Function at 0x140001000
Capabilities:
Create process on windows
Delete directory

Disassembly:
sub rsp, 0x28
mov r8, 0x128
xor rdx, rdx
movabs rcx, 0x140011e38
call sub.msvcrt.dll_memset
xor rcx, rcx
call sub.KERNEL32.DLL_GetModuleHandleA
mov qword [0x140011e40], rax
xor r8, r8
mov rdx, 0x1000
xor rcx, rcx
call sub.KERNEL32.DLL_HeapCreate
mov qword [0x140011e38], rax
call fcn.1400069a0
call fcn.1400067ec
call fcn.140004600
call fcn.140003e40
call fcn.140003b04
call fcn.1400031f4
mov rdx, qword [0x140012000]
push rdx
push rdx
sub rsp, 0x20
call fcn.140002417
add rsp, 0x28
lea rcx, [0x140011e88]
pop rdx
call fcn.140006a30
mov rax, qword [0x140012000]
push rax
sub rsp, 8
push rax
pop rcx
sub rsp, 0x20
call fcn.140003b4c
add rsp, 0x28
lea rcx, [0x140011e50]
pop rdx
call fcn.140006a30
mov rax, qword [0x140012000]
push rax
sub rsp, 8
push rax
mov rcx, qword [0x140011e50]
pop rdx
sub rsp, 0x20
call fcn.140003f78
add rsp, 0x28
lea rcx, [0x140011eb8]
pop rdx
call fcn.140006a30
mov rax, qword [0x140012000]
push rax
sub rsp, 8
push rax
pop rcx
sub rsp, 0x20
call fcn.140003f84
add rsp, 0x28
lea rcx, [0x140011eb0]
pop rdx
call fcn.140006a30
movabs rax, str..bat
mov rdx, rax
mov rcx, qword [0x140011eb8]
call sub.SHLWAPI.DLL_PathRenameExtensionA
mov rax, qword [0x140012000]
push rax
sub rsp, 8
push rax
pop rcx
sub rsp, 0x20
call fcn.140003f84
add rsp, 0x28
lea rcx, [0x140011ec0]
pop rdx
call fcn.140006a30
mov qword [0x140011ea8], 0x8800
mov rdx, qword [0x140011e50]
movabs rcx, 0
call fcn.140004b70
mov rdx, qword [0x140011ea8]
movabs rcx, 0
call fcn.140004cf0
mov rax, qword [0x140012000]
push rax
sub rsp, 8
push rax
movabs r8, 1
movabs rdx, 0x18
movabs rcx, 0
pop r9
sub rsp, 0x20
call fcn.140004d50
add rsp, 0x28
lea rcx, [0x140011e80]
pop rdx
call fcn.140006a30
inc qword [0x140011ea8]
push qword [0x140011e80]
movabs rcx, 0x140011021
pop rdx
call fcn.140006af0
or rax, rax
je 0x140001351
mov rdx, qword [0x140011ea8]
movabs rcx, 0
call fcn.140004cf0
mov rax, qword [0x140012000]
push rax
sub rsp, 8
push rax
movabs r8, 0x20
movabs rdx, 0x18
movabs rcx, 0
pop r9
sub rsp, 0x20
call fcn.140004d50
add rsp, 0x28
lea rcx, [0x140011e78]
pop rdx
call fcn.140006a30
add qword [0x140011ea8], 0x20
mov rdx, qword [0x140012000]
push rdx
push rdx
push 1
movabs rax, 0x14001101e
push rax
movabs rax, str.Enter_the_password_to_decrypt_this_application.
push rax
movabs rax, str.Enter_Password
mov rcx, rax
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400033bc
add rsp, 0x28
lea rcx, [0x140011ec8]
pop rdx
call fcn.140006a30
mov rcx, qword [0x140011ec8]
xor rdx, rdx
call fcn.140006af0
or rax, rax
jne 0x14000134a
mov rax, qword [0x140012000]
push rax
sub rsp, 8
push rax
sub rsp, 8
mov rcx, qword [0x140011ec8]
sub rsp, 0x20
call fcn.140003060
add rsp, 0x28
push rax
mov rax, qword [0x140011ec8]
mov rcx, rax
pop rdx
pop r8
sub rsp, 0x20
call fcn.1400056c0
add rsp, 0x28
inc qword [0x140012000]
mov rcx, qword [0x140011e78]
pop rdx
mov qword [0x140012000], rdx
add rdx, qword [0x140012010]
call fcn.140006af0
or rax, rax
jne 0x140001348
push 0x10
movabs rax, str.Wrong_password_
push rax
movabs rax, str.Error
mov rcx, rax
pop rdx
pop r8
call fcn.14000388c
jmp 0x1400018be
jmp 0x14000134f
jmp 0x1400018be
jmp 0x140001367
mov rdx, qword [0x140011ea8]
movabs rcx, 0
call fcn.140004cf0
movabs rcx, 0
call fcn.140004e50
mov r15, rax
sub r15, qword [0x140011ea8]
mov qword [0x140011ea0], r15
mov rcx, qword [0x140011ea0]
call fcn.140003e70
mov qword [0x140011e60], rax
movabs rcx, 0
call fcn.140004e50
mov r15, rax
imul r15, r15, 0xa
mov rax, r15
mov rcx, rax
call fcn.140003e70
mov qword [0x140011e90], rax
mov r8, qword [0x140011ea0]
mov rdx, qword [0x140011e60]
movabs rcx, 0
call fcn.140004eb0
movabs rcx, 0
call fcn.140004560
mov rcx, qword [0x140011ec8]
xor rdx, rdx
call fcn.140006af0
or rax, rax
jne 0x140001422
push qword [0x140011ec8]
mov rax, qword [0x140011ea0]
push rax
mov rax, qword [0x140011e60]
mov rcx, rax
pop rdx
pop r8
call fcn.140002000
movabs rcx, 0x2800
call fcn.140003e70
mov qword [0x140011e90], rax
mov dword [0x140011ee8], 0x2800
movsxd r15, dword [0x140011ee8]
movsxd r14, dword [0x140011ee8]
mov rax, r14
mov rcx, 0x3e8
cqo
idiv rcx
mov r14, rax
add r15, r14
add r15, 0x10
mov rax, r15
mov dword [0x140011ee4], eax
movsxd r15, dword [0x140011ee4]
add r15, 0x400
mov rax, r15
mov dword [0x140011ee0], eax
push qword [0x140011ea0]
push qword [0x140011e60]
lea rax, [0x140011ee0]
mov rdx, rax
mov rcx, qword [0x140011e90]
pop r8
pop r9
call fcn.140006e60
mov rcx, qword [0x140011e60]
call fcn.140003e90
mov rdx, qword [0x140012000]
push rdx
push rdx
sub rsp, 0x20
call fcn.140002557
add rsp, 0x28
lea rcx, [0x140011ed0]
pop rdx
call fcn.140006a30
mov rcx, qword [0x140011ed0]
call fcn.140003fe4
mov rdx, qword [0x140011eb8]
movabs rcx, 0
call fcn.140004960
movabs rax, str._echo_off
mov rdx, rax
movabs rcx, 0
call fcn.140004f30
movabs rax, str.shift__0
mov rdx, rax
movabs rcx, 0
call fcn.140004f30
movabs rax, str._echo_on
mov rdx, rax
movabs rcx, 0
call fcn.140004f30
movsxd rax, dword [0x140011ee0]
mov r8, rax
mov rdx, qword [0x140011e90]
movabs rcx, 0
call fcn.140005020
movabs rcx, 0
call fcn.140004560
mov rcx, qword [0x140011e90]
call fcn.140003e90
mov rcx, qword [0x140011eb0]
call fcn.140003fe4
mov rcx, qword [0x140011ed0]
call sub.SHLWAPI.DLL_PathAddBackslashA
mov rax, qword [0x140012000]
push rax
sub rsp, 8
push rax
sub rsp, 8
mov rcx, qword [0x140012000]
sub rsp, 0x20
call fcn.140003b4c
add rsp, 0x28
inc qword [0x140012000]
movabs rax, str.b2eprogramname
push rax
mov rdx, qword [0x140012010]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140003c24
add rsp, 0x28
pop qword [0x140012000]
mov rax, qword [0x140012000]
push rax
sub rsp, 8
push rax
sub rsp, 8
mov rdx, qword [0x140012000]
push rdx
push rdx
mov rcx, qword [0x140012000]
sub rsp, 0x20
call fcn.140003b4c
add rsp, 0x20
mov rdx, qword [0x140012010]
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140003f78
add rsp, 0x28
inc qword [0x140012000]
movabs rax, str.b2eprogramfilename
push rax
mov rdx, qword [0x140012010]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140003c24
add rsp, 0x28
pop qword [0x140012000]
mov rax, qword [0x140012000]
push rax
sub rsp, 8
push rax
sub rsp, 8
mov rdx, qword [0x140012000]
push rdx
push rdx
mov rcx, qword [0x140012000]
sub rsp, 0x20
call fcn.140003b4c
add rsp, 0x20
mov rdx, qword [0x140012010]
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140004000
add rsp, 0x28
inc qword [0x140012000]
movabs rax, str.b2eprogrampathname
push rax
mov rdx, qword [0x140012010]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140003c24
add rsp, 0x28
pop qword [0x140012000]
mov rax, qword [0x140012000]
push rax
sub rsp, 8
push rax
pop rcx
sub rsp, 0x20
call fcn.140003b4c
add rsp, 0x28
lea rcx, [0x140011e68]
pop rdx
call fcn.140006a30
mov rcx, qword [0x140011e68]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
mov rcx, qword [0x140011e68]
push qword [0x140012000]
sub rsp, 0x28
call fcn.140006b50
add rsp, 0x28
movabs rcx, 0x14001101f
sub rsp, 0x28
call fcn.140006b50
add rsp, 0x28
mov rcx, qword [0x140011e88]
sub rsp, 0x28
call fcn.140006b50
add rsp, 0x28
lea rcx, [0x140011e88]
pop rdx
call fcn.140006a30
mov rcx, qword [0x140011ed0]
push qword [0x140012000]
sub rsp, 0x28
call fcn.140006b50
add rsp, 0x28
mov rcx, qword [0x140011eb8]
sub rsp, 0x28
call fcn.140006b50
add rsp, 0x28
lea rcx, [0x140011e98]
pop rdx
call fcn.140006a30
lea rbp, [0x140011ef0]
mov dword [rbp], 0x70
mov dword [rbp + 4], 0x140
mov dword [rbp + 0x30], 0
movabs rax, str.open
push rax
pop qword [rbp + 0x10]
mov rax, qword [0x140011e98]
push rax
pop qword [rbp + 0x18]
mov rax, qword [0x140011e88]
push rax
pop qword [rbp + 0x20]
mov rax, qword [0x140011eb0]
push rax
pop qword [rbp + 0x28]
movabs rax, 0x140011ef0
mov rcx, rax
call sub.SHELL32.DLL_ShellExecuteExA
mov qword [0x140011e58], rax
movabs rcx, 0x19
call fcn.14000302c
lea rax, [0x140011ed8]
push rax
lea rbp, [0x140011ef0]
mov rcx, qword [rbp + 0x68]
pop rdx
call sub.KERNEL32.DLL_GetExitCodeProcess
and rax, rax
je 0x140001859
mov r15, qword [0x140011ed8]
cmp r15, 0x103
je 0x140001859
jmp 0x14000185b
jmp 0x14000181a
push qword [0x140012000]
sub rsp, 8
mov rcx, qword [0x140011ed0]
push qword [0x140012000]
sub rsp, 0x28
call fcn.140006b50
add rsp, 0x28
mov rcx, qword [0x140011eb8]
sub rsp, 0x28
call fcn.140006b50
add rsp, 0x28
mov rdx, qword [0x140012010]
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.1400040d8
add rsp, 0x28
pop qword [0x140012000]
mov rcx, qword [0x140011ed0]
call sub.KERNEL32.DLL_RemoveDirectoryA
call 0x1400018e0
call fcn.140006a00
mov rcx, qword [0x140011e38]
call sub.KERNEL32.DLL_HeapDestroy
mov rcx, qword [0x140011e48]
call sub.KERNEL32.DLL_ExitProcess
sub rsp, 0x28
call fcn.1400040e0
call fcn.1400045f0
call fcn.140003e60
add rsp, 0x28
ret