Function at 0x140004ac7
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
mov r13, r9
mov rbp, r8
mov r15, rdx
mov r12, rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdx
lea rdx, [0x140098453]
lea rsi, [rsp + 0xd0]
mov r8d, 4
mov rcx, rsi
call fcn.140006470
lea rbx, [0x140098457]
lea r9, [0x140098470]
mov r8d, reloc.WS2_32.dll_send
mov rcx, rsi
mov rdx, rbx
call fcn.1400045fc
mov qword [rsp + 0x30], rax
mov rdi, rdx
lea rsi, [rsp + 0xd0]
mov rcx, rsi
mov rdx, r12
mov r8, r15
call fcn.140006470
lea r9, [0x140098488]
mov r8d, reloc.WS2_32.dll_send
mov rcx, rsi
mov rdx, rbx
call fcn.1400045fc
mov r14, rax
test rbp, rbp
je 0x140004cd1
mov qword [rsp + 0x38], r14
mov r14, rdx
lea rax, [rsp + 0xa8]
mov qword [rax], rbp
mov qword [rax + 8], r13
lea rcx, str.rundll32.exe
lea rdx, [rsp + 0xc0]
mov qword [rdx], rcx
mov qword [rdx + 8], select
lea r12, [rsp + 0xd0]
mov qword [r12], rdx
lea rbp, [0x140008320]
mov qword [r12 + 8], rbp
lea rbx, [rsp + 0x50]
mov qword [r12 + 0x10], rbx
mov qword [r12 + 0x18], rbp
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r13, [rsp + 0x60]
mov qword [r13], rcx
mov ecx, 3
mov qword [r13 + 8], rcx
and qword [r13 + 0x20], 0
mov qword [r12 + 0x20], rax
mov qword [r12 + 0x28], rbp
mov qword [r13 + 0x10], rsi
mov qword [r13 + 0x18], rcx
lea rsi, [rsp + 0x90]
mov rcx, rsi
mov rdx, r13
call fcn.1400048ca
mov rcx, r12
call fcn.140065410
mov r15, qword [rsi]
mov rax, qword [rsi + 0x10]
lea rcx, str._CFailed_to_execute_DLL:
mov qword [r13], rcx
mov qword [r13 + 8], 2
mov qword [r13 + 0x10], r15
mov qword [r13 + 0x18], rax
lea rsi, [rsp + 0x60]
mov rcx, r12
mov rdx, rsi
call fcn.140003a94
mov dword [r12 + 0xc0], 0x8000000
lea r13, [rsp + 0x40]
mov rcx, r13
mov rdx, r12
call fcn.140061680
mov rcx, r12
call fcn.140003f7d
cmp dword [r13], 0
je 0x140004e3d
mov rax, qword [rsp + 0x48]
lea r12, [rsp + 0xb8]
mov qword [r12], rax
mov qword [rsp + 0x60], r12
lea rax, [0x140098500]
lea rcx, [rsp + 0xd0]
mov qword [rcx], rax
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
lea rax, [0x140052180]
mov qword [rsp + 0x68], rax
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 1
call fcn.140055080
mov rcx, r12
call fcn.140003f26
jmp 0x140004e7e
mov rbp, rdx
lea r8, str..ps1powershell.exe
mov r9d, 4
mov rcx, r12
mov rdx, r15
call fcn.1400218b1
test al, al
je 0x140004e9b
mov qword [rsp + 0x38], r14
lea rax, [0x140098524]
lea rcx, [rsp + 0xc0]
mov qword [rcx], rax
mov qword [rcx + 8], select
lea r13, [rsp + 0x60]
mov qword [r13], rcx
lea r14, [0x140008320]
mov qword [r13 + 8], r14
lea rcx, [rsp + 0x50]
lea rax, str.called__Option::unwrap____on_a__None__value
lea rdx, [rsp + 0xd0]
mov qword [rdx], rax
mov ebx, 2
mov qword [rdx + 8], rbx
and qword [rdx + 0x20], 0
mov qword [r13 + 0x10], rcx
mov qword [r13 + 0x18], r14
mov qword [rdx + 0x10], r13
mov qword [rdx + 0x18], rbx
lea rsi, [rsp + 0x90]
mov rcx, rsi
call fcn.1400048ca
lea r12, [rsp + 0xd0]
mov rcx, r12
call fcn.140065410
mov r15, qword [rsi]
mov rax, qword [rsi + 0x10]
lea rcx, str._CFailed_to_execute_DLL:
mov qword [r13], rcx
mov qword [r13 + 8], rbx
mov qword [r13 + 0x10], r15
mov qword [r13 + 0x18], rax
lea rsi, [rsp + 0x60]
mov rcx, r12
mov rdx, rsi
call fcn.140003a94
mov dword [r12 + 0xc0], 0x8000000
lea r13, [rsp + 0x40]
mov rcx, r13
mov rdx, r12
call fcn.140061680
mov rcx, r12
call fcn.140003f7d
cmp dword [r13], 0
je 0x140004ec3
mov rax, qword [rsp + 0x48]
lea r12, [rsp + 0xa8]
mov qword [r12], rax
mov qword [rsp + 0x60], r12
lea rax, str.Failed_to_execute_PowerShell_script:
lea rcx, [rsp + 0xd0]
mov qword [rcx], rax
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
lea rax, [0x140052180]
mov qword [rsp + 0x68], rax
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 1
call fcn.140055080
mov rcx, r12
call fcn.140003f26
mov rbx, qword [rsp + 0x30]
jmp 0x140004f0e
cmp dword [rsp + 0x44], 0
je 0x140004e7e
lea rax, [0x140098500]
lea rcx, [rsp + 0xd0]
mov qword [rcx], rax
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 1
call fcn.140055080
mov rdx, qword [rsp + 0x98]
mov rcx, r15
call fcn.140013a58
mov rbx, qword [rsp + 0x30]
mov rdx, r14
jmp 0x140004f21
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], 0
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
mov rdx, rbx
mov r8, r14
xor r9d, r9d
call sub.SHELL32.dll_ShellExecuteA
mov rdx, rbp
jmp 0x140004f26
lea rdx, [rsp + 0x50]
cmp dword [rsp + 0x44], 0
mov rbx, qword [rsp + 0x30]
je 0x140004f0e
lea rax, str.Failed_to_execute_PowerShell_script:
lea rcx, [rsp + 0xd0]
mov qword [rcx], rax
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r14
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 1
call fcn.140055080
mov rdx, qword [rsp + 0x98]
mov rcx, r15
call fcn.140013a58
mov rdx, rbp
mov r14, qword [rsp + 0x38]
mov rcx, r14
call fcn.140004439
mov rcx, rbx
mov rdx, rdi
call fcn.140004439
nop
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret