Function at 0x1401a2000
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1402fa010]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
movzx eax, r8w
mov dword [rcx + 0x40], eax
cmp eax, 0x8254
jne 0x1401a20fc
xor ebx, ebx
mov qword [rbp - 0x30], rbx
call fcn.1400195b0
mov rcx, rax
test rax, rax
je 0x1401a23c7
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
add rax, 0x18
mov qword [rbp - 0x30], rax
lea r14, str._Command___get_appxpackage_Bandisoft.com.15700C60EE320___Remove_AppxPackage_
mov rdx, r14
lea rcx, [rbp - 0x30]
call fcn.140018bd0
lea rdi, [rbx - 1]
test al, al
jne 0x1401a209d
mov r8, rdi
inc r8
cmp word [r14 + r8*2], 0
jne 0x1401a2085
mov rdx, r14
lea rcx, [rbp - 0x30]
call fcn.140018f70
nop
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov rbx, qword [rbp - 0x30]
mov r9, rbx
lea r8, str.powershell
lea rdx, [0x140265d30]
mov rcx, qword [rsi + 8]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, 1
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_EndDialog]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1401a2396
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
jmp 0x1401a2396
mov ecx, 0x8255
cmp ax, cx
jne 0x1401a232b
xor ebx, ebx
mov qword [rbp - 0x18], rbx
lea rcx, [rbp - 0x18]
call fcn.1401a0c60
nop
mov qword [rbp - 0x20], rbx
lea rax, [rbp - 0x30]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x50]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x38], rax
call fcn.1400195b0
mov rcx, rax
test rax, rax
je 0x1401a23d2
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
add rax, 0x18
mov qword [rbp - 0x30], rax
lea r14, [0x1402624f4]
mov rdx, r14
lea rcx, [rbp - 0x30]
call fcn.140018bd0
lea rdi, [rbx - 1]
test al, al
jne 0x1401a2198
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [r14 + r8*2], 0
jne 0x1401a2180
mov rdx, r14
lea rcx, [rbp - 0x30]
call fcn.140018f70
nop
call fcn.1400195b0
mov rcx, rax
test rax, rax
je 0x1401a23dd
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
add rax, 0x18
mov qword [rbp - 0x50], rax
lea r14, str.Uninstall.exe
mov rdx, r14
lea rcx, [rbp - 0x50]
call fcn.140018bd0
test al, al
jne 0x1401a21f8
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp word [r14 + r8*2], 0
jne 0x1401a21e0
mov rdx, r14
lea rcx, [rbp - 0x50]
call fcn.140018f70
nop
mov rcx, qword [rbp - 0x18]
add rcx, 0xffffffffffffffe8
call fcn.1400191a0
add rax, 0x18
mov qword [rbp - 0x48], rax
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x20]
call fcn.140025220
nop
mov qword [rbp - 0x28], rbx
call fcn.1400195b0
mov rcx, rax
test rax, rax
je 0x1401a23bc
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
add rax, 0x18
mov qword [rbp - 0x28], rax
lea r14, [0x1402aba9c]
mov rdx, r14
lea rcx, [rbp - 0x28]
call fcn.140018bd0
test al, al
jne 0x1401a2288
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [r14 + r8*2], 0
jne 0x1401a2270
mov rdx, r14
lea rcx, [rbp - 0x28]
call fcn.140018f70
nop
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rbx
mov rbx, qword [rbp - 0x28]
mov r9, rbx
mov r8, qword [rbp - 0x20]
lea rdx, [0x140265d30]
mov rcx, qword [rsi + 8]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, 1
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_EndDialog]
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401a22e2
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401a2307
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1401a2396
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
jmp 0x1401a2396
mov ecx, 0x8257
cmp ax, cx
jne 0x1401a235f
mov dword [rsp + 0x28], 1
xor ebx, ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str.https:__www.bandisoft.com_bandizip_help_ms_store_app_
lea rdx, [0x140265d30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1401a2396
mov ecx, 0x8259
cmp ax, cx
jne 0x1401a2396
call fcn.140163500
mov dword [rax + 0x69c], 1
call fcn.140163500
mov rcx, rax
xor edx, edx
call fcn.14016a570
mov edx, 1
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1401f3bf0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140019320
nop
mov ecx, 0x80004005
call fcn.140019320
nop
mov ecx, 0x80004005
call fcn.140019320
nop
mov ecx, 0x80004005
call fcn.140019320
int3