Function at 0x1401de630
Capabilities:
Create process on windows
Set console window title

Disassembly:
mov r11, rsp
push rbp
push rbx
push r15
lea rbp, [r11 - 0x448]
sub rsp, 0x530
mov rax, qword [0x14041f010]
xor rax, rsp
mov qword [rbp + 0x400], rax
mov eax, dword [0x14045b990]
mov r8, rcx
mov qword [r11 + 0x18], rsi
xor r15d, r15d
mov qword [r11 - 0x20], rdi
mov rsi, rcx
mov edi, edx
mov dword [rsp + 0x54], edx
lea rdx, str.executing_shell_command:__s
mov qword [r11 - 0x38], r14
xor ecx, ecx
mov dword [rsp + 0x5c], eax
call fcn.1401522a0
mov edx, 0x1fc
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
lea r14, [r15 - 1]
test eax, eax
je 0x1401de78c
test rsi, rsi
jne 0x1401de6d8
lea rcx, [rbp]
sub rcx, 2
cmp word [rcx + 2], r15w
lea rcx, [rcx + 2]
jne 0x1401de6b1
movsd xmm0, qword [str._:sh]
movzx eax, word [0x1403c9250]
movsd qword [rcx], xmm0
mov word [rcx + 8], ax
jmp 0x1401de78c
xor edx, edx
mov rcx, rsi
call fcn.140321bb0
mov rbx, rax
test rax, rax
je 0x1401de78c
lea rcx, [rbp]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], r15w
lea rcx, [rcx + 2]
jne 0x1401de700
movzx eax, word [0x1403c9260]
movsd xmm0, qword [0x1403c9258]
movsd qword [rcx], xmm0
mov word [rcx + 8], ax
mov rax, r14
inc rax
cmp word [rbx + rax*2], r15w
jne 0x1401de725
lea rdx, [rbp]
mov rcx, r14
inc rcx
cmp word [rdx + rcx*2], r15w
jne 0x1401de736
add rax, rcx
cmp rax, 0x200
jae 0x1401de771
lea rcx, [rbp]
sub rcx, 2
cmp word [rcx + 2], r15w
lea rcx, [rcx + 2]
jne 0x1401de753
xor edx, edx
movzx eax, word [rbx + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1401de760
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
cmp dword [0x14045b3f8], r15d
jne 0x1401de78c
mov rcx, rbx
call fcn.140005660
call fcn.1402ac330
mov edx, 1
lea ecx, [rdx + 1]
call fcn.14001aab8
mov edx, 1
lea ecx, [rdx + 0x14]
call fcn.14001aab8
mov edx, 1
lea ecx, [rdx + 3]
call fcn.14001aab8
mov edx, 1
lea ecx, [rdx + 7]
call fcn.14001aab8
mov edx, 1
lea ecx, [rdx + 0xa]
call fcn.14001aab8
mov edx, 1
lea ecx, [rdx + 0xe]
call fcn.14001aab8
mov edx, 1
lea ecx, [rdx + 0x15]
call fcn.14001aab8
test dil, 4
je 0x1401de7f9
xor ecx, ecx
call fcn.1402ac1d0
test rsi, rsi
jne 0x1401de812
mov rcx, qword [0x140469678]
call fcn.1401d90a0
mov r15d, eax
jmp 0x1401deda0
movzx ecx, byte [rsi]
mov rax, rsi
cmp cl, 0x22
jne 0x1401de825
movzx ecx, byte [rsi + 1]
lea rax, [rsi + 1]
cmp cl, 0x28
lea rdi, [rax + 1]
mov r8d, 5
lea rdx, str.start
cmovne rdi, rax
mov rcx, rdi
call fcn.14001d5e0
test eax, eax
jne 0x1401decf7
movzx eax, byte [rdi + 5]
add rdi, 5
cmp al, 0x20
je 0x1401de861
cmp al, 9
jne 0x1401decf7
xorps xmm0, xmm0
mov qword [rsp + 0x520], r12
movups xmmword [rsp + 0x70], xmm0
mov r12d, reloc.WSOCK32.dll_recv
xor ecx, ecx
movups xmmword [rbp - 0x50], xmm0
mov dword [rsp + 0x50], r12d
movups xmmword [rbp - 0x60], xmm0
mov dword [rsp + 0x70], WSAGetLastError
mov qword [rsp + 0x78], r15
mov dword [rbp - 0x54], r15d
mov word [rbp - 0x4e], r15w
mov qword [rbp - 0x48], r15
mov qword [rsp + 0x518], r13
mov dword [rsp + 0x58], 1
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x30], rcx
movups xmmword [rbp - 0x40], xmm0
movdqa xmmword [rbp - 0x80], xmm0
cmp al, 0x20
je 0x1401de8c9
cmp al, 9
jne 0x1401de8d2
movzx eax, byte [rdi + 1]
inc rdi
jmp 0x1401de8c1
mov r8d, 4
lea rdx, str._min
mov rcx, rdi
call fcn.14001d5e0
test eax, eax
jne 0x1401de92a
movzx eax, byte [rdi + 4]
cmp al, 0x20
je 0x1401de8f7
cmp al, 9
jne 0x1401de92a
add rdi, 4
nop dword [rax + rax]
cmp al, 0x20
je 0x1401de908
cmp al, 9
jne 0x1401de911
movzx eax, byte [rdi + 1]
inc rdi
jmp 0x1401de900
mov ebx, 7
mov dword [rbp - 0x54], 1
mov dword [rsp + 0x58], ebx
mov word [rbp - 0x50], bx
jmp 0x1401de9af
mov r8d, 2
lea rdx, [0x1403c926c]
mov rcx, rdi
call fcn.14001d5e0
test eax, eax
jne 0x1401de9af
movzx eax, byte [rdi + 2]
cmp al, 0x20
je 0x1401de94f
cmp al, 9
jne 0x1401de9af
add rdi, 2
cmp al, 0x20
je 0x1401de95b
cmp al, 9
jne 0x1401de964
movzx eax, byte [rdi + 1]
inc rdi
jmp 0x1401de953
mov qword [rsp + 0x30], r15
lea rcx, str..NUL
mov r12d, 0x8000000
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov dword [rsp + 0x50], r12d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov dword [rbp - 0x54], 0x100
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
cmp rdi, rsi
jbe 0x1401de9f7
mov rax, r14
inc rax
cmp byte [rdi + rax], r15b
jne 0x1401de9b7
add rax, rdi
cmp rax, rdi
jbe 0x1401de9f7
cmp byte [rax - 1], 0x22
lea rcx, [rax - 1]
jne 0x1401de9e2
cmp byte [rsi], 0x22
jne 0x1401de9e2
mov byte [rcx], r15b
mov rax, rcx
cmp rcx, rdi
jbe 0x1401de9f7
cmp byte [rax - 1], 0x29
jne 0x1401de9f7
cmp byte [rsi], 0x28
je 0x1401de9f3
cmp byte [rsi + 1], 0x28
jne 0x1401de9f7
mov byte [rax - 1], r15b
mov r15, qword [0x140469958]
mov r13, rdi
mov rsi, rdi
mov rbx, r14
inc rbx
cmp byte [rdi + rbx], 0
jne 0x1401dea07
movzx eax, byte [rdi]
test al, al
je 0x1401dea55
cmp al, 0x5e
jne 0x1401dea3d
movzx edx, byte [rsi + 1]
mov rcx, r15
call fcn.14028abb0
test rax, rax
je 0x1401dea3d
movsxd r8, ebx
lea rdx, [rsi + 1]
dec ebx
mov rcx, rsi
call fcn.140003740
mov rcx, rsi
call qword [0x140420bf8]
movsxd rcx, eax
sub ebx, eax
add rsi, rcx
movzx eax, byte [rsi]
test al, al
jne 0x1401dea17
cmp r12d, 0x10
je 0x1401debeb
lea rcx, str.COMSPEC
call fcn.140013e0c
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1401dea7a
cmp byte [rax], 0
jne 0x1401dea86
lea rax, str.cmd.exe
mov qword [rsp + 0x60], rax
cmp byte [rdi], 0
mov esi, 1
mov rbx, rdi
je 0x1401dead9
cmp dword [0x14045b514], 0
je 0x1401deab6
mov rcx, rbx
call qword [0x140420bf8]
cmp eax, 1
jle 0x1401deab6
add esi, eax
dec eax
movsxd rcx, eax
add rbx, rcx
jmp 0x1401dead1
movzx edx, byte [rbx]
lea rcx, [0x1403b86f0]
call fcn.14028abb0
lea ecx, [rsi + 1]
test rax, rax
cmove ecx, esi
lea esi, [rcx + 1]
inc rbx
cmp byte [rbx], 0
jne 0x1401dea93
mov ecx, esi
mov edx, 1
call fcn.140032b90
mov r12, rax
test rax, rax
je 0x1401debe6
cmp byte [rdi], 0
mov rsi, rax
mov r14, rdi
je 0x1401deb65
nop dword [rax]
cmp dword [0x14045b514], 0
je 0x1401deb38
mov rcx, r14
call qword [0x140420bf8]
movsxd r15, eax
cmp r15d, 1
jle 0x1401deb38
mov r8, r15
mov rdx, r14
mov rcx, rsi
call fcn.140003740
lea eax, [r15 - 1]
add rsi, r15
movsxd rcx, eax
add r14, rcx
jmp 0x1401deb5c
movzx edx, byte [r14]
lea rcx, [0x1403b86f0]
call fcn.14028abb0
test rax, rax
je 0x1401deb53
mov byte [rsi], 0x5e
inc rsi
movzx eax, byte [r14]
mov byte [rsi], al
inc rsi
inc r14
cmp byte [r14], 0
jne 0x1401deb00
mov r14, 0xffffffffffffffff
mov byte [rsi], 0
mov rcx, r14
cmp byte [r12 + rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1401deb72
mov rsi, qword [rsp + 0x60]
mov rax, r14
nop word [rax + rax]
cmp byte [rsi + rax + 1], 0
lea rax, [rax + 1]
jne 0x1401deb90
lea rbx, [rcx + rax]
mov edx, 1
lea rcx, [rbx + 5]
call fcn.140032b90
mov r13, rax
test rax, rax
je 0x1401debd2
mov r9, rsi
mov qword [rsp + 0x20], r12
lea r8, str._s__c__s
mov rcx, rax
lea rdx, [rbx + 5]
call fcn.14028ab80
jmp 0x1401debd5
mov r13, rdi
cmp dword [0x14045b3f8], 0
jne 0x1401debe6
mov rcx, r12
call fcn.140005660
mov r12d, dword [rsp + 0x50]
xor edx, edx
mov rcx, r13
call fcn.140321bb0
xor r15d, r15d
mov rbx, rax
test rax, rax
je 0x1401dec4f
lea rax, [rbp - 0x20]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x70]
mov rdx, rbx
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
cmp dword [0x14045b3f8], r15d
jne 0x1401dec4b
mov rcx, rbx
call fcn.140005660
test esi, esi
jne 0x1401dec9b
xor edx, edx
mov rcx, r13
call fcn.140321bb0
mov rbx, rax
test rax, rax
je 0x1401dec98
mov eax, dword [rsp + 0x58]
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x20], r15
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [0x14045b3f8], 0
mov rsi, rax
jne 0x1401dec92
mov rcx, rbx
call fcn.140005660
cmp rsi, 0x20
ja 0x1401dec9b
mov r15d, r14d
mov r12, qword [rsp + 0x520]
cmp r13, rdi
je 0x1401decbe
test r13, r13
je 0x1401decbe
cmp dword [0x14045b3f8], 0
jne 0x1401decbe
mov rcx, r13
call fcn.140005660
cmp dword [rbp - 0x54], 0x100
mov r13, qword [rsp + 0x518]
jne 0x1401decde
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x1401decde
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401ded9c
mov rax, r14
nop word [rax + rax]
inc rax
cmp byte [rsi + rax], r15b
jne 0x1401ded00
mov rdx, qword [0x140469668]
mov rcx, r14
inc rcx
cmp byte [rdx + rcx], r15b
jne 0x1401ded13
add rax, rcx
mov rcx, qword [0x140469678]
nop word [rax + rax]
cmp byte [rcx + r14 + 1], r15b
lea r14, [r14 + 1]
jne 0x1401ded30
lea rdi, [rax + r14]
mov edx, 1
lea rcx, [rdi + 0xa]
call fcn.140032b90
mov rbx, rax
test rax, rax
je 0x1401ded9c
mov rcx, qword [0x140469668]
lea r8, str._s__s__s
mov r9, qword [0x140469678]
lea rdx, [rdi + 0xa]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14028ab80
mov rcx, rbx
call fcn.1401d90a0
cmp dword [0x14045b3f8], 0
mov r15d, eax
jne 0x1401ded9c
mov rcx, rbx
call fcn.140005660
mov edi, dword [rsp + 0x54]
cmp dword [rsp + 0x5c], 2
mov r14, qword [rsp + 0x510]
mov rsi, qword [rsp + 0x560]
jne 0x1401dee35
mov eax, dword [0x14045b974]
mov dword [0x14045b990], 3
test eax, eax
je 0x1401dee35
mov eax, dword [0x14045b990]
cmp eax, 2
je 0x1401dee35
cmp dword [0x14045b780], 0
je 0x1401dee12
cmp eax, 1
je 0x1401dee12
cmp dword [0x14045b6b4], 0
jne 0x1401dedf7
mov dword [0x14045b6b4], 1
call fcn.1402ab410
mov rcx, qword [0x1404688d8]
call fcn.1402ab4a0
mov dword [0x140465000], 1
call fcn.1402ac330
mov ecx, 2
call fcn.1401df350
mov dword [0x14045b990], 2
call fcn.140193ce0
call fcn.1402ac330
test r15d, r15d
je 0x1401dee6b
test dil, 0x10
jne 0x1401dee6b
cmp dword [0x14045b404], 0
jne 0x1401dee6b
lea rcx, str.shell_returned__d
call qword [case.0x1400407ae.0]
mov rcx, rax
mov edx, r15d
call fcn.140185f40
xor edx, edx
lea ecx, [rdx + 0xa]
call fcn.140184470
mov rcx, qword [0x14045e9b0]
mov rdi, qword [rsp + 0x528]
test rcx, rcx
je 0x1401deea8
xor edx, edx
call fcn.140321bb0
mov rbx, rax
test rax, rax
je 0x1401deea8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
cmp dword [0x14045b3f8], 0
jne 0x1401deea8
mov rcx, rbx
call fcn.140005660
xor edx, edx
lea ecx, [rdx + 2]
call fcn.14001aab8
xor edx, edx
lea ecx, [rdx + 0x15]
call fcn.14001aab8
xor edx, edx
lea ecx, [rdx + 4]
call fcn.14001aab8
xor edx, edx
lea ecx, [rdx + 8]
call fcn.14001aab8
xor edx, edx
lea ecx, [rdx + 0xb]
call fcn.14001aab8
xor edx, edx
lea ecx, [rdx + 0xf]
call fcn.14001aab8
xor edx, edx
lea ecx, [rdx + 0x16]
call fcn.14001aab8
mov eax, r15d
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.140001200
add rsp, 0x530
pop r15
pop rbx
pop rbp
ret