Function at 0x14004ed70
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Delete file
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x140149040]
xor rax, rsp
mov qword [rbp + 0x30], rax
xor r15d, r15d
mov dword [rsp + 0x40], r15d
xor ecx, ecx
cmp dword [0x140149e80], 1
jne 0x14004f130
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
lea ecx, [r15 + 1]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov rcx, qword [0x140149d70]
mov dword [rcx + 0x1de4], 0x43c80000
mov dword [rcx + 0x1de8], 0x43480000
mov dword [rcx + 0x1dc8], 2
movd xmm2, eax
cvtdq2ps xmm2, xmm2
mulss xmm2, dword [0x14013e174]
subss xmm2, dword [0x14013e224]
movd xmm1, ebx
cvtdq2ps xmm1, xmm1
mulss xmm1, dword [0x14013e174]
subss xmm1, dword [0x14013e238]
or dword [rcx + 0x1dc0], 3
movss dword [rcx + 0x1dd4], xmm1
movss dword [rcx + 0x1dd8], xmm2
mov qword [rcx + 0x1ddc], r15
mov dword [rcx + 0x1dc4], 2
mov byte [rcx + 0x1dfc], 1
movdqa xmm0, xmmword [0x14013e5d0]
movdqu xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [str.heat__CM_Matic_]
movdqu xmmword [rbp + 0x20], xmm1
xor edx, edx
lea r8d, [r15 + 0x22]
lea rcx, [rbp + 0x11]
call fcn.140013a30
mov dword [rbp - 0x10], 0x65725038
mov dword [rbp - 0xc], 0x69207373
mov dword [rbp - 8], 0x63656a6e
mov word [rbp - 4], 0x74
lea rcx, [rbp - 0xf]
call fcn.14004f830
movdqa xmm0, xmmword [0x14013e7b0]
movdqu xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x68], 0x616d2065
mov dword [rsp + 0x6c], 0x6d206e69
mov dword [rsp + 0x70], 0x756e65
lea rcx, [rsp + 0x59]
call fcn.14004f830
mov rax, qword [0x140149d70]
mov rax, qword [rax + 0x1d18]
cmp byte [rax + 0xd4], r15b
jne 0x14004eeef
mov eax, dword [rax + 0x1f4]
neg eax
sbb ecx, ecx
add ecx, 6
call fcn.1400412d0
mov dword [rsp + 0x48], 0x6a6e4969
mov dword [rsp + 0x4c], 0x746365
lea rcx, [rsp + 0x49]
call fcn.14004f720
mov qword [rbp - 0x10], r15
mov dword [rsp + 0x48], 0x6a6e492b
mov dword [rsp + 0x4c], 0x746365
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x49]
call fcn.14003fd30
test al, al
je 0x14004ef34
call fcn.14004ae40
lea rcx, str.Logout
call fcn.14004f720
mov qword [rbp - 0x10], r15
mov dword [rsp + 0x48], 0x676f4c35
mov dword [rsp + 0x4c], 0x74756f
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x49]
call fcn.14003fd30
test al, al
je 0x14004f0c1
mov qword [rbp - 0x10], r15
lea rax, [0x1401490b8]
mov qword [rbp - 8], rax
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x58]
call fcn.140005010
mov dword [rsp + 0x40], 1
cmp dword [rbp - 0x10], 0
jne 0x14004f705
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x70], 7
cmova rax, qword [rsp + 0x58]
mov qword [rbp - 0x10], rax
mov rax, qword [rsp + 0x68]
mov qword [rbp - 8], rax
call fcn.140050d34
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x10], xmm0
lea r8, [rbp - 0x10]
mov edx, eax
lea rcx, [rbp + 0x10]
call fcn.140005e40
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 7
jbe 0x14004f01a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004f015
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004f015
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400510bc
movdqa xmm0, xmmword [0x14013e2d0]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r15w
mov dword [rsp + 0x40], 0x2e734d59
mov dword [rsp + 0x44], 0x6e6962
lea rax, [rsp + 0x41]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004f050
lea rdx, [rsp + 0x41]
lea rcx, [rbp + 0x10]
call fcn.140002fb0
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0xf
cmova rcx, qword [rbp + 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov dword [0x140149e80], r15d
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x14004f0c1
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004f0bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004f0bc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400510bc
mov dword [rsp + 0x40], 0x6f6c4319
mov word [rsp + 0x44], 0x6573
mov byte [rsp + 0x46], 0
lea rcx, [rsp + 0x41]
call fcn.14004f720
mov qword [rbp - 0x10], 0
mov dword [rsp + 0x40], 0x6f6c4349
mov word [rsp + 0x44], 0x6573
mov byte [rsp + 0x46], 0
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x41]
call fcn.14003fd30
test al, al
je 0x14004f116
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, qword [0x140149d70]
mov rax, qword [rax + 0x1d18]
cmp byte [rax + 0xd4], 0
jmp 0x14004f6c3
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov rcx, qword [0x140149d70]
mov dword [rcx + 0x1de4], 0x43c80000
mov dword [rcx + 0x1de8], 0x43480000
mov dword [rcx + 0x1dc8], 2
movd xmm2, ebx
cvtdq2ps xmm2, xmm2
mulss xmm2, dword [0x14013e174]
subss xmm2, dword [0x14013e23c]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mulss xmm1, dword [0x14013e174]
subss xmm1, dword [0x14013e22c]
or dword [rcx + 0x1dc0], 3
movss dword [rcx + 0x1dd4], xmm2
movss dword [rcx + 0x1dd8], xmm1
mov qword [rcx + 0x1ddc], r15
mov dword [rcx + 0x1dc4], 2
mov byte [rcx + 0x1dfc], 1
movdqa xmm0, xmmword [0x14013e5c0]
movdqu xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [str.heat__CM_Matic_]
movdqu xmmword [rbp + 0x20], xmm1
xor edx, edx
lea r8d, [rdx + 0x22]
lea rcx, [rbp + 0x11]
call fcn.140013a30
movdqa xmm0, xmmword [0x14013e800]
movdqu xmmword [rbp - 0x10], xmm0
mov dword [rbp], 0x68207965
mov dword [rbp + 4], 0x657265
lea rcx, [rbp - 0xf]
call fcn.14004f830
mov dword [rbp - 0x10], 0x7465470b
mov dword [rbp - 0xc], 0x79654b20
mov byte [rbp - 8], r15b
lea rcx, [rbp - 0xf]
call fcn.14004f720
mov qword [rbp - 0x10], r15
mov dword [rsp + 0x48], 0x7465471f
mov dword [rsp + 0x4c], 0x79654b20
mov byte [rsp + 0x50], r15b
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x49]
call fcn.14003fd30
test al, al
je 0x14004f44e
mov cl, 0x5b
mov word [rbp - 0x80], 0x5b
movsx esi, cl
movzx r14d, si
xor r14w, 0x33
mov word [rbp - 0x7e], r14w
movzx edi, si
xor di, 0x2f
mov word [rbp - 0x7c], di
mov word [rbp - 0x7a], di
movzx eax, si
xor ax, 0x2b
mov word [rbp - 0x78], ax
movzx eax, si
xor ax, 0x28
mov word [rbp - 0x76], ax
movzx eax, si
xor ax, 0x61
mov word [rbp - 0x74], ax
movzx r10d, si
xor r10w, 0x74
mov word [rbp - 0x72], r10w
mov word [rbp - 0x70], r10w
movzx eax, si
xor ax, 0x37
mov word [rbp - 0x6e], ax
movzx eax, si
xor ax, 0x32
mov word [rbp - 0x6c], ax
movzx ecx, si
xor cx, 0x35
mov word [rbp - 0x6a], cx
movzx ebx, si
xor bx, 0x30
mov word [rbp - 0x68], bx
movzx r11d, si
xor r11w, 0x76
mov word [rbp - 0x66], r11w
mov word [rbp - 0x64], di
movzx eax, si
xor ax, 0x3a
mov word [rbp - 0x62], ax
movzx r9d, si
xor r9w, 0x29
mov word [rbp - 0x60], r9w
movzx edx, si
xor dx, 0x3c
mov word [rbp - 0x5e], dx
movzx r8d, si
xor r8w, 0x3e
mov word [rbp - 0x5c], r8w
mov word [rbp - 0x5a], di
movzx eax, si
xor ax, 0x75
mov word [rbp - 0x58], ax
mov word [rbp - 0x56], cx
mov word [rbp - 0x54], r8w
mov word [rbp - 0x52], di
mov word [rbp - 0x50], r10w
movzx eax, si
xor ax, 0x6e
mov word [rbp - 0x4e], ax
movzx eax, si
xor ax, 0x6c
mov word [rbp - 0x4c], ax
movzx eax, si
xor ax, 0x68
mov word [rbp - 0x4a], ax
movzx eax, si
xor ax, 0x6f
mov word [rbp - 0x48], ax
movzx eax, si
xor ax, 0x6a
mov word [rbp - 0x46], ax
movzx eax, si
xor ax, 0x6d
mov word [rbp - 0x44], ax
mov word [rbp - 0x42], r10w
mov word [rbp - 0x40], dx
mov word [rbp - 0x3e], r8w
mov word [rbp - 0x3c], di
mov word [rbp - 0x3a], r11w
movzx ecx, si
xor cx, 0x22
mov word [rbp - 0x38], cx
movzx eax, si
xor ax, 0x34
mov word [rbp - 0x36], ax
xor si, 0x2e
mov word [rbp - 0x34], si
mov word [rbp - 0x32], r9w
mov word [rbp - 0x30], r11w
mov word [rbp - 0x2e], bx
mov word [rbp - 0x2c], r8w
mov word [rbp - 0x2a], cx
mov word [rbp - 0x28], r11w
mov word [rbp - 0x26], r14w
mov word [rbp - 0x24], r8w
mov word [rbp - 0x22], r9w
mov word [rbp - 0x20], r8w
mov word [rbp - 0x1e], r15w
mov cl, 0x60
mov word [rbp - 0x10], 0x60
movsx ecx, cl
movzx eax, cx
xor ax, 0xf
mov word [rbp - 0xe], ax
movzx eax, cx
xor ax, 0x10
mov word [rbp - 0xc], ax
movzx eax, cx
xor ax, 5
mov word [rbp - 0xa], ax
xor cx, 0xe
mov word [rbp - 8], cx
mov word [rbp - 6], r15w
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, [rbp - 0x7e]
lea rdx, [rbp - 0xe]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rax, qword [0x140149d70]
mov rax, qword [rax + 0x1d18]
cmp byte [rax + 0xd4], r15b
jne 0x14004f477
mov eax, dword [rax + 0x1f4]
neg eax
sbb ecx, ecx
add ecx, 6
call fcn.1400412d0
movdqa xmm0, xmmword [0x14013e370]
movdqu xmmword [rbp - 0x10], xmm0
lea rcx, [rbp - 0xf]
call fcn.14004f830
mov qword [rbp - 0x10], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0x100
lea rbx, [0x140149e90]
mov r8, rbx
xor edx, edx
lea rcx, [0x140053c11]
call fcn.1400444e0
movss xmm1, dword [0x14013e270]
xorps xmm0, xmm0
call fcn.1400177c0
mov qword [rbp - 0x10], r15
mov dword [rsp + 0x40], 0x746e4558
mov word [rsp + 0x44], 0x7265
mov byte [rsp + 0x46], r15b
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x41]
call fcn.14003fd30
test al, al
je 0x14004f65a
mov rdx, rbx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400035b0
lea rdx, [0x140003780]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r15
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rbx + r8], r15b
jne 0x14004f540
mov rdx, rbx
lea rcx, [rbp + 0x10]
call fcn.140003a60
lea rcx, [rbp + 0x10]
call fcn.1400052d0
test al, al
je 0x14004f571
mov dword [0x140149e80], 1
jmp 0x14004f65a
mov cl, 0x75
mov word [rbp - 0x10], 0x75
movsx ecx, cl
movzx eax, cx
xor ax, 0x30
mov word [rbp - 0xe], ax
movzx eax, cx
xor ax, 7
mov word [rbp - 0xc], ax
mov word [rbp - 0xa], ax
xor cx, 0x1a
mov word [rbp - 8], cx
mov word [rbp - 6], ax
mov word [rbp - 4], r15w
mov cl, 0x31
mov word [rsp + 0x58], 0x31
movsx ecx, cl
movzx eax, cx
xor ax, 0x78
mov word [rsp + 0x5a], ax
movzx eax, cx
xor ax, 0x5f
mov word [rsp + 0x5c], ax
movzx eax, cx
xor ax, 0x47
mov word [rsp + 0x5e], ax
movzx eax, cx
xor ax, 0x50
mov word [rsp + 0x60], ax
movzx eax, cx
xor ax, 0x5d
mov word [rsp + 0x62], ax
movzx eax, cx
xor ax, 0x58
mov word [rsp + 0x64], ax
movzx eax, cx
xor ax, 0x55
mov word [rsp + 0x66], ax
movzx eax, cx
xor ax, 0x11
mov word [rsp + 0x68], ax
movzx eax, cx
xor ax, 0x7a
mov word [rsp + 0x6a], ax
movzx eax, cx
xor ax, 0x54
mov word [rsp + 0x6c], ax
movzx eax, cx
xor ax, 0x48
mov word [rsp + 0x6e], ax
xor cx, 0x10
mov word [rsp + 0x70], cx
mov word [rsp + 0x72], r15w
xor r9d, r9d
lea r8, [rbp - 0xe]
lea rdx, [rsp + 0x5a]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, str.Close
call fcn.14004f720
mov qword [rbp - 0x10], r15
mov dword [rsp + 0x40], 0x6f6c4376
mov word [rsp + 0x44], 0x6573
mov byte [rsp + 0x46], r15b
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x41]
call fcn.14003fd30
test al, al
je 0x14004f6ae
lea rcx, [0x1401490e0]
call fcn.140002fa0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, qword [0x140149d70]
mov rax, qword [rax + 0x1d18]
cmp byte [rax + 0xd4], r15b
jne 0x14004f6d7
mov eax, dword [rax + 0x1f4]
neg eax
sbb ecx, ecx
add ecx, 6
call fcn.1400412d0
call fcn.140016a40
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.140051060
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
lea r8, [rsp + 0x58]
lea rdx, [rbp - 0x10]
call fcn.140004fb0
int3