Function at 0x14000a1f0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create process suspended
Read file on windows
Run powershell expression

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x11d0]
mov eax, 0x12d0
call fcn.14002ecc0
sub rsp, rax
mov rax, qword [0x140043040]
xor rax, rsp
mov qword [rbp + 0x11c0], rax
mov ebx, ecx
mov dword [rsp + 0x60], ecx
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xe0], xmm1
lea r8d, [rdi + 0x11]
lea rdx, str.Invoke_RestMethod
lea rcx, [rbp + 0xd0]
call fcn.140003b50
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x100], xmm1
lea r8d, [rdi + 0x31]
lea rdx, str.____Found_ImportCode_string:_Invoke_RestMethod.
lea rcx, [rbp + 0xf0]
call fcn.140003b50
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x120], xmm1
lea r8d, [rdi + 0x11]
lea rdx, str.Invoke_Expression
lea rcx, [rbp + 0x110]
call fcn.140003b50
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x140], xmm1
lea r8d, [rdi + 0x31]
lea rdx, str.____Found_ImportCode_string:_Invoke_Expression.
lea rcx, [rbp + 0x130]
call fcn.140003b50
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x160], xmm1
lea r8d, [rdi + 0xd]
lea rdx, str.import_base64
lea rcx, [rbp + 0x150]
call fcn.140003b50
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x170], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x180], xmm1
lea r8d, [rdi + 0x2d]
lea rdx, str.____Found_ImportCode_string:_import_base64.
lea rcx, [rbp + 0x170]
call fcn.140003b50
nop
lea rax, [rbp + 0xd0]
mov qword [rbp - 0x80], rax
lea rax, [rbp + 0x190]
mov qword [rbp - 0x78], rax
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x70]
call fcn.14000aa60
nop
lea r9, [fcn.140004700]
lea edx, [rdi + 0x40]
lea r8d, [rdi + 3]
lea rcx, [rbp + 0xd0]
call fcn.14002e6b0
lea r9, [rbp + 0x1ba]
mov r8d, ebx
nop dword [rax]
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x14000a390
lea r8, [rbp + 0x1ba]
mov rdx, r9
lea rcx, [rbp + 0xb0]
call fcn.14000aca0
nop
mov r9d, 0x16
lea r8, str.memory_scanner.exe__p
lea rcx, [rbp + 0xb0]
call fcn.140004190
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa0], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rbp + 0xc8]
cmp rdx, 7
jbe 0x14000a472
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a46d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a46d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002e2d0
movdqa xmm0, xmmword [0x140039470]
movdqu xmmword [rbp + 0xc0], xmm0
mov word [rbp + 0xb0], di
mov qword [rbp - 0x58], 0x18
mov qword [rbp - 0x48], 1
mov qword [rbp - 0x50], rdi
xor r9d, r9d
lea r8, [rbp - 0x58]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov dword [rbp - 0x20], 0x68
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 0x28], xmm0
movups xmmword [rbp + 0x38], xmm0
mov rax, qword [rsp + 0x68]
mov qword [rbp + 0x38], rax
psrldq xmm0, 4
movd eax, xmm0
or eax, 0x101
mov dword [rbp + 0x1c], eax
mov word [rbp + 0x20], di
lea rdx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 7
cmova rdx, qword [rbp + 0x90]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000a940
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x1c0]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x50]
mov r8d, 0x1000
lea rdx, [rbp + 0x1c0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000a91d
mov edx, 0xa
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x14000a91d
shr rax, 1
lea r14, [rbp + 0x1c0]
add r14, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
lea rcx, [rbp + 0x1c0]
xor r9d, r9d
mov qword [rbp + 0x60], r9
cmp rcx, r14
jne 0x14000a5f5
mov r13d, r9d
mov qword [rbp + 0x68], 7
mov word [rbp + 0x50], r9w
jmp 0x14000a6b4
lea rdi, [rbp + 0x1c0]
mov rsi, r9
mov ebx, 7
mov qword [rbp + 0x68], rbx
cmp rax, rbx
jbe 0x14000a670
mov rbx, rax
or rbx, 7
cmp rbx, 0xa
cmovb rbx, rdx
lea rcx, [rbx*2 + 2]
cmp rcx, 0x1000
jb 0x14000a65c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000aa40
mov rcx, rax
call fcn.14002e3f8
mov rcx, rax
test rax, rax
je 0x14000a916
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000a661
call fcn.14002e3f8
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x68], rbx
xor r9d, r9d
nop dword [rax]
lea rcx, [rbp + 0x50]
cmp rbx, 7
cmova rcx, qword [rbp + 0x50]
movsx eax, byte [rdi]
mov word [rcx + rsi*2], ax
mov rsi, qword [rbp + 0x60]
inc rsi
mov qword [rbp + 0x60], rsi
inc rdi
cmp rdi, r14
je 0x14000a69d
mov rbx, qword [rbp + 0x68]
jmp 0x14000a670
lea rax, [rbp + 0x50]
cmp qword [rbp + 0x68], 7
cmova rax, qword [rbp + 0x50]
mov word [rax + rsi*2], r9w
mov r13, qword [rbp + 0x60]
mov rbx, qword [rbp - 0x70]
mov rax, qword [rbp - 0x68]
mov qword [rbp - 0x80], rax
mov rcx, qword [rbp + 0x50]
mov qword [rsp + 0x70], rcx
cmp rbx, rax
je 0x14000a8c4
nop dword [rax]
nop word [rax + rax]
lea r12, [rbx + 0x20]
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x14000a6fb
mov rcx, qword [rbx]
mov rdx, rcx
lea r8, [rcx + rax*2]
jmp 0x14000a702
lea r8, [rbx + rax*2]
mov rdx, rbx
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], r9
mov qword [rbp + 0x88], r9
cmp rdx, r8
jne 0x14000a739
mov rdi, r9
mov qword [rbp + 0x80], r9
mov esi, 7
mov qword [rbp + 0x88], rsi
mov word [rbp + 0x70], r9w
jmp 0x14000a759
sub r8, rdx
sar r8, 1
lea rcx, [rbp + 0x70]
call fcn.140003b50
mov rsi, qword [rbp + 0x88]
mov rdi, qword [rbp + 0x80]
xor r9d, r9d
lea r11, [rbp + 0x70]
mov r14, qword [rbp + 0x70]
cmp rsi, 7
cmova r11, r14
lea r15, [rbp + 0x50]
cmp qword [rbp + 0x68], 7
cmova r15, qword [rsp + 0x70]
cmp rdi, r13
ja 0x14000a870
mov rax, r13
sub rax, rdi
test rdi, rdi
je 0x14000a814
inc rax
lea r13, [r15 + rax*2]
mov rax, r15
movzx r10d, word [r11]
nop
mov rcx, r13
sub rcx, rax
sar rcx, 1
mov rdx, r9
je 0x14000a7ca
cmp word [rax], r10w
je 0x14000a7c7
cmp rcx, 1
je 0x14000a7ca
dec rcx
add rax, 2
cmp word [rax], r10w
jne 0x14000a7b4
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x14000a870
mov r8, rdi
mov rdx, r11
test rdi, rdi
je 0x14000a808
mov r9, rax
sub r9, r11
nop word [rax + rax]
movzx ecx, word [r9 + rdx]
cmp cx, word [rdx]
jne 0x14000a903
add rdx, 2
sub r8, 1
jne 0x14000a7f0
sub rax, r15
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x14000a870
mov r8, qword [r12 + 0x10]
cmp qword [r12 + 0x18], 7
jbe 0x14000a825
mov r12, qword [r12]
mov rdx, r12
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140004290
lea rdx, str.on_process_with_pid:
mov rcx, rax
call fcn.140003670
mov edx, dword [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str.._This_is_bannable_
call fcn.140003670
lea rdx, [0x140003850]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
cmp rsi, 7
jbe 0x14000a8a7
lea rdx, [rsi*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x14000a89f
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a90f
mov rcx, r14
call fcn.14002e2d0
add rbx, 0x40
cmp rbx, qword [rbp - 0x80]
mov r13, qword [rbp + 0x60]
mov r9d, 0
jne 0x14000a6e0
mov rcx, qword [rsp + 0x70]
mov rax, qword [rbp + 0x68]
cmp rax, 7
jbe 0x14000a8fc
lea rdx, [rax*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a8f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a916
call fcn.14002e2d0
xor edi, edi
jmp 0x14000a57e
add rax, 2
xor r9d, r9d
jmp 0x14000a7a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 7
jbe 0x14000a995
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a990
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a990
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002e2d0
movdqa xmm0, xmmword [0x140039470]
movdqu xmmword [rbp + 0xa0], xmm0
mov word [rbp + 0x90], di
mov rbx, qword [rbp - 0x70]
test rbx, rbx
je 0x14000aa10
mov rdi, qword [rbp - 0x68]
cmp rbx, rdi
je 0x14000a9d5
nop
mov rcx, rbx
call fcn.140004700
add rbx, 0x40
cmp rbx, rdi
jne 0x14000a9c0
mov rbx, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x60]
sub rdx, rbx
and rdx, 0xffffffffffffffc0
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000aa08
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000aa08
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14002e2d0
mov rcx, qword [rbp + 0x11c0]
xor rcx, rsp
call fcn.14002e2b0
lea r11, [rsp + 0x12d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001ef0
nop
int3