Function at 0x140052270
Capabilities:
Create thread
Encode data using xor
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x318]
sub rsp, 0x410
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
movaps xmmword [rax - 0x78], xmm12
movaps xmmword [rax - 0x88], xmm13
movaps xmmword [rax - 0x98], xmm14
movaps xmmword [rax - 0xa8], xmm15
mov rax, qword [0x1400a7040]
xor rax, rsp
mov qword [rbp + 0x260], rax
movups xmm0, xmmword [0x140097040]
mov eax, dword [0x140097058]
xor esi, esi
mov edi, dword [0x1400a7090]
mov r8d, esi
movdqa xmm10, xmmword [0x140097580]
movdqa xmm7, xmmword [0x140097520]
movdqa xmm12, xmmword [0x1400975a0]
movdqa xmm8, xmmword [str.1111]
movdqa xmm6, xmmword [0x1400978c0]
mov dword [rbp - 0x80], eax
movzx eax, byte [0x14009705c]
mov byte [rbp - 0x7c], al
movups xmmword [rsp + 0x68], xmm0
movsd xmm0, qword [0x140097050]
movsd qword [rsp + 0x78], xmm0
cmp edi, 2
jl 0x14005244d
movdqa xmmword [rbp - 0x70], xmm12
lea rcx, [rsp + 0x6c]
mov edx, dword [rbp - 0x70]
nop word [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm7
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm6
pmuldq xmm1, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm10
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movd dword [rcx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm7
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm6
pmuldq xmm1, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm10
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r8d, 0x18
jl 0x140052360
cmp r8d, 0x1d
jge 0x140052491
movsxd rax, r8d
lea r9, [rsp + 0x68]
add r9, rax
nop dword [rax + rax]
mov eax, 0x5397829d
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x39
xor byte [r9 - 1], al
cmp r8d, 0x1d
jl 0x140052460
lea rcx, [rsp + 0x68]
call fcn.14003cbd0
mov qword [rsp + 0x30], rsi
lea rcx, str..MailwareApp133
mov dword [rsp + 0x28], esi
xor r9d, r9d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1400a9df8], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140052bf4
cmp byte [0x140096fd9], sil
movsd xmm0, qword [str.jOX_XMLaKB]
movzx eax, word [0x140096fd8]
movsd qword [rbp], xmm0
mov word [rbp + 8], ax
je 0x140052524
xor byte [rbp + 1], 0x3a
xor byte [rbp + 2], 0x3b
xor byte [rbp + 3], 0x3c
xor byte [rbp + 4], 0x3d
xor byte [rbp + 5], 0x3e
xor byte [rbp + 6], 0x3f
xor byte [rbp + 7], 0x40
xor byte [rbp + 8], 0x41
xor byte [rbp + 9], 0x42
mov byte [rbp], 0x53
lea rcx, [rbp]
call fcn.14003cbd0
movdqa xmm13, xmmword [0x140097560]
lea r14, str.XYZAB
movdqa xmm14, xmmword [0x140097550]
movdqa xmm15, xmmword [0x140097540]
movdqa xmm9, xmmword [0x140097590]
movdqa xmm11, xmmword [0x140097490]
mov qword [rsp + 0x28], rsi
lea r8, [0x140052150]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rax, qword [sym.imp.USER32.dll_DefWindowProcA]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0x50
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], rsi
call qword [sym.imp.USER32.dll_LoadIconW]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp - 0x30], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
xorps xmm0, xmm0
mov qword [rbp - 0x10], r14
mov edx, 0x7f00
movdqu xmmword [rbp - 0x20], xmm0
xor ecx, ecx
mov qword [rbp - 0x28], rax
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rbp - 8], rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp - 0x60]
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_RegisterClassExA]
cmp byte [0x140096a75], sil
movzx eax, word [0x140096a74]
mov word [rsp + 0x60], ax
je 0x140052614
xor byte [rsp + 0x61], 0x3a
mov byte [rsp + 0x60], 0x58
cmp byte [0x140096a75], sil
movzx eax, word [0x140096a74]
mov word [rsp + 0x64], ax
je 0x140052633
xor byte [rsp + 0x65], 0x3a
mov byte [rsp + 0x64], 0x58
mov rax, qword [rbp - 0x38]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x58], rsi
lea rdx, [rsp + 0x64]
mov qword [rsp + 0x50], rax
mov r9d, 0x80000000
mov eax, dword [rbp - 0x54]
xor ecx, ecx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], eax
mov eax, dword [rbp - 0x58]
mov dword [rsp + 0x30], eax
mov eax, dword [rbp - 0x5c]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp - 0x60]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov edx, 0xffffffec
mov r8d, 0x800a0
mov rcx, rax
mov qword [0x1400a9e50], rax
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov rcx, qword [0x1400a9e50]
mov r9d, 2
mov r8b, 0xff
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov rcx, qword [0x1400a9e50]
lea rdx, [rbp + 0x10]
movdqu xmmword [rbp + 0x10], xmm11
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x1400a9e50]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400a9e50]
call qword [sym.imp.USER32.dll_UpdateWindow]
call fcn.140048270
movups xmm0, xmmword [0x140096e70]
mov ecx, esi
movups xmm1, xmmword [0x140096e80]
mov eax, dword [0x140096eb0]
movups xmmword [rbp - 0x50], xmm0
movups xmm0, xmmword [str.__x_]
movups xmmword [rbp - 0x40], xmm1
movups xmm1, xmmword [0x140096ea0]
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm1
mov dword [rbp - 0x10], eax
cmp edi, 2
jl 0x140052830
lea rdx, [rbp - 0x50]
nop dword [rax]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 0x10]
paddd xmm2, xmm7
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm6
pmuldq xmm1, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshufhw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rdx - 0x10], xmm3
paddd xmm2, xmm7
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshufhw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rdx - 8], xmm3
cmp ecx, 0x20
jl 0x140052740
cmp ecx, 0x22
jge 0x140052871
movsxd rax, ecx
lea r8, [rbp - 0x50]
lea r8, [r8 + rax*2]
nop dword [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 2]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul edx, eax, 0x31
movzx eax, cx
inc ecx
sub ax, dx
add ax, 0x39
xor word [r8 - 2], ax
cmp ecx, 0x22
jl 0x140052840
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp + 0x20]
mov dword [rbp + 0x20], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400528c7
nop dword [rax]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rcx, rbx
test eax, eax
je 0x140052bde
lea rdx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400528a0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1400a9e00]
mov eax, esi
cdqe
lea r8, [rbp - 0x70]
mov qword [rsp + 0x38], rsi
mov r9d, 0x10
mov qword [0x1400a9e80], rax
mov edx, 0x22d084
lea rax, [rbp]
mov dword [rbp - 0x6c], ecx
mov rcx, qword [0x1400a9df8]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rbp - 0x68], rax
mov qword [rbp], rsi
mov dword [rbp - 0x70], 0x9af2b24
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov r10, qword [rbp]
mov r8d, esi
movzx eax, byte [0x140096bd4]
mov edx, dword [0x140096bd0]
mov qword [0x1400a9e78], r10
mov dword [rsp + 0x78], edx
mov byte [rsp + 0x7c], al
movups xmm2, xmmword [str._HYZ_2_10d]
movups xmmword [rsp + 0x68], xmm2
cmp edi, 2
jl 0x140052b61
movd eax, xmm2
movdqa xmm1, xmm7
movdqa xmm2, xmmword [0x140097530]
movdqa xmm0, xmm7
punpckhdq xmm0, xmm7
pmuldq xmm0, xmm6
punpckldq xmm1, xmm7
pmuldq xmm1, xmm6
movd ecx, xmm12
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm7
pmulld xmm0, xmm8
psubd xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm10
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
movd dword [rsp + 0x68], xmm1
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movd xmm1, dword [rsp + 0x6c]
pmulld xmm0, xmm8
psubd xmm2, xmm0
movd xmm0, ecx
andps xmm2, xmm10
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movdqa xmm0, xmm15
xorps xmm2, xmm1
punpckhdq xmm0, xmm15
pmuldq xmm0, xmm6
movdqa xmm1, xmm15
punpckldq xmm1, xmm15
pmuldq xmm1, xmm6
movd dword [rsp + 0x6c], xmm2
movdqa xmm2, xmm15
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movd xmm1, dword [rsp + 0x70]
pmulld xmm0, xmm8
psubd xmm2, xmm0
movd xmm0, ecx
andps xmm2, xmm10
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movdqa xmm0, xmm14
xorps xmm2, xmm1
punpckhdq xmm0, xmm14
pmuldq xmm0, xmm6
movdqa xmm1, xmm14
punpckldq xmm1, xmm14
pmuldq xmm1, xmm6
movd dword [rsp + 0x70], xmm2
movdqa xmm2, xmm14
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
movd xmm1, dword [rsp + 0x74]
psubd xmm2, xmm0
andps xmm2, xmm10
movd xmm0, ecx
packuswb xmm2, xmm2
mov r8d, 0x14
packuswb xmm2, xmm2
paddb xmm2, xmm0
movdqa xmm0, xmm13
xorps xmm2, xmm1
punpckhdq xmm0, xmm13
movd dword [rsp + 0x74], xmm2
movdqa xmm1, xmm13
pmuldq xmm0, xmm6
movdqa xmm2, xmm13
punpckldq xmm1, xmm13
pmuldq xmm1, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movd xmm1, edx
pmulld xmm0, xmm8
psubd xmm2, xmm0
movd xmm0, ecx
andps xmm2, xmm10
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
xorps xmm2, xmm1
movd dword [rsp + 0x78], xmm2
mov eax, r8d
lea r9, [rsp + 0x68]
add r9, rax
nop dword [rax]
mov eax, 0x5397829d
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x39
xor byte [r9 - 1], al
cmp r8d, 0x15
jl 0x140052b70
mov rdx, r10
lea rcx, [rsp + 0x68]
call fcn.14003cbd0
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, [0x140048ea0]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140051e10
jmp 0x140052561
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rbp + 0x28]
mov eax, ecx
mov dword [0x1400a9e00], ecx
jmp 0x1400528d8
movzx eax, byte [0x140097108]
lea rcx, [rbp]
movsd xmm0, qword [0x140097100]
xor al, 0x41
movsd qword [rbp], xmm0
xor byte [rbp + 1], 0x3a
xor byte [rbp + 2], 0x3b
xor byte [rbp + 3], 0x3c
xor byte [rbp + 4], 0x3d
xor byte [rbp + 5], 0x3e
xor byte [rbp + 6], 0x3f
xor byte [rbp + 7], 0x40
mov byte [rbp + 8], al
mov byte [rbp], 0x46
call fcn.14003cbd0
mov eax, dword [str.I_NOX_]
lea rcx, [rbp]
mov dword [rbp], eax
movzx eax, word [0x140096b90]
xor byte [rbp + 1], 0x3a
xor byte [rbp + 2], 0x3b
xor byte [rbp + 3], 0x3c
mov word [rbp + 4], ax
xor al, 0x3d
xor byte [rbp + 5], 0x3e
mov byte [rbp + 4], al
mov byte [rbp], 0x70
call fcn.140068688
mov eax, 1
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.1400537d0
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop rbp
ret