Function at 0x1400434a0
Capabilities:
Execute command
Self delete
Terminate process

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x140061040]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x150]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x150]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x150]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov rbx, rax
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
mov byte [rax], 0
lea rcx, [rsp + 0x20]
call fcn.140043260
nop
lea rcx, str.type_nul___deleter.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rsp + 0x40]
call fcn.1400437b0
lea rcx, [rsp + 0x40]
call fcn.1400445f0
nop
lea rcx, [rsp + 0x40]
call fcn.140044460
lea rdx, str._echo_off
lea rcx, [rsp + 0x40]
call fcn.140041520
lea rdx, [0x140002b80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp byte [0x1400610cf], 0
je 0x1400435d9
lea rdx, str.del___s___q
lea rcx, [rsp + 0x40]
call fcn.140041520
mov rcx, rax
lea rdx, [0x14005677c]
call fcn.140041520
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.140044950
mov rcx, rax
lea rdx, [0x140056788]
call fcn.140041520
mov rcx, rax
mov rdx, rbx
call fcn.140041520
mov rcx, rax
lea rdx, str..exe
call fcn.140041520
mov rcx, rax
lea rdx, [0x14005677c]
call fcn.140041520
lea rdx, [0x140002b80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp byte [0x140061106], 0
je 0x140043690
lea rdx, [0x1400567a0]
lea rcx, [rsp + 0x40]
call fcn.140041520
lea rdx, [0x140002b80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.cd_windows_prefetch
lea rcx, [rsp + 0x40]
call fcn.140041520
lea rdx, [0x140002b80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.del
lea rcx, [rsp + 0x40]
call fcn.140041520
mov rcx, rax
lea rdx, [0x14005677c]
call fcn.140041520
mov rcx, rax
mov rdx, rbx
call fcn.140041520
mov rcx, rax
lea rdx, str...pf
call fcn.140041520
mov rcx, rax
lea rdx, [0x14005677c]
call fcn.140041520
mov rcx, rax
lea rdx, str._s__q
call fcn.140041520
lea rdx, [0x140002b80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp byte [0x140062dbb], 0
je 0x1400436db
lea rdx, str.taskkill__f__IM_explorer.exe
lea rcx, [rsp + 0x40]
call fcn.140041520
lea rdx, [0x140002b80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.start_explorer.exe
lea rcx, [rsp + 0x40]
call fcn.140041520
lea rdx, [0x140002b80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.echo_You_can_close_this_window
lea rcx, [rsp + 0x40]
call fcn.140041520
lea rdx, [0x140002b80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.DEL____f0_
lea rcx, [rsp + 0x40]
call fcn.140041520
lea rdx, [0x140002b80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rsp + 0x40]
call fcn.140044420
lea rcx, str.start_deleter.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3