Function at 0x140065370
Capabilities:
Execute command
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
xor esi, esi
mov rax, qword [0x1401516e0]
test rax, rax
je 0x1400653a6
mov rax, qword [rax + 0x98]
jmp 0x1400653a9
mov rax, rsi
cmp qword [rax + 0x48], rsi
jne 0x1400653b4
call fcn.140047890
call fcn.140048820
cmp byte [0x14015090c], sil
je 0x140065446
mov qword [rbp + 0x67], rsi
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [0x140072a80]
xor edx, edx
mov r8d, 1
lea rcx, [0x140072a90]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x140065440
cmp qword [0x140151710], rsi
je 0x140065440
mov rax, qword [rbp + 0x67]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rdx, rax
mov rcx, qword [rbp + 0x67]
call rbx
mov rcx, qword [rbp + 0x67]
mov rax, qword [rcx]
mov rdx, qword [0x140151710]
call qword [rax + 0x28]
mov rcx, qword [rbp + 0x67]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov byte [0x14015090c], sil
call qword [sym.imp.ole32.dll_CoUninitialize]
call fcn.1400084d0
mov rax, qword [0x1401516e0]
mov rax, qword [rax + 0x4910]
lea r8, str.Foreground
mov edx, 1
mov rcx, qword [rax]
call fcn.140007b90
lea rdi, [rbp + 0x5f]
movabs r14, 0xff00ff00ff00ff00
mov qword [rbp + 0xf], r14
mov qword [rbp + 0x17], rdi
mov rbx, qword [rdi]
mov rax, rbx
xor rax, r14
mov qword [rbp + 7], rax
mov qword [rdi], rsi
mov rax, qword [0x140151d78]
mov ecx, 0x2d
call rax
nop
mov qword [rdi], rbx
test ax, ax
je 0x1400654c3
cmp byte [0x140151e1d], 0
sete byte [0x140151e1d]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x140151e1d], 0
je 0x1400654d1
call fcn.140056960
lea rdi, [rbp + 0x5f]
mov qword [rbp + 0xf], r14
mov qword [rbp + 0x17], rdi
mov rbx, qword [rdi]
mov rax, rbx
xor rax, r14
mov qword [rbp + 7], rax
mov qword [rdi], rsi
mov rax, qword [0x140151d78]
mov ecx, 0x2e
call rax
nop
mov qword [rdi], rbx
test ax, ax
je 0x14006553f
movdqa xmm0, xmmword [0x14007a0f0]
movdqu xmmword [rbp + 7], xmm0
movdqa xmm1, xmmword [0x14007a810]
movdqu xmmword [rbp + 0x17], xmm1
mov word [rbp + 0x27], 0x100
lea rcx, [rbp + 7]
call fcn.140064790
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov word [rbp + 0x1e], 0x53
movdqa xmm0, xmmword [0x14007a100]
movdqu xmmword [rbp + 7], xmm0
mov dword [rbp + 0x17], 0x47454c20
mov word [rbp + 0x1b], 0x4e45
mov byte [rbp + 0x1d], 0x44
mov byte [rbp + 0x20], 0
lea rax, [rbp + 7]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x38], 1
mov byte [rsp + 0x30], 0
lea rax, [0x1400db7a0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xa
mov r9d, 0xa
movss xmm2, dword [0x140079d68]
movd r8d, xmm2
mov rdx, qword [0x140152470]
lea rcx, [0x140152468]
call fcn.14005dfa0
cmp byte [0x1400faf9e], 0
je 0x140065614
movdqa xmm0, xmmword [0x14007a640]
movdqa xmmword [rbp + 7], xmm0
movd xmm4, dword [0x1400fafa0]
cvtdq2ps xmm4, xmm4
movd xmm3, dword [0x1400fafa4]
cvtdq2ps xmm3, xmm3
movss xmm2, dword [0x140151c7c]
mulss xmm2, dword [0x140079c68]
movss xmm1, dword [0x140151c78]
mulss xmm1, dword [0x140079c68]
lea rax, [rbp + 7]
mov qword [rsp + 0x28], rax
movss dword [rsp + 0x20], xmm4
call fcn.140060040
call fcn.14006a720
call fcn.14000a590
xorps xmm0, xmm0
movups xmmword [rbp + 0x37], xmm0
mov rcx, qword [0x140151718]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [0x140151c70]
mov edx, 1
call qword [rax + pe_nt_image_headers64]
mov rcx, qword [0x140151718]
mov rax, qword [rcx]
lea r8, [rbp + 0x37]
mov rdx, qword [0x140151c70]
call qword [rax + 0x190]
mov rax, qword [0x1401516e0]
mov rcx, qword [rax + 0x4910]
mov rcx, qword [rcx]
add rcx, 0x48
cmp byte [rcx], 0
cmove rcx, rsi
call fcn.140046e60
mov rcx, qword [0x140151c48]
mov rax, qword [rcx]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x40]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret