Function at 0x1400011e0
Capabilities:
Create process on windows
Create thread
Enumerate files on windows
Get memory capacity
Query environment variable
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
xor r13d, r13d
lea rdx, str.Start_y_n_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001b90
lea rdx, [rsp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140001db0
movzx eax, byte [rsp + 0x30]
cmp al, 0x79
jne 0x1400019de
mov dword [rbp + 0x30], 0x40
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rcx, qword [rbp + 0x38]
xorps xmm0, xmm0
test rcx, rcx
js 0x140001270
cvtsi2sd xmm0, rcx
jmp 0x140001285
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
mulsd xmm0, qword [0x140004540]
xor eax, eax
movsd xmm1, qword [0x140004548]
comisd xmm0, xmm1
jb 0x1400012b4
subsd xmm0, xmm1
comisd xmm0, xmm1
jae 0x1400012b4
movabs rcx, 0x8000000000000000
mov rax, rcx
cvttsd2si rdi, xmm0
add rdi, rax
mov rcx, rdi
call fcn.1400027ec
mov rsi, rax
mov rbx, r13
test rdi, rdi
je 0x1400012f1
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x1400012e6
dec eax
or eax, 0xffffff00
inc eax
mov byte [rsi + rbx], al
inc rbx
cmp rbx, rdi
jb 0x1400012d0
lea rdx, str.Allocated
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001b90
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, str._bytes_of_memory.
call fcn.140001b90
lea rdx, [0x140001d70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rsi
call fcn.1400026d0
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv ebx
mov r15d, edx
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv ebx
mov r14d, edx
mov ecx, r15d
call qword [sym.imp.USER32.dll_SetCursorPos]
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
mov qword [rbp - 0x10], r13
lea rcx, str.USERPROFILE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], r13
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1400013a0
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.140001e70
nop
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
mov rax, rdx
sub rax, rcx
cmp rax, 0xa
jb 0x1400013fe
lea rax, [rcx + 0xa]
mov qword [rbp - 0x30], rax
lea rbx, [rbp - 0x40]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x40]
add rbx, rcx
mov r8d, 0xa
lea rdx, str.Desktop
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xa], 0
jmp 0x14000141c
mov qword [rsp + 0x20], 0xa
lea r9, str.Desktop
mov edx, 0xa
lea rcx, [rbp - 0x40]
call fcn.140002000
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rcx, qword [rbp - 0x40]
lea rdx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140001510
lea rdx, str.Failed_to_find_files_on_desktop.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001b90
lea rdx, [0x140001d70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x1400014a3
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000149e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000149e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400026d0
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140001501
mov rdx, qword [rbp - 0x18]
call fcn.140001f70
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x20]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400014fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400014fc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400026d0
mov eax, 1
jmp 0x140001a13
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea rax, [rbp + 0x9c]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140001530
lea rdx, [rbp + 0x9c]
lea rcx, [rbp - 0x60]
call fcn.140001e70
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, qword [rbp - 0x10]
je 0x140001574
movups xmm0, xmmword [rbp - 0x60]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x50]
movups xmmword [rdx + 0x10], xmm1
mov edx, 0xf
mov byte [rbp - 0x60], 0
add qword [rbp - 0x18], 0x20
jmp 0x140001585
lea r8, [rbp - 0x60]
lea rcx, [rbp - 0x20]
call fcn.140002250
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x1400015bc
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400015b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001676
call fcn.1400026d0
lea rdx, [rbp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140001510
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdi, qword [rbp - 0x20]
mov r12, qword [rbp - 0x18]
cmp rdi, r12
je 0x14000170f
nop dword [rax + rax]
mov rax, qword [rbp - 0x30]
lea r8, [rax - 1]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
cmp rax, r8
cmovb r8, rax
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x60]
call fcn.140001e70
nop
mov rsi, qword [rdi + 0x10]
mov r9, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x140001637
mov r9, qword [rdi]
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x14000167d
lea rax, [rsi + rcx]
mov qword [rbp - 0x50], rax
lea rbx, [rbp - 0x60]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x60]
add rbx, rcx
mov r8, rsi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rsi], 0
jmp 0x14000168e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov qword [rsp + 0x20], rsi
mov rdx, rsi
lea rcx, [rbp - 0x60]
call fcn.140002000
lea r8, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova r8, qword [rbp - 0x60]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140001702
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400016fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400019c9
call fcn.1400026d0
add rdi, 0x20
cmp rdi, r12
jne 0x1400015f0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], rax
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
mov r8d, 3
lea rdx, [0x1400044e4]
lea rcx, [rsp + 0x40]
call fcn.140001e70
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
mov r8d, 3
lea rdx, [0x1400044e8]
lea rcx, [rsp + 0x60]
call fcn.140001e70
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
mov r8d, 3
lea rdx, [0x1400044ec]
lea rcx, [rbp - 0x80]
call fcn.140001e70
nop
lea rdi, [rsp + 0x40]
lea rbx, [rbp - 0x60]
xorps xmm0, xmm0
movdqu xmmword [rbp - 8], xmm0
mov qword [rbp + 8], r13
mov ecx, 0x60
call fcn.1400026d8
mov qword [rbp - 8], rax
mov qword [rbp], rax
lea rcx, [rax + 0x60]
mov qword [rbp + 8], rcx
lea r8, [rbp - 8]
mov qword [rsp + 0x38], r8
lea r9, [rbp - 8]
mov r8, rax
mov rdx, rbx
mov rcx, rdi
call fcn.1400024e0
mov qword [rbp], rax
lea r9, [0x140001ac0]
mov edx, 0x20
mov r8d, 3
lea rcx, [rsp + 0x40]
call fcn.140002714
nop dword [rax]
mov ecx, 1
call qword [sym.imp.USER32.dll_BlockInput]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
mov r8d, 0x2b
lea rdx, str.https:__www.youtube.com_watch_vdQw4w9WgXcQ
lea rcx, [rbp - 0x60]
call fcn.140001e70
nop
lea r8, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova r8, qword [rbp - 0x60]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [0x1400011c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], r13
mov r8d, 3
lea rdx, [0x1400044e4]
lea rcx, [rbp + 0x10]
call fcn.140001e70
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x66666667
imul r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub r8d, ecx
lea ebx, [r8 - 5]
add ebx, r15d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x66666667
imul r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub r8d, ecx
add r8d, 0xfffffffb
mov r15d, r13d
test ebx, ebx
cmovns r15d, ebx
add r14d, r8d
cmovs r14d, r13d
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp r15d, eax
jl 0x14000191b
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea r15d, [rax - 1]
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp r14d, eax
jl 0x14000193a
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea r14d, [rax - 1]
mov edx, r14d
mov ecx, r15d
call qword [sym.imp.USER32.dll_SetCursorPos]
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x140001989
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001983
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400019d0
call fcn.1400026d0
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140001800
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400019d7
call fcn.1400026d0
jmp 0x140001800
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
cmp al, 0x6e
jne 0x1400019ee
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.Invalid_Input
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001b90
lea rdx, [0x140001d70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.1400026b0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret