Function at 0x1400012a0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov rbx, rcx
xor r9d, r9d
cmp qword [rcx + 0x18], 0xf
jbe 0x1400012eb
mov rsi, qword [rcx]
add rsi, qword [rcx + 0x10]
mov rbx, qword [rcx]
jmp 0x1400012f2
mov rsi, qword [rcx + 0x10]
add rsi, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movabs rdx, 0x7fffffffffffffff
mov ecx, 0xa
movabs r10, 0x7ffffffffffffffe
mov qword [rbp - 0x80], r9
mov edi, 7
mov qword [rbp - 0x78], rdi
cmp rbx, rsi
jne 0x140001336
mov r15, r9
mov r14d, edi
mov word [rsp + 0x70], r9w
jmp 0x140001454
sub rsi, rbx
cmp rsi, r10
ja 0x1400016fc
mov r14, rdi
cmp rsi, rdi
jbe 0x1400013f7
mov r14, rsi
or r14, rdi
cmp r14, r10
jbe 0x140001362
mov r14, r10
lea rcx, [rdx + rdx]
jmp 0x140001382
cmp r14, rcx
cmovb r14, rcx
lea rcx, [r14 + 1]
cmp rcx, rdx
ja 0x140001702
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400013c7
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001702
mov rcx, rax
call fcn.140002290
mov rcx, rax
test rax, rax
je 0x1400016ba
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
xor r9d, r9d
movabs r10, 0x7ffffffffffffffe
mov qword [rsp + 0x70], rax
mov qword [rbp - 0x78], r14
jmp 0x1400013fc
test rcx, rcx
je 0x1400013e9
call fcn.140002290
xor r9d, r9d
movabs r10, 0x7ffffffffffffffe
mov qword [rsp + 0x70], rax
mov qword [rbp - 0x78], r14
jmp 0x1400013fc
mov rax, r9
mov qword [rsp + 0x70], rax
mov qword [rbp - 0x78], r14
jmp 0x1400013fc
mov rax, qword [rsp + 0x70]
lea r8, [rsp + 0x70]
cmp r14, rdi
cmova r8, rax
mov rcx, r8
mov rdx, rsi
test rsi, rsi
je 0x140001434
nop dword [rax]
nop word [rax + rax]
movsx eax, byte [rbx]
mov word [rcx], ax
lea rcx, [rcx + 2]
lea rbx, [rbx + 1]
sub rdx, 1
jne 0x140001420
mov qword [rbp - 0x80], rsi
mov word [r8 + rsi*2], r9w
mov r14, qword [rbp - 0x78]
mov r15, qword [rbp - 0x80]
movabs rdx, 0x7fffffffffffffff
mov ecx, 0xa
mov rax, r10
sub rax, r15
cmp rax, 0xf
jb 0x140001708
lea r13, [rsp + 0x70]
mov rsi, qword [rsp + 0x70]
cmp r14, 7
cmova r13, rsi
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
lea r12, [r15 + 0xf]
lea rbx, [rbp - 0x70]
cmp r12, 7
jbe 0x14000150b
mov rdi, r12
or rdi, 7
cmp rdi, r10
jbe 0x1400014a8
mov rdi, r10
lea rcx, [rdx + rdx]
jmp 0x1400014c9
cmp rdi, 0xa
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, rdx
ja 0x1400016f6
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400014f5
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400016f6
mov rcx, rax
call fcn.140002290
test rax, rax
je 0x14000166e
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140001507
test rcx, rcx
je 0x140001504
call fcn.140002290
mov rbx, rax
jmp 0x140001507
mov rbx, r9
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], rdi
movups xmm0, xmmword [str.powershell.exe]
movups xmmword [rbx], xmm0
movsd xmm0, qword [0x140004430]
movsd qword [rbx + 0x10], xmm0
mov eax, dword [0x140004438]
mov dword [rbx + 0x18], eax
movzx eax, word [0x14000443c]
mov word [rbx + 0x1c], ax
lea rcx, [rbx + 0x1e]
lea r8, [r15 + r15]
mov rdx, r13
call sub.VCRUNTIME140.dll_memcpy
xor edi, edi
mov word [rbx + r12*2], di
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rax
mov dword [rbp - 0x50], 0x68
mov dword [rbp - 0x14], 1
mov word [rbp - 0x10], di
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rax
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rdx, qword [rbp - 0x70]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140001610
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.CreateProcess_failed__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001ec0
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140004440]
call fcn.140001ec0
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x14000167a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001675
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001675
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400022cc
movdqa xmm0, xmmword [0x1400044b0]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], di
cmp r14, 7
jbe 0x1400016c9
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400016c1
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400016c1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400022cc
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.140002270
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001100
nop
call fcn.1400011a0
int3
call fcn.140001100
nop
call fcn.1400011a0
int3