Function at 0x498e40
Capabilities:
Run powershell expression

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x49919b
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movq qword [rsp + 0x78], xmm15
mov qword [rsp + 0x90], rax
mov byte [rsp + 0x2b], 0
mov qword [rsp + 0x40], 0
movups xmmword [rsp + 0x48], xmm15
mov rcx, qword [rax + 8]
mov qword [rsp + 0x38], rcx
mov ebx, 0xffffffff
mov rax, rcx
call sym.syscall.WaitForSingleObject
test eax, eax
je 0x498f86
nop dword [rax + rax]
cmp eax, 0xffffffff
jne 0x498f34
test rbx, rbx
jne 0x498eb4
xor eax, eax
xor ecx, ecx
jmp 0x498f10
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x58], rcx
lea rax, [0x004c6200]
call sym.runtime.newobject
mov qword [rax + 8], 0x13
lea rcx, [0x004db027]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
cmp dword [0x0061c240], 0
jne 0x498ef5
mov rdx, qword [rsp + 0x58]
jmp 0x498f02
call sym.runtime.gcWriteBarrier1
mov rdx, qword [rsp + 0x58]
mov qword [r11], rdx
mov qword [rax + 0x18], rdx
mov rcx, rax
lea rax, [0x00501d88]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rcx
mov rdx, qword [rsp + 0x40]
mov rbx, rax
mov rax, rdx
sub rsp, 0xffffffffffffff80
pop rbp
ret
lea rax, [0x004c4080]
nop dword [rax + rax]
call sym.runtime.newobject
mov qword [rax + 8], 0x2e
lea rcx, [0x004e16c5]
mov qword [rax], rcx
mov qword [rsp + 0x40], 0
lea rcx, [0x00501ce8]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov dword [rsp + 0x2c], 0
mov rax, qword [rsp + 0x38]
lea rbx, [rsp + 0x2c]
call sym.syscall.GetExitCodeProcess
nop dword [rax]
test rax, rax
je 0x499022
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x58], rbx
lea rax, [0x004c6200]
call sym.runtime.newobject
mov qword [rax + 8], 0x12
lea rcx, [0x004dabff]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
cmp dword [0x0061c240], 0
jne 0x498fe6
mov rdx, qword [rsp + 0x58]
jmp 0x498ff3
call sym.runtime.gcWriteBarrier1
mov rdx, qword [rsp + 0x58]
mov qword [r11], rdx
mov qword [rax + 0x18], rdx
mov qword [rsp + 0x40], 0
lea rbx, [0x00501d88]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x40]
mov rcx, rax
mov rax, rdx
sub rsp, 0xffffffffffffff80
pop rbp
ret
lea rax, [0x004cd040]
call sym.runtime.newobject
mov qword [rsp + 0x70], rax
lea rcx, [rax + 8]
lea rdi, [rax + 0x10]
lea rsi, [rax + 0x18]
mov rbx, rax
mov rax, qword [rsp + 0x38]
call sym.syscall.GetProcessTimes
test rax, rax
je 0x4990d2
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x30], rax
lea rax, [0x004c6200]
call sym.runtime.newobject
mov qword [rax + 8], 0xf
lea rcx, [0x004da12c]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
cmp dword [0x0061c240], 0
jne 0x499096
mov rdx, qword [rsp + 0x58]
jmp 0x4990a3
call sym.runtime.gcWriteBarrier1
mov rdx, qword [rsp + 0x58]
mov qword [r11], rdx
mov qword [rax + 0x18], rdx
mov qword [rsp + 0x40], 0
lea rbx, [0x00501d88]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x40]
mov rcx, rax
mov rax, rdx
sub rsp, 0xffffffffffffff80
pop rbp
ret
nop
nop
mov ecx, 1
mov rdx, qword [rsp + 0x90]
xchg dword [rdx + 0x10], ecx
movups xmmword [rsp + 0x60], xmm15
lea rcx, [sym.os._Process_.wait.deferwrap1]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x78], rcx
mov byte [rsp + 0x2b], 1
lea rax, [0x004c9680]
call sym.runtime.newobject
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx]
mov qword [rax], rcx
mov ecx, dword [rsp + 0x2c]
mov dword [rax + 8], ecx
cmp dword [0x0061c240], 0
jne 0x499140
mov rcx, qword [rsp + 0x70]
jmp 0x49914d
call sym.runtime.gcWriteBarrier1
mov rcx, qword [rsp + 0x70]
mov qword [r11], rcx
mov qword [rax + 0x10], rcx
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x48], xmm15
mov byte [rsp + 0x2b], 0
mov rdx, qword [rsp + 0x78]
mov rax, qword [rdx]
call rax
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
sub rsp, 0xffffffffffffff80
pop rbp
nop
ret
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.os._Process_.wait