Function at 0x140008fe0
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov rax, qword [0x140021040]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rsi, r9
mov r14, r8
mov r15, rcx
xor r12d, r12d
mov dword [rsp + 0x48], r12d
mov r8, rdx
lea rdx, str.C:UsersPublicDocumentscografyaoyun_
lea rcx, [rbp - 0x29]
call fcn.14000c3e0
nop
mov rdi, qword [rbp - 0x19]
lea rbx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0xf
cmova rbx, qword [rbp - 0x29]
call fcn.14000f5c4
mov qword [rbp - 0x49], rbx
mov qword [rbp - 0x41], rdi
lea r8, [rbp - 0x49]
mov edx, eax
lea rcx, [rbp - 0x69]
call fcn.140008090
nop
lea r11, [rbp - 0x69]
cmp qword [rbp - 0x51], 7
cmova r11, qword [rbp - 0x69]
mov rax, qword [rbp - 0x59]
lea rdx, [r11 + rax*2]
mov rcx, r11
call fcn.1400081e0
mov r10, rax
cmp rax, rdx
je 0x1400090ce
nop dword [rax]
nop dword [rax + rax]
lea r8, [rdx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x1400090ae
cmp cx, 0x2f
je 0x1400090ae
mov rdx, r8
cmp r10, r8
jne 0x140009090
jmp 0x1400090ce
cmp r10, rdx
je 0x1400090ce
lea rcx, [rdx - 2]
movzx eax, word [rcx]
cmp ax, 0x5c
je 0x1400090c6
cmp ax, 0x2f
jne 0x1400090ce
mov rdx, rcx
cmp r10, rcx
jne 0x1400090b3
mov qword [rbp - 0x49], r11
sub rdx, r11
sar rdx, 1
mov qword [rbp - 0x41], rdx
lea rdx, [rbp - 0x49]
lea rcx, [rsp + 0x28]
call fcn.14000da30
mov ebx, 0x1c
mov qword [rbp - 0x49], r12
lea r13, [0x1400210d8]
mov qword [rbp - 0x41], r13
lea rdx, [rbp - 0x49]
lea rcx, [rsp + 0x28]
call fcn.140008cf0
cmp dword [rbp - 0x49], 0
jne 0x1400096e8
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x14000915b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009156
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009156
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010118
movdqa xmm0, xmmword [0x140019ba0]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], r12w
mov rdx, qword [rbp - 0x51]
cmp rdx, 7
jbe 0x1400091b2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400091ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400091ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010118
cmp byte [r14], 0
jne 0x14000932e
mov rdi, qword [rbp - 0x19]
lea rbx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0xf
cmova rbx, qword [rbp - 0x29]
call fcn.14000f5c4
mov qword [rbp - 0x49], rbx
mov qword [rbp - 0x41], rdi
lea r8, [rbp - 0x49]
mov edx, eax
lea rcx, [rsp + 0x28]
call fcn.140008090
nop
mov ebx, 0x7d
mov dword [rsp + 0x48], ebx
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 7
cmova rcx, qword [rsp + 0x28]
mov r9d, 0xffffffff
lea r8d, [rbx - 0x7a]
lea rdx, [rbp - 9]
call fcn.14000f89c
mov edx, eax
test eax, eax
jne 0x140009269
mov eax, dword [rbp + 7]
test al, 1
mov ecx, 0x1ff
mov r8d, 0x16d
cmovne ecx, r8d
mov dword [rbp - 0x45], ecx
bt eax, 0xa
jae 0x14000925b
mov ecx, dword [rbp + 0xb]
cmp ecx, 0xa000000c
jne 0x14000924c
lea eax, [rbx - 0x79]
jmp 0x14000928c
cmp ecx, 0xa0000003
jne 0x14000925b
mov eax, 0xa
jmp 0x14000928c
movzx eax, al
and eax, 0x10
or eax, 0x20
shr eax, 4
jmp 0x14000928c
mov dword [rbp - 0x45], 0xffff
sub eax, 2
je 0x140009287
sub eax, 1
je 0x140009287
sub eax, 0x32
je 0x140009287
cmp eax, 0x46
mov eax, r12d
jne 0x14000928c
mov eax, 1
mov dword [rbp - 0x49], edx
mov qword [rbp - 0x41], r13
movaps xmm0, xmmword [rbp - 0x49]
movdqa xmmword [rbp - 0x49], xmm0
test eax, eax
je 0x140009326
cmp eax, 1
je 0x14000932e
cmp dword [rsi], 0
je 0x140009321
mov rdi, qword [rbp - 0x19]
lea rbx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0xf
cmova rbx, qword [rbp - 0x29]
call fcn.14000f5c4
mov qword [rbp - 0x49], rbx
mov qword [rbp - 0x41], rdi
lea r8, [rbp - 0x49]
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.140008090
nop
mov ebx, 0xc7f
mov dword [rsp + 0x48], ebx
lea rcx, [rsp + 0x50]
cmp qword [rbp - 0x71], 7
cmova rcx, qword [rsp + 0x50]
mov r9d, 0xffffffff
mov r8d, 9
lea rdx, [rbp - 9]
call fcn.14000f89c
test eax, eax
jne 0x1400096fe
movsxd rax, dword [rsi]
cmp rax, qword [rbp - 1]
jne 0x14000932e
xor dil, dil
jmp 0x140009331
test edx, edx
jne 0x1400096d2
mov dil, 1
test bl, 2
je 0x140009390
and ebx, 0xfffffffd
mov rdx, qword [rbp - 0x71]
cmp rdx, 7
jbe 0x14000937d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009378
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009378
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010118
movdqa xmm0, xmmword [0x140019ba0]
movdqu xmmword [rbp - 0x79], xmm0
mov word [rsp + 0x50], r12w
test bl, 1
je 0x1400093da
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x1400093da
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400093d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400093d5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010118
test dil, dil
je 0x14000966d
mov r8, r15
lea rdx, str.powershell__Command__Invoke_WebRequest__Uri_
lea rcx, [rbp - 9]
call fcn.14000c3e0
nop
mov r8d, 0xc
lea rdx, str.__OutFile_
mov rcx, rax
call fcn.14000c1f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x38], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0xf
cmova rdx, qword [rbp - 0x29]
mov r8, qword [rbp - 0x19]
lea rcx, [rsp + 0x28]
call fcn.14000c1f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x79], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x79], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r12
mov byte [rax], 0
mov r8d, 2
lea rdx, [0x1400149d8]
lea rcx, [rsp + 0x50]
call fcn.14000c1f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x39], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x49], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x39], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0xf
cmova rcx, qword [rbp - 0x49]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ebx, eax
mov rdx, qword [rbp - 0x31]
cmp rdx, 0xf
jbe 0x140009520
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000951b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000951b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010118
movdqa xmm0, xmmword [0x140019bb0]
movdqu xmmword [rbp - 0x39], xmm0
mov byte [rbp - 0x49], 0
mov rdx, qword [rbp - 0x71]
cmp rdx, 0xf
jbe 0x140009570
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000956b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000956b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010118
movdqa xmm0, xmmword [0x140019bb0]
movdqu xmmword [rbp - 0x79], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x1400095c2
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400095bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400095bd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010118
movdqa xmm0, xmmword [0x140019bb0]
movdqu xmmword [rsp + 0x38], xmm0
mov byte [rsp + 0x28], 0
mov rdx, qword [rbp + 0xf]
cmp rdx, 0xf
jbe 0x140009613
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000960e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000960e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010118
lea rdx, str.e_1_34m
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c540
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0xf
cmova rdx, qword [rbp - 0x29]
mov r8, qword [rbp - 0x19]
mov rcx, rax
call fcn.14000db80
lea rcx, str.e_1_32m____indirildi.e_0m
lea rdx, str.e_1_31m____indirilemedi.e_0m
test ebx, ebx
cmove rdx, rcx
mov rcx, rax
call fcn.14000c540
lea rdx, [0x14000c710]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x1400096ab
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400096a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400096a6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010118
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14000fcc0
mov rbx, qword [rsp + 0x150]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [rsp + 0x28]
lea rdx, [rbp - 0x49]
lea rcx, str.exists
call fcn.140008c90
nop
lea r8, [rsp + 0x28]
lea rdx, [rbp - 0x49]
lea rcx, str.create_directories
call fcn.140008c90
nop
lea r8, [rsp + 0x50]
mov edx, eax
lea rcx, str.file_size
call fcn.140008c20
int3