Function at 0x18032f4a0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x18054e100]
xor rax, rsp
mov qword [rbp + 0x58], rax
xor r12d, r12d
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], 1
mov r13d, 0xf
mov qword [rbp - 0x10], r13
movzx eax, word [0x180460e04]
mov byte [rbp - 0x28], al
mov byte [rbp - 0x27], r12b
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], 1
mov qword [rbp + 0x10], r13
movzx eax, word [0x1804a69cc]
mov byte [rbp - 8], al
mov byte [rbp - 7], r12b
lea rcx, [rbp + 0x38]
call fcn.1803006b0
nop
lea rdx, [rbp - 0x28]
lea r8d, [r12 + 1]
mov rcx, rax
call fcn.18006a3c0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rbp + 0x18], xmm0
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r13
mov byte [rax], r12b
lea rcx, [rbp + 0x38]
call fcn.18006b8d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], r13
lea ecx, [r12 + 0x20]
call fcn.180357684
mov rdx, rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x78], 0x1b
mov qword [rbp - 0x70], 0x1f
movups xmm0, xmmword [str.c:windows_system32cmd.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x180503968]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x180503970]
mov word [rax + 0x18], cx
movzx eax, byte [0x180503972]
mov byte [rdx + 0x1a], al
mov byte [rdx + 0x1b], r12b
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r13
lea ecx, [r12 + 0x50]
call fcn.180357684
mov rcx, rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], 0x4e
mov qword [rsp + 0x70], 0x4f
movaps xmm0, xmmword [str._cmd__c_powershell_Set_ExecutionPolicy__Scope_CurrentUser_Unrestricted__exit]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x180503c90]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x180503ca0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x180503cb0]
movups xmmword [rax + 0x30], xmm1
movsd xmm0, qword [0x180503cc0]
movsd qword [rax + 0x40], xmm0
mov eax, dword [0x180503cc8]
mov dword [rcx + 0x48], eax
movzx eax, word [0x180503ccc]
mov word [rcx + 0x4c], ax
mov byte [rcx + 0x4e], r12b
mov esi, dword [rbp - 0x78]
lea r8, [rsp + 0x78]
cmp qword [rbp - 0x70], r13
cmova r8, qword [rsp + 0x78]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9d, [rsi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov eax, 2
mul rdi
mov rbx, 0xffffffffffffffff
cmovo rax, rbx
mov rcx, rax
call fcn.180357d9c
mov r14, rax
lea r8, [rsp + 0x78]
cmp qword [rbp - 0x70], r13
cmova r8, qword [rsp + 0x78]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r12
mov r8, rbx
nop dword [rax]
inc r8
cmp word [r14 + r8*2], 0
jne 0x18032f6d0
mov rdx, r14
lea rcx, [rbp - 0x48]
call fcn.18008a510
mov rcx, r14
call fcn.180357650
nop
lea r15, [rbp - 0x48]
cmp qword [rbp - 0x30], 7
cmova r15, qword [rbp - 0x48]
mov esi, dword [rsp + 0x68]
lea r8, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova r8, qword [rsp + 0x58]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9d, [rsi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov eax, 2
mul rdi
cmovo rax, rbx
mov rcx, rax
call fcn.180357d9c
mov r14, rax
lea r8, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova r8, qword [rsp + 0x58]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], r12
nop dword [rax]
inc rbx
cmp word [r14 + rbx*2], 0
jne 0x18032f780
mov r8, rbx
mov rdx, r14
lea rcx, [rbp - 0x68]
call fcn.18008a510
mov rcx, r14
call fcn.180357650
lea r9, [rbp - 0x68]
cmp qword [rbp - 0x50], 7
cmova r9, qword [rbp - 0x68]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r8, r15
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x18032f80c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18032f807
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18032f9b7
call fcn.180357650
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r12w
mov rdx, qword [rbp - 0x30]
cmp rdx, 7
jbe 0x18032f85d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18032f858
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18032f9bd
call fcn.180357650
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], r12w
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x18032f8ab
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18032f8a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18032f9c3
call fcn.180357650
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r13
mov byte [rsp + 0x58], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x18032f8f6
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18032f8f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18032f9c9
call fcn.180357650
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], r13
mov byte [rsp + 0x78], 0
movups xmm0, xmmword [rsp + 0x38]
psrldq xmm0, 8
movq rdx, xmm0
cmp rdx, 0xf
jbe 0x18032f94b
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18032f945
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18032f9cf
call fcn.180357650
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x18032f982
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18032f97d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18032f9b1
call fcn.180357650
xor eax, eax
mov rcx, qword [rbp + 0x58]
xor rcx, rsp
call fcn.180357630
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18035e820
nop
call fcn.18035e820
nop
call fcn.18035e820
nop
call fcn.18035e820
nop
call fcn.18035e820
nop
call fcn.18035e820
int3