Function at 0x14003caa0
Capabilities:
Delete file
Execute command
Self delete

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x140078040]
xor rax, rsp
mov qword [rbp + 0x40], rax
movzx edi, dl
movsx ebx, cl
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 3
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, ebx
lea rcx, str._NTFS_Scanner__Running_journal_query_for_drive__c._n
call fcn.14000fc00
test dil, dil
je 0x14003cc1c
lea rcx, str._NTFS_Scanner__Detecting_file_rename_modifications_in_the_entire_NTFS_drive..._n
call fcn.14000fc00
mov r8d, ebx
lea rdx, str.fsutil_usn_readjournal__c:_csv__findstr__i__c:0x00001000____.old_renamed_files.txt
lea rcx, [rsp + 0x30]
call fcn.14003d5c0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r8d, ebx
lea rdx, str.fsutil_usn_readjournal__c:_csv__findstr__i__c:0x00002000____._new_renamed_files.txt
lea rcx, [rsp + 0x30]
call fcn.14003d5c0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._NTFS_Scanner__Detecting_every_file_modification_with_any_special_character..._n
nop
call fcn.14000fc00
mov r8d, ebx
lea rdx, str.fsutil_usn_readjournal__c:_csv__findstr__i__C:_______._special_characters.txt
lea rcx, [rsp + 0x30]
call fcn.14003d5c0
lea rcx, ds:[rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._NTFS_Scanner__Detecting_Glorious_macro_traces_on_the_entire_NTFS_drive..._n
call fcn.14000fc00
mov r8d, ebx
lea rdx, str.fsutil_usn_readjournal__c:_csv__findstr__i__C:_.mcf_____.glorious.txt
lea rcx, [rsp + 0x30]
call fcn.14003d5c0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._NTFS_Scanner__Detecting_Logitech_macro_traces_on_the_entire_NTFS_drive..._n
call fcn.14000fc00
mov r8d, ebx
lea rdx, str.fsutil_usn_readjournal__c:_csv__findstr__i__C:_settings.db_____.logitech.txt
lea rcx, [rsp + 0x30]
call fcn.14003d5c0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._NTFS_Scanner__Detecting_Bloody_macro_traces_on_the_entire_NTFS_drive..._n
call fcn.14000fc00
mov r8d, ebx
lea rdx, str.fsutil_usn_readjournal__c:_csv__findstr__i__C:_.amc2_____._bloody.txt
lea rcx, [rsp + 0x30]
call fcn.14003d5c0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._NTFS_Scanner__Detecting_Corsair_macro_traces_on_the_entire_NTFS_drive..._n
call fcn.14000fc00
lea rdx, str.fsutil_usn_readjournal__c:_csv__findstr__i__C:_.cuecfg_____.corsair.txt
jmp 0x14003cc85
lea rcx, str._NTFS_Scanner__Skipping_macro_trace_detection_based_on_user_input._n
call fcn.14000fc00
lea rcx, str._NTFS_Scanner__Detecting_file_rename_modifications_in_the_entire_NTFS_drive..._n
call fcn.14000fc00
mov r8d, ebx
lea rdx, str.fsutil_usn_readjournal__c:_csv__findstr__i__c:0x00001000____.old_renamed_files.txt
lea rcx, [rsp + 0x30]
call fcn.14003d5c0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r8d, ebx
lea rdx, str.fsutil_usn_readjournal__c:_csv__findstr__i__c:0x00002000____._new_renamed_files.txt
lea rcx, [rsp + 0x30]
call fcn.14003d5c0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._NTFS_Scanner__Detecting_every_file_modification_with_any_special_character..._n
call fcn.14000fc00
lea rdx, str.fsutil_usn_readjournal__c:_csv__findstr__i__C:_______._special_characters.txt
mov r8d, ebx
lea rcx, [rsp + 0x30]
call fcn.14003d5c0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._NTFS_Scanner__Detecting_renamed_and_deleted_Prefetch_folders_on_the_entire_NTFS_drive..._n
call fcn.14000fc00
mov r8d, ebx
lea rdx, str.fsutil_usn_readjournal__c:_csv__findstr__i__C:_Prefetch_____.prefetch.txt
lea rcx, [rsp + 0x30]
call fcn.14003d5c0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._NTFS_Scanner__Detecting_AutoHotKey_file_traces_on_the_entire_NTFS_drive..._n
call fcn.14000fc00
mov r8d, ebx
lea rdx, str.fsutil_usn_readjournal__c:_csv__findstr__i__c:.ahk____._ahk_files.txt
lea rcx, [rsp + 0x30]
call fcn.14003d5c0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._NTFS_Scanner__Detecting_renamed_and_deleted_Eventlog_files_on_the_entire_NTFS_drive..._n
call fcn.14000fc00
mov r8d, ebx
lea rdx, str.fsutil_usn_readjournal__c:_csv__findstr__i__c:.evtx__findstr__i__c:0x80000200__c:0x00002000____.deleted_evtx.txt
lea rcx, [rsp + 0x30]
call fcn.14003d5c0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 7
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor edi, edi
lea r8, [0x1400636e8]
lea rdx, [0x140063760]
mov qword [rsp + 0x20], rdi
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
jne 0x14003cd9a
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14003cd9a
xor edx, edx
lea r8d, [rdi + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov rcx, qword [rsp + 0x20]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test ebx, ebx
jne 0x14003cd9a
lea rcx, [0x140063760]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea r8, [0x1400636e8]
mov qword [rsp + 0x20], rdi
lea rdx, [0x140063778]
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
jne 0x14003cdfb
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14003cdfb
xor edx, edx
lea r8d, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov rcx, qword [rsp + 0x20]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test ebx, ebx
jne 0x14003cdfb
lea rcx, [0x140063778]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea r8, [0x1400636e8]
mov qword [rsp + 0x20], rdi
lea rdx, str.special_characters.txt
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
jne 0x14003ce5c
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14003ce5c
xor edx, edx
lea r8d, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov rcx, qword [rsp + 0x20]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test ebx, ebx
jne 0x14003ce5c
lea rcx, str.special_characters.txt
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea r8, [0x1400636e8]
mov qword [rsp + 0x20], rdi
lea rdx, str.glorious.txt
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
jne 0x14003cebd
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14003cebd
xor edx, edx
lea r8d, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov rcx, qword [rsp + 0x20]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test ebx, ebx
jne 0x14003cebd
lea rcx, str.glorious.txt
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea r8, [0x1400636e8]
mov qword [rsp + 0x20], rdi
lea rdx, str.logitech.txt
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
jne 0x14003cf26
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14003cf26
xor edx, edx
lea r8d, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, qword ds:[rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov rcx, qword [rsp + 0x20]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test ebx, ebx
jne 0x14003cf26
lea rcx, str.logitech.txt
nop
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea r8, [0x1400636e8]
mov qword ds:[rsp + 0x20], rdi
lea rdx, str.bloody.txt
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
jne 0x14003cf91
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14003cf91
xor edx, edx
lea r8d, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov rcx, qword [rsp + 0x20]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
nop
test ebx, ebx
jne 0x14003cf91
lea rcx, str.bloody.txt
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea r8, [0x1400636e8]
mov qword [rsp + 0x20], rdi
lea rdx, str.Prefetch.txt
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
jne 0x14003cff7
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14003cff7
xor edx, edx
lea r8d, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov rcx, qword ds:[rsp + 0x20]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test ebx, ebx
jne 0x14003cff7
lea rcx, str.Prefetch.txt
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea r8, [0x1400636e8]
mov qword [rsp + 0x20], rdi
lea rdx, str.ahk_files.txt
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
jne 0x14003d05a
mov rcx, qword ds:[rsp + 0x20]
test rcx, rcx
je 0x14003d05a
xor edx, edx
lea r8d, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov rcx, qword [rsp + 0x20]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test ebx, ebx
jne 0x14003d05a
lea rcx, str.ahk_files.txt
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea r8, [0x1400636e8]
mov qword [rsp + 0x20], rdi
lea rdx, str.deleted_evtx.txt
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
jne 0x14003d0bb
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14003d0bb
xor edx, edx
lea r8d, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov rcx, qword [rsp + 0x20]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test ebx, ebx
jne 0x14003d0bb
lea rcx, str.deleted_evtx.txt
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.14004d6a0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret