
pushf
not eax
add eax, 0x42accec2
xor eax, 0x67eac60
rol eax, 0x6f
popf
pushf
not eax
add eax, 0x1002a60a
xor eax, 0x2b69eee8
rol eax, 0x3f
popf
pushf
not eax
add eax, 0x61af79cd
xor eax, 0x5e55043c
rol eax, 0x33
popf
jmp 0x1400863b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
push rcx
not rcx
add rax, rcx
pop rcx
add rax, 1
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140086b91
push rax
pushf
mov eax, 0x5e0d094a
pushf
not eax
add eax, 0x7148f352
xor eax, 0xf2cd1e
rol eax, 0xc6
popf
pushf
not eax
add eax, 0x1ca41985
xor eax, 0x58ff5650
rol eax, 0xec
popf
pushf
not eax
add eax, 0x47b6e020
xor eax, 0x66f55bd8
rol eax, 0xf4
popf
pushf
not eax
add eax, 0x62b2781d
xor eax, 0x2f495f14
rol eax, 0xcc
popf
jmp 0x1400863b0
push rax
pushf
mov eax, 0xd40c48ac
pushf
not eax
add eax, 0x4cbc293b
xor eax, 0x4b6b5fe3
rol eax, 0xc2
popf
pushf
not eax
add eax, 0xb5dae04
xor eax, 0x364ab04f
rol eax, 0x88
popf
jmp 0x1400863b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140100bbf
push rax
pushf
mov eax, 0x7522202d
pushf
not eax
add eax, 0x1e8293d8
xor eax, 0x79d5bc1e
rol eax, 0x7c
popf
pushf
not eax
add eax, 0x7d63c287
xor eax, 0x532b46de
rol eax, 0xf3
popf
pushf
not eax
add eax, 0x15892905
xor eax, 0x5d8b9f91
rol eax, 0x15
popf
pushf
not eax
add eax, 0x67fc9b5a
xor eax, 0x88bb0a7
rol eax, 0xce
popf
jmp 0x1400863b0
xor edx, edx
mov r8d, 0x79f9ddbe
pushf
not r8d
add r8d, 0x53d34d9
xor r8d, 0x7f0e08c1
rol r8d, 0x87
popf
pushf
not r8d
add r8d, 0x461d5bd5
xor r8d, 0x568ef54e
rol r8d, 0x16
popf
pushf
not r8d
add r8d, 0x47063b48
xor r8d, 0x21f3c671
rol r8d, 0x7e
popf
lea rcx, [rbp - 0x70]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp - 0x70]
mov ecx, 0x7848772f
pushf
not ecx
add ecx, 0x12744927
xor ecx, 0x61e95ab5
rol ecx, 0x1a
popf
pushf
not ecx
add ecx, 0x201a3b18
xor ecx, 0x25344e8e
rol ecx, 0xfb
popf
pushf
not ecx
add ecx, 0x3a772c6e
xor ecx, 0x58ee306a
rol ecx, 0xe4
popf
jmp 0x140086d28
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rax, [rbp - 0x70]
mov r8, 0xffffffffffffffff
push rax
pushf
mov eax, 0xe4a8c999
pushf
not eax
add eax, 0x30c65697
xor eax, 0x43d061f8
rol eax, 0x85
popf
pushf
not eax
add eax, 0x71582a4f
xor eax, 0x779a899d
rol eax, 0x3e
popf
jmp 0x1400863b0
inc r8
cmp byte [rax + r8], 0
jne 0x140086de0
push rax
pushf
mov eax, 0xd4e5dfb6
pushf
not eax
add eax, 0x621552b1
xor eax, 0x10364e25
rol eax, 0xba
popf
pushf
not eax
add eax, 0x344fae8
xor eax, 0x3fd178a
rol eax, 0x4d
popf
pushf
not eax
add eax, 0x13f94ffb
xor eax, 0x24fc2806
rol eax, 9
popf
pushf
not eax
add eax, 0x19b2f10a
xor eax, 0x6ea4ca7b
rol eax, 0x4b
popf
jmp 0x1400863b0
push rax
pushf
mov eax, 0x516795f8
pushf
not eax
add eax, 0x477ba8b2
xor eax, 0xeab7741
rol eax, 0xa2
popf
pushf
not eax
add eax, 0x4afac9ac
xor eax, 0x5843e4e1
rol eax, 6
popf
pushf
not eax
add eax, 0x2359fed7
xor eax, 0x33a4b787
rol eax, 0xba
popf
jmp 0x1400863b0
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x20]
call fcn.140080330
nop
mov r8d, 0xb7fa4711
pushf
not r8d
add r8d, 0x396e1be7
xor r8d, 0x67bf9668
rol r8d, 0xf2
popf
pushf
not r8d
add r8d, 0x68c58789
xor r8d, 0x5dcde857
rol r8d, 0x36
popf
lea rdx, [0x18bf652e6]
pushf
sub rdx, 0x4bf367ea
popf
lea rcx, [rsp + 0x20]
call fcn.140079008
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], 0
mov byte [rax], 0
mov r8d, 0x28d91271
pushf
not r8d
add r8d, 0x18b27c3d
xor r8d, 0x4faf903c
rol r8d, 0x46
popf
pushf
not r8d
add r8d, 0x5765065c
xor r8d, 0x56c8f57c
rol r8d, 0x26
popf
pushf
not r8d
add r8d, 0x8df4e88
xor r8d, 0x1400aac
rol r8d, 0xa6
popf
lea rdx, [0x1992ea803]
pushf
sub rdx, 0x592bbd13
popf
lea rcx, [rsp + 0x48]
call fcn.140079008
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x140086fc4
push rax
pushf
mov eax, 0x4764555b
pushf
not eax
add eax, 0x73e2560e
xor eax, 0x4f5aa8a4
rol eax, 0x25
popf
pushf
not eax
add eax, 0xa1af94a
xor eax, 0x30c5ee5d
rol eax, 0xad
popf
pushf
not eax
add eax, 0x429eaa0f
xor eax, 0x5c090e42
rol eax, 0xc1
popf
pushf
not eax
add eax, 0x388b447d
xor eax, 0x7164120c
rol eax, 0x1e
popf
jmp 0x1400863b0
push rax
pushf
mov eax, 0xc57700f5
pushf
not eax
add eax, 0x6e43b213
xor eax, 0x4f4c2f09
rol eax, 0x3a
popf
pushf
not eax
add eax, 0x4fc7453c
xor eax, 0x7bc46ef7
rol eax, 0x87
popf
pushf
not eax
add eax, 0x5710ad1d
xor eax, 0x607392d9
rol eax, 0x91
popf
jmp 0x1400863b0
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140087077
push rax
pushf
mov eax, 0xd87358b1
pushf
not eax
add eax, 0x78aef099
xor eax, 0xfcf3f19
rol eax, 0x49
popf
pushf
not eax
add eax, 0x6eb7995
xor eax, 0x10eea8df
rol eax, 0x46
popf
pushf
not eax
add eax, 0x3074e6cb
xor eax, 0x6a74eff4
rol eax, 2
popf
pushf
not eax
add eax, 0xd794eea
xor eax, 0x554c401b
rol eax, 0x25
popf
jmp 0x1400863b0
push rax
pushf
mov eax, 0x7c2e87d6
pushf
not eax
add eax, 0x705cd668
xor eax, 0x5f0e1855
rol eax, 0x6e
popf
pushf
not eax
add eax, 0x60396ec8
xor eax, 0x4dcb988
rol eax, 0x58
popf
pushf
not eax
add eax, 0x6cc81890
xor eax, 0x687643f6
rol eax, 0x63
popf
pushf
not eax
add eax, 0xc9a1402
xor eax, 0x241e10a1
rol eax, 0xde
popf
jmp 0x1400863b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
push rcx
not rcx
add rax, rcx
pop rcx
add rax, 1
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140087121
push rax
pushf
mov eax, 0x6c043459
pushf
not eax
add eax, 0x469c38f
xor eax, 0x18d455dc
rol eax, 0x73
popf
pushf
not eax
add eax, 0xba83e45
xor eax, 0x355c38b6
rol eax, 0x2c
popf
jmp 0x1400863b0
push rax
pushf
mov eax, 0x1c145096
pushf
not eax
add eax, 0x2091e40d
xor eax, 0x3c6710a9
rol eax, 0x39
popf
pushf
not eax
add eax, 0x96b25d4
xor eax, 0x4afae1cc
rol eax, 0x38
popf
jmp 0x1400863b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140100bbf
push rax
pushf
mov eax, 0x7ede2c60
pushf
not eax
add eax, 0x159f0501
xor eax, 0x8a78d83
rol eax, 0x3f
popf
pushf
not eax
add eax, 0x3caa2ae9
xor eax, 0x64768057
rol eax, 0x29
popf
jmp 0x1400863b0
movdqa xmm0, xmmword [0x1400375d0]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140087218
push rax
pushf
mov eax, 0x83a244db
pushf
not eax
add eax, 0x45427d3b
xor eax, 0x3d3bb830
rol eax, 0xde
popf
pushf
not eax
add eax, 0x1901ba42
xor eax, 0x19dada35
rol eax, 0x60
popf
jmp 0x1400863b0
push rax
pushf
mov eax, 0x5dabfb6c
pushf
not eax
add eax, 0x7ce00108
xor eax, 0x5ce0b7de
rol eax, 0x3f
popf
pushf
not eax
add eax, 0x4d89ddf4
xor eax, 0x20147796
rol eax, 0xb2
popf
pushf
not eax
add eax, 0x40abb5be
xor eax, 0x738da98e
rol eax, 0x37
popf
jmp 0x1400863b0
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400872a5
push rax
pushf
mov eax, 0xab1a3edc
pushf
not eax
add eax, 0x3ff75552
xor eax, 0x4cf81ac3
rol eax, 0x61
popf
pushf
not eax
add eax, 0xc9c80a0
xor eax, 0x59526732
rol eax, 0x4a
popf
jmp 0x1400863b0
push rax
pushf
mov eax, 0x6ef22d24
pushf
not eax
add eax, 0x31887166
xor eax, 0x1e20715b
rol eax, 0xbc
popf
pushf
not eax
add eax, 0x108c664e
xor eax, 0xf46836c
rol eax, 0x29
popf
pushf
not eax
add eax, 0x49a56712
xor eax, 0x31a24636
rol eax, 0x69
popf
jmp 0x1400863b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
push rcx
not rcx
add rax, rcx
pop rcx
add rax, 1
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008733c
push rax
pushf
mov eax, 0x4753673d
pushf
not eax
add eax, 0x4b8d2b9f
xor eax, 0x1d7869e2
rol eax, 0xd1
popf
pushf
not eax
add eax, 0x75317710
xor eax, 0x302b448c
rol eax, 0xc7
popf
jmp 0x1400863b0
push rax
pushf
mov eax, 0xe210a83d
pushf
not eax
add eax, 0x386355cc
xor eax, 0x27bd02c0
rol eax, 0x22
popf
pushf
not eax
add eax, 0x300f9147
xor eax, 0x3b503e38
rol eax, 0x28
popf
pushf
not eax
add eax, 0x610f0d81
xor eax, 0x3fab7eed
rol eax, 0x69
popf
pushf
not eax
add eax, 0x49bfdec7
xor eax, 0x2a724807
rol eax, 0x98
popf
jmp 0x1400863b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140100bbf
push rax
pushf
mov eax, 0xc51c9f4c
pushf
not eax
add eax, 0xfbcabab
xor eax, 0x535c810e
rol eax, 0x29
popf
pushf
not eax
add eax, 0x6ed8bff7
xor eax, 0x75be1eb3
rol eax, 0x9c
popf
jmp 0x1400863b0
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rcx, qword [rsp + 0x68]
jmp 0x14008743f
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x140087482
push rax
pushf
mov eax, 0x30cdcd93
pushf
not eax
add eax, 0x6886f96d
xor eax, 0x708d15dc
rol eax, 0xf2
popf
pushf
not eax
add eax, 0x8da2b58
xor eax, 0x10c50f07
rol eax, 0xbc
popf
jmp 0x1400863b0
push rax
pushf
mov eax, 0x1e4508bb
pushf
not eax
add eax, 0x1b6ad74c
xor eax, 0x52555fa5
rol eax, 0x69
popf
pushf
not eax
add eax, 0x84e566c
xor eax, 0x272bebed
rol eax, 0x7d
popf
jmp 0x1400863b0
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140087522
push rax
pushf
mov eax, 0x970080d5
pushf
not eax
add eax, 0x17efa7b3
xor eax, 0x38f191e4
rol eax, 0xc9
popf
pushf
not eax
add eax, 0x4ddbe57c
xor eax, 0x4ebd28d9
rol eax, 0xd7
popf
pushf
not eax
add eax, 0x23ef98f2
xor eax, 0x62c4e163
rol eax, 0xac
popf
pushf
not eax
add eax, 0x481c8af
xor eax, 0x7f674b2e
rol eax, 0xc5
popf
jmp 0x1400863b0
push rax
pushf
mov eax, 0x3932dcf5
pushf
not eax
add eax, 0x4defd2b2
xor eax, 0x106453b0
rol eax, 0x8c
popf
pushf
not eax
add eax, 0x58e6f11e
xor eax, 0xfa5ad5d
rol eax, 0x28
popf
pushf
not eax
add eax, 0x68846acb
xor eax, 0x44e6eb09
rol eax, 0xf7
popf
jmp 0x1400863b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
push rcx
not rcx
add rax, rcx
pop rcx
add rax, 1
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400875df
push rax
pushf
mov eax, 0xc37dd2b5
pushf
not eax
add eax, 0x6cd6c406
xor eax, 0x7ac32244
rol eax, 0x61
popf
pushf
not eax
add eax, 0x6d4cbf1e
xor eax, 0x301112c0
rol eax, 0x75
popf
pushf
not eax
add eax, 0x73323722
xor eax, 0x535043a0
rol eax, 0x26
popf
pushf
not eax
add eax, 0xd2fa15f
xor eax, 0x1c62b13f
rol eax, 0x55
popf
jmp 0x1400863b0
push rax
pushf
mov eax, 0x1eb20e39
pushf
not eax
add eax, 0x51217336
xor eax, 0x6d83e527
rol eax, 0x94
popf
pushf
not eax
add eax, 0x199c3588
xor eax, 0x61ceb65c
rol eax, 0xcd
popf
pushf
not eax
add eax, 0x438e29db
xor eax, 0x151c1620
rol eax, 0xb7
popf
pushf
not eax
add eax, 0x20c6aa71
xor eax, 0x463373ad
rol eax, 0x41
popf
jmp 0x1400863b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140100bbf
push rax
pushf
mov eax, 0x321ef8c8
pushf
not eax
add eax, 0x7003f91f
xor eax, 0x29aac07c
rol eax, 0xb6
popf
pushf
not eax
add eax, 0x3041d40b
xor eax, 0x60645613
rol eax, 0xe2
popf
pushf
not eax
add eax, 0x2f29b850
xor eax, 0x17c6a02a
rol eax, 0xd4
popf
jmp 0x1400863b0
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.1400ff118
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret