Function at 0x140011497
Capabilities:
Create directory
Delete file
Execute command
Set console window title

Disassembly:
jmp 0x140018320
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x2a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140028040]
xor rax, rbp
mov qword [rbp + 0x158], rax
lea rcx, [0x14002e0fa]
call fcn.14001169f
lea rcx, str.NightWare_Loader
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xor edx, edx
lea rcx, str.C:Windows_bcastdvr
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rcx, str.C:Windows_bcastdvr236.dll
call qword [sym.imp.ucrtbased.dll_remove]
lea rdx, str.RustClient
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x1400183b0
mov rax, qword [rbp + 8]
mov qword [0x1400284c8], rax
jmp 0x140018436
lea rdx, str._______NIGHTWARE.XYZ________n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110be
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.RustClient_is_not_running
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110be
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 0x64
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.Loader_will_Closed_in_5_seconds
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110be
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.exit
call qword [sym.imp.ucrtbased.dll_system]
lea rdx, [0x1400284d8]
mov rcx, qword [0x1400284c8]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [0x1400284d8]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1400284c0], rax
lea r8, str.236.dll
mov edx, dword [0x1400284d8]
lea rcx, [0x1400284c0]
call fcn.1400116e0
mov dword [0x1400284d0], eax
cmp dword [0x1400284d8], 1
jbe 0x1400184f4
lea rdx, str.https:__cdn.discordapp.com_attachments_854325809481121792_1200723821133574164_9PT5xBiR.txt_ex65c73833is65b4c333hmd482beec333795fb92b309a9e9a7ae643d9a140611b1bdab4441e0e02cd9b98b
lea rcx, [rbp + 0x28]
call fcn.1400112e9
nop
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x68]
call fcn.140011573
nop
lea rdx, [rbp + 0x68]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001160e
lea rdx, [0x140023bf0]
mov rcx, rax
call fcn.1400110be
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14001121c
nop
lea rcx, [rbp + 0x68]
call fcn.140011136
nop
lea rcx, [rbp + 0x28]
call fcn.140011136
jmp 0x14001857c
xor eax, eax
cmp eax, 1
je 0x14001856c
lea rdx, str.Rust
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1400284c8], rax
lea rdx, [0x1400284d8]
mov rcx, qword [0x1400284c8]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [0x1400284d8]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1400284c0], rax
lea r8, str.dll.dll
mov edx, dword [0x1400284d8]
lea rcx, [0x1400284c0]
call fcn.1400116e0
mov dword [0x1400284d0], eax
cmp dword [0x1400284d8], 1
jbe 0x14001856a
jmp 0x14001856c
jmp 0x1400184f4
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14001121c
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400234a0]
call fcn.140011596
mov eax, edi
mov rcx, qword [rbp + 0x158]
xor rcx, rbp
call fcn.14001133e
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret