Function at 0x14000e4c0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x1400471b0]
xor rax, rsp
mov qword [rbp + 0xc8], rax
mov rsi, r8
mov r15, rdx
mov qword [rbp + 0x50], rdx
mov qword [rbp + 0x58], r8
xor r13d, r13d
mov qword [rbp + 0xa8], r13
mov qword [rbp + 0xb8], r13
mov qword [rbp + 0xc0], 7
mov word [rbp + 0xa8], r13w
lea r8d, [r13 + 0x1a]
lea rdx, str.CreateZipPackageInternalPS
lea rcx, [rbp + 0xa8]
call fcn.140003d50
nop
xor r12b, r12b
mov dword [rbp + 0x80], 0xffffffff
call fcn.14000c310
mov rcx, rax
lea rdx, [rbp - 0x70]
call fcn.14000adf0
mov rbx, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x2f
jb 0x14000e5a0
lea r14, [rcx + 0x2f]
mov qword [rbx + 0x10], r14
mov rdi, rbx
cmp rdx, 8
jb 0x14000e583
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
mov r8d, 0x5e
lea rdx, str._system32WindowsPowerShell_v1.0PowerShell.exe
call fcn.140015370
mov word [rdi + r14*2], r13w
jmp 0x14000e5c3
lfence
mov qword [rsp + 0x20], 0x2f
lea r9, str._system32WindowsPowerShell_v1.0PowerShell.exe
mov edx, 0x2f
mov rcx, rbx
call fcn.140004bf0
mov rbx, rax
mov qword [rbp + 0x60], r13
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], r13
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x70], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 7
mov word [rbx], r13w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14000e62e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e629
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ec31
call fcn.140012fbc
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r13w
mov qword [rsp + 0x70], r13
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
mov r14, qword [rbp + 0x70]
lea rbx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rbx, qword [rbp + 0x60]
cmp r14, 8
jae 0x14000e673
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x70], xmm0
mov edi, 7
jmp 0x14000e6bf
mov rdi, r14
or rdi, 7
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
cmova rdi, rax
mov rdx, rdi
add rdx, 1
mov rax, 0xffffffffffffffff
cmovb rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140003cd0
mov qword [rsp + 0x70], rax
lea r8, [r14*2 + 2]
mov rdx, rbx
mov rcx, rax
call fcn.140015370
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], rdi
lea rcx, [rsp + 0x70]
call fcn.1400043c0
test al, al
jne 0x14000e6eb
mov r8d, 0xe
lea rdx, str.PowerShell.exe
lea rcx, [rbp + 0x60]
call fcn.140003d50
mov r8, r15
lea rdx, str.Compress_Archive__Force__Path_
lea rcx, [rbp - 0x48]
call fcn.14000fd80
mov rbx, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x14
jb 0x14000e746
lea r14, [rcx + 0x14]
mov qword [rbx + 0x10], r14
mov rdi, rbx
cmp rdx, 8
jb 0x14000e729
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
mov r8d, 0x28
lea rdx, str.__DestinationPath_
call fcn.140015370
mov word [rdi + r14*2], r13w
jmp 0x14000e769
lfence
mov qword [rsp + 0x20], 0x14
lea r9, str.__DestinationPath_
mov edx, 0x14
mov rcx, rbx
call fcn.140004bf0
mov rbx, rax
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 7
mov word [rbx], r13w
mov r9, rsi
cmp qword [rsi + 0x18], 8
jb 0x14000e7a6
mov r9, qword [rsi]
mov rdx, qword [rsi + 0x10]
mov rcx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x14000e7f3
lea rdi, [rcx + rdx]
mov qword [rsp + 0x60], rdi
lea rbx, [rsp + 0x50]
cmp r8, 8
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
mov rdx, r9
call fcn.140015370
mov word [rbx + rdi*2], r13w
lea rax, [rsp + 0x50]
jmp 0x14000e805
lfence
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x50]
call fcn.140004bf0
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov rax, r8
sub rax, rdx
mov ebx, 1
cmp rax, rbx
jb 0x14000e87e
lea rcx, [rdx + 1]
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x30]
cmp r8, 8
cmovae rax, qword [rsp + 0x30]
mov r8d, 0x27
mov word [rax + rdx*2], r8w
mov word [rax + rcx*2], r13w
lea rax, [rsp + 0x30]
jmp 0x14000e89a
lfence
mov qword [rsp + 0x20], rbx
lea r9, [0x14003f6c0]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140004bf0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x88], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x98], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14000e901
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e8fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ec37
call fcn.140012fbc
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r13w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14000e957
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e952
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ec3d
call fcn.140012fbc
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r13w
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x14000e9ab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e9a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ec43
call fcn.140012fbc
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
mov dword [rbp - 0x20], 0x70
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], r13
mov dword [rbp + 0x10], r13d
mov dword [rbp - 0x1c], 0x40
lea rax, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rax, qword [rbp + 0x60]
mov qword [rbp - 8], rax
lea rax, [rbp + 0x88]
cmp qword [rbp + 0xa0], 8
cmovae rax, qword [rbp + 0x88]
mov qword [rbp], rax
lea rcx, [rbp - 0x20]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x14000ea65
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14000ea65
mov edx, 0xffffffff
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
test eax, eax
jne 0x14000ea52
lea rdx, [rbp + 0x80]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetExitCodeProcess]
movzx r12d, r12b
test eax, eax
cmovne r12d, ebx
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14000ea65
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [rbp + 0x48], r13
mov rdx, qword [rbp + 0xa0]
cmp rdx, 8
jb 0x14000eaab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000eaa6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ec49
call fcn.140012fbc
mov qword [rbp + 0x98], r13
mov qword [rbp + 0xa0], 7
mov word [rbp + 0x88], r13w
mov rdx, qword [rbp + 0x78]
cmp rdx, 8
jb 0x14000eb05
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000eb00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ec4f
call fcn.140012fbc
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], 7
mov word [rbp + 0x60], r13w
mov rdx, qword [rbp + 0xc0]
cmp rdx, 8
jb 0x14000eb5d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000eb57
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ec55
call fcn.140012fbc
nop
mov rdx, qword [r15 + 0x18]
cmp rdx, 8
jb 0x14000eb9c
mov rcx, qword [r15]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000eb97
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000ec25
mov rcx, r8
call fcn.140012fbc
mov qword [r15 + 0x10], r13
mov qword [r15 + 0x18], 7
mov word [r15], r13w
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x14000ebe7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x14000ebe2
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000ec2b
mov rcx, r8
call fcn.140012fbc
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], 7
mov word [rsi], r13w
movzx eax, r12b
mov rcx, qword [rbp + 0xc8]
xor rcx, rsp
call fcn.140012f70
mov rbx, qword [rsp + 0x210]
add rsp, 0x1d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140019554
nop
call fcn.140019554
nop
call fcn.140019554
nop
call fcn.140019554
nop
call fcn.140019554
nop
call fcn.140019554
int3
call fcn.140019554
nop
call fcn.140019554
nop
call fcn.140019554
int3