Function at 0x140057450
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Enumerate processes
Execute command
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push r12
push r15
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x140070040]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov byte [rsp + 0x78], 0x93
xor ebx, ebx
mov byte [rsp + 0x79], 0x9c
movabs r12, 0x704bd73bab1c3fe
mov byte [rsp + 0x7a], 0x70
mov r10, r12
mov byte [rsp + 0x7b], 0xd
mov r9d, ebx
movzx eax, byte [rsp + 0x78]
mov r15d, 0xf
lea rax, [rsp + 0x78]
sub r10, rax
nop dword [rax]
nop word [rax + rax]
mov rcx, r9
lea r8, [rsp + 0x78]
add r8, r9
and ecx, r15d
cmp rcx, r15
mov rdx, r12
cmovae rcx, r15
shl cl, 2
lea eax, [r10 + r8]
shr rdx, cl
and dl, r15b
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rsp + r9 + 0x78], dl
inc r9
cmp r9, 4
jb 0x1400574c0
lea rcx, [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rsp + 0x30], rbx
lea rcx, str..skibidisoftware
mov dword [rsp + 0x28], ebx
xor r9d, r9d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1402ac158], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14005790f
mov byte [rsp + 0x40], 0xf6
movabs r11, 0x26d6b641f8128bb2
mov byte [rsp + 0x41], 0xd7
mov r10, r11
mov byte [rsp + 0x42], 0xcd
mov r9, rbx
mov byte [rsp + 0x43], 0xc9
mov byte [rsp + 0x44], 0xda
mov byte [rsp + 0x45], 0xdf
mov byte [rsp + 0x46], 0xc4
mov byte [rsp + 0x47], 0xd3
mov byte [rsp + 0x48], pe_nt_image_headers64
mov byte [rsp + 0x49], 0xd3
mov byte [rsp + 0x4a], 0xd3
mov byte [rsp + 0x4b], 0xd3
mov byte [rsp + 0x4c], 0xd6
mov byte [rsp + 0x4d], 0xc6
mov byte [rsp + 0x4e], 0xeb
mov byte [rsp + 0x4f], 0x94
mov byte [rsp + 0x50], 0xa9
mov byte [rsp + 0x51], 0xa6
mov byte [rsp + 0x52], 0xf9
mov byte [rsp + 0x53], 0xf9
mov byte [rsp + 0x54], 0xe9
mov byte [rsp + 0x55], 0x95
mov byte [rsp + 0x56], 0xa8
mov byte [rsp + 0x57], 0xaf
mov byte [rsp + 0x58], 0xbb
mov byte [rsp + 0x59], 0xbf
mov byte [rsp + 0x5a], 0xa3
mov byte [rsp + 0x5b], 0xa8
mov byte [rsp + 0x5c], 0xaf
mov byte [rsp + 0x5d], 0xec
mov byte [rsp + 0x5e], 0xb3
mov byte [rsp + 0x5f], 0xab
mov qword [rsp + 0x200], rsi
mov byte [rsp + 0x60], 0xb5
mov qword [rsp + 0x208], rdi
mov byte [rsp + 0x61], 0xd8
movzx eax, byte [rsp + 0x40]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x210], r14
sub r10, rax
movaps xmmword [rsp + 0x1d0], xmm6
nop dword [rax]
mov rcx, r9
lea r8, [rsp + 0x40]
add r8, r9
and ecx, r15d
cmp rcx, r15
mov rdx, r11
cmovae rcx, r15
shl cl, 2
lea eax, [r10 + r8]
shr rdx, cl
and dl, r15b
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rsp + r9 + 0x40], dl
inc r9
cmp r9, 0x22
jb 0x140057630
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp - 0x70]
mov dword [rbp - 0x70], 0x130
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400576c8
nop dword [rax]
nop word [rax + rax]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x44]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rdi
test eax, eax
je 0x140057901
lea rdx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400576a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [0x1402ac158]
lea r8, [rsp + 0x68]
mov qword [rsp + 0x38], rbx
mov r9d, 0x10
mov dword [0x1402ac160], eax
mov edx, 0x22d158
mov dword [rsp + 0x6c], eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x78], rbx
mov dword [rsp + 0x68], 0x9af2b37
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rsp + 0x78]
lea r8, [rsp + 0x40]
mov rcx, qword [0x1402ac2c8]
mov r9d, 0x10
mov qword [rsp + 0x38], rbx
mov edx, 0x2359e0
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rcx], rax
mov eax, dword [0x1402ac160]
mov rcx, qword [0x1402ac158]
mov dword [rsp + 0x40], eax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
mov qword [rbp - 0x80], rbx
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.PID:
call fcn.14005c620
mov edx, dword [0x1402ac160]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x14005c800]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.IMG:
call fcn.14005c620
mov rcx, qword [0x1402ac2c8]
mov rdx, qword [rcx]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x14005c800]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movss xmm6, dword [0x1400674e4]
mov esi, ebx
mov r14d, ebx
nop dword [rax]
nop word [rax + rax]
mov rax, qword [0x1402ac2c8]
movsxd rdx, r14d
mov rcx, qword [rax]
add rcx, rdx
mov qword [0x1402ac120], rcx
add rcx, 0x12300468
call fcn.14005c0a0
mov rdi, rax
lea rcx, [rax + 0x30]
call fcn.14005c0a0
test rdi, rdi
je 0x14005784a
test rax, rax
je 0x14005784a
lea rcx, [rax + 0xc0]
call fcn.14005c0a0
cmp rax, rdi
je 0x14005785f
inc esi
add r14d, 0x1000
movd xmm0, esi
cvtdq2ps xmm0, xmm0
comiss xmm6, xmm0
ja 0x140057800
movaps xmm6, xmmword [rsp + 0x1d0]
mov r14, qword [rsp + 0x210]
mov rdi, qword [rsp + 0x208]
mov rsi, qword [rsp + 0x200]
mov byte [rsp + 0x78], 0x93
mov byte [rsp + 0x79], 0x9c
mov byte [rsp + 0x7a], 0x70
mov byte [rsp + 0x7b], 0xd
movzx eax, byte [rsp + 0x78]
nop dword [rax + rax]
movzx eax, byte [rsp + rbx + 0x78]
mov rcx, rbx
and ecx, r15d
mov rdx, r12
cmp rcx, r15
cmovae rcx, r15
shl cl, 2
shr rdx, cl
and dl, r15b
xor dl, al
lea eax, [rbx - 2]
xor dl, al
mov byte [rsp + rbx + 0x78], dl
inc rbx
cmp rbx, 4
jb 0x1400578a0
lea rcx, [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.14005cf60
mov rbx, qword [rsp + 0x218]
add rsp, 0x1e0
pop r15
pop r12
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp - 0x68]
jmp 0x1400576d3
mov r8, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs r9, 0xcb4431baf5e4005a
mov byte [rsp + 0x40], 0x14
mov byte [rsp + 0x41], 0x2c
mov byte [rsp + 0x42], 0x35
mov byte [rsp + 0x43], 0x2b
mov byte [rsp + 0x44], 0x3f
mov byte [rsp + 0x45], 0x23
mov byte [rsp + 0x46], 0x45
mov byte [rsp + 0x47], 0x27
mov byte [rsp + 0x48], 0x1b
mov byte [rsp + 0x49], 6
mov byte [rsp + 0x4a], 0x42
mov byte [rsp + 0x4b], 0x12
mov byte [rsp + 0x4c], 0x42
mov byte [rsp + 0x4d], 0x2f
mov byte [rsp + 0x4e], 0xc
mov byte [rsp + 0x4f], 4
mov byte [rsp + 0x50], 4
mov byte [rsp + 0x51], 0xb
mov byte [rsp + 0x52], 8
mov byte [rsp + 0x53], 0x4c
mov byte [rsp + 0x54], 0x6a
movzx eax, byte [rsp + 0x40]
nop
movzx eax, byte [rsp + rbx + 0x40]
mov rcx, rbx
and ecx, r15d
mov rdx, r9
cmp rcx, r15
cmovae rcx, r15
shl cl, 2
shr rdx, cl
and dl, r15b
xor dl, al
lea eax, [rbx + 0x5a]
xor dl, al
mov byte [rsp + rbx + 0x40], dl
inc rbx
cmp rbx, 0x15
jb 0x140057990
lea rdx, [rsp + 0x40]
mov rcx, r8
call fcn.14005c620
lea rdx, [0x14005c800]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3