Function at 0x14006a6a0
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x1400ca040]
xor rax, rsp
mov qword [rbp + 0x260], rax
xor r13d, r13d
call fcn.14006a2b0
lea rcx, [rax + 0x118]
call fcn.14006e050
lea rcx, [rax + 0x1a8]
call fcn.14006e050
mov r8d, 0x104
lea rdx, [rbp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rbp + 0x40]
mov rbx, 0xffffffffffffffff
mov rdi, rbx
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], r13b
jne 0x14006a720
call fcn.14009bbe4
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
lea r8, [rsp + 0x20]
mov edx, eax
lea rcx, [rbp - 0x60]
call fcn.1400031e0
nop
lea r10, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova r10, qword [rbp - 0x60]
mov rax, qword [rbp - 0x50]
lea rdx, [r10 + rax*2]
mov rcx, r10
call fcn.140069f70
cmp rax, rdx
je 0x14006a7de
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x14006a77f
cmp cx, 0x2f
jne 0x14006a788
add rax, 2
cmp rax, rdx
jne 0x14006a770
cmp rax, rdx
je 0x14006a7de
nop dword [rax]
lea rcx, [rdx - 2]
movzx r8d, word [rcx]
cmp r8w, 0x5c
je 0x14006a7b0
cmp r8w, 0x2f
je 0x14006a7b0
mov rdx, rcx
cmp rax, rcx
jne 0x14006a790
jmp 0x14006a7de
cmp rax, rdx
je 0x14006a7de
nop word [rax + rax]
lea rcx, [rdx - 2]
movzx r8d, word [rcx]
cmp r8w, 0x5c
je 0x14006a7d6
cmp r8w, 0x2f
jne 0x14006a7de
mov rdx, rcx
cmp rax, rcx
jne 0x14006a7c0
sub rdx, r10
sar rdx, 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
mov r8, rdx
mov rdx, r10
lea rcx, [rsp + 0x40]
call fcn.140007e00
nop
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.14006a070
nop
lea rcx, [rsp + 0x40]
call fcn.140006fb0
nop
lea rcx, [rbp - 0x60]
call fcn.140006fb0
nop
mov r8d, 0x104
lea rdx, [rbp + 0x150]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rbp + 0x150]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14006a847
call fcn.14009bbe4
lea rcx, [rbp + 0x150]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rbx
lea r8, [rsp + 0x20]
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.1400031e0
nop
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.14006a160
nop
lea rdx, [rbp - 0x40]
mov rcx, rax
call fcn.14006a070
nop
lea rcx, [rbp - 0x80]
call fcn.140006fb0
nop
lea rcx, [rsp + 0x60]
call fcn.140006fb0
nop
mov r14, qword [rbp + 0x30]
movabs r12, 0x7fffffffffffffff
mov rax, r12
sub rax, r14
cmp rax, 1
jb 0x14006ac4b
lea r15, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova r15, qword [rbp + 0x20]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rsi, [r14 + 1]
mov ebx, 0xf
lea rdi, [rsp + 0x20]
movabs rax, 0x8000000000000000
lea ecx, [rbx + 7]
cmp rsi, rbx
jbe 0x14006a975
mov rbx, rsi
or rbx, 0xf
cmp rbx, r12
jbe 0x14006a934
mov rbx, r12
add rax, 0x27
mov rcx, rax
call fcn.14009c520
test rax, rax
je 0x14006a957
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14006a970
cmp rbx, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14006a95e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14006ac3f
jmp 0x14006a919
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14006a96d
call fcn.14009c520
mov rdi, rax
jmp 0x14006a970
mov rdi, r13
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbx
mov r8, r14
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0x5c
mov byte [rdi + rsi], 0
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rdx, qword [rbp - 0x40]
mov r8, qword [rbp - 0x30]
lea rcx, [rsp + 0x20]
call fcn.140007110
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x20]
call fcn.140007020
mov r15, qword [rbp - 0x30]
mov rax, r12
sub rax, r15
cmp rax, 0x11
jb 0x14006ac39
lea r14, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova r14, qword [rbp - 0x40]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea rsi, [r15 + 0x11]
mov ebx, 0xf
lea rdi, [rsp + 0x40]
cmp rsi, rbx
jbe 0x14006aa9f
mov rbx, rsi
or rbx, 0xf
cmp rbx, r12
jbe 0x14006aa58
mov rbx, r12
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14009c520
test rax, rax
je 0x14006aa81
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14006aa9a
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14006aa88
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14006ac45
jmp 0x14006aa3d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14006aa97
call fcn.14009c520
mov rdi, rax
jmp 0x14006aa9a
mov rdi, r13
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rbx
movups xmm0, xmmword [str.taskkill__F__IM__]
movups xmmword [rdi], xmm0
movzx eax, byte [0x1400b4e40]
mov byte [rdi + 0x10], al
lea rcx, [rdi + 0x11]
mov r8, r15
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov r8d, 0xf
lea rdx, str.___start_____
lea rcx, [rsp + 0x40]
call fcn.140007110
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rdx, qword [rbp]
mov r8, qword [rbp + 0x10]
lea rcx, [rsp + 0x60]
call fcn.140007110
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
mov r8d, 1
lea rdx, [0x1400b4e2c]
lea rcx, [rbp - 0x80]
call fcn.140007110
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x10], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp - 0x80]
call fcn.140007020
nop
lea rcx, [rsp + 0x60]
call fcn.140007020
nop
lea rcx, [rsp + 0x40]
call fcn.140007020
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rcx, qword [rbp - 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x20]
call fcn.140007020
nop
lea rcx, [rbp]
call fcn.140007020
nop
lea rcx, [rbp - 0x40]
call fcn.140007020
nop
lea rcx, [rbp + 0x20]
call fcn.140007020
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.14009c500
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400029a0
nop
call fcn.140002900
nop
call fcn.140002900
nop
call fcn.1400029a0
int3