Function at 0x180035410
Capabilities:
Encode data using xor
Enumerate gui resources
Execute command
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
xorps xmm0, xmm0
lea rdx, str.winver.exe
xorps xmm1, xmm1
lea rcx, [rsp + 0x60]
xor esi, esi
mov r8d, 0xa
mov r15d, esi
movups xmmword [rsp + 0x60], xmm0
movdqu xmmword [rsp + 0x70], xmm1
call fcn.18002de60
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x10]
call fcn.180035120
mov r13, qword [rbp + 0x10]
mov r14, qword [rbp + 0x18]
cmp r13, r14
je 0x1800354c7
sub r14, r13
sar r14, 2
test r14, r14
je 0x1800354c7
mov rdi, r13
nop
mov r8d, dword [rdi]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
xor edx, edx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
lea rdi, [rdi + 4]
movsxd rax, esi
cmp rax, r14
jb 0x180035490
xor esi, esi
lea rdi, [rbp + 0x108]
mov r8d, esi
mov rbx, qword [rdi]
mov qword [rdi], rsi
cmp dword [0x1800adb58], 2
movups xmm3, xmmword [str.ECYKNeKTPI_3l__F]
movzx eax, byte [0x180053640]
mov qword [rbp + 0x110], rbx
movups xmmword [rsp + 0x40], xmm3
mov byte [rsp + 0x50], al
jl 0x1800356c6
movdqa xmm5, xmmword [0x18004e960]
movdqa xmm2, xmmword [0x18004e8e0]
movdqa xmm4, xmmword [0x18004e950]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
movd eax, xmm3
movdqa xmm3, xmmword [0x18004e900]
movaps xmmword [rsp + 0x1d0], xmm6
movdqa xmm6, xmmword [str.7777]
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
movaps xmmword [rsp + 0x1c0], xmm7
movdqa xmm7, xmmword [0x18004e970]
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
movd xmm0, eax
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
xorps xmm2, xmm0
movd dword [rsp + 0x40], xmm2
movdqa xmm2, xmmword [0x18004e8f0]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
pmulld xmm0, xmm6
psubd xmm2, xmm0
punpckldq xmm1, xmm3
movd xmm0, dword [rsp + 0x44]
andps xmm2, xmm4
pmuldq xmm1, xmm5
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
movd dword [rsp + 0x44], xmm2
movdqa xmm2, xmmword [0x18004e910]
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm2
pmulld xmm0, xmm6
psubd xmm3, xmm0
punpckldq xmm1, xmm2
movd xmm0, dword [rsp + 0x48]
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
pmuldq xmm1, xmm5
paddb xmm3, xmm7
xorps xmm3, xmm0
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
movd dword [rsp + 0x48], xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
mov r8d, 0x10
pmulld xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x1d0]
psubd xmm2, xmm0
movd xmm0, dword [rsp + 0x4c]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
movaps xmm7, xmmword [rsp + 0x1c0]
xorps xmm2, xmm0
movd dword [rsp + 0x4c], xmm2
mov eax, r8d
lea r9, [rsp + 0x40]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x94f2095
lea r9, [r9 + 1]
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x36
xor byte [r9 - 1], al
cmp r8d, 0x11
jl 0x1800356e0
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
lea rdx, str.winver.exe
xorps xmm1, xmm1
lea rcx, [rsp + 0x40]
mov r8d, 0xa
movups xmmword [rsp + 0x40], xmm0
movdqu xmmword [rsp + 0x50], xmm1
call fcn.18002de60
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.180035120
mov rax, qword [rsp + 0x68]
mov r12, qword [rsp + 0x60]
cmp r12, rax
je 0x180035a41
sub rax, r12
sar rax, 2
cmp rax, 1
ja 0x180035a41
mov edi, dword [r12]
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov byte [rbp - 0x78], r15b
mov r14, rsi
movups xmmword [rbp - 0x58], xmm0
mov byte [rbp - 0x58], r15b
xor ebx, ebx
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], 0xf
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x40], 0xf
mov qword [rbp - 0x38], r15
movdqu xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 0x10000000
mov qword [rbp - 8], rsi
movdqu xmmword [rbp], xmm0
mov dword [rbp - 0x80], edi
mov byte [rbp - 0x10], 1
nop
test r15, r15
je 0x1800357de
cmp ebx, 0x32
jle 0x1800358f3
mov ecx, 0x320
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp - 0x78]
mov dword [rbp + 0x28], edi
lea rcx, [rbp + 0x30]
call fcn.18002ee00
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0x50]
call fcn.18002ee00
mov rax, qword [rbp - 0x28]
lea rdx, [rbp - 8]
movups xmm0, xmmword [rbp - 0x38]
lea rcx, [rbp + 0xa0]
mov qword [rbp + 0x80], rax
movss xmm1, dword [rbp - 0x1c]
mov eax, dword [rbp - 0x18]
mov dword [rbp + 0x90], eax
mov eax, dword [rbp - 0x14]
mov dword [rbp + 0x94], eax
movzx eax, byte [rbp - 0x10]
movups xmmword [rbp + 0x70], xmm0
mov byte [rbp + 0x98], al
movss xmm0, dword [rbp - 0x20]
movss dword [rbp + 0x88], xmm0
movss dword [rbp + 0x8c], xmm1
call fcn.18002f400
lea rdx, [rbp + 0x28]
lea rcx, [0x1800345b0]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rdx, [rbp + 0xa0]
lea rcx, [rsp + 0x40]
call fcn.18002f400
lea rcx, [rbp + 0x28]
call fcn.18002f5c0
test r14, r14
je 0x1800358c6
sub rsi, r14
and rsi, 0xfffffffffffffff8
cmp rsi, 0x1000
jb 0x1800358bb
mov rcx, qword [r14 - 8]
add rsi, 0x27
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x180035a3a
mov r14, rcx
mov rdx, rsi
mov rcx, r14
call fcn.18004b988
mov r14, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
sub rax, r14
sar rax, 3
cmp rax, 1
ja 0x1800359e5
mov r15, qword [r14]
inc ebx
mov edi, dword [rbp - 0x80]
jmp 0x1800357d0
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_SetMenu]
lea rax, [rbp + 0x108]
xor ebx, ebx
mov rdi, qword [rax]
mov edx, 0xfffffff0
mov r8d, 0x10000000
mov qword [rax], rbx
mov rcx, r15
call qword [0x1800ae058]
lea rax, [rbp + 0x108]
mov edx, 0xffffffec
mov r8d, 0x80020
mov qword [rax], rbx
mov rcx, r15
call qword [0x1800ae058]
lea rax, [rbp + 0x108]
mov ecx, 1
mov qword [rax], rbx
mov rax, qword [0x1800ae070]
call rax
mov ebx, eax
xor ecx, ecx
lea rax, [rbp + 0x108]
mov qword [rax], 0
mov rdx, qword [0x1800ae070]
call rdx
lea rcx, [rbp + 0x108]
mov dword [rsp + 0x30], 0x80
mov qword [rcx], 0
xor r9d, r9d
mov rcx, r15
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov dword [rsp + 0x20], eax
xor edx, edx
call qword [0x1800ae0c0]
lea rax, [rbp + 0x108]
xor ecx, ecx
mov qword [rax], 0
mov rax, qword [0x1800ae070]
call rax
mov dword [0x1800ae428], eax
lea rbx, [rbp + 0x108]
mov qword [rbx], 0
mov ecx, 1
mov rax, qword [0x1800ae070]
call rax
mov dword [0x1800ae42c], eax
mov qword [rbx], rdi
test r14, r14
je 0x180035a21
sub rsi, r14
and rsi, 0xfffffffffffffff8
cmp rsi, 0x1000
jb 0x180035a16
mov rcx, qword [r14 - 8]
add rsi, 0x27
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x180035ab3
mov r14, rcx
mov rdx, rsi
mov rcx, r14
call fcn.18004b988
lea rcx, [rbp - 0x80]
call fcn.18002f5c0
mov rbx, qword [rbp + 0x110]
lea rdi, [rbp + 0x108]
jmp 0x180035a44
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r15, rsi
test r12, r12
je 0x180035a7f
mov rdx, qword [rsp + 0x70]
mov rax, r12
sub rdx, r12
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x180035a77
mov r12, qword [r12 - 8]
add rdx, 0x27
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180035ab3
mov rcx, r12
call fcn.18004b988
mov qword [rdi], rbx
test r13, r13
je 0x180035ac2
mov rdx, qword [rbp + 0x20]
mov rax, r13
sub rdx, r13
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x180035aba
mov r13, qword [r13 - 8]
add rdx, 0x27
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180035aba
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r13
call fcn.18004b988
lea r11, [rsp + 0x1e0]
mov rax, r15
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret