Function at 0x140001310
Capabilities:
Execute command

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xe8]
sub rsp, 0x1c0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rbp + 0x98], rax
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
mov qword [rbp + 0x68], 1
mov qword [rbp + 0x70], 0xf
mov word [rbp + 0x58], 0x70
movups xmmword [rbp + 0x18], xmm0
movdqa xmm1, xmmword [0x140005a70]
movdqu xmmword [rbp + 0x28], xmm1
mov word [rbp + 0x18], 0x6f70
mov byte [rbp + 0x1a], dil
movq rcx, xmm1
psrldq xmm1, 8
movq rdx, xmm1
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x1400013c5
lea rax, [rcx + 1]
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0x18]
cmp rdx, 0xf
cmova rax, qword [rbp + 0x18]
mov word [rax + rcx], 0x77
lea rax, [rbp + 0x18]
jmp 0x1400013e3
mov qword [rsp + 0x20], 1
lea r9, [0x1400056ac]
mov edx, 1
lea rcx, [rbp + 0x18]
call fcn.140003540
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rbp]
mov rdx, qword [rbp + 8]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140001445
lea rax, [rcx + 1]
mov qword [rbp], rax
lea rax, [rbp - 0x10]
cmp rdx, 0xf
cmova rax, qword [rbp - 0x10]
mov word [rax + rcx], 0x65
lea rax, [rbp - 0x10]
jmp 0x140001463
mov qword [rsp + 0x20], 1
lea r9, [0x1400056a8]
mov edx, 1
lea rcx, [rbp - 0x10]
call fcn.140003540
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x1400014c5
lea rax, [rcx + 1]
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x30]
cmp rdx, 0xf
cmova rax, qword [rbp - 0x30]
mov word [rax + rcx], 0x72
lea rax, [rbp - 0x30]
jmp 0x1400014e3
mov qword [rsp + 0x20], 1
lea r9, [0x1400056a4]
mov edx, 1
lea rcx, [rbp - 0x30]
call fcn.140003540
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
mov rax, rdx
sub rax, rcx
cmp rax, 0x1a
jb 0x14000155b
lea rax, [rcx + 0x1a]
mov qword [rbp - 0x40], rax
lea rbx, [rbp - 0x50]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x50]
add rbx, rcx
mov r8d, 0x1a
lea rdx, str.shell.exe___Command__.Win
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x1a], 0
lea rax, [rbp - 0x50]
jmp 0x140001579
mov qword [rsp + 0x20], 0x1a
lea r9, str.shell.exe___Command__.Win
mov edx, 0x1a
lea rcx, [rbp - 0x50]
call fcn.140003540
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x58]
mov rax, rdx
sub rax, rcx
cmp rax, 3
jb 0x1400015f1
lea rax, [rcx + 3]
mov qword [rbp - 0x60], rax
lea rbx, [rbp - 0x70]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x70]
add rbx, rcx
mov r8d, 3
lea rdx, [0x140005684]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 3], 0
lea rax, [rbp - 0x70]
jmp 0x14000160f
mov qword [rsp + 0x20], 3
lea r9, [0x140005684]
mov edx, 3
lea rcx, [rbp - 0x70]
call fcn.140003540
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x78]
mov rax, rdx
sub rax, rcx
cmp rax, 2
jb 0x14000167b
lea rax, [rcx + 2]
mov qword [rbp - 0x80], rax
lea rax, [rsp + 0x70]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x70]
mov word [rax + rcx], 0x622e
mov byte [rax + rcx + 2], 0
lea rax, [rsp + 0x70]
jmp 0x14000169a
mov qword [rsp + 0x20], 2
lea r9, [0x140005680]
mov edx, 2
lea rcx, [rsp + 0x70]
call fcn.140003540
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x14000170c
lea rax, [rcx + 4]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x50]
mov dword [rax + rcx], 0x20227461
mov byte [rax + rcx + 4], 0
lea rax, [rsp + 0x50]
jmp 0x14000172b
mov qword [rsp + 0x20], 4
lea r9, str.at_
mov edx, 4
lea rcx, [rsp + 0x50]
call fcn.140003540
movups xmm7, xmmword [rax]
movups xmmword [rbp + 0x78], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0x88], xmm6
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000178c
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001787
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001787
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400037ac
movdqa xmm0, xmmword [0x140005a60]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x1400017de
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400017d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400017d9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400037ac
movdqa xmm0, xmmword [0x140005a60]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x14000182e
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001829
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001829
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400037ac
movdqa xmm0, xmmword [0x140005a60]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x14000187d
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001878
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001878
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400037ac
movdqa xmm0, xmmword [0x140005a60]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400018cc
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400018c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400018c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400037ac
movdqa xmm0, xmmword [0x140005a60]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x14000191b
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001916
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001916
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400037ac
movdqa xmm0, xmmword [0x140005a60]
movdqu xmmword [rbp], xmm0
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x14000196a
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001965
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001965
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400037ac
movdqa xmm0, xmmword [0x140005a60]
movdqu xmmword [rbp + 0x28], xmm0
mov byte [rbp + 0x18], 0
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
movq r14, xmm6
sub rax, r14
cmp rax, 2
jb 0x140001cea
lea r12, [rbp + 0x78]
movq rsi, xmm7
psrldq xmm6, 8
movq r13, xmm6
cmp r13, 0xf
cmova r12, rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea r15, [r14 + 2]
mov ebx, 0xf
lea rdi, [rsp + 0x30]
cmp r15, rbx
jbe 0x140001a56
mov rbx, r15
or rbx, 0xf
cmp rbx, rcx
jbe 0x140001a11
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140003770
test rax, rax
je 0x140001a39
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001a51
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001a40
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001cf0
jmp 0x1400019f6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001a4f
call fcn.140003770
mov rdi, rax
jmp 0x140001a51
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], rbx
mov r8, r14
mov rdx, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov word [r14 + rdi], 0x572d
mov byte [rdi + r15], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 0x11
jb 0x140001acb
lea rax, [rcx + 0x11]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8d, 0x11
lea rdx, [0x1400056b0]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x11], 0
lea rax, [rsp + 0x30]
jmp 0x140001aea
mov qword [rsp + 0x20], 0x11
lea r9, [0x1400056b0]
mov edx, 0x11
lea rcx, [rsp + 0x30]
call fcn.140003540
movups xmm7, xmmword [rax]
movups xmmword [rbp + 0x18], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0x28], xmm6
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140001b49
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001b44
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400037ac
movdqa xmm0, xmmword [0x140005a60]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov qword [rbp + 0x40], rbx
mov ecx, 0x40
call fcn.140003770
mov rcx, rax
mov qword [rbp + 0x38], rax
movdqa xmm0, xmmword [0x140005a80]
movdqu xmmword [rbp + 0x48], xmm0
movups xmm1, xmmword [str.powershell.exe__Command__.Win2_2.bat___WindowStyle_Hidden]
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x1400056d8]
movups xmmword [rax + 0x10], xmm0
movups xmm1, xmmword [0x1400056e8]
movups xmmword [rax + 0x20], xmm1
movsd xmm0, qword [0x1400056f8]
movsd qword [rax + 0x30], xmm0
movzx eax, word [0x140005700]
mov word [rcx + 0x38], ax
mov byte [rcx + 0x3a], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x140001be0
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Failed_to_find_a_required_file.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rdx, qword [rbp + 0x50]
cmp rdx, 0xf
jbe 0x140001c1e
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c19
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001c19
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400037ac
movdqa xmm0, xmmword [0x140005a60]
movdqu xmmword [rbp + 0x48], xmm0
mov byte [rbp + 0x38], 0
psrldq xmm6, 8
movq rdx, xmm6
cmp rdx, 0xf
jbe 0x140001c75
inc rdx
movq rcx, xmm7
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001c6f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400037ac
nop
cmp r13, 0xf
jbe 0x140001cb0
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140001ca7
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ca7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400037ac
nop
mov rcx, qword [rbp + 0x98]
xor rcx, rsp
call fcn.140003750
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011b0
nop
call fcn.140001110
int3