Function at 0x140007be0
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov r14, rcx
mov rax, qword [0x140093e08]
xor rax, rsp
mov qword [rsp + 0xb8], rax
lea rcx, str.echo_:k____tmp_Kill.bat
call fcn.14003e2a8
lea rdx, str.echo_if_exist
lea rbx, [rsp + 0x38]
mov rcx, rbx
mov r8, r14
call fcn.14000b350
lea r8, str.__del__f__q
lea rsi, [rsp + 0x58]
mov rcx, rsi
mov rdx, rbx
call fcn.140008040
lea r15, [rsp + 0x78]
mov rcx, r15
mov rdx, rsi
mov r8, r14
call fcn.140009ee0
lea r8, str.__else_exit______tmp_Kill.bat
lea rdi, [rsp + 0x98]
mov rcx, rdi
mov rdx, r15
call fcn.140008040
mov rcx, r15
call fcn.140001fc0
mov rcx, rsi
call fcn.140001fc0
mov rcx, rbx
call fcn.140001fc0
mov qword [rsp + 0x38], rdi
mov rsi, qword [rsp + 0x38]
mov ecx, dword [0x140094d2c]
mov edx, dword [0x140094d30]
lea ebx, [rcx - 1]
imul ebx, ecx
mov ecx, ebx
xor ecx, 0xfffffffe
test ecx, ebx
setne cl
sete bl
cmp edx, 9
setg al
cmp edx, 0xa
setl dl
xor dl, bl
or al, cl
xor al, 1
or al, dl
mov edi, 0x8336cd56
mov eax, 0x88f20d79
cmove edi, eax
mov qword [rsp + 0x58], rsi
mov edx, 0x2a190b9b
cmove edx, eax
cmp qword [rsp + 0xb0], 0xf
mov eax, 0xba1333b4
mov ebx, 0xb27da599
cmova ebx, eax
mov eax, 0x3507d79e
nop word cs:[rax + rax]
nop
cmp eax, 0xba1333b3
jg 0x140007d20
cmp eax, 0x8336cd56
je 0x140007d3e
cmp eax, 0x88f20d79
je 0x140007d4a
cmp eax, 0xb27da599
jne 0x140007d00
jmp 0x140007d6b
cmp eax, 0xba1333b4
je 0x140007d56
cmp eax, 0x2a190b9b
je 0x140007d5a
cmp eax, 0x3507d79e
jne 0x140007d00
mov rcx, qword [rsp + 0x58]
mov eax, ebx
jmp 0x140007d00
mov rcx, qword [rsp + 0x78]
mov eax, 0xb27da599
jmp 0x140007d00
mov rax, qword [rsp + 0x38]
mov eax, 0x2a190b9b
jmp 0x140007d00
mov eax, edx
jmp 0x140007d00
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x78], rax
mov eax, edi
jmp 0x140007d00
call fcn.14003e2a8
lea rcx, str.echo_timeout__t_1______tmp_Kill.bat
call fcn.14003e2a8
lea rcx, str.echo_goto_k______tmp_Kill.bat
call fcn.14003e2a8
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14005f11d]
call fcn.14003ae10
mov rcx, r15
mov rdx, rax
call fcn.140001b60
lea rdx, [0x14005f07f]
mov r8d, 9
mov rcx, r15
call fcn.140022680
mov qword [rsp + 0x30], r15
mov rdi, qword [rsp + 0x30]
mov ecx, dword [0x140094d2c]
mov edx, dword [0x140094d30]
lea ebx, [rcx - 1]
imul ebx, ecx
not ebx
or ebx, 0xfffffffe
cmp ebx, 0xffffffff
setne cl
sete bl
cmp edx, 9
setg al
cmp edx, 0xa
setl dl
xor dl, bl
or al, cl
xor al, 1
or al, dl
mov ebx, 0x8336cd56
mov eax, 0x88f20d79
cmove ebx, eax
mov qword [rsp + 0x38], rdi
mov ecx, 0x2a190b9b
cmove ecx, eax
cmp qword [rsp + 0x90], 0xf
mov eax, 0xba1333b4
mov edx, 0xb27da599
cmova edx, eax
mov eax, 0x3507d79e
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0xba1333b3
jg 0x140007e60
cmp eax, 0x8336cd56
je 0x140007e7e
cmp eax, 0x88f20d79
je 0x140007e8a
cmp eax, 0xb27da599
jne 0x140007e40
jmp 0x140007eab
cmp eax, 0xba1333b4
je 0x140007e96
cmp eax, 0x2a190b9b
je 0x140007e9a
cmp eax, 0x3507d79e
jne 0x140007e40
mov r8, qword [rsp + 0x38]
mov eax, edx
jmp 0x140007e40
mov r8, qword [rsp + 0x58]
mov eax, 0xb27da599
jmp 0x140007e40
mov rax, qword [rsp + 0x30]
mov eax, 0x2a190b9b
jmp 0x140007e40
mov eax, ecx
jmp 0x140007e40
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov eax, ebx
jmp 0x140007e40
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rdx, str.open
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, [rsp + 0x78]
call fcn.140001fc0
lea rcx, [rsp + 0x98]
call fcn.140001fc0
mov rcx, r14
call fcn.140001fc0
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1400317a0
mov al, 1
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret