Function at 0x140064420
Capabilities:
Contain obfuscated stackstrings
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
xorps xmm0, xmm0
movups xmmword [rbp + 0xf], xmm0
movups xmmword [rbp + 0x1f], xmm0
movups xmmword [rbp + 0x2f], xmm0
lea rsi, [rbp + 0x5f]
movabs r15, 0xff00ff00ff00ff00
xor r14d, r14d
nop word [rax + rax]
mov word [rbp - 0x22], 0x73
mov dword [rbp - 0x2d], 0x78657041
mov dword [rbp - 0x29], 0x67654c20
mov word [rbp - 0x25], 0x6e65
mov byte [rbp - 0x23], 0x64
mov byte [rbp - 0x20], 0
mov word [rbp - 0x30], 0x31
mov dword [rbp - 0x39], 0x70736552
mov dword [rbp - 0x35], 0x306e7761
mov byte [rbp - 0x31], 0x30
mov byte [rbp - 0x2e], 0
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], rsi
mov rbx, qword [rsi]
mov rax, rbx
xor rax, r15
mov qword [rbp - 0x19], rax
mov qword [rsi], r14
mov rax, qword [0x140151ea8]
lea rdx, [rbp - 0x2d]
lea rcx, [rbp - 0x39]
call rax
nop
mov qword [rsi], rbx
test rax, rax
je 0x14006462c
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], rsi
mov rax, rbx
xor rax, r15
mov qword [rbp - 0x19], rax
mov qword [rsi], r14
mov rcx, qword [0x140151710]
call qword [0x140151d68]
nop
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], rsi
mov rax, rbx
xor rax, r15
mov qword [rbp - 0x19], rax
mov qword [rsi], r14
mov edx, 5
mov rcx, qword [0x140151710]
call qword [0x140151e40]
nop
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], rsi
mov rax, rbx
xor rax, r15
mov qword [rbp - 0x19], rax
mov qword [rsi], r14
mov rax, qword [0x140151de8]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [0x140151710]
lea rcx, [rbp + 0xf]
call rax
nop
mov qword [rsi], rbx
test eax, eax
je 0x140064582
lea rcx, [rbp + 0xf]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0xf]
call qword [sym.imp.USER32.dll_DispatchMessageA]
mov rdi, qword [0x1401516e0]
mov rax, qword [0x140151710]
mov qword [rdi + 0xc8], rax
mov dword [rdi + 0x18], 0x3c888889
lea rcx, [rbp + 0x67]
call qword [sym.imp.USER32.dll_GetCursorPos]
movd xmm0, dword [rbp + 0x67]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 0xe00], xmm0
movd xmm0, dword [rbp + 0x6b]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 0xe04], xmm0
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], rsi
mov rbx, qword [rsi]
mov rax, rbx
xor rax, r15
mov qword [rbp - 0x19], rax
mov qword [rsi], r14
mov rax, qword [0x140151d78]
mov ecx, 1
call rax
nop
mov qword [rsi], rbx
test ax, ax
je 0x14006461b
mov byte [rdi + 0xe08], 1
mov byte [rdi + 0x3740], 1
mov eax, dword [rdi + 0xe04]
mov dword [rdi + 0x36f0], eax
call fcn.140065370
jmp 0x140064470
mov byte [rdi + 0xe08], 0
call fcn.140065370
jmp 0x140064470
mov word [rbp + 7], 0
movdqa xmm0, xmmword [str.taskkill__f__im_Failed_to_setup]
movdqu xmmword [rbp - 0x19], xmm0
movdqa xmm1, xmmword [0x14007a7b0]
movdqu xmmword [rbp - 9], xmm1
lea rcx, [rbp - 0x19]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rbx, qword [0x1401516e0]
test rbx, rbx
je 0x14006466b
mov rdi, qword [rbx + 0x98]
jmp 0x14006466e
mov rdi, r14
call fcn.140047d70
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x140064682
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rdi]
test rcx, rcx
je 0x140064690
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14006469f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx + 0x88], r14
mov qword [rbx + 0x98], r14
and dword [rbx + 0xc], 0xfffffff7
mov rax, qword [0x1401516e0]
test rax, rax
je 0x1400646c3
dec dword [rax + 0xf0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [0x1401516e0]
test rax, rax
je 0x1400646e1
mov rdi, qword [rax + 0x90]
jmp 0x1400646e4
mov rdi, r14
lea rbx, [rax + 8]
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1400646fe
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [0x1401516e0]
mov qword [rbx + 0x78], r14
mov qword [rbx + 0x88], r14
and dword [rbx + 4], 0xfffffff8
test rax, rax
je 0x140064718
dec dword [rax + 0xf0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [0x1401516e0]
mov qword [0x1401516e0], rbx
call fcn.140006220
mov qword [0x1401516e0], r14
test rbx, rbx
je 0x140064763
mov rcx, rbx
call fcn.14001c740
mov rax, qword [0x1401516e0]
test rax, rax
je 0x14006475a
dec dword [rax + 0xf0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x140151710]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov al, 1
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret