Function at 0x4a9563
Capabilities:
Delete file
Encode data using xor
Execute command

Disassembly:
mov eax, 0x5016ad
call fcn.00500754
sub esp, 0x308
push ebx
push esi
push edi
mov edi, 0x65b940
mov ecx, 0x659578
push edi
xor ebx, ebx
call fcn.004a64ab
push 0x7e
pop ecx
xor edx, edx
mov byte [ebp - 0x12], bl
div ecx
push 5
inc dl
mov ecx, ebx
mov al, dl
mov byte [ebp - 0x18], dl
xor al, 0x4c
mov byte [ebp - 0x17], al
mov al, dl
xor al, 0x6f
mov byte [ebp - 0x16], al
mov al, dl
xor al, 0x67
mov byte [ebp - 0x15], al
mov al, dl
xor al, 0x69
mov byte [ebp - 0x14], al
mov al, dl
xor al, 0x6e
mov byte [ebp - 0x13], al
pop esi
mov al, byte [ebp + ecx - 0x17]
xor al, dl
mov byte [ecx + 0x65e100], al
inc ecx
cmp ecx, esi
jb 0x4a95bf
mov ecx, 0x65e100
mov byte [0x65e105], bl
call fcn.004e311c
cmp byte [0x65a3e9], bl
jne 0x4a95f4
call fcn.004a9409
mov byte [0x65a3e9], 1
push edi
mov ecx, 0x659578
call fcn.004a64ab
xor edx, edx
mov byte [ebp - 0x19], bl
push 0x7e
pop ecx
div ecx
inc dl
mov al, dl
mov byte [ebp - 0x23], dl
xor al, 0x55
mov cl, dl
mov byte [ebp - 0x22], al
xor cl, 0x65
mov al, dl
mov byte [ebp - 0x20], cl
xor al, 0x73
mov byte [ebp - 0x1b], cl
mov byte [ebp - 0x21], al
mov ecx, ebx
mov al, dl
xor al, 0x72
mov byte [ebp - 0x1f], al
mov al, dl
xor al, 0x6e
mov byte [ebp - 0x1e], al
mov al, dl
xor al, 0x61
mov byte [ebp - 0x1d], al
mov al, dl
xor al, 0x6d
mov byte [ebp - 0x1c], al
mov al, dl
xor al, 0x3a
mov byte [ebp - 0x1a], al
mov al, byte [ebp + ecx - 0x22]
xor al, dl
mov byte [ecx + 0x65e154], al
inc ecx
cmp ecx, 9
jb 0x4a964c
push 0x65e154
mov byte [0x65e15d], bl
call fcn.004e0ca4
push ecx
push ebx
push 0xc
mov edx, 0x659010
mov ecx, str.username
call fcn.004e50b2
add esp, 0x10
mov ecx, 0x659578
push edi
call fcn.004a64ab
xor edx, edx
mov byte [ebp - 0x19], bl
push 0x7e
pop ecx
div ecx
inc dl
mov al, dl
mov byte [ebp - 0x22], dl
xor al, 0x4c
mov cl, dl
mov byte [ebp - 0x21], al
xor cl, 0x65
mov al, dl
mov byte [ebp - 0x1e], cl
xor al, 0x69
mov byte [ebp - 0x1b], cl
mov byte [ebp - 0x20], al
mov ecx, ebx
mov al, dl
xor al, 0x63
mov byte [ebp - 0x1f], al
mov al, dl
xor al, 0x6e
mov byte [ebp - 0x1d], al
mov al, dl
xor al, 0x73
mov byte [ebp - 0x1c], al
mov al, dl
xor al, 0x3a
mov byte [ebp - 0x1a], al
mov al, byte [ebp + ecx - 0x21]
xor al, dl
mov byte [ecx + 0x65e0f4], al
inc ecx
cmp ecx, 8
jb 0x4a96d5
push 0x65e0f4
mov byte [0x65e0fc], bl
call fcn.004e0ca4
push ecx
push ebx
push 0x19
mov edx, 0x65901c
mov ecx, str.password
call fcn.004e50b2
mov bl, byte [0x659035]
add esp, 0x10
push dword [ebp - 0x15]
push ecx
lea ecx, [ebp - 0x7c]
call fcn.004aa995
xor edx, edx
mov cl, byte [eax + edx + 1]
xor cl, byte [eax]
mov byte [edx + 0x65e200], cl
inc edx
cmp edx, 0x16
jb 0x4a9721
mov edx, 0x659035
mov byte [0x65e216], 0
mov ecx, 0x65e200
call fcn.004e2283
push 2
pop edi
test al, al
je 0x4a97e6
mov al, byte [0x659035]
cmp al, bl
je 0x4a97e6
lea ecx, [ebp - 0x64]
test al, al
je 0x4a97ac
push 0x65901c
call fcn.004a2965
xor ebx, ebx
lea ecx, [ebp - 0x7c]
push 0x659010
mov dword [ebp - 4], ebx
call fcn.004a2965
push 1
lea edx, [ebp - 0x64]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x7c]
call fcn.004a934b
pop ecx
lea ecx, [ebp - 0x7c]
call fcn.004a2890
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.004a2890
jmp 0x4a97e8
push 0x503dbe
call fcn.004a2965
push 0x503dbe
lea ecx, [ebp - 0x7c]
mov dword [ebp - 4], edi
call fcn.004a2965
push str.log.config
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
pop ecx
lea ecx, [ebp - 0x7c]
call fcn.004a2890
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.004a2890
xor ebx, ebx
and dword [ebp - 0x20], 0
mov ecx, 0x659578
and dword [ebp - 0x1c], 0
push 0x65b940
call fcn.004a64ab
xor edx, edx
mov byte [ebp - 0x12], bl
push 0x7e
pop ecx
div ecx
mov ecx, ebx
inc dl
mov al, dl
mov byte [ebp - 0x18], dl
xor al, 0x4c
mov byte [ebp - 0x17], al
mov al, dl
xor al, 0x6f
mov byte [ebp - 0x16], al
mov al, dl
xor al, 0x67
mov byte [ebp - 0x15], al
mov al, dl
xor al, 0x69
mov byte [ebp - 0x14], al
mov al, dl
xor al, 0x6e
mov byte [ebp - 0x13], al
mov al, byte [ebp + ecx - 0x17]
xor al, dl
mov byte [ecx + 0x65e0e4], al
inc ecx
cmp ecx, esi
jb 0x4a9833
push ecx
lea edx, [ebp - 0x20]
mov byte [0x65e0e9], bl
mov ecx, 0x65e0e4
call fcn.004e136c
pop ecx
test al, al
je 0x4a9adb
lea ecx, [ebp - 0x7c]
call fcn.004a85cb
mov dword [ebp - 4], esi
lea esi, [ebp - 0x7c]
cmp dword [ebp - 0x68], 0xf
cmova esi, dword [ebp - 0x7c]
call fcn.004a869c
test al, al
je 0x4a9a1b
call fcn.004a8812
lea eax, [ebp - 0x19c]
mov edx, 0x100
push eax
push esi
lea ecx, [ebp - 0x314]
call fcn.004a84a0
pop ecx
pop ecx
mov esi, 0x65b940
mov ecx, 0x659578
push esi
call fcn.004a64ab
xor edx, edx
mov byte [ebp - 0x12], bl
push 0x7e
pop ecx
div ecx
mov byte [0x65e1c5], bl
mov ecx, 0x65e1c4
inc dl
mov al, dl
xor al, 0x65
xor al, dl
mov byte [0x65e1c4], al
lea eax, [ebp - 0x19c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4a98f9
test dl, dl
je 0x4a98f5
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4a98f9
add eax, edi
add ecx, edi
test dl, dl
jne 0x4a98db
mov eax, ebx
jmp 0x4a98fe
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4a9966
push esi
mov ecx, 0x659578
call fcn.004a64ab
xor edx, edx
mov byte [ebp - 0x12], bl
push 0x7e
pop ecx
div ecx
mov byte [0x65e1ed], bl
mov ecx, 0x65e1ec
inc dl
mov al, dl
xor al, 0x74
xor al, dl
mov byte [0x65e1ec], al
lea eax, [ebp - 0x19c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4a9953
test dl, dl
je 0x4a994f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4a9953
add eax, edi
add ecx, edi
test dl, dl
jne 0x4a9935
mov eax, ebx
jmp 0x4a9958
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4a9966
call fcn.004a8812
jmp 0x4a9acf
push dword [ebp - 0x15]
push ecx
lea ecx, [ebp - 0x64]
call fcn.004aac6e
push ecx
push 0xb
lea ecx, [ebp - 0x30]
mov esi, eax
call fcn.004a2831
push 7
mov edx, ebx
pop ebx
mov ax, word [esi + edx + 2]
xor ax, word [esi]
cmp dword [ebp - 0x1c], ebx
movzx ecx, ax
lea eax, [ebp - 0x30]
cmova eax, dword [ebp - 0x30]
mov word [edx + eax], cx
add edx, edi
cmp edx, 0x16
jb 0x4a9984
mov byte [ebp - 4], 6
lea esi, [ebp - 0x30]
push dword [ebp - 0x15]
cmp dword [ebp - 0x1c], ebx
push ecx
cmova esi, dword [ebp - 0x30]
lea ecx, [ebp - 0x20e]
call fcn.004aaa41
push ecx
push 0x37
lea ecx, [ebp - 0x48]
mov edi, eax
call fcn.004a2831
xor edx, edx
mov ax, word [edi + edx + 2]
xor ax, word [edi]
cmp dword [ebp - 0x34], ebx
movzx ecx, ax
lea eax, [ebp - 0x48]
cmova eax, dword [ebp - 0x48]
mov word [edx + eax], cx
add edx, 2
cmp edx, 0x6e
jb 0x4a99d0
cmp dword [ebp - 0x34], ebx
lea eax, [ebp - 0x48]
push 0x1010
cmova eax, dword [ebp - 0x48]
xor ebx, ebx
push esi
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x48]
call fcn.004a2dca
lea ecx, [ebp - 0x30]
jmp 0x4a9aca
push dword [ebp - 0x15]
push ecx
lea ecx, [ebp - 0x26]
call fcn.004aad8c
push ecx
push 5
lea ecx, [ebp - 0x64]
mov esi, eax
call fcn.004a2831
push 7
mov edx, ebx
pop ebx
mov ax, word [edx + esi + 2]
xor ax, word [esi]
cmp dword [ebp - 0x50], ebx
movzx ecx, ax
lea eax, [ebp - 0x64]
cmova eax, dword [ebp - 0x64]
mov word [edx + eax], cx
add edx, edi
cmp edx, 0xa
jb 0x4a9a39
mov byte [ebp - 4], bl
lea esi, [ebp - 0x64]
push dword [ebp - 0x15]
cmp dword [ebp - 0x50], ebx
push ecx
cmova esi, dword [ebp - 0x64]
lea ecx, [ebp - 0x9c]
call fcn.004aacf1
push ecx
push 0xe
lea ecx, [ebp - 0x48]
mov edi, eax
call fcn.004a2831
xor edx, edx
mov ax, word [edx + edi + 2]
xor ax, word [edi]
cmp dword [ebp - 0x34], ebx
movzx ecx, ax
lea eax, [ebp - 0x48]
cmova eax, dword [ebp - 0x48]
mov word [edx + eax], cx
add edx, 2
cmp edx, 0x1c
jb 0x4a9a84
cmp dword [ebp - 0x34], ebx
lea eax, [ebp - 0x48]
push 0x1010
cmova eax, dword [ebp - 0x48]
xor ebx, ebx
push esi
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x48]
call fcn.004a2dca
lea ecx, [ebp - 0x64]
call fcn.004a2dca
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.004a2890
push 0x65b940
mov ecx, 0x659578
call fcn.004a64ab
xor edx, edx
mov byte [ebp - 0x19], bl
push 0x7e
pop ecx
div ecx
inc dl
mov al, dl
mov byte [ebp - 0x25], dl
xor al, 0x42
mov cl, dl
mov byte [ebp - 0x24], al
xor cl, 0x65
mov al, dl
mov byte [ebp - 0x1d], cl
xor al, 0x75
mov byte [ebp - 0x1a], cl
mov byte [ebp - 0x23], al
mov ecx, ebx
mov al, dl
xor al, 0x79
mov byte [ebp - 0x22], al
mov al, dl
xor al, 0x20
mov byte [ebp - 0x21], al
mov al, dl
xor al, 0x4c
mov byte [ebp - 0x20], al
mov al, dl
xor al, 0x69
mov byte [ebp - 0x1f], al
mov al, dl
xor al, 0x63
mov byte [ebp - 0x1e], al
mov al, dl
xor al, 0x6e
mov byte [ebp - 0x1c], al
mov al, dl
xor al, 0x73
mov byte [ebp - 0x1b], al
mov al, byte [ebp + ecx - 0x24]
xor al, dl
mov byte [ecx + 0x65e1c8], al
inc ecx
cmp ecx, 0xb
jb 0x4a9b45
mov ecx, 0x65e1c8
mov byte [0x65e1d3], bl
call fcn.004e311c
push dword [ebp - 0x15]
and dword [ebp - 0x20], 0
and dword [ebp - 0x1c], 0
push ecx
lea ecx, [ebp - 0x40]
call fcn.004aadde
mov edx, ebx
mov cl, byte [eax + edx + 1]
xor cl, byte [eax]
mov byte [edx + 0x65e130], cl
inc edx
cmp edx, 0xe
jb 0x4a9b7d
push ecx
lea edx, [ebp - 0x20]
mov byte [0x65e13e], bl
mov ecx, 0x65e130
call fcn.004e136c
pop ecx
test al, al
je 0x4a9bb4
push str.start_https:__discord.gg_wUKSDhfQtX
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
pop ecx
movss xmm1, dword [0x50e328]
xorps xmm0, xmm0
call fcn.004c99b6
push dword [ebp - 0x15]
push ecx
lea ecx, [ebp - 0x99]
call fcn.004aae5e
mov edx, ebx
mov cl, byte [eax + edx + 1]
xor cl, byte [eax]
mov byte [edx + 0x65e18c], cl
inc edx
cmp edx, 0x1b
jb 0x4a9bd5
push 0x504d98
mov byte [0x65e1a7], bl
call fcn.004e0d1d
pop ecx
mov ecx, 0x1000
call fcn.004c098f
test al, al
je 0x4a9c44
xor ecx, ecx
call fcn.004ca5bc
test al, al
je 0x4a9c44
mov eax, dword [0x65a600]
movss xmm0, dword [eax + 0x3bb8]
mulss xmm0, dword [0x50e264]
call fcn.004c743c
push 1
xor edx, edx
mov ecx, 0x65e18c
call fcn.004e0877
pop ecx
call fcn.004c747d
call fcn.004c6e16
mov ecx, 0x503dbe
call fcn.004e311c
call fcn.004ed3d5
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret