Function at 0x1400014a0
Capabilities:
Copy file
Execute command
Move file
Self delete
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x140008010]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rsi, rcx
mov r8d, 0x104
lea rdx, [rbp + 0xa0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor r13d, r13d
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x70], r13
mov edi, 0xf
mov qword [rbp - 0x68], rdi
mov byte [rbp - 0x80], r13b
lea rax, [rbp + 0xa0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r13b
jne 0x140001510
lea rdx, [rbp + 0xa0]
lea rcx, [rbp - 0x80]
call fcn.140002d80
nop
lea rbx, [rbp - 0x80]
mov r15, qword [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rbx, r15
mov r14, qword [rbp - 0x70]
test r14, r14
je 0x14000175d
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x1400055ac]
lea rdx, [0x1400055ae]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rbp + rax - 0x60], 1
inc rcx
cmp rcx, rdx
jne 0x140001570
lea rax, [r14 - 1]
mov rdx, 0xffffffffffffffff
mov r8, rdx
cmp rax, rdx
cmovb r8, rax
add r8, rbx
movzx eax, byte [r8]
cmp byte [rbp + rax - 0x60], 0
jne 0x1400015ba
cmp r8, rbx
je 0x140001764
dec r8
movzx eax, byte [r8]
cmp byte [rbp + rax - 0x60], 0
je 0x1400015a3
sub r8, rbx
cmp r8, rdx
je 0x140001764
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], rdi
mov byte [rsp + 0x20], 0
inc r8
cmp r14, r8
cmovb r8, r14
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rdx, r15
lea rcx, [rsp + 0x20]
call fcn.140002d80
nop
mov rdx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x140001609
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x20]
call fcn.140002ee0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], rdi
mov byte [rax], 0
mov r8d, 4
lea rdx, str..exe
lea rcx, [rsp + 0x40]
call fcn.140002ee0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], rdi
mov byte [rax], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x1400016bd
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400016ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400016ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400039ec
movups xmm0, xmmword [rsp + 0x60]
movups xmm1, xmmword [rsp + 0x70]
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm1
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140001705
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001700
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001700
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400039ec
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], rdi
mov byte [rsp + 0x40], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140001885
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001753
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001753
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400039ec
jmp 0x140001885
mov rdx, 0xffffffffffffffff
mov r14, qword [rsi + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 4
jb 0x140001a1c
cmp qword [rsi + 0x18], 0x10
jb 0x14000178c
mov rsi, qword [rsi]
mov qword [rsp + 0x20], r13
lea r15, [r14 + 4]
lea rbx, [rsp + 0x20]
cmp r15, 0xf
jbe 0x140001810
mov rdi, r15
or rdi, 0xf
cmp rdi, rcx
jbe 0x1400017b1
mov rdi, rcx
jmp 0x1400017bd
mov eax, 0x16
cmp rdi, rax
cmovb rdi, rax
mov rcx, rdi
add rcx, 1
cmovb rcx, rdx
cmp rcx, 0x1000
jb 0x1400017f9
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001a16
mov rcx, rax
call fcn.1400039b0
test rax, rax
je 0x140001867
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14000180b
test rcx, rcx
je 0x140001808
call fcn.1400039b0
mov rbx, rax
jmp 0x14000180b
mov rbx, r13
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], rdi
mov r8, r14
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov dword [rbx + r14], 0x6578652e
mov byte [rbx + r15], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x140001873
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000186e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000186e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400039ec
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rbp - 0x70], xmm1
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rdx, qword [rbp - 0x80]
xor r8d, r8d
lea rcx, [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x140001974
lea rcx, [rbp - 0x80]
call fcn.140001290
lea rdx, str.Renamed_to:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002f90
mov rcx, rax
lea rdx, [rbp - 0x80]
call fcn.1400031a0
mov rcx, rax
lea rdx, [0x140003160]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.public_loader.exe
lea rcx, [rbp + 0xa0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
movups xmm0, xmmword [str.start__min_cmd__c_del]
movaps xmmword [rbp - 0x60], xmm0
mov eax, dword [0x1400055f0]
mov dword [rbp - 0x50], eax
movzx eax, word [0x1400055f4]
mov word [rbp - 0x4c], ax
movzx eax, byte [0x1400055f6]
mov byte [rbp - 0x4a], al
xor edx, edx
mov r8d, 0xe9
lea rcx, [rbp - 0x49]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp - 0x60]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x140001943
movups xmm0, xmmword [str.public_loader.exe]
movups xmmword [rcx], xmm0
movzx eax, word [0x1400055d8]
mov word [rcx + 0x10], ax
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.Failed_to_rename_file._Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002f90
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140003160]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x1400019e9
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400019e4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400039ec
xor al, al
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.140003990
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
call fcn.140001110
nop
call fcn.1400011b0
int3