Function at 0x18032f9e0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x18054e100]
xor rax, rsp
mov qword [rbp + 0xd8], rax
xor r13d, r13d
call fcn.18032f4a0
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], 1
mov ebx, 0xf
mov qword [rbp + 0x10], rbx
movzx eax, word [0x180460e04]
mov byte [rbp - 8], al
mov byte [rbp - 7], r13b
movups xmmword [rbp + 0x98], xmm0
mov qword [rbp + 0xa8], 1
mov qword [rbp + 0xb0], rbx
movzx eax, word [0x1804a69cc]
mov byte [rbp + 0x98], al
mov byte [rbp + 0x99], r13b
lea rcx, [rbp + 0xb8]
call fcn.1803006b0
nop
lea rdx, [rbp - 8]
lea r8d, [r13 + 1]
mov rcx, rax
call fcn.18006a3c0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], rbx
mov byte [rax], r13b
lea rcx, [rbp + 0xb8]
call fcn.18006b8d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], rbx
lea ecx, [rbx + 0x11]
call fcn.180357684
mov rdx, rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], 0x1b
mov qword [rsp + 0x70], 0x1f
movups xmm0, xmmword [str.c:windows_system32cmd.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x180503968]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x180503970]
mov word [rax + 0x18], cx
movzx eax, byte [0x180503972]
mov byte [rdx + 0x1a], al
mov byte [rdx + 0x1b], r13b
movabs r15, 0x7fffffffffffffff
mov rax, r15
mov rcx, qword [rsp + 0x48]
sub rax, rcx
cmp rax, 0x24
jb 0x18032ffe0
lea rax, [rbp - 0x48]
cmp qword [rbp - 0x30], rbx
cmova rax, qword [rbp - 0x48]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x24
lea r9, str.__c_powershell_Expand_Archive__Path
lea rcx, [rbp + 0x78]
call fcn.18006a4c0
nop
mov rax, r15
mov rcx, qword [rbp + 0x88]
sub rax, rcx
cmp rax, 0xb
jb 0x18032ffe6
lea r9, [rbp + 0x78]
cmp qword [rbp + 0x90], rbx
cmova r9, qword [rbp + 0x78]
mov qword [rsp + 0x30], 0xb
lea rax, str.ffmpeg.zip
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x58]
call fcn.18006a4c0
nop
mov edi, dword [rsp + 0x68]
lea r8, [rsp + 0x58]
cmp qword [rsp + 0x70], rbx
cmova r8, qword [rsp + 0x58]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
lea r9d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
mov rsi, 0xffffffffffffffff
cmovo rax, rsi
mov rcx, rax
call fcn.180357d9c
mov r14, rax
lea r8, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova r8, qword [rsp + 0x58]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], r13
mov r8, rsi
inc r8
cmp word [r14 + r8*2], 0
jne 0x18032fc41
mov rdx, r14
lea rcx, [rbp - 0x68]
call fcn.18008a510
mov rcx, r14
call fcn.180357650
nop
lea r12, [rbp - 0x68]
cmp qword [rbp - 0x50], 7
cmova r12, qword [rbp - 0x68]
mov rax, r15
mov rcx, qword [rbp - 0x38]
sub rax, rcx
cmp rax, 0x11
jb 0x18032ffec
lea rax, [rbp - 0x48]
cmp qword [rbp - 0x30], 0xf
cmova rax, qword [rbp - 0x48]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x11
lea r9, str._DestinationPath
lea rcx, [rbp + 0x38]
call fcn.18006a4c0
nop
mov rax, r15
mov rcx, qword [rbp + 0x48]
sub rax, rcx
cmp rax, 7
jb 0x18032fff2
lea r9, [rbp + 0x38]
cmp qword [rbp + 0x50], 0xf
cmova r9, qword [rbp + 0x38]
mov qword [rsp + 0x30], 7
lea rax, str.ffmpeg_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x18]
call fcn.18006a4c0
nop
mov rcx, qword [rbp + 0x68]
sub r15, rcx
mov rdx, qword [rbp + 0x28]
cmp r15, rdx
jb 0x18032fff8
lea r9, [rbp + 0x58]
cmp qword [rbp + 0x70], 0xf
cmova r9, qword [rbp + 0x58]
lea rax, [rbp + 0x18]
cmp qword [rbp + 0x30], 0xf
cmova rax, qword [rbp + 0x18]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x28]
call fcn.18006a4c0
nop
mov edi, dword [rbp - 0x18]
lea r8, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
cmova r8, qword [rbp - 0x28]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
lea r9d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rsi
mov rcx, rax
call fcn.180357d9c
mov r14, rax
lea r8, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
cmova r8, qword [rbp - 0x28]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], r13
nop dword [rax]
inc rsi
cmp word [r14 + rsi*2], 0
jne 0x18032fdc0
mov r8, rsi
mov rdx, r14
lea rcx, [rsp + 0x78]
call fcn.18008a510
mov rcx, r14
call fcn.180357650
lea r9, [rsp + 0x78]
cmp qword [rbp - 0x70], 7
cmova r9, qword [rsp + 0x78]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
mov r8, r12
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x18032fe50
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18032fe4b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18032fffe
call fcn.180357650
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r13w
lea rcx, [rbp - 0x28]
call fcn.18006b8d0
nop
lea rcx, [rbp + 0x18]
call fcn.18006b8d0
nop
lea rcx, [rbp + 0x38]
call fcn.18006b8d0
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x18032fec0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18032febb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180330004
call fcn.180357650
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r13w
lea rcx, [rbp + 0x58]
call fcn.18006b8d0
nop
lea rcx, [rbp + 0x78]
call fcn.18006b8d0
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x18032ff22
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18032ff1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18033000a
call fcn.180357650
mov qword [rsp + 0x68], r13
mov ebx, 0xf
mov qword [rsp + 0x70], rbx
mov byte [rsp + 0x58], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, rbx
jbe 0x18032ff71
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18032ff6b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180330010
call fcn.180357650
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 0xf
jbe 0x18032ffa8
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18032ffa3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18032ffda
call fcn.180357650
xor eax, eax
mov rcx, qword [rbp + 0xd8]
xor rcx, rsp
call fcn.180357630
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18035e820
nop
call fcn.18006b090
nop
call fcn.18006b090
nop
call fcn.18006b090
nop
call fcn.18006b090
nop
call fcn.18006b090
nop
call fcn.18035e820
nop
call fcn.18035e820
nop
call fcn.18035e820
nop
call fcn.18035e820
int3