Function at 0x1400019e0
Capabilities:
Delete file
Execute command

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], bl
lea r8d, [rbx + 0x12]
lea rdx, str.C:Users_build.sys
lea rcx, [rbp - 0x20]
call fcn.140001230
nop
mov r8d, 0x64d0
lea rdx, [0x14006a440]
lea rcx, [rbp - 0x20]
call fcn.1400016f0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140001a6c
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001a67
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d5c
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
mov r8d, 0x12
lea rdx, str.C:Users_build.exe
lea rcx, [rbp - 0x20]
call fcn.140001230
nop
mov r8d, 0x1de00
lea rdx, [0x1400d7e40]
lea rcx, [rbp - 0x20]
call fcn.1400016f0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140001aec
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ae7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ae7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d5c
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
mov r8d, 0x10
lea rdx, str.C:Usersmac.bat
lea rcx, [rbp - 0x20]
call fcn.140001230
nop
mov r8d, 0x10f0
lea rdx, str._echo_off_r_nsetlocal_EnableDelayedExpansion_r_nmode_con:cols66_lines25_r_n_r_n::_BatchGotAdmin_r_n:______________________________________r_n_r_nREM_____Check_for_permissions_r_nIF___PROCESSOR_ARCHITECTURE___EQU__amd64____r_n_nul_2_1___SYSTEMROOT_SysWOW64cacls.exe____SYSTEMROOT_SysWOW64config_system__r_n__ELSE___r_n_nul_2_1___SYSTEMROOT__system32cacls.exe____SYSTEMROOT__system32config_system__r_n__r_n_r_nREM_____If_error_flag_set__we_do_not_have_admin._r_nif__errorlevel__NEQ_0___r_necho_Requesting_Admin..._r_ngoto_UACPrompt_r_n__else___goto_gotAdmin___r_n_r_n:UACPrompt_r_necho_Set_UAC__CreateObject__Shell.Application_______temp_getadmin.vbs__r_nset_params___r_necho_UAC.ShellExecute__cmd.exe_____c____s0____params:____________runas___1______temp_getadmin.vbs__r_n_r_n__temp_getadmin.vbs__r_ndel___temp_getadmin.vbs__r_nexit__B_r_n_r_n:gotAdmin_r_npushd___CD___r_nCD__D___dp0__r_n_r_n_r_n::_Variable_s__r_nset__reg_pathHKLMSYSTEMCurrentControlSetControlClass4d36e972_e325_11ce_bfc1_08002be10318__r_n_r_n_r_n:SELECTION_MENU_r_n::_Enumerate_available_NICs____You_can_use__name__or__NetConnectionId___r_nset__count0__r_ncls__echo___echo___e_35m_i__Input_NIC__to_modify.e_0m__echo__r_nfor__f__skip2_tokens2_delims_____A_in__wmic_nic_get_NetConnectionId__format:csv__do___r_n_tfor__f__delims____B_in_____A___do___r_n_t_tset__a__count1__r_n_t_tset__nic__count____B__r_n_t_techo___e_31m_count_e_0m_____B_r_n_t__r_n__r_n::_Recieve_user_selection_r_necho___echo___e_31me_0m_____echo__r_nset__p__nic_selection._b__e_35m_e_0m__r_nset__a__nic_selectionnic_selection__r_nif__nic_selection__GTR_0___r_n_tif__nic_selection__LEQ__count____r_n_t_tfor__f__delims____A_in____nic_selection____do_set__NetworkAdapter_nic___A____r_n_t_tgoto_:SPOOF_MAC_r_n_t_texit__b_r_n_t__r_n_tif__nic_selection__EQU_99___r_n_t_tcls__echo___echo___e_32m_Revising_networking_configurations...e_0m_r_n_t_t_nul_2_1__r_n_t_t_tipconfig__release__arp__d___ipconfig__renew_r_n_t_t_tgoto_:SELECTION_MENU_r_n_t_t__r_n_t__r_n__r_ngoto_:INVALID_SELECTION_r_n_r_n_r_n:SPOOF_MAC_r_ncls__echo___call_:MAC_RECIEVE__call_:GEN_MAC__call_:NIC_INDEX_r_necho___e_31m_Selected_NIC_:e_0m__NetworkAdapter___echo__r_necho___e_31m_Previous_MAC_:e_0m__MAC___echo__r_necho___e_31m_Spoofed_MAC__:e_0m__mac_address__r_n_nul_2_1___r_n_tnetsh_interface_set_interface___NetworkAdapter___admindisable_r_n_treg_delete___reg_path__Index____v__OriginalNetworkAddress___f_r_n_treg_add___reg_path__Index____v__NetworkAddress___t_REG_SZ__d___mac_address____f_r_n_tnetsh_interface_set_interface___NetworkAdapter___adminenable_r_n__r_necho___echo___e_35me_0m_Press_any_key_to_continue...___nul_pause___call_:EXIT_MENU__exit__b__r_n_r_n_r_n:INVALID_SELECTION_r_ncls__echo___echo___e_31m__nic_selection___is_a_invalid_option.e_0m___nul_timeout__t_2__goto_:SELECTION_MENU_r_n_r_n_r_n:EXIT_MENU_r_nset__count0__r_ncls__echo__r_necho___e_31m1e_0m___Selection_Menu_r_necho___e_31m2e_0m___Exit__echo__r_nset__p_c_._b__e_35me_0m___r_nif__c_1_goto_:SELECTION_MENU_r_nif__c_2_exit__b_1_r_nexit__b_r_n_r_n_r_n::_Generating_Random_MAC_Address_r_n::_The_second_character_of_the_first_octet_of_the_MAC_Address_needs_to_contain_A__E__2__or_6_to_properly_function_for_certain_wireless_NICs._Example:_xA:xx:xx:xx:xx_r_n:GEN_MAC_r_nset_hex_chars0123456789ABCDEF_AE26_r_nif_defined_mac_address___r_n____set_mac_address_r_n__r_nfor__l___A_in__1_1_11__do___r_n____set__a__random_index_random_____16__r_n____for___B_in___random_index___do___r_n________set_mac_address_mac_address__hex_chars:__B_1__r_n______r_n__r_nset__a__random_index_random_____4__17__r_nset_mac_address_mac_address:0_1__hex_chars:_random_index__1__mac_address:1__r_nexit__b_r_n_r_n_r_n::_Retrieving_Current_MAC_Address_r_n:MAC_RECIEVE_r_ncall_:NIC_INDEX_r_nfor__f__tokens3____A_in__reg_query___reg_path__Index____find__NetworkAddress___do___r_n_tset__MAC__A__r_n__r_n_r_n::_An_unaltered_MAC_address_will_not_be_present_in_the_reg
lea rcx, [rbp - 0x20]
call fcn.1400016f0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140001b6c
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001b67
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d5c
lea rcx, str.C:Users_build.exe_C:Users_build.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_C:Usersmac.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_winmgmt__y__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x8fc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.net_start_winmgmt__y__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Users_build.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:Users_build.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:Usersmac.bat
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
jmp qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]