Function at 0x1400422f0
Capabilities:
Contain obfuscated stackstrings
Create thread
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x290]
sub rsp, 0x390
xor r14d, r14d
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdi, rax
lea rdx, [rbp + 0x2d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edx, dword [rbp + 0x2d0]
and edx, 0xffffffbf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
movabs r15, 0x27b47de5d8c491c5
mov qword [rbp - 0x40], r15
movabs r12, 0xe46a3c209be26f12
mov qword [rbp - 0x38], r12
movabs r13, 0x1be3a13fcf25b747
mov qword [rbp - 0x30], r13
movabs rsi, 0x87a62a6a370c199c
mov qword [rbp - 0x28], rsi
movabs rax, 0x53d13aa89196e58b
mov qword [rsp + 0x60], rax
movabs rax, 0x963a5943f2940a56
mov qword [rsp + 0x68], rax
movabs rax, 0x6886c84bbd40c728
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rsi
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rbp - 0x30]
pxor xmm1, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm1
mov dword [rbp - 0x50], 0x72657375
mov dword [rbp - 0x4c], 0x642e3233
mov word [rbp - 0x48], 0x6c6c
mov byte [rbp - 0x46], r14b
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [rbp - 0x60], 0x336e6977
mov dword [rbp - 0x5c], 0x642e7532
mov word [rbp - 0x58], 0x6c6c
mov byte [rbp - 0x56], r14b
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ecx, ecx
mov qword [rbp - 0x50], rcx
mov word [rbp - 0x48], cx
mov byte [rbp - 0x46], cl
movabs rbx, 0xe1b70a8129860ec9
movabs rdi, 0xccf5383c55baced6
test rax, rax
je 0x140042470
mov qword [rbp - 0x60], rcx
mov word [rbp - 0x58], cx
mov byte [rbp - 0x56], cl
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140042470
mov qword [0x1400e9978], rax
jmp 0x14004258a
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rdi
movabs rax, 0x4bdd1ca3f899ba9e
mov qword [rsp + 0x60], rax
movabs rax, 0x8a031c4fefc20b77
mov qword [rsp + 0x68], rax
movabs rax, 0x7e99c853ae4cc32e
mov qword [rsp + 0x70], rax
movabs rax, 0xeec85f075a637abc
mov qword [rsp + 0x78], rax
movabs rax, 0xeb9664ee40f26faa
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rdi
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
pxor xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
pxor xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x80], xmm0
lea rcx, [rsp + 0x60]
call fcn.1400387c0
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], rsi
movabs rax, 0x53dd1cb2f899ba9e
mov qword [rsp + 0x60], rax
movabs rax, 0x960e1c44fa8d0332
mov qword [rsp + 0x68], rax
movabs rax, 0x11cd8f11bd40c12e
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rsi
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
pxor xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x70], xmm1
lea rcx, [rsp + 0x60]
call fcn.1400387c0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], rsi
movabs rax, 0x27d57da2d8859190
mov qword [rsp + 0x60], rax
movabs rax, 0xe40f3c0e9b876f7f
mov qword [rsp + 0x68], rax
movabs rax, 0x1be3a13fcf40b73f
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rsi
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
pxor xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x70], xmm1
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov edi, r14d
cmp rax, 0xffffffffffffffff
je 0x14004268e
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x54]
call fcn.140050ac0
mov dword [rbp + 0x50], 0x238
lea rdx, [rbp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140042685
lea rdx, [rbp + 0x7c]
lea rcx, [rsp + 0x60]
call fcn.140060a90
test eax, eax
jne 0x140042649
mov edi, dword [rbp + 0x58]
jmp 0x140042685
lea rdx, [rbp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140042685
nop word [rax + rax]
lea rdx, [rbp + 0x7c]
lea rcx, [rsp + 0x60]
call fcn.140060a90
test eax, eax
cmove edi, dword [rbp + 0x58]
lea rdx, [rbp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140042660
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1400e9984], edi
movabs rbx, 0x7ac61895a8a5fc9e
test edi, edi
jne 0x140042721
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], rsi
mov qword [rsp + 0x60], rbx
movabs rax, 0x97195943f4901f32
mov qword [rsp + 0x68], rax
movabs rax, 0x6e8cc71fbb4ad967
mov qword [rsp + 0x70], rax
movabs rax, 0x87a62a6a3d2d7df2
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
pxor xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x70], xmm1
lea rcx, [rsp + 0x60]
call fcn.1400387c0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [0x1400e9984]
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], rsi
movabs rax, 0x7c70e80bbabe395
mov qword [rsp + 0x60], rax
movabs rax, 0x804f1c1eb6c22b5b
mov qword [rsp + 0x68], rax
movabs rax, 0x1be3a13fcf25b74d
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rsi
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
pxor xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x70], xmm1
mov edx, edi
lea rcx, [rsp + 0x60]
call fcn.1400387c0
mov dword [rsp + 0x6c], r14d
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r14
lea rdi, [rsp + 0x60]
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov dword [rsp + 0x60], r14d
mov dword [rsp + 0x68], 0xdeadbeef
mov eax, dword [0x1400e9984]
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x70], r14
xor edx, edx
lea rcx, [rsp + 0x60]
call qword [0x1400e9978]
mov rdx, qword [rsp + 0x70]
mov qword [0x1400e9970], rdx
test rdx, rdx
jne 0x1400428f9
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], rsi
movabs rax, 0xe1b70a8129860ec9
mov qword [rbp - 0x20], rax
movabs rax, 0xccf5383c55baced6
mov qword [rbp - 0x18], rax
movabs rax, 0xc3d759ab98c7aa4b
mov qword [rbp - 0x10], rax
movabs rcx, 0x69f0b406786b5ae0
mov qword [rbp - 8], rcx
mov qword [rsp + 0x60], rbx
movabs rax, 0xc40e594cf2830932
mov qword [rsp + 0x68], rax
movabs rax, 0x79c3d55aa805d833
mov qword [rsp + 0x70], rax
movabs rax, 0xf5c24e0b17696afd
mov qword [rsp + 0x78], rax
movabs rax, 0x91976cee09f57dac
mov qword [rbp - 0x80], rax
movabs rax, 0xa5d54b4f30d9a1a4
mov qword [rbp - 0x78], rax
movabs rax, 0xc9b37c8ba6ea8a2f
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rcx
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
pxor xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
pxor xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [rbp - 0x70]
pxor xmm1, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x70], xmm1
mov edx, dword [0x1400e9984]
lea rcx, [rsp + 0x60]
call fcn.1400387c0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [0x1400e9970]
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], rsi
movabs rax, 0x46f65d80bfa5fc8c
mov qword [rsp + 0x60], rax
movabs rax, 0x9c5a1c1eb6c20a61
mov qword [rsp + 0x68], rax
movabs rax, 0x1be3a1359749db62
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rsi
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
pxor xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x70], xmm1
lea rcx, [rsp + 0x60]
call fcn.1400387c0
cmp qword [0x1400e9970], r14
je 0x1400429e8
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], rsi
movabs rax, 0x4dda38c585efcacf
mov qword [rsp + 0x60], rax
movabs rax, 0x8b331c0eb5cc1d7d
mov qword [rsp + 0x68], rax
movabs rax, 0x74a4815abd449732
mov qword [rsp + 0x70], rax
movabs rax, 0x87a62a6a372d38f8
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rbp - 0x30]
pxor xmm1, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm1
lea rcx, [rsp + 0x60]
call fcn.1400387c0
lea rdi, [0x14003bd60]
nop
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x140040f00]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movups xmm0, xmmword [str.AsusSoftwareManagerAgent]
movups xmmword [rsp + 0x60], xmm0
movsd xmm0, qword [0x1400b3190]
movsd qword [rsp + 0x70], xmm0
movzx eax, byte [0x1400b3198]
mov byte [rsp + 0x78], al
mov qword [rbp], 0x50
mov rax, qword [sym.imp.USER32.dll_DefWindowProcA]
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x18], r14
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconA]
mov qword [rbp + 0x20], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rbp + 0x28], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x30], xmm0
lea rax, [rsp + 0x60]
mov qword [rbp + 0x40], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconA]
mov qword [rbp + 0x48], rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rcx, [rbp]
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov qword [rsp + 0x58], r14
mov rax, qword [rbp + 0x18]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov eax, dword [rbp - 0x44]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp - 0x48]
mov dword [rsp + 0x30], eax
mov eax, dword [rbp - 0x4c]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp - 0x50]
mov dword [rsp + 0x20], eax
mov r9d, 0x80000000
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x1400e9360], rax
mov edx, 0xffffffec
mov r8d, 0x800a0
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov r9d, 2
mov r8b, 0xff
xor edx, edx
mov rcx, qword [0x1400e9360]
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
movdqa xmm0, xmmword [0x1400b3700]
movdqu xmmword [rbp - 0x40], xmm0
lea rdx, [rbp - 0x40]
mov rcx, qword [0x1400e9360]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov edx, 5
mov rcx, qword [0x1400e9360]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400e9360]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, qword [0x1400e9360]
call fcn.1400406e0
mov ecx, 8
call fcn.14004cd94
mov qword [rax], rdi
mov qword [rbp + 0x2d8], rax
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x14004bb80]
xor edx, edx
xor ecx, ecx
call fcn.140060fa4
mov qword [rbp - 0x60], rax
test rax, rax
je 0x140042c03
cmp dword [rbp - 0x58], 0
je 0x140042bf8
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call fcn.14004ea38
test eax, eax
jne 0x140042bf0
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
call fcn.140040b90
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400429f0
mov ecx, eax
call fcn.14004d9cc
int3
mov ecx, 1
call fcn.14004da08
nop
mov dword [rbp - 0x58], r14d
mov ecx, 6
call fcn.14004da08
int3