Function at 0x140001060
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x170
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov ecx, 1
call fcn.140005820
mov rsi, rax
mov dword [rbp + 0x110], 0x7805c031
mov dword [rbp + 0x114], 0x57f1901
lea rax, str.AmsiInitialize
mov qword [rbp + 0xc0], rax
movabs r14, 0x5c7cfdb5f39d2d32
mov dword [rbp + 0x118], 0xedfedf
lea rax, str.AmsiUninitialize
mov qword [rbp + 0xc8], rax
movabs rbx, 0xa6ac0ba14beb6668
mov byte [rbp + 0x11c], 0xc3
lea rax, str.AmsiOpenSession
mov qword [rbp + 0xd0], rax
movabs rdi, 0xbe5ed2d0bcd78907
lea rax, str.AmsiCloseSession
movabs r15, 0xc5c963e26bb64c33
mov qword [rbp + 0xd8], rax
movabs r12, 0x2cf678770645410
lea rax, str.AmsiScanBuffer
movabs r13, 0xbe5ed2d0bcd7890d
mov qword [rbp + 0xe0], rax
mov ecx, 1
lea rax, str.AmsiScanString
mov qword [rbp + 0xe8], rax
lea rax, str.AmsiNotifyOperation
mov qword [rbp + 0xf0], rax
lea rax, str.AmsiUacInitialize
mov qword [rbp + 0xf8], rax
lea rax, str.AmsiUacScan
mov qword [rbp + 0x100], rax
lea rax, str.AmsiUacUninitialize
mov qword [rbp + 0x108], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x579f24a7170a3d7b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x40], ymm1
vzeroupper
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, [rbp + 0x40]
call fcn.140001010
call fcn.140004800
test eax, eax
je 0x1400012dc
movabs rax, 0xa0a50db74beb6168
mov ecx, 1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x89a37c450103d77
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x40], ymm1
vzeroupper
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, [rbp + 0x40]
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movabs rax, 0xacae06ae4beb6768
mov ecx, 2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x2c56dd220277464
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], r12
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x48], rax
xorps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x20], xmm0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, [rbp + 0x20]
call fcn.140001010
mov qword [rbp], rbx
mov ecx, 1
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x579f20a7170a3d7b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x40], ymm1
vzeroupper
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, [rbp + 0x40]
call fcn.140001010
call fcn.140004d00
test eax, eax
je 0x14000148e
movabs rax, 0xa0a50db74beb6168
mov ecx, 1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x89a37c050103d77
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x40], ymm1
vzeroupper
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, [rbp + 0x40]
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movabs rax, 0xacae06ae4beb6768
mov ecx, 2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x2c56dd220237464
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], r12
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x48], rax
xorps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x20], xmm0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, [rbp + 0x20]
call fcn.140001010
movabs rax, 0xa6bd02b24beb6668
mov ecx, 1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x518226a7170a3d78
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0xbe5ed2d0bcdd8344
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x40], ymm1
vzeroupper
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, [rbp + 0x40]
call fcn.140001010
lea rbx, [rbp + 0xc0]
nop word [rax + rax]
mov rdi, qword [rbx]
lea r8, [rbp + 0x110]
mov rdx, rdi
mov r9d, 0xd
mov rcx, rsi
call fcn.140003740
test eax, eax
jne 0x14000167d
movabs rax, 0xa9a002a44beb6168
mov ecx, 2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x63bf47e804443075
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0xbe54a1f59cbfea79
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x40], ymm1
vzeroupper
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rdi
lea rdx, [rbp + 0x40]
mov rcx, rax
call fcn.140001010
add rbx, 8
lea rax, [rbp + 0x110]
cmp rbx, rax
jne 0x1400015b0
movabs rax, 0xaaa10db74beb6668
mov ecx, 1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x568147e01e0d3f7f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0xbe5ed2d0b69bc549
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x40], ymm1
vzeroupper
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, [rbp + 0x40]
call fcn.140001010
mov rcx, rsi
call fcn.1400023a0
movabs rdi, 0xa6aa16b14beb6768
movabs rcx, 0x7ba30bf216172775
test eax, eax
je 0x14000187d
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], rcx
movabs rcx, 0xc97a55cbf61c1c64
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0xdb35bdbfd4b9fc2d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x5630b1f1a7d30d56
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
movabs rax, 0xf2f38db66f2de0dd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs rax, 0xf2f38db66f2de0d7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
mov qword [rbp], rcx
mov ecx, 1
mov rax, qword [rbp]
movdqa xmm2, xmmword [rbp + 0x60]
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
mov qword [rbp + 0xa8], rax
vxorps xmm2, xmm2, xmmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0x40], ymm1
vmovdqa xmmword [rbp + 0x60], xmm2
vzeroupper
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, [rbp + 0x40]
call fcn.140001010
movabs rbx, 0xa9a002a44beb6168
jmp 0x14000192e
movabs rbx, 0xa9a002a44beb6168
mov ecx, 2
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x6cba47e804443075
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0xfa0a9cf0d7b8e665
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x5c7cfdb5f997617e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x40], ymm1
vzeroupper
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, [rbp + 0x40]
call fcn.140001010
movabs rax, 0xb1a706942ec13876
mov ecx, 1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x2cf67e2040d2647
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], r12
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x48], rax
movabs rax, 0xa6bd02b24beb6668
xorps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x20], xmm0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x559b22a7170a3d78
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0xbe5ed2d0bcd78907
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x40], ymm1
vzeroupper
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, [rbp + 0x40]
call fcn.140001010
lea rdx, [rbp + 0x20]
mov rcx, rsi
call fcn.140001d50
test eax, eax
je 0x140001a8f
mov qword [rbp], rdi
mov ecx, 1
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x7ba30bf216172775
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0xda3bbab3c8b6f92d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x5c7cf7bfa4c96812
jmp 0x140001ad6
mov qword [rbp], rbx
mov ecx, 2
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x63bf47e804443075
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0xb40986959cbfea79
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x5c7cfdb5f39d2d38
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x40], ymm1
vzeroupper
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, [rbp + 0x40]
call fcn.140001010
mov edx, 1
mov rcx, rsi
call fcn.14000585c
xor eax, eax
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.140005800
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret