Function at 0x406000
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows
Run powershell expression

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42779e
mov eax, dword fs:[0]
push eax
mov eax, 0x11b0
call fcn.004265c0
mov eax, dword [0x439040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1114]
push str.____Found_ImportCode_string:_Invoke_RestMethod
push str.Invoke_RestMethod
mov dword [ebp - 0x1140], eax
call fcn.00405dc0
push str.____Found_ImportCode_string:_Invoke_Expression
push str.Invoke_Expression
lea ecx, [ebp - 0x10e4]
mov dword [ebp - 4], 0
call fcn.00405dc0
push 0xd
xorps xmm0, xmm0
mov byte [ebp - 4], 1
push str.import_base64
lea ecx, [ebp - 0x10b4]
mov dword [ebp - 0x10a4], 0
movups xmmword [ebp - 0x10b4], xmm0
mov dword [ebp - 0x10a0], 0
call fcn.00402080
push 0x2d
xorps xmm0, xmm0
mov byte [ebp - 4], 2
push str.____Found_ImportCode_string:_import_base64
lea ecx, [ebp - 0x109c]
mov dword [ebp - 0x108c], 0
movups xmmword [ebp - 0x109c], xmm0
mov dword [ebp - 0x1088], 0
call fcn.00402080
lea edi, [ebp - 0x1114]
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x1084]
mov dword [ebp - 0x1138], 0
sub ecx, edi
mov dword [ebp - 0x1134], 0
mov eax, 0x2aaaaaab
mov dword [ebp - 0x1130], 0
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x4061ee
cmp eax, 0x5555555
ja 0x40692d
lea esi, [eax + eax*2]
shl esi, 4
mov dword [ebp - 0x1124], esi
cmp esi, 0x1000
jb 0x406163
lea eax, [esi + 0x23]
cmp eax, esi
jbe 0x406932
push eax
call fcn.0042601c
add esp, 4
test eax, eax
je 0x406386
lea esi, [eax + 0x23]
and esi, 0xffffffe0
mov dword [esi - 4], eax
jmp 0x406176
test esi, esi
je 0x406174
push esi
call fcn.0042601c
add esp, 4
mov esi, eax
jmp 0x406176
xor esi, esi
mov eax, dword [ebp - 0x1124]
add eax, esi
mov dword [ebp - 0x1138], esi
mov dword [ebp - 0x1130], eax
lea eax, [ebp - 0x1138]
mov dword [ebp - 0x1134], esi
mov dword [ebp - 0x1128], eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1084]
mov byte [ebp - 4], 5
cmp edi, eax
je 0x4061e8
push edi
mov ecx, esi
mov dword [ebp - 0x1148], esi
call fcn.00404d40
lea eax, [edi + 0x18]
mov byte [ebp - 4], 6
lea ecx, [esi + 0x18]
push eax
call fcn.00404d40
add esi, 0x30
mov byte [ebp - 4], 5
add edi, 0x30
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x1084]
cmp edi, eax
jne 0x4061b3
mov dword [ebp - 0x1134], esi
push 0x405fd0
push 3
push 0x30
lea eax, [ebp - 0x1114]
mov byte [ebp - 4], 8
push eax
call fcn.0042649f
push dword [ebp - 0x1140]
lea eax, [ebp - 0x12]
push eax
call fcn.00405f50
add esp, 8
lea ecx, [ebp - 0x1129]
push ecx
lea ecx, [ebp - 0x12]
push ecx
push eax
lea ecx, [ebp - 0x106c]
call fcn.00405e80
mov ecx, dword [ebp - 0x1058]
mov eax, ecx
mov esi, dword [ebp - 0x105c]
sub eax, esi
mov byte [ebp - 4], 9
cmp eax, 0x16
jb 0x4062ec
cmp ecx, 7
lea edx, [ebp - 0x106c]
lea eax, [esi + 0x16]
cmova edx, dword [ebp - 0x106c]
mov dword [ebp - 0x105c], eax
mov dword [ebp - 0x1118], edx
cmp edx, 0x42b24c
jae 0x406296
lea eax, [edx + esi*2]
cmp eax, str.memory_scanner.exe__p
jb 0x406296
cmp edx, str.memory_scanner.exe__p
ja 0x40628a
xor edi, edi
jmp 0x40629b
mov edi, edx
sub edi, str.memory_scanner.exe__p
sar edi, 1
jmp 0x40629b
mov edi, 0x16
lea eax, [esi*2 + 2]
push eax
lea ecx, [edx + 0x2c]
push edx
push ecx
call sub.VCRUNTIME140.dll_memmove
lea esi, [edi + edi]
push esi
push str.memory_scanner.exe__p
push dword [ebp - 0x1118]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp - 0x1118]
lea edx, [edi*2 + 0x42b24c]
mov eax, 0x16
add ecx, esi
sub eax, edi
add eax, eax
push eax
push edx
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x24
lea eax, [ebp - 0x106c]
jmp 0x406308
push 0x16
push str.memory_scanner.exe__p
push 0
push dword [ebp - 0x1128]
lea ecx, [ebp - 0x106c]
push 0x16
call fcn.00402560
xorps xmm0, xmm0
mov dword [ebp - 0x1074], 0
movups xmmword [ebp - 0x1084], xmm0
mov dword [ebp - 0x1070], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x1084], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1074], xmm0
mov byte [ebp - 4], 0xb
xor ecx, ecx
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov ecx, dword [ebp - 0x1058]
cmp ecx, 7
jbe 0x406396
mov edx, dword [ebp - 0x106c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40638c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40638c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0042604c
add esp, 8
xor eax, eax
mov dword [ebp - 0x105c], 0
push eax
mov word [ebp - 0x106c], ax
mov dword [ebp - 0x1164], eax
lea eax, [ebp - 0x1168]
push eax
lea eax, [ebp - 0x113c]
mov dword [ebp - 0x1058], 7
push eax
lea eax, [ebp - 0x111c]
mov dword [ebp - 0x1168], 0xc
push eax
mov dword [ebp - 0x1160], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push 0
push 1
push dword [ebp - 0x111c]
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 0x40
lea eax, [ebp - 0x11b8]
mov dword [ebp - 0x11bc], 0x44
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 0x113c]
lea ecx, [ebp - 0x1178]
or dword [ebp - 0x1190], 0x101
add esp, 0xc
mov dword [ebp - 0x1180], eax
xor eax, eax
cmp dword [ebp - 0x1070], 7
mov word [ebp - 0x118c], ax
lea eax, [ebp - 0x1084]
cmova eax, dword [ebp - 0x1084]
push ecx
lea ecx, [ebp - 0x11bc]
push ecx
push 0
push 0
push 0x10
push 1
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4068a0
push dword [ebp - 0x113c]
call esi
push 0x1000
lea eax, [ebp - 0x103c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1124]
push 0
push eax
push 0x1000
lea eax, [ebp - 0x103c]
push eax
push dword [ebp - 0x111c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x406882
mov eax, dword [ebp - 0x1124]
test eax, eax
je 0x40687c
shr eax, 1
lea ecx, [ebp - 0x103c]
add ecx, eax
lea edx, [ebp - 0x103c]
mov dword [ebp - 0x1120], ecx
xorps xmm0, xmm0
movups xmmword [ebp - 0x1054], xmm0
cmp edx, ecx
jne 0x406515
xor eax, eax
mov dword [ebp - 0x1044], 0
mov dword [ebp - 0x1040], 7
mov word [ebp - 0x1054], ax
jmp 0x4065e3
xor edi, edi
lea esi, [ebp - 0x103c]
mov dword [ebp - 0x1044], edi
mov edx, 7
mov dword [ebp - 0x1040], edx
cmp eax, 0x7ffffffe
ja 0x406937
cmp eax, edx
jbe 0x406590
or eax, edx
cmp eax, 0x7ffffffe
jbe 0x40654d
mov eax, SysReAllocString
jmp 0x406558
cmp eax, 0xa
mov ecx, 0xa
cmovb eax, ecx
mov dword [ebp - 0x1118], eax
lea eax, [ebp - 0x1118]
push eax
lea eax, [ebp - 0x1054]
push eax
call fcn.00402010
mov edx, dword [ebp - 0x1118]
add esp, 8
mov dword [ebp - 0x1054], eax
mov dword [ebp - 0x1040], edx
nop word [eax + eax]
movsx ax, byte [esi]
lea ecx, [ebp - 0x1054]
cmp edx, 7
cmova ecx, dword [ebp - 0x1054]
inc esi
movzx eax, ax
mov word [ecx + edi*2], ax
mov edi, dword [ebp - 0x1044]
inc edi
mov dword [ebp - 0x1044], edi
cmp esi, dword [ebp - 0x1120]
je 0x4065c9
mov edx, dword [ebp - 0x1040]
jmp 0x406590
cmp dword [ebp - 0x1040], 7
lea eax, [ebp - 0x1054]
cmova eax, dword [ebp - 0x1054]
xor ecx, ecx
mov word [eax + edi*2], cx
mov esi, dword [ebp - 0x1138]
mov eax, dword [ebp - 0x1134]
mov edx, dword [ebp - 0x1054]
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x1144], esi
mov dword [ebp - 0x1128], eax
mov dword [ebp - 0x1120], edx
cmp esi, eax
je 0x406815
cmp dword [esi + 0x14], 7
lea eax, [esi + 0x18]
mov dword [ebp - 0x1148], eax
mov eax, dword [esi + 0x10]
jbe 0x40662e
mov ecx, dword [esi]
mov edx, ecx
lea eax, [ecx + eax*2]
jmp 0x406633
lea eax, [esi + eax*2]
mov edx, esi
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x2c], xmm0
cmp edx, eax
jne 0x406660
xor ecx, ecx
mov dword [ebp - 0x18], 7
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov word [ebp - 0x2c], ax
jmp 0x406671
sub eax, edx
lea ecx, [ebp - 0x2c]
sar eax, 1
push eax
push edx
call fcn.00402080
mov ecx, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], 7
lea esi, [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
lea edi, [ebp - 0x1054]
mov eax, dword [ebp - 0x1044]
cmova esi, edx
cmp dword [ebp - 0x1040], 7
mov byte [ebp - 4], 0xd
cmova edi, dword [ebp - 0x1120]
mov dword [ebp - 0x1118], edx
mov dword [ebp - 0x114c], esi
mov dword [ebp - 0x115c], edi
cmp ecx, eax
ja 0x4067b9
sub eax, ecx
test ecx, ecx
je 0x40675e
inc eax
mov edx, edi
lea eax, [edi + eax*2]
movzx edi, word [esi]
mov dword [ebp - 0x1158], eax
mov dword [ebp - 0x1154], edi
sub eax, edx
mov esi, 0
sar eax, 1
je 0x4066ff
movzx ecx, word [edx]
cmp cx, di
je 0x4066fa
cmp eax, 1
je 0x4066fc
movzx ecx, word [edx + 2]
add edx, 2
dec eax
cmp cx, di
jne 0x4066e8
mov esi, edx
mov ecx, dword [ebp - 0x1c]
mov edx, esi
test edx, edx
je 0x4067b3
mov edi, ecx
mov ecx, dword [ebp - 0x114c]
mov esi, ecx
test edi, edi
je 0x406751
mov eax, edx
sub eax, ecx
mov dword [ebp - 0x1150], eax
movzx ecx, word [eax + esi]
movzx eax, word [esi]
cmp cx, ax
jne 0x40673d
add esi, 2
sub edi, 1
je 0x406751
mov eax, dword [ebp - 0x1150]
jmp 0x406721
mov edi, dword [ebp - 0x1154]
add edx, 2
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1158]
jmp 0x4066d5
sub edx, dword [ebp - 0x115c]
sar edx, 1
cmp edx, 0xffffffff
je 0x4067b3
mov ecx, dword [ebp - 0x1148]
cmp dword [ecx + 0x14], 7
mov eax, dword [ecx + 0x10]
jbe 0x40676f
mov ecx, dword [ecx]
push eax
push ecx
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.00402230
push str.on_process_with_pid:
push eax
call fcn.00404830
add esp, 0x14
mov ecx, eax
push str.._This_is_bannable_
push dword [ebp - 0x1140]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
push eax
call fcn.00404830
add esp, 8
mov ecx, eax
push 0x4026c0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
mov edx, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 0xc
cmp ecx, 7
jbe 0x4067f4
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4067ea
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406386
push ecx
push edx
call fcn.0042604c
add esp, 8
mov esi, dword [ebp - 0x1144]
add esi, 0x30
mov dword [ebp - 0x1144], esi
cmp esi, dword [ebp - 0x1128]
jne 0x406613
mov edx, dword [ebp - 0x1120]
mov eax, dword [ebp - 0x1040]
mov byte [ebp - 4], 0xb
cmp eax, 7
jbe 0x406853
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x406849
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406386
push ecx
push edx
call fcn.0042604c
add esp, 8
push 0
lea eax, [ebp - 0x1124]
push eax
push 0x1000
lea eax, [ebp - 0x103c]
push eax
push dword [ebp - 0x111c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4064c1
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push dword [ebp - 0x1178]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x1178]
call esi
push dword [ebp - 0x1174]
call esi
push dword [ebp - 0x111c]
call esi
mov ecx, dword [ebp - 0x1070]
cmp ecx, 7
jbe 0x4068ea
mov edx, dword [ebp - 0x1084]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4068e0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4068e0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0042604c
add esp, 8
xor eax, eax
mov dword [ebp - 0x1074], 0
lea ecx, [ebp - 0x1138]
mov dword [ebp - 0x1070], 7
mov word [ebp - 0x1084], ax
call fcn.00406b30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00426399
mov esp, ebp
pop ebp
ret
call fcn.004054c0
call fcn.00403d70
call fcn.00403e20
int3