Function at 0x140041430
Capabilities:
Encode data using xor
Execute command
Self delete

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0xd8]
sub rsp, 0x1b0
movaps xmmword [rax - 0x38], xmm6
xor r12d, r12d
lea rcx, str.taskkill__f__im_explorer.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rdi, rax
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDC]
mov rbx, rax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, 4
call qword [sym.imp.GDI32.dll_GetStockObject]
mov r8, rax
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.USER32.dll_FillRect]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_ReleaseDC]
lea rdx, [rbp - 0x10]
lea rcx, [0x1400fd930]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm0
movups xmm1, xmmword [rcx + 0x80]
movups xmmword [rdx], xmm1
movups xmm0, xmmword [rcx + 0x90]
movups xmmword [rdx + 0x10], xmm0
mov eax, dword [rcx + 0xa0]
mov dword [rdx + 0x20], eax
movzx eax, word [rcx + 0xa4]
mov word [rdx + 0x24], ax
movzx eax, byte [rcx + 0xa6]
mov byte [rdx + 0x26], al
mov ecx, r12d
cmp dword [0x1401120a0], 2
jl 0x14004166a
movdqa xmm4, xmmword [0x1400fe330]
movdqa xmm3, xmmword [0x1400fe710]
movdqa xmm5, xmmword [str.6666]
movdqa xmm0, xmmword [str.4444444444444444]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rbp - 0xc]
movdqa xmm6, xmmword [0x1400fe360]
mov r8d, dword [rsp + 0x30]
nop word [rax + rax]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
xorps xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0xa0
jl 0x140041580
cmp ecx, 0xa7
jge 0x1400416af
movsxd rax, ecx
lea r8, [rbp - 0x10]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x4bda12f7
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
sub al, dl
add al, 0x34
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0xa7
jl 0x140041680
lea rcx, [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsSystem32__AMIDEWINx64.EXE__IVN__AMI_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsSystem32__AMIDEWINx64.EXE__SP__System_product_name_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsSystem32__AMIDEWINx64.EXE__SV__System_product_name_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0xa
lea rcx, [rbp - 0x70]
call fcn.14003f4e0
mov rbx, rax
mov r8, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 0x2e
jb 0x140041784
lea rax, [r8 + 0x2e]
mov qword [rbx + 0x10], rax
mov rdi, rbx
cmp rcx, 0xf
jbe 0x140041719
mov rdi, qword [rbx]
lea rax, [0x1400fb726]
mov esi, 0x2e
lea r15, str.cd_C:WindowsSystem32__AMIDEWINx64.EXE__SS
cmp rax, rdi
jbe 0x14004174c
lea rax, [rdi + r8]
cmp r15, rax
ja 0x14004174c
cmp rdi, r15
ja 0x140041744
mov r14, r12
jmp 0x14004174f
mov r14, rdi
sub r14, r15
jmp 0x14004174f
mov r14, rsi
inc r8
lea rcx, [rdi + 0x2e]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, r14
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8, rsi
sub r8, r14
lea rdx, [r15 + 0x2e]
add rdx, r14
lea rcx, [rdi + r14]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1400417b2
mov esi, 0x2e
mov qword [rsp + 0x28], rsi
lea r15, str.cd_C:WindowsSystem32__AMIDEWINx64.EXE__SS
mov qword [rsp + 0x20], r15
xor r9d, r9d
movzx r8d, byte [rbp + 0xe0]
mov edx, esi
mov rcx, rbx
call fcn.14004e990
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14004183a
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041835
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140041835
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ccee8
movdqa xmm0, xmmword [0x1400fe1c0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x14004188b
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041886
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140041886
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ccee8
lea rcx, str.cd_C:WindowsSystem32__AMIDEWINx64.EXE__SU_AUTO
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rdi, rax
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDC]
mov rbx, rax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, 4
call qword [sym.imp.GDI32.dll_GetStockObject]
mov r8, rax
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.USER32.dll_FillRect]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_ReleaseDC]
lea rcx, str.cd_C:WindowsSystem32__AMIDEWINx64.EXE__SK__To_Be_Filled_By_O.E.M_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsSystem32__AMIDEWINx64.EXE__SK__To_Be_Filled_By_O.E.M_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsSystem32__AMIDEWINx64.EXE__BM__AsRock_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsSystem32__AMIDEWINx64.EXE__BP__B560M_C_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0xe
lea rcx, [rbp - 0x50]
call fcn.14003f4e0
mov rbx, rax
mov r8, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 0x2e
jb 0x1400419b6
lea rax, [r8 + 0x2e]
mov qword [rbx + 0x10], rax
mov rdi, rbx
cmp rcx, 0xf
jbe 0x140041950
mov rdi, qword [rbx]
lea rax, [0x1400fb84e]
lea r15, str.cd_C:WindowsSystem32__AMIDEWINx64.EXE__BS
cmp rax, rdi
jbe 0x14004197e
lea rax, [rdi + r8]
cmp r15, rax
ja 0x14004197e
cmp rdi, r15
ja 0x140041976
mov r14, r12
jmp 0x140041981
mov r14, rdi
sub r14, r15
jmp 0x140041981
mov r14, rsi
inc r8
lea rcx, [rdi + 0x2e]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, r14
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8, rsi
sub r8, r14
lea rdx, [r15 + 0x2e]
add rdx, r14
lea rcx, [rdi + r14]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1400419e0
mov qword [rsp + 0x28], rsi
lea r15, str.cd_C:WindowsSystem32__AMIDEWINx64.EXE__BS
mov qword [rsp + 0x20], r15
xor r9d, r9d
movzx r8d, byte [rbp + 0xe0]
mov rdx, rsi
mov rcx, rbx
call fcn.14004e990
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140041a68
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041a63
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140041a63
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ccee8
movdqa xmm0, xmmword [0x1400fe1c0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140041ab9
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041ab4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140041ab4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ccee8
lea rcx, str.cd_C:WindowsSystem32__AMIDEWINx64.EXE__BT__Default_String_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsSystem32__AMIDEWINx64.EXE__BLC__Default_String_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rdi, rax
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDC]
mov rbx, rax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, 4
call qword [sym.imp.GDI32.dll_GetStockObject]
mov r8, rax
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.USER32.dll_FillRect]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_ReleaseDC]
lea rcx, str.cd_C:WindowsSystem32__AMIDEWINx64.EXE__CM__Default_String_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsSystem32__AMIDEWINx64.EXE__CV__Default_String_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0xa
lea rcx, [rbp - 0x30]
call fcn.14003f4e0
mov rbx, rax
mov r8, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 0x2e
jb 0x140041bd7
lea rax, [r8 + 0x2e]
mov qword [rbx + 0x10], rax
mov rdi, rbx
cmp rcx, 0xf
jbe 0x140041b71
mov rdi, qword [rbx]
lea rax, [0x1400fb98e]
lea r15, str.cd_C:WindowsSystem32__AMIDEWINx64.EXE__CS
cmp rax, rdi
jbe 0x140041b9f
lea rax, [rdi + r8]
cmp r15, rax
ja 0x140041b9f
cmp rdi, r15
ja 0x140041b97
mov r14, r12
jmp 0x140041ba2
mov r14, rdi
sub r14, r15
jmp 0x140041ba2
mov r14, rsi
inc r8
lea rcx, [rdi + 0x2e]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, r14
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
sub rsi, r14
lea rdx, [r15 + 0x2e]
add rdx, r14
lea rcx, [rdi + r14]
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140041c01
mov qword [rsp + 0x28], rsi
lea r15, str.cd_C:WindowsSystem32__AMIDEWINx64.EXE__CS
mov qword [rsp + 0x20], r15
xor r9d, r9d
movzx r8d, byte [rbp + 0xe0]
mov rdx, rsi
mov rcx, rbx
call fcn.14004e990
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140041c85
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041c80
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140041c80
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ccee8
movdqa xmm0, xmmword [0x1400fe1c0]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140041cd5
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041cd0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140041cd0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ccee8
lea rcx, str.cd_C:WindowsSystem32__AMIDEWINx64.EXE__CA__Default_String_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsSystem32__AMIDEWINx64.EXE__CSK__SKU_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsSystem32__AMIDEWINx64.EXE__PSN__To_Be_Filled_By_O.E.M_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsSystem32__AMIDEWINx64.exe__PAT__To_Be_Filled_By_O.E.M_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsSystem32__AMIDEWINx64.exe__PPn__To_Be_Filled_By_O.E.M_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:Windows__del__f__q_AMIDEWINx64.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.start_explorer.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r9d, 0x40
lea r8, str.Coolware_Services
lea rdx, str.Success_
xor ecx, ecx
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
jmp qword [sym.imp.USER32.dll_MessageBoxA]