Function at 0xadfff9
Capabilities:
Bypass windows file protection
Get file attributes
Read file on windows
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov eax, 0xb3c8
call fcn.00aedef0
push ebx
push ebp
push esi
push edi
push str.kernel32
xor bh, bh
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0xae007e
push str.SetDllDirectoryW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov bl, byte [esp + 0xb3dc]
mov edi, eax
test edi, edi
je 0xae004b
movzx ecx, bl
neg ecx
sbb ecx, ecx
and ecx, 0xb025a4
push ecx
mov ecx, edi
call dword [0xb02260]
call edi
push str.SetDefaultDllDirectories
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0xae007e
xor ecx, ecx
test bl, bl
sete cl
dec ecx
and ecx, 0xfffff800
add ecx, 0x1000
push ecx
mov ecx, esi
call dword [0xb02260]
call esi
mov bh, 1
mov eax, dword [str.xlistpos]
or ebp, 0xffffffff
mov dword [esp + 0x14], str.version.dll
mov esi, 0x800
mov dword [esp + 0x18], str.DXGIDebug.dll
mov dword [esp + 0x1c], str.sfc_os.dll
cmp byte [eax], 0x78
mov dword [esp + 0x20], str.SSPICLI.DLL
mov dword [esp + 0x24], str.rsaenh.dll
mov dword [esp + 0x28], str.UXTheme.dll
mov dword [esp + 0x2c], str.dwmapi.dll
mov dword [esp + 0x30], str.cryptbase.dll
mov dword [esp + 0x34], str.lpk.dll
mov dword [esp + 0x38], str.usp10.dll
mov dword [esp + 0x3c], str.clbcatq.dll
mov dword [esp + 0x40], str.comres.dll
mov dword [esp + 0x44], str.ws2_32.dll
mov dword [esp + 0x48], str.ws2help.dll
mov dword [esp + 0x4c], str.psapi.dll
mov dword [esp + 0x50], str.ieframe.dll
mov dword [esp + 0x54], str.ntshrui.dll
mov dword [esp + 0x58], str.atl.dll
mov dword [esp + 0x5c], str.setupapi.dll
mov dword [esp + 0x60], str.apphelp.dll
mov dword [esp + 0x64], str.userenv.dll
mov dword [esp + 0x68], str.netapi32.dll
mov dword [esp + 0x6c], str.shdocvw.dll
mov dword [esp + 0x70], str.crypt32.dll
mov dword [esp + 0x74], str.msasn1.dll
mov dword [esp + 0x78], str.cryptui.dll
mov dword [esp + 0x7c], str.wintrust.dll
mov dword [esp + 0x80], str.shell32.dll
mov dword [esp + 0x84], str.secur32.dll
mov dword [esp + 0x88], str.cabinet.dll
mov dword [esp + 0x8c], str.oleaccrc.dll
mov dword [esp + 0x90], str.ntmarta.dll
mov dword [esp + 0x94], str.profapi.dll
mov dword [esp + 0x98], str.WindowsCodecs.dll
mov dword [esp + 0x9c], str.srvcli.dll
mov dword [esp + 0xa0], str.cscapi.dll
mov dword [esp + 0xa4], str.slc.dll
mov dword [esp + 0xa8], str.imageres.dll
mov dword [esp + 0xac], str.dnsapi.DLL
mov dword [esp + 0xb0], str.iphlpapi.DLL
mov dword [esp + 0xb4], str.WINNSI.DLL
mov dword [esp + 0xb8], str.netutils.dll
mov dword [esp + 0xbc], str.mpr.dll
mov dword [esp + 0xc0], str.devrtl.dll
mov dword [esp + 0xc4], str.propsys.dll
mov dword [esp + 0xc8], str.mlang.dll
mov dword [esp + 0xcc], str.samcli.dll
mov dword [esp + 0xd0], str.samlib.dll
mov dword [esp + 0xd4], str.wkscli.dll
mov dword [esp + 0xd8], str.dfscli.dll
mov dword [esp + 0xdc], str.browcli.dll
mov dword [esp + 0xe0], str.rasadhlp.dll
mov dword [esp + 0xe4], str.dhcpcsvc6.dll
mov dword [esp + 0xe8], str.dhcpcsvc.dll
mov dword [esp + 0xec], str.XmlLite.dll
mov dword [esp + 0xf0], str.linkinfo.dll
mov dword [esp + 0xf4], str.cryptsp.dll
mov dword [esp + 0xf8], str.RpcRtRemote.dll
mov dword [esp + 0xfc], str.aclui.dll
mov dword [esp + 0x100], str.dsrole.dll
mov dword [esp + 0x104], str.peerdist.dll
je 0xae03ae
push eax
call fcn.00af6cd8
mov edi, eax
pop ecx
test edi, edi
je 0xae03ae
push esi
lea eax, [esp + 0x1314]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
push eax
push eax
push 3
push eax
push 1
push 0x80000000
lea eax, [esp + 0x1328]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, ebp
je 0xae03a2
push 0
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, edi
jne 0xae03a2
push 0
lea eax, [esp + 0x14]
push eax
push 0x7ffe
lea eax, [esp + 0x33e4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0xae03a2
mov eax, dword [esp + 0x10]
shr eax, 1
xor ecx, ecx
push 0x104
mov word [esp + eax*2 + 0x33dc], cx
lea eax, [esp + 0x10c]
push eax
lea eax, [esp + 0x33e0]
push eax
jmp 0xae0397
lea eax, [esp + 0x108]
push eax
call fcn.00adffaf
push 0x104
lea eax, [esp + 0x10c]
push eax
push edi
call fcn.00adfb02
mov edi, eax
test edi, edi
jne 0xae037c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x800
push esi
lea eax, [esp + 0x314]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
lea eax, [esp + 0x314]
push eax
call fcn.00adbbe9
push eax
lea eax, [esp + 0x23e0]
push eax
call fcn.00adfd80
xor edi, edi
xor esi, esi
call fcn.00adac45
cmp eax, 0x600
jb 0xae03f6
push dword [esp + esi*4 + 0x14]
call fcn.00adffaf
jmp 0xae03f8
xor eax, eax
test eax, eax
je 0xae041c
push ebp
push str.DXGIDebug.dll
push ebp
push dword [esp + esi*4 + 0x20]
push 0x1001
push 0x400
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0xae0444
push 0x800
push dword [esp + esi*4 + 0x18]
lea eax, [esp + 0x318]
push eax
call fcn.00adbc5f
lea eax, [esp + 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, ebp
jne 0xae044c
inc esi
cmp esi, 8
jb 0xae03df
jmp 0xae0450
mov edi, dword [esp + esi*4 + 0x14]
test bh, bh
jne 0xae048a
xor esi, esi
push 0x800
push dword [esp + esi*4 + 0x38]
lea eax, [esp + 0x318]
push eax
call fcn.00adbc5f
lea eax, [esp + 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, ebp
jne 0xae0486
inc esi
cmp esi, 0x35
jb 0xae0456
jmp 0xae048a
mov edi, dword [esp + esi*4 + 0x34]
test edi, edi
je 0xae0599
lea eax, [esp + 0x310]
push eax
call fcn.00adbc33
call fcn.00adac45
cmp eax, 0x600
jb 0xae0511
push str.dwmapi.dll
call fcn.00adffaf
push str.uxtheme.dll
call fcn.00adffaf
lea eax, [esp + 0x23d8]
push eax
lea eax, [esp + 0x314]
push eax
push edi
push 0xf1
call fcn.00addce1
push eax
lea eax, [esp + 0x1320]
push 0x864
push eax
call fcn.00ad3dd3
add esp, 0x18
push 0x30
push 0xf0
call fcn.00addce1
push eax
lea eax, [esp + 0x1318]
push eax
push 0
call fcn.00ae9b85
jmp 0xae0591
lea eax, [esp + 0x23d8]
push eax
lea eax, [esp + 0x314]
push eax
push edi
push str.Please_remove__s_from__s_folder._It_is_unsecure_to_run__s_until_it_is_done.
lea eax, [esp + 0x1320]
push 0x864
push eax
call fcn.00ad3dd3
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_AllocConsole]
test eax, eax
je 0xae0591
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_AttachConsole]
push 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1318]
push eax
call fcn.00af3193
pop ecx
push eax
lea eax, [esp + 0x131c]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb3c8
ret 4