Function at 0x1400074c0
Capabilities:
Delete file
Encode data using xor
Execute command
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r13
push rbp
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x1400950c0]
xor rax, rsp
mov qword [rbp + 0x180], rax
xor ebx, ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x68], 0x7721323d
mov dword [rsp + 0x6c], 0x28232e
mov byte [rsp + 0x70], 1
mov ecx, ebx
nop word [rax + rax]
lea eax, [rcx + 0x56]
xor byte [rsp + rcx + 0x68], al
inc rcx
cmp rcx, 7
jb 0x140007520
mov byte [rsp + 0x70], bl
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x6f]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x48]
call fcn.1400027d0
nop
mov dword [rsp + 0x30], 0x46d15
mov byte [rsp + 0x34], 1
mov rcx, rbx
nop dword [rax]
lea eax, [rcx + 0x56]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 3
jb 0x140007560
mov byte [rsp + 0x34], 0
lea r8, [rbp + 0x48]
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x18]
call fcn.140002e40
mov rsi, rax
lea rax, [rbp - 0x38]
mov qword [rsp + 0x40], rax
mov r14, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
jbe 0x1400075a1
mov rsi, qword [rsi]
call fcn.14006e25c
mov r15d, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], rbx
mov edx, 7
mov qword [rbp - 0x20], rdx
mov word [rbp - 0x38], bx
mov dword [rsp + 0x30], reloc.WS2_32.dll_send
test r14, r14
je 0x140007640
cmp r14, 0x7fffffff
ja 0x140007da0
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, r14d
mov rdx, rsi
mov ecx, eax
call fcn.14006e284
mov rdi, rax
shr rax, 0x20
test eax, eax
jne 0x140007dab
xor r8d, r8d
movsxd rdx, edi
lea rcx, [rbp - 0x38]
call fcn.14000a8c0
lea r9, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova r9, qword [rbp - 0x38]
mov dword [rsp + 0x20], edi
mov r8d, r14d
mov rdx, rsi
mov ecx, r15d
call fcn.14006e284
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140007d80
mov rdx, qword [rbp - 0x20]
lea rcx, [rbp - 0x38]
cmp rdx, 7
cmova rcx, qword [rbp - 0x38]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rbp + 0x18]
call fcn.14006e398
mov edx, eax
test eax, eax
jne 0x1400076b3
mov eax, dword [rbp + 0x28]
test al, 1
mov ecx, 0x1ff
mov r8d, 0x16d
cmovne ecx, r8d
mov dword [rsp + 0x44], ecx
bt eax, 0xa
jae 0x1400076a5
mov ecx, dword [rbp + 0x2c]
cmp ecx, 0xa000000c
jne 0x140007696
lea eax, [rdx + 4]
jmp 0x1400076d6
cmp ecx, 0xa0000003
jne 0x1400076a5
mov eax, 0xa
jmp 0x1400076d6
movzx eax, al
and eax, 0x10
or eax, 0x20
shr eax, 4
jmp 0x1400076d6
mov dword [rsp + 0x44], 0xffff
sub eax, 2
je 0x1400076d1
sub eax, 1
je 0x1400076d1
sub eax, 0x32
je 0x1400076d1
cmp eax, 0x46
mov eax, ebx
jne 0x1400076d6
mov eax, 1
mov dword [rsp + 0x40], edx
lea rcx, [0x140095018]
mov qword [rsp + 0x48], rcx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
test eax, eax
je 0x14000773f
cmp eax, 1
setne dil
lea rcx, [rbp - 0x38]
call fcn.140007380
nop
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x140007751
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000774c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000774c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
xor dil, dil
test edx, edx
jne 0x140007d8a
jmp 0x1400076fc
call fcn.14006d208
test dil, dil
je 0x140007b70
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movdqa xmm1, xmmword [0x1400721e0]
movdqu xmmword [rbp - 0x28], xmm1
mov byte [rbp - 0x38], 0
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x70]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x30], 0x46d15
mov byte [rsp + 0x34], 1
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x56]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 3
jb 0x1400077a0
mov byte [rsp + 0x34], 0
lea r8, [rbp + 0x48]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x18]
call fcn.140002e40
nop
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x3f]
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.1400048a0
nop
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x140007825
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007820
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007820
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006d208
movdqa xmm0, xmmword [0x1400721e0]
movdqu xmmword [rbp + 0x28], xmm0
mov byte [rbp + 0x18], 0
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x70]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0x70]
call fcn.1400042a0
lea rcx, [rbp + 0x80]
call fcn.140007f50
test rax, rax
jne 0x14000788b
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x70]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov edx, 6
mov rcx, qword [0x1400958a0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov r15, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov dword [rsp + 0x40], 0x79785d5c
mov dword [rsp + 0x44], 0x38283a16
mov dword [rsp + 0x48], 0xc3e2c
mov byte [rsp + 0x4c], 1
mov rcx, rbx
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x56]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0xb
jb 0x1400078d0
mov byte [rsp + 0x4c], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140007901
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x78]
call fcn.140002fa0
mov dword [rbp - 0x68], reloc.WLDAP32.dll_Ordinal_50
lea rdi, [rsp + 0x78]
mov rsi, qword [rsp + 0x78]
mov r13, qword [rbp - 0x70]
cmp r13, 0xf
cmova rdi, rsi
lea r14, [rsp + 0x78]
cmova r14, rsi
add r14, qword [rbp - 0x78]
cmp rdi, r14
je 0x14000797f
mov qword [rsp + 0x30], reloc.WLDAP32.dll_Ordinal_50
movzx edx, byte [rdi]
mov rcx, r15
call fcn.1400029a0
lea rdx, [0x140004280]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rsp + 0x30]
call fcn.1400045c0
inc rdi
cmp rdi, r14
jne 0x140007952
cmp r13, 0xf
jbe 0x1400079b6
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400079ae
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007ad8
mov rcx, rsi
call fcn.14006d208
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, qword [0x1400958a0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov r14, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [0x140072420]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x2481513
mov dword [rsp + 0x54], 0x4342120f
mov word [rsp + 0x58], 0x40
mov byte [rsp + 0x5a], 1
nop dword [rax]
lea eax, [rbx + 0x56]
xor byte [rsp + rbx + 0x40], al
inc rbx
cmp rbx, 0x19
jb 0x140007a00
mov byte [rsp + 0x5a], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140007a30
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.140002fa0
mov dword [rbp - 0x40], 0xa
lea rbx, [rbp - 0x60]
mov rdi, qword [rbp - 0x60]
mov r15, qword [rbp - 0x48]
cmp r15, 0xf
cmova rbx, rdi
lea rcx, [rbp - 0x60]
cmova rcx, rdi
mov rsi, qword [rbp - 0x50]
add rsi, rcx
cmp rbx, rsi
je 0x140007aad
mov qword [rsp + 0x30], 0xa
movzx edx, byte [rbx]
mov rcx, r14
call fcn.1400029a0
lea rdx, [0x140004280]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rsp + 0x30]
call fcn.1400045c0
inc rbx
cmp rbx, rsi
jne 0x140007a80
cmp r15, 0xf
jbe 0x140007ae7
lea rdx, [r15 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140007adf
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007adf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14006d208
mov ecx, 0xdac
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x18]
call fcn.1400049e0
mov rdx, rax
lea rcx, [0x140095910]
call fcn.140018ff0
cmp byte [0x140095b28], 0
jne 0x140007c86
mov dword [rsp + 0x40], 0x32046d15
mov dword [rsp + 0x44], 0x2972223f
mov dword [rsp + 0x48], 0x1002b26
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x40]
call fcn.1400063f0
lea rcx, [rbp - 0x18]
call fcn.140007e50
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [rbp - 0x18]
call fcn.1400058c0
nop
lea rcx, [rbp + 0x70]
call fcn.1400064a0
nop
lea rcx, [rbp - 0x38]
call fcn.1400058c0
mov dword [rsp + 0x30], 0x2b3b35
mov byte [rsp + 0x34], 1
lea rcx, [rsp + 0x30]
call fcn.140007dc0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xdac
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x30], 0x2b3b35
mov byte [rsp + 0x34], 1
lea rcx, [rsp + 0x30]
call fcn.140007dc0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140006740
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [0x140072680]
movdqu xmmword [rbp + 0x18], xmm0
movdqa xmm1, xmmword [str.FGHIJKL]
movdqu xmmword [rbp + 0x28], xmm1
mov dword [rbp + 0x38], 0x180e5702
mov dword [rbp + 0x3c], 0x5c181216
mov word [rbp + 0x40], 0x100
lea rcx, [rbp + 0x18]
call fcn.140007e20
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.140004b00
mov dword [rbp + 8], reloc.WS2_32.dll_sendto
lea rdx, [rbp - 0x18]
mov rcx, rbx
call fcn.140006360
nop
lea rcx, [rbp - 0x18]
call fcn.1400058c0
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm0, xmmword [str._9.]
movdqu xmmword [rbp - 0x18], xmm0
movdqa xmm1, xmmword [0x140072750]
movdqu xmmword [rbp - 8], xmm1
mov dword [rbp + 8], 0x59140218
mov dword [rbp + 0xc], 0x4c5a4548
mov word [rbp + 0x10], 0x100
lea rcx, [rbp - 0x18]
call fcn.140007e20
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x70], rax
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x6c], edx
lea rcx, [rbp + 0x80]
call fcn.140005850
lea rcx, [rbp + 0x88]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x120]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x140007d12
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007d0c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007d0c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006d208
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x140007d50
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007d4b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007d4b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006d208
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.14006d5c0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
shr rcx, 0x20
call fcn.140007320
nop
lea r8, [rbp - 0x38]
lea rdx, [rsp + 0x40]
lea rcx, str.exists
call fcn.140007280
nop
mov ecx, reloc.WLDAP32.dll_Ordinal_22
call fcn.1400072e0
int3
shr rdi, 0x20
mov ecx, edi
call fcn.140007320
int3