Function at 0x140174310
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1402fa010]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor r13d, r13d
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x58], r13
call fcn.1400195b0
mov rcx, rax
test rax, rax
je 0x140174750
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
add rax, 0x18
mov qword [rsp + 0x58], rax
call fcn.1401285c0
mov rcx, rax
lea rdx, [rsp + 0x48]
call fcn.140129500
mov rdi, rax
call fcn.140163500
mov rbx, qword [rax + 0xc0]
mov rdi, qword [rdi]
call fcn.140163500
mov rcx, qword [rax + 0x508]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rbx
mov r9, rdi
lea r8, str.https:__ana.bandi.so_bandizip_pass.html
lea rdx, str._hidden__s_v_se_sl_s
lea rcx, [rsp + 0x58]
call fcn.14001c3d0
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov rbp, 0xffffffffffffffff
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401743f1
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
lea rcx, [rsp + 0x50]
call fcn.140022bf0
mov r15, rax
mov qword [rsp + 0x38], r13
mov rcx, qword [rax]
mov rcx, qword [rcx - 0x18]
test rcx, rcx
je 0x140174424
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x20]
call qword [case.0x140038716.0]
mov rcx, rax
test rax, rax
jne 0x140174448
call fcn.1400195b0
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x140038716.0]
mov rcx, rax
test rax, rax
je 0x14017475b
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
mov r12d, 1
mov dword [rsp + 0x30], r12d
lea rcx, str.data_
mov rdi, rbp
inc rdi
cmp word [rcx + rdi*2], 0
jne 0x140174473
mov r15, qword [r15]
movsxd r14, dword [r15 - 0x10]
lea esi, [r14 + rdi]
test esi, esi
js 0x140174745
mov ecx, r12d
sub ecx, dword [rax + 0x10]
mov eax, dword [rax + 0xc]
sub eax, esi
or eax, ecx
jge 0x1401744b0
mov edx, esi
lea rcx, [rsp + 0x38]
call fcn.140018ec0
mov rbx, qword [rsp + 0x38]
add r14, r14
je 0x1401744e6
test rbx, rbx
je 0x1401744d6
mov r8, r14
mov rcx, rbx
test r15, r15
je 0x1401744cf
mov rdx, r15
call fcn.1401f61a0
jmp 0x1401744e6
xor edx, edx
call fcn.1401f6840
call fcn.1401fae4c
mov dword [rax], 0x16
call fcn.1401facac
movsxd r8, edi
add r8, r8
lea rcx, [r14 + rbx]
je 0x140174515
test rcx, rcx
jne 0x140174509
call fcn.1401fae4c
mov dword [rax], 0x16
call fcn.1401facac
jmp 0x140174515
lea rdx, str.data_
call fcn.1401f61a0
cmp esi, dword [rbx - 0xc]
jg 0x140174745
mov dword [rbx - 0x10], esi
movsxd rax, esi
mov word [rbx + rax*2], r13w
mov qword [rsp + 0x40], r13
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x14017454c
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x140038716.0]
mov rcx, rax
test rax, rax
jne 0x140174570
call fcn.1400195b0
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x140038716.0]
mov rcx, rax
test rax, rax
je 0x140174766
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
mov rcx, rax
lea rdi, [rax + 0x18]
mov qword [rsp + 0x40], rdi
mov r13d, 3
mov dword [rsp + 0x30], r13d
lea rax, str.web32.exe
mov rsi, rbp
nop
inc rsi
cmp word [rax + rsi*2], 0
jne 0x1401745a0
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x34], eax
lea r14d, [rax + rsi]
test r14d, r14d
js 0x14017473a
sub r12d, dword [rcx + 0x10]
mov eax, dword [rcx + 0xc]
sub eax, r14d
or eax, r12d
jge 0x1401745df
mov edx, r14d
lea rcx, [rsp + 0x40]
call fcn.140018ec0
mov rdi, qword [rsp + 0x40]
movsxd rax, dword [rsp + 0x34]
lea r12, [rax + rax]
test r12, r12
je 0x140174612
test rdi, rdi
jne 0x140174604
call fcn.1401fae4c
mov dword [rax], 0x16
call fcn.1401facac
jmp 0x140174612
mov r8, r12
mov rdx, rbx
mov rcx, rdi
call fcn.1401f61a0
movsxd r8, esi
add r8, r8
lea rcx, [r12 + rdi]
je 0x140174641
test rcx, rcx
jne 0x140174635
call fcn.1401fae4c
mov dword [rax], 0x16
call fcn.1401facac
jmp 0x140174641
lea rdx, str.web32.exe
call fcn.1401f61a0
cmp r14d, dword [rdi - 0xc]
jg 0x14017473a
mov dword [rdi - 0x10], r14d
movsxd rax, r14d
xor ecx, ecx
mov word [rdi + rax*2], cx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0x58]
mov r8, rdi
lea rdx, [0x140265d30]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
and r13d, 0xfffffffd
mov dword [rsp + 0x30], r13d
lea rdx, [rdi - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14017469f
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
and dword [rsp + 0x30], 0xfffffffe
mov eax, ebp
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x1401746c6
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401746ec
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
sub ebp, 1
jg 0x14017470f
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401f3bf0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x80070057
call fcn.140019320
nop
mov ecx, 0x80070057
call fcn.140019320
nop
mov ecx, 0x80004005
call fcn.140019320
nop
mov ecx, 0x80004005
call fcn.140019320
nop
mov ecx, 0x80004005
call fcn.140019320
int3