Function at 0x14006ac04
Capabilities:
Create process on windows
Execute command

Disassembly:
push rbp
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp + 0x20], rcx
mov dword [rbp + 0x28], edx
mov rax, qword [0x1401c3e50]
mov eax, dword [rax]
test eax, eax
jne 0x14006b537
mov eax, dword [0x1402126e0]
mov dword [0x1407503d8], eax
mov eax, dword [0x1407503d8]
test eax, eax
je 0x14006ac5f
mov dword [0x1401765b0], 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, dword [0x1402126e0]
test eax, eax
jne 0x14006ac47
mov dword [0x14075040c], 0
mov rax, qword [0x1401c3bc0]
mov eax, dword [rax]
test eax, eax
je 0x14006ac8a
mov eax, dword [0x14017631c]
test eax, eax
je 0x14006ac8a
mov dword [0x14075040c], 1
mov rax, qword [0x1407503e0]
test rax, rax
jne 0x14006acac
mov edx, 0
mov ecx, 0
call fcn.1400437be
mov qword [0x1407503e0], rax
mov rax, qword [0x1407503e8]
test rax, rax
jne 0x14006acce
mov edx, 0
mov ecx, 0
call fcn.1400437be
mov qword [0x1407503e8], rax
mov rax, qword [0x1407503f0]
test rax, rax
jne 0x14006acf0
mov edx, 0
mov ecx, 0
call fcn.1400437be
mov qword [0x1407503f0], rax
mov rax, qword [0x1407503f8]
test rax, rax
jne 0x14006ad12
mov edx, 0
mov ecx, 0
call fcn.1400437be
mov qword [0x1407503f8], rax
mov rax, qword [0x140750400]
test rax, rax
jne 0x14006ad34
mov edx, 0
mov ecx, 0
call fcn.1400437be
mov qword [0x140750400], rax
cmp dword [rbp + 0x28], 0
je 0x14006ad4c
mov rax, qword [rbp + 0x20]
mov eax, dword [rax + 8]
test eax, eax
jne 0x14006ad4c
mov dword [rbp + 0x28], 0
cmp dword [rbp + 0x28], 0
je 0x14006b486
mov eax, dword [0x14075040c]
test eax, eax
je 0x14006adc0
mov edx, 1
lea rax, [0x1401a3c64]
mov rcx, rax
call fcn.140043595
mov rdx, rax
mov rax, qword [rbp + 0x20]
mov rcx, rax
call fcn.1400442e7
mov rdx, rax
mov rax, qword [0x1407503e0]
mov rcx, rax
call fcn.14004398c
mov dword [0x14073cf7c], 1
mov rax, qword [0x1407503e0]
mov rax, qword [rax]
mov rcx, rax
call sub.msvcrt.dll_system
mov dword [0x14073cf7c], 0
jmp 0x14006b507
call fcn.140068f8f
test eax, eax
setne al
test al, al
je 0x14006b31b
mov rax, qword [0x1407503e8]
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call fcn.14004398c
lea rax, [0x140189bce]
mov rcx, rax
call fcn.1400434d7
mov rdx, rax
mov rax, qword [0x1407503f8]
mov rcx, rax
call fcn.14004398c
mov rax, qword [0x1407503e8]
mov eax, dword [rax + 8]
test eax, eax
je 0x14006b4fa
mov rax, qword [0x1407503e8]
mov rcx, rax
call fcn.1400690ab
test eax, eax
sete al
test al, al
je 0x14006af20
mov edx, 1
lea rax, [0x1401a3c64]
mov rcx, rax
call fcn.140043595
mov rdx, rax
mov rax, qword [0x1407503e8]
mov rcx, rax
call fcn.1400442e7
mov rdx, rax
mov rax, qword [0x1407503f0]
mov rcx, rax
call fcn.14004398c
mov r8d, 0x70
mov edx, 0
lea rax, [0x1407504c0]
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [0x1407504c0], 0x70
mov rax, qword [0x1407503f0]
mov rax, qword [rax]
mov qword [0x1407504d8], rax
mov qword [0x1407504e0], 0
mov dword [0x1407504c4], 0x440
mov dword [0x1407504f0], 5
lea rax, [0x1407504c0]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
call rax
test eax, eax
setne al
test al, al
je 0x14006af20
mov dword [0x14073cf7c], 1
mov rax, qword [0x140750528]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [0x140750528]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov dword [0x14073cf7c], 0
jmp 0x14006b507
mov dword [0x140750530], 0
mov dword [0x140750534], 0
jmp 0x14006b009
mov rax, qword [0x1407503e8]
mov rdx, qword [rax]
mov eax, dword [0x140750530]
cdqe
add rax, rdx
movzx eax, byte [rax]
cmp al, 0x22
jne 0x14006af75
mov eax, dword [0x140750534]
test eax, eax
jne 0x14006af6b
mov dword [0x140750534], 1
jmp 0x14006af75
mov dword [0x140750534], 0
mov rax, qword [0x1407503e8]
mov rdx, qword [rax]
mov eax, dword [0x140750530]
cdqe
add rax, rdx
movzx eax, byte [rax]
cmp al, 0x20
jne 0x14006affa
mov eax, dword [0x140750534]
test eax, eax
jne 0x14006affa
mov rax, qword [0x1407503e8]
mov edx, dword [rax + 8]
mov eax, dword [0x140750530]
sub edx, eax
sub edx, 1
mov rax, qword [0x1407503e8]
mov rcx, rax
call fcn.1400447a1
mov rdx, rax
mov rax, qword [0x1407503f8]
mov rcx, rax
call fcn.14004398c
mov edx, dword [0x140750530]
mov rax, qword [0x1407503e8]
mov rcx, rax
call fcn.1400446c0
mov rdx, rax
mov rax, qword [0x1407503e8]
mov rcx, rax
call fcn.14004398c
jmp 0x14006b022
mov eax, dword [0x140750530]
add eax, 1
mov dword [0x140750530], eax
mov rax, qword [0x1407503e8]
mov edx, dword [rax + 8]
mov eax, dword [0x140750530]
cmp edx, eax
jg 0x14006af39
nop
mov rax, qword [0x1407503e8]
mov eax, dword [rax + 8]
test eax, eax
je 0x14006b4fd
mov rax, qword [0x1407503f8]
mov eax, dword [rax + 8]
test eax, eax
je 0x14006b18c
mov rax, qword [0x1407503e8]
mov rcx, rax
call fcn.1400690ab
test eax, eax
sete al
test al, al
je 0x14006b18c
mov edx, 1
lea rax, [0x1401a3c64]
mov rcx, rax
call fcn.140043595
mov rdx, rax
mov rax, qword [0x1407503e8]
mov rcx, rax
call fcn.1400442e7
mov rdx, rax
mov rax, qword [0x1407503f0]
mov rcx, rax
call fcn.14004398c
mov edx, 1
lea rax, [0x1401a3c64]
mov rcx, rax
call fcn.140043595
mov rdx, rax
mov rax, qword [0x1407503f8]
mov rcx, rax
call fcn.1400442e7
mov rdx, rax
mov rax, qword [0x140750400]
mov rcx, rax
call fcn.14004398c
mov r8d, 0x70
mov edx, 0
lea rax, [0x1407504c0]
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [0x1407504c0], 0x70
mov rax, qword [0x1407503f0]
mov rax, qword [rax]
mov qword [0x1407504d8], rax
mov rax, qword [0x140750400]
mov rax, qword [rax]
mov qword [0x1407504e0], rax
mov dword [0x1407504c4], 0x440
mov dword [0x1407504f0], 5
lea rax, [0x1407504c0]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
call rax
test eax, eax
setne al
test al, al
je 0x14006b18c
mov dword [0x14073cf7c], 1
mov rax, qword [0x140750528]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [0x140750528]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov dword [0x14073cf7c], 0
jmp 0x14006b507
mov rax, qword [0x1407503f8]
mov eax, dword [rax + 8]
test eax, eax
je 0x14006b1cd
mov rbx, qword [0x1407503f8]
lea rax, [0x1401a3f66]
mov rcx, rax
call fcn.1400434d7
mov rdx, rbx
mov rcx, rax
call fcn.1400442e7
mov rdx, rax
mov rax, qword [0x1407503f8]
mov rcx, rax
call fcn.14004398c
mov rdx, qword [0x1407503f8]
mov rax, qword [0x1407503e8]
mov rcx, rax
call fcn.1400442e7
mov rdx, rax
mov rax, qword [0x1407503e0]
mov rcx, rax
call fcn.14004398c
mov rbx, qword [0x1407503e0]
lea rax, [0x1401a4319]
mov rcx, rax
call fcn.1400434d7
mov rdx, rbx
mov rcx, rax
call fcn.1400442e7
mov rdx, rax
mov rax, qword [0x1407503e0]
mov rcx, rax
call fcn.14004398c
mov edx, 1
lea rax, [0x1401a3c64]
mov rcx, rax
call fcn.140043595
mov rdx, rax
mov rax, qword [0x1407503e0]
mov rcx, rax
call fcn.1400442e7
mov rdx, rax
mov rax, qword [0x1407503e0]
mov rcx, rax
call fcn.14004398c
mov r8d, 0x70
mov edx, 0
lea rax, [0x1407504c0]
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [0x1407504c0], 0x70
lea rax, [0x1401767c0]
mov qword [0x1407504d8], rax
mov rax, qword [0x1407503e0]
mov rax, qword [rax]
mov qword [0x1407504e0], rax
mov dword [0x1407504c4], 0x440
mov dword [0x1407504f0], 5
lea rax, [0x1407504c0]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
call rax
test eax, eax
setne al
test al, al
je 0x14006b500
mov dword [0x14073cf7c], 1
mov rax, qword [0x140750528]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [0x140750528]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov dword [0x14073cf7c], 0
jmp 0x14006b507
lea rax, str.command.com__c
mov rcx, rax
call fcn.1400434d7
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov rdx, rax
call fcn.1400442e7
mov rdx, rax
mov rax, qword [0x1407503e0]
mov rcx, rax
call fcn.14004398c
mov edx, 1
lea rax, [0x1401a3c64]
mov rcx, rax
call fcn.140043595
mov rdx, rax
mov rax, qword [0x1407503e0]
mov rcx, rax
call fcn.1400442e7
mov rdx, rax
mov rax, qword [0x1407503e0]
mov rcx, rax
call fcn.14004398c
mov r8d, 0x68
mov edx, 0
lea rax, [0x140750420]
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [0x140750420], 0x68
mov r8d, 0x18
mov edx, 0
lea rax, [0x140750490]
mov rcx, rax
call sub.msvcrt.dll_memset
mov rax, qword [0x1407503e0]
mov rax, qword [rax]
lea rdx, [0x140750490]
mov qword [rsp + 0x48], rdx
lea rdx, [0x140750420]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
setne al
test al, al
je 0x14006b503
mov dword [0x14073cf7c], 1
mov rax, qword [0x140750490]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [0x140750490]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [0x140750498]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov dword [0x14073cf7c], 0
jmp 0x14006b507
mov eax, dword [0x14075040c]
test eax, eax
jne 0x14006b499
mov rax, qword [sym.imp.KERNEL32.dll_AllocConsole]
call rax
mov edx, 4
lea rax, [0x1401a432e]
mov rcx, rax
call fcn.140043595
mov rdx, rax
mov rax, qword [0x1407503e0]
mov rcx, rax
call fcn.14004398c
mov dword [0x14073cf7c], 1
mov rax, qword [0x1407503e0]
mov rax, qword [rax]
mov rcx, rax
call sub.msvcrt.dll_system
mov dword [0x14073cf7c], 0
mov eax, dword [0x14075040c]
test eax, eax
jne 0x14006b506
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
jmp 0x14006b506
nop
jmp 0x14006b507
nop
jmp 0x14006b507
nop
jmp 0x14006b507
nop
jmp 0x14006b507
nop
mov eax, dword [0x1407503d8]
test eax, eax
je 0x14006b538
mov eax, dword [0x1407503d8]
mov dword [0x1401765b0], eax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, dword [0x1402126e0]
test eax, eax
je 0x14006b51d
jmp 0x14006b538
nop
add rsp, 0x58
pop rbx
pop rbp
ret