Function at 0x1400417f0
Capabilities:
Execute command
Self delete
Terminate process

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x14005e040]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x150]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x150]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x150]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov rbx, rax
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
mov byte [rax], 0
lea rcx, [rsp + 0x20]
call fcn.1400415b0
nop
lea rcx, str.type_nul___deleter.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rsp + 0x40]
call fcn.140041b00
lea rcx, [rsp + 0x40]
call fcn.140042940
nop
lea rcx, [rsp + 0x40]
call fcn.1400427b0
lea rdx, str._echo_off
lea rcx, [rsp + 0x40]
call fcn.14003f860
lea rdx, [0x140036cc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp byte [0x14005e0cf], 0
je 0x140041929
lea rdx, str.del___s___q
lea rcx, [rsp + 0x40]
call fcn.14003f860
mov rcx, rax
lea rdx, [0x1400546ac]
call fcn.14003f860
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.140042ca0
mov rcx, rax
lea rdx, [0x1400546b8]
call fcn.14003f860
mov rcx, rax
mov rdx, rbx
call fcn.14003f860
mov rcx, rax
lea rdx, str..exe
call fcn.14003f860
mov rcx, rax
lea rdx, [0x1400546ac]
call fcn.14003f860
lea rdx, [0x140036cc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp byte [0x14005e0ce], 0
je 0x1400419e0
lea rdx, [0x1400546d0]
lea rcx, [rsp + 0x40]
call fcn.14003f860
lea rdx, [0x140036cc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.cd_windows_prefetch
lea rcx, [rsp + 0x40]
call fcn.14003f860
lea rdx, [0x140036cc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.del
lea rcx, [rsp + 0x40]
call fcn.14003f860
mov rcx, rax
lea rdx, [0x1400546ac]
call fcn.14003f860
mov rcx, rax
mov rdx, rbx
call fcn.14003f860
mov rcx, rax
lea rdx, str...pf
call fcn.14003f860
mov rcx, rax
lea rdx, [0x1400546ac]
call fcn.14003f860
mov rcx, rax
lea rdx, str._s__q
call fcn.14003f860
lea rdx, [0x140036cc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp byte [0x14005fd84], 0
je 0x140041a2b
lea rdx, str.taskkill__f__IM_explorer.exe
lea rcx, [rsp + 0x40]
call fcn.14003f860
lea rdx, [0x140036cc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.start_explorer.exe
lea rcx, [rsp + 0x40]
call fcn.14003f860
lea rdx, [0x140036cc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.echo_You_can_close_this_window
lea rcx, [rsp + 0x40]
call fcn.14003f860
lea rdx, [0x140036cc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.DEL____f0_
lea rcx, [rsp + 0x40]
call fcn.14003f860
lea rdx, [0x140036cc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rsp + 0x40]
call fcn.140042770
lea rcx, str.start_deleter.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3