Function at 0x1401a56e0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140300040]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
movzx eax, r8w
mov dword [rcx + 0x40], eax
cmp eax, 0x8254
jne 0x1401a57dc
xor ebx, ebx
mov qword [rbp - 0x30], rbx
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x1401a5aa7
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rbp - 0x30], rax
lea r14, str._Command___get_appxpackage_Bandisoft.com.15700C60EE320___Remove_AppxPackage_
mov rdx, r14
lea rcx, [rbp - 0x30]
call fcn.140018bb0
lea rdi, [rbx - 1]
test al, al
jne 0x1401a577d
mov r8, rdi
inc r8
cmp word [r14 + r8*2], 0
jne 0x1401a5765
mov rdx, r14
lea rcx, [rbp - 0x30]
call fcn.140018f50
nop
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov rbx, qword [rbp - 0x30]
mov r9, rbx
lea r8, str.powershell
lea rdx, [0x14026ad70]
mov rcx, qword [rsi + 8]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, 1
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_EndDialog]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1401a5a76
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
jmp 0x1401a5a76
mov ecx, 0x8255
cmp ax, cx
jne 0x1401a5a0b
xor ebx, ebx
mov qword [rbp - 0x18], rbx
lea rcx, [rbp - 0x18]
call fcn.1401a4340
nop
mov qword [rbp - 0x20], rbx
lea rax, [rbp - 0x30]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x50]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x38], rax
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x1401a5ab2
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rbp - 0x30], rax
lea r14, [0x140267514]
mov rdx, r14
lea rcx, [rbp - 0x30]
call fcn.140018bb0
lea rdi, [rbx - 1]
test al, al
jne 0x1401a5878
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [r14 + r8*2], 0
jne 0x1401a5860
mov rdx, r14
lea rcx, [rbp - 0x30]
call fcn.140018f50
nop
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x1401a5abd
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rbp - 0x50], rax
lea r14, str.Uninstall.exe
mov rdx, r14
lea rcx, [rbp - 0x50]
call fcn.140018bb0
test al, al
jne 0x1401a58d8
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp word [r14 + r8*2], 0
jne 0x1401a58c0
mov rdx, r14
lea rcx, [rbp - 0x50]
call fcn.140018f50
nop
mov rcx, qword [rbp - 0x18]
add rcx, 0xffffffffffffffe8
call fcn.140019180
add rax, 0x18
mov qword [rbp - 0x48], rax
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x20]
call fcn.140025320
nop
mov qword [rbp - 0x28], rbx
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x1401a5a9c
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rbp - 0x28], rax
lea r14, [0x1402b176c]
mov rdx, r14
lea rcx, [rbp - 0x28]
call fcn.140018bb0
test al, al
jne 0x1401a5968
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [r14 + r8*2], 0
jne 0x1401a5950
mov rdx, r14
lea rcx, [rbp - 0x28]
call fcn.140018f50
nop
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rbx
mov rbx, qword [rbp - 0x28]
mov r9, rbx
mov r8, qword [rbp - 0x20]
lea rdx, [0x14026ad70]
mov rcx, qword [rsi + 8]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, 1
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_EndDialog]
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401a59c2
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401a59e7
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1401a5a76
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
jmp 0x1401a5a76
mov ecx, 0x8257
cmp ax, cx
jne 0x1401a5a3f
mov dword [rsp + 0x28], 1
xor ebx, ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str.https:__www.bandisoft.com_bandizip_help_ms_store_app_
lea rdx, [0x14026ad70]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1401a5a76
mov ecx, 0x8259
cmp ax, cx
jne 0x1401a5a76
call fcn.140166630
mov dword [rax + 0x69c], 1
call fcn.140166630
mov rcx, rax
xor edx, edx
call fcn.14016d760
mov edx, 1
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1401f74b0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140019300
nop
mov ecx, 0x80004005
call fcn.140019300
nop
mov ecx, 0x80004005
call fcn.140019300
nop
mov ecx, 0x80004005
call fcn.140019300
int3