Function at 0x1800995c0
Capabilities:
Create thread
Delete file
Get disk information

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x738
mov rax, qword [0x1803af200]
xor rax, rsp
mov qword [rsp + 0x720], rax
mov eax, 4
mov eax, eax
mov ecx, dword [0x1803d3748]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x1803b06c8], eax
jle 0x18009964e
lea rcx, [0x1803b06c8]
call fcn.1801b09bc
cmp dword [0x1803b06c8], 0xffffffff
jne 0x18009964e
lea rdx, [0x1801c74c0]
lea rcx, [0x1803b06a8]
call fcn.18008da80
lea rcx, [0x1801bc330]
call fcn.1801b08fc
nop
lea rcx, [0x1803b06c8]
call fcn.1801b0950
nop
lea rax, str.C:_temp_124765756423R3254568756.txt
mov qword [rsp + 0x60], rax
lea rax, str.C:_niz.txt
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x40], 0
mov edx, 0x110
lea rcx, [rsp + 0x400]
call fcn.1800786c0
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
lea rdx, [0x1803b06a8]
lea rcx, [rsp + 0x400]
call fcn.18008d320
nop
lea rcx, [rsp + 0x400]
call fcn.180096570
movzx eax, al
test eax, eax
je 0x180099774
lea rcx, [rsp + 0x250]
call fcn.18008dae0
nop
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x400]
call fcn.18008cb30
lea rcx, [rsp + 0x400]
call fcn.180094fd0
nop
lea rdx, [0x1801c7540]
lea rcx, [rsp + 0x250]
call fcn.1800889e0
movzx eax, al
test eax, eax
je 0x180099766
lea rdx, [0x1801c7560]
lea rcx, [rsp + 0xc8]
call fcn.18008da80
nop
lea rdx, [0x1801c75a8]
lea rcx, [rsp + 0xa8]
call fcn.18008da80
nop
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0xa8]
call fcn.180090ec0
nop
lea rcx, [rsp + 0xa8]
call fcn.18008ef30
nop
lea rcx, [rsp + 0xc8]
call fcn.18008ef30
nop
lea rcx, [rsp + 0x250]
call fcn.18008ef30
nop
mov edx, 0x110
lea rcx, [rsp + 0x2f0]
call fcn.1800786c0
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x2f0]
call fcn.18008d3b0
nop
lea rcx, [rsp + 0x2f0]
call fcn.180096570
movzx eax, al
test eax, eax
je 0x18009987b
lea rcx, [rsp + 0x210]
call fcn.18008dae0
nop
lea rdx, [rsp + 0x210]
lea rcx, [rsp + 0x2f0]
call fcn.18008cb30
lea rcx, [rsp + 0x2f0]
call fcn.180094fd0
nop
lea rdx, str.Nizz__Szzz
lea rcx, [rsp + 0x210]
call fcn.1800889e0
movzx eax, al
test eax, eax
je 0x18009986d
lea rdx, [0x1801c75f0]
lea rcx, [rsp + 0x108]
call fcn.18008da80
nop
lea rdx, [0x1801c7638]
lea rcx, [rsp + 0xe8]
call fcn.18008da80
nop
lea rdx, [rsp + 0x108]
lea rcx, [rsp + 0xe8]
call fcn.180090ec0
nop
lea rcx, [rsp + 0xe8]
call fcn.18008ef30
nop
lea rcx, [rsp + 0x108]
call fcn.18008ef30
nop
lea rcx, [rsp + 0x210]
call fcn.18008ef30
nop
lea rcx, [rsp + 0x2f0]
call fcn.180096570
movzx eax, al
test eax, eax
je 0x180099904
lea rcx, [rsp + 0x2f0]
call fcn.180094fd0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
lea rdx, str.http:__nizzix.ovh_static_nizzix.rar
lea rcx, [rsp + 0x148]
call fcn.18008da80
nop
lea rdx, str.You_need_the_new_loader
lea rcx, [rsp + 0x128]
call fcn.18008da80
nop
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x128]
call fcn.180090ec0
nop
lea rcx, [rsp + 0x128]
call fcn.18008ef30
nop
lea rcx, [rsp + 0x148]
call fcn.18008ef30
nop
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
movzx eax, byte [rsp + 0x40]
test eax, eax
jne 0x180099942
mov r8d, 0x104
lea rdx, [rsp + 0x510]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x180099942
lea rcx, [rsp + 0x510]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [0x1803b06a8]
call fcn.18007c0f0
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x190]
call fcn.18008d990
nop
lea rcx, [rsp + 0x190]
call fcn.18007c0f0
mov qword [rsp + 0x68], rax
lea rcx, [0x1803b06a8]
call fcn.180094b80
mov qword [rsp + 0x70], rax
xor edx, edx
lea rcx, [rsp + 0x190]
call fcn.18008f5d0
mov qword [rsp + 0x78], rax
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs]
mov dword [rsp + 0x188], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x188]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1801c76e8]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x180099a07
jmp 0x180099a4c
call fcn.1800958b0
call fcn.180090450
nop
mov dword [rsp + 0x48], 1
lea rcx, [rsp + 0x190]
call fcn.1800825a0
nop
lea rcx, [rsp + 0x2f0]
call fcn.18008fcf0
nop
lea rcx, [rsp + 0x400]
call fcn.18008fcf0
mov eax, dword [rsp + 0x48]
jmp 0x180099da8
mov edx, dword [rsp + 0x188]
lea rcx, [rsp + 0x168]
call fcn.180098870
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
mov r8d, 0x5469
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x1f0]
call fcn.180095b20
nop
lea rcx, [rsp + 0x168]
call fcn.1800825a0
nop
lea rcx, [rsp + 0x1f0]
call fcn.18007c0f0
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x230]
call fcn.18008db20
nop
lea rcx, [rsp + 0x1f0]
call fcn.18007c0f0
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x1f0]
call fcn.180084080
mov qword [rsp + 0x98], rax
xor edx, edx
lea rcx, [rsp + 0x230]
call fcn.18008f600
mov qword [rsp + 0xa0], rax
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs]
mov eax, 4
mov eax, eax
mov ecx, dword [0x1803d3748]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x1803b06f0], eax
jle 0x180099b8a
lea rcx, [0x1803b06f0]
call fcn.1801b09bc
cmp dword [0x1803b06f0], 0xffffffff
jne 0x180099b8a
lea rdx, [rsp + 0x230]
lea rcx, [0x1803b06d0]
call fcn.18008d9e0
lea rcx, [0x1801bc310]
call fcn.1801b08fc
nop
lea rcx, [0x1803b06f0]
call fcn.1801b0950
nop
xor r8d, r8d
lea rdx, str.C:_nizzix_lua_nizzix_actions
lea rcx, [rsp + 0x1d0]
call fcn.180087f60
nop
lea rcx, [rsp + 0x1d0]
call fcn.180095f30
movzx eax, al
test eax, eax
je 0x180099bca
lea rcx, [rsp + 0x1d0]
call fcn.1800964d0
movzx eax, al
test eax, eax
jne 0x180099bd8
lea rcx, [rsp + 0x1d0]
call fcn.1800951c0
nop
xor r8d, r8d
lea rdx, [0x1801c7730]
lea rcx, [rsp + 0x1b0]
call fcn.180087f60
nop
lea rcx, [rsp + 0x1b0]
call fcn.180095f30
movzx eax, al
test eax, eax
je 0x180099c18
lea rcx, [rsp + 0x1b0]
call fcn.1800964d0
movzx eax, al
test eax, eax
jne 0x180099c26
lea rcx, [rsp + 0x1b0]
call fcn.1800951c0
nop
call fcn.1800903e0
lea rdx, str.C:_nizzix_lua_nizzix_actions_servercrasher.lua
lea rcx, [rsp + 0x2d0]
call fcn.18008da80
nop
lea rdx, str.https:__raw.githubusercontent.com_yashing2_Nizzix_refs_heads_main_lua.lua.lua.lua
lea rcx, [rsp + 0x2b0]
call fcn.18008da80
nop
lea rdx, str.https:__raw.githubusercontent.com_yashing2_Nizzix_main_odiumbackdoor.lua
lea rcx, [rsp + 0x290]
call fcn.18008da80
nop
lea rdx, str.C:_nizzix_lua_nizzix_actions_odium_bd.lua
lea rcx, [rsp + 0x270]
call fcn.18008da80
nop
mov eax, dword [rsp + 0x748]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x180099cf2
cmp dword [rsp + 0x44], 1
je 0x180099c9a
jmp 0x180099d03
mov rcx, qword [rsp + 0x740]
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call fcn.1800901c0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x740]
lea r8, [0x1800958d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x180099cf0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x180099d03
cmp qword [rsp + 0x750], 0
jne 0x180099d03
call fcn.1800958b0
nop
mov dword [rsp + 0x4c], 1
lea rcx, [rsp + 0x270]
call fcn.18008ef30
nop
lea rcx, [rsp + 0x290]
call fcn.18008ef30
nop
lea rcx, [rsp + 0x2b0]
call fcn.18008ef30
nop
lea rcx, [rsp + 0x2d0]
call fcn.18008ef30
nop
lea rcx, [rsp + 0x1b0]
call fcn.18008f440
nop
lea rcx, [rsp + 0x1d0]
call fcn.18008f440
nop
lea rcx, [rsp + 0x230]
call fcn.18008ef30
nop
lea rcx, [rsp + 0x1f0]
call fcn.1800825a0
nop
lea rcx, [rsp + 0x190]
call fcn.1800825a0
nop
lea rcx, [rsp + 0x2f0]
call fcn.18008fcf0
nop
lea rcx, [rsp + 0x400]
call fcn.18008fcf0
mov eax, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x720]
xor rcx, rsp
call fcn.1801b0160
add rsp, 0x738
ret