Function at 0x1400441c0
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1150]
mov eax, 0x1250
call fcn.140049ae0
sub rsp, rax
mov rax, qword [0x140090040]
xor rax, rsp
mov qword [rbp + 0x1140], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x50], rcx
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rbp + 0x88], xmm0
mov r13d, edi
mov qword [rbp + 0x98], rdi
mov r15d, 0xf
mov qword [rbp + 0xa0], r15
mov byte [rbp + 0x88], dil
xor eax, eax
movups xmmword [rbp + 0xa8], xmm0
movups xmmword [rbp + 0xb8], xmm0
mov qword [rbp + 0xc8], rax
lea rdx, str.__.__
lea rcx, [rbp + 0xa8]
call fcn.14001a730
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0xd0], rdi
mov byte [rbp + 0xd8], dil
movdqa xmmword [rbp + 0xe0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xf0], xmm1
mov qword [rbp + 0x100], rdi
mov byte [rbp + 0x108], dil
movdqa xmmword [rbp + 0x110], xmm0
mov byte [rbp + 0x120], dil
mov qword [rbp + 0x128], rdi
mov qword [rbp + 0x130], rdi
mov byte [rbp + 0x138], dil
cmp qword [rbx + 0x18], r15
jbe 0x1400442e5
mov rdx, qword [rbx]
mov r11, rdx
mov r10, rdx
add r11, qword [rbx + 0x10]
jmp 0x1400442f2
mov r11, qword [rbx + 0x10]
add r11, rbx
mov r10, rbx
mov rdx, rbx
mov qword [rsp + 0x28], rdx
lea r9, [rbp + 0xa8]
lea r8, [rbp + 0xd0]
mov rdx, r11
mov rcx, r10
call fcn.14001f7c0
test al, al
je 0x1400443e3
mov rcx, qword [rbp + 0xe8]
mov r8, qword [rbp + 0xe0]
sub rcx, r8
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, 1
ja 0x14004435a
lea rax, [rbp + 0x128]
lea r8, [rbp + 0x138]
jmp 0x140044362
lea rax, [r8 + 0x18]
add r8, 0x28
cmp byte [r8], 0
je 0x140044372
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
jmp 0x14004437b
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
cmp rdx, r8
jne 0x1400443ab
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
jmp 0x1400443b8
sub r8, rdx
lea rcx, [rsp + 0x60]
call fcn.1400055d0
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rbp + 0x88], xmm0
movups xmm1, xmmword [rsp + 0x70]
movups xmmword [rbp + 0x98], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 8
movq r15, xmm0
movq r13, xmm1
mov dword [rbp - 0x50], 0x18
mov dword [rbp - 0x40], 1
mov qword [rbp - 0x48], rdi
xor r9d, r9d
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xorps xmm0, xmm0
test eax, eax
jne 0x1400444b8
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], rdi
xor r8d, r8d
lea rdx, [0x140081220]
mov rcx, rsi
call fcn.1400055d0
nop
lea rcx, [rbp + 0xe0]
call fcn.14001a610
nop
lea rcx, [rbp + 0xa8]
call fcn.14001ab50
mov rcx, qword [rbp + 0xc8]
test rcx, rcx
je 0x140044475
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x140044475
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, 1
mov rcx, rax
call r8
nop
cmp r15, 0xf
jbe 0x140044ae2
lea rdx, [r15 + 1]
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140044add
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140044b1b
jmp 0x140044add
xorps xmm1, xmm1
xor eax, eax
movups xmmword [rbp - 0x2c], xmm1
movups xmmword [rbp - 0x1c], xmm1
movups xmmword [rbp - 0xc], xmm1
movups xmmword [rbp + 4], xmm1
movups xmmword [rbp + 0x14], xmm1
mov dword [rbp + 0x24], eax
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rax
mov dword [rbp - 0x30], 0x68
mov rax, qword [rbp - 0x70]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x28], rax
psrldq xmm1, 8
movd eax, xmm1
bts eax, 8
mov dword [rbp + 0xc], eax
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 0x18
jb 0x140044b2d
lea rax, [rbp + 0x88]
mov r14, qword [rbp + 0x88]
cmp r15, 0xf
cmova rax, r14
mov qword [rsp + 0x50], rax
movups xmmword [rbp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x58], xmm1
lea r12, [r13 + 0x18]
mov ebx, 0xf
lea rdi, [rbp + 0x48]
movabs rdx, 0x8000000000000000
lea r8d, [rbx + 7]
cmp r12, rbx
jbe 0x1400445d4
mov rbx, r12
or rbx, 0xf
cmp rbx, rcx
jbe 0x140044597
mov rbx, rcx
lea rax, [rdx + 0x27]
mov rcx, rax
call fcn.1400491b8
test rax, rax
je 0x140044b33
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov rax, qword [rsp + 0x50]
jmp 0x1400445d0
cmp rbx, r8
cmovb rbx, r8
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400445ba
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140044b21
jmp 0x140044573
test rcx, rcx
je 0x1400445ce
call fcn.1400491b8
mov rdi, rax
mov rax, qword [rsp + 0x50]
jmp 0x1400445d0
xor edi, edi
mov qword [rbp + 0x48], rdi
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x60], rbx
movups xmm0, xmmword [str.powershell.exe__Command]
movups xmmword [rdi], xmm0
movsd xmm0, qword [0x140084618]
movsd qword [rdi + 0x10], xmm0
lea rcx, [rdi + 0x18]
mov r8, r13
mov rdx, rax
call fcn.14006eff0
mov byte [rdi + r12], 0
lea rdx, [rbp + 0x48]
cmp qword [rbp + 0x60], 0xf
cmova rdx, qword [rbp + 0x48]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140044754
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rbx
xor r8d, r8d
lea rdx, [0x140081220]
mov rcx, rsi
call fcn.1400055d0
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x1400446c5
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400446c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140044b33
call fcn.1400491b0
movdqa xmm0, xmmword [0x140084880]
movdqu xmmword [rbp + 0x58], xmm0
mov byte [rbp + 0x48], 0
lea rcx, [rbp + 0xe0]
call fcn.14001a610
nop
lea rcx, [rbp + 0xa8]
call fcn.14001ab50
mov rcx, qword [rbp + 0xc8]
test rcx, rcx
je 0x140044718
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x140044718
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, 1
mov rcx, rax
call r8
nop
cmp r15, 0xf
jbe 0x140044ae2
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140044ada
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140044b1b
jmp 0x140044ada
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x78], rbx
mov qword [rbp + 0x80], 0xf
mov byte [rbp + 0x68], bl
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x40]
mov r8d, 0xfff
lea rdx, [rbp + 0x140]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004480e
nop dword [rax + rax]
mov eax, dword [rbp + 0x40]
test eax, eax
je 0x14004480e
cmp rax, 0x1000
jae 0x140044b3f
mov byte [rbp + rax + 0x140], 0
lea rax, [rbp + 0x140]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400447d0
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x68]
call fcn.140004e50
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x40]
mov r8d, 0xfff
lea rdx, [rbp + 0x140]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400447a0
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rbp + 0x78]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 1
jb 0x140044b39
lea rax, [rbp + 0x68]
cmp qword [rbp + 0x80], 0xf
cmova rax, qword [rbp + 0x68]
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea r12, [r13 + 1]
mov ebx, 0xf
lea rdi, [rsp + 0x60]
cmp r12, rbx
jbe 0x14004491c
mov rbx, r12
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400448d8
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400491b8
test rax, rax
je 0x140044b45
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov rax, qword [rsp + 0x50]
jmp 0x140044917
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140044901
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140044b27
jmp 0x1400448b4
test rcx, rcx
je 0x140044915
call fcn.1400491b8
mov rdi, rax
mov rax, qword [rsp + 0x50]
jmp 0x140044917
xor edi, edi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], rbx
mov byte [rdi], 0x60
lea rcx, [rdi + 1]
mov r8, r13
mov rdx, rax
call fcn.14006eff0
mov byte [rdi + r12], 0
mov r8d, 1
lea rdx, [0x140084600]
lea rcx, [rsp + 0x60]
call fcn.140004e50
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
xor ebx, ebx
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsi + 0x10], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x1400449bd
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400449b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140044b45
call fcn.1400491b0
movdqa xmm0, xmmword [0x140084880]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp + 0x80]
cmp rdx, 0xf
jbe 0x140044a0e
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140044a09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140044b4b
call fcn.1400491b0
mov qword [rbp + 0x78], rbx
mov qword [rbp + 0x80], 0xf
mov byte [rbp + 0x68], 0
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x140044a5c
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140044a57
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140044b51
call fcn.1400491b0
movdqa xmm0, xmmword [0x140084880]
movdqu xmmword [rbp + 0x58], xmm0
mov byte [rbp + 0x48], 0
lea rcx, [rbp + 0xe0]
call fcn.14001a610
nop
lea rcx, [rbp + 0xa8]
call fcn.14001ab50
mov rcx, qword [rbp + 0xc8]
test rcx, rcx
je 0x140044aaf
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x140044aaf
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, 1
mov rcx, rax
call r8
nop
cmp r15, 0xf
jbe 0x140044ae2
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140044ada
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140044b15
mov rcx, r14
call fcn.1400491b0
mov rax, rsi
mov rcx, qword [rbp + 0x1140]
xor rcx, rsp
call fcn.140049190
lea r11, [rsp + 0x1250]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400500ac
int3
call fcn.1400500ac
nop
call fcn.140002390
nop
call fcn.140002390
nop
call fcn.140002430
int3
call fcn.1400500ac
nop
call fcn.140002430
int3
call fcn.140049640
int3
call fcn.1400500ac
nop
call fcn.1400500ac
nop
call fcn.1400500ac
int3