Function at 0x1400409d0
Capabilities:
Encode data using xor
Execute command
Self delete

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x158]
sub rsp, 0x250
movaps xmmword [rax - 0x18], xmm6
xor edi, edi
movups xmm0, xmmword [0x1400fca40]
movups xmmword [rbp + 0xa0], xmm0
movups xmm1, xmmword [0x1400fca50]
movups xmmword [rbp + 0xb0], xmm1
movups xmm0, xmmword [0x1400fca60]
movups xmmword [rbp + 0xc0], xmm0
movups xmm1, xmmword [0x1400fca70]
movups xmmword [rbp + 0xd0], xmm1
movups xmm0, xmmword [0x1400fca80]
movups xmmword [rbp + 0xe0], xmm0
movups xmm1, xmmword [0x1400fca90]
movups xmmword [rbp + 0xf0], xmm1
movups xmm0, xmmword [0x1400fcaa0]
movups xmmword [rbp + 0x100], xmm0
movups xmm1, xmmword [0x1400fcab0]
movups xmmword [rbp + 0x110], xmm1
movups xmm0, xmmword [0x1400fcac0]
movups xmmword [rbp + 0x120], xmm0
movsd xmm0, qword [0x1400fcad0]
movsd qword [rbp + 0x130], xmm0
mov eax, dword [0x1400fcad8]
mov dword [rbp + 0x138], eax
movzx eax, word [0x1400fcadc]
mov word [rbp + 0x13c], ax
movzx eax, byte [0x1400fcade]
mov byte [rbp + 0x13e], al
mov ecx, edi
cmp dword [0x1401100a0], 2
jl 0x140040be2
movdqa xmm4, xmmword [0x1400fd020]
movdqa xmm3, xmmword [0x1400fd430]
movdqa xmm5, xmmword [str.8888]
movdqa xmm0, xmmword [str.5555555555555555]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rbp + 0xa4]
mov r8d, dword [rsp + 0x20]
movdqa xmm6, xmmword [0x1400fd050]
nop
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
xorps xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x98
jl 0x140040af0
cmp ecx, 0x9f
jge 0x140040c21
movsxd rax, ecx
lea r8, [rbp + 0xa0]
add r8, rax
nop
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x38
movzx eax, cl
sub al, dl
add al, 0x35
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x9f
jl 0x140040bf0
lea rcx, [rbp + 0xa0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rcx, [rbp - 0x80]
call fcn.140040450
mov rbx, rax
lea rcx, [rsp + 0x60]
call fcn.140040450
nop
mov r8d, 1
lea rdx, [0x1400f8c70]
mov rcx, rax
call fcn.14004c730
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r9, rbx
lea r8, [rsp + 0x20]
movzx edx, byte [rbp + 0x160]
lea rcx, [rbp + 0x80]
call fcn.14004d9b0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140040ce7
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040ce1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140040ce1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ccc18
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x140040d27
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040d22
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140040d22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ccc18
movdqa xmm6, xmmword [0x1400fceb0]
movdqu xmmword [rsp + 0x70], xmm6
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140040d78
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040d73
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140040d73
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ccc18
movdqu xmmword [rbp - 0x70], xmm6
mov byte [rbp - 0x80], 0
lea rcx, [rbp - 0x40]
call fcn.140040450
mov rbx, rax
lea rcx, [rbp - 0x60]
call fcn.140040450
nop
mov r8d, 1
lea rdx, [0x1400f8c70]
mov rcx, rax
call fcn.14004c730
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r9, rbx
lea r8, [rsp + 0x20]
movzx edx, byte [rbp + 0x160]
lea rcx, [rbp + 0x60]
call fcn.14004d9b0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140040e26
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040e20
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140040e20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ccc18
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140040e64
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040e5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140040e5f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ccc18
movdqu xmmword [rbp - 0x50], xmm6
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140040eab
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040ea6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140040ea6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ccc18
movdqu xmmword [rbp - 0x30], xmm6
mov byte [rbp - 0x40], 0
lea rcx, [rsp + 0x40]
call fcn.140040450
mov rbx, rax
lea rcx, [rbp - 0x20]
call fcn.140040450
nop
mov r8d, 1
lea rdx, [0x1400f8c70]
mov rcx, rax
call fcn.14004c730
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r9, rbx
lea r8, [rsp + 0x20]
movzx edx, byte [rbp + 0x160]
lea rcx, [rbp + 0x40]
call fcn.14004d9b0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140040f5a
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040f54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140040f54
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ccc18
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140040f98
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040f93
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140040f93
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ccc18
movdqu xmmword [rbp - 0x10], xmm6
mov byte [rbp - 0x20], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140040fe1
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040fdc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140040fdc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ccc18
movdqu xmmword [rsp + 0x50], xmm6
mov byte [rsp + 0x40], 0
lea rcx, [rbp + 0x20]
call fcn.140040450
mov rbx, rax
lea rcx, [rbp]
call fcn.140040450
nop
mov r8d, 1
lea rdx, [0x1400f8c70]
mov rcx, rax
call fcn.14004c730
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r9, rbx
lea r8, [rsp + 0x20]
movzx edx, byte [rbp + 0x160]
lea rcx, [rsp + 0x40]
call fcn.14004d9b0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140041092
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004108c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004108c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ccc18
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x1400410d0
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400410cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400410cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ccc18
movdqu xmmword [rbp + 0x10], xmm6
mov byte [rbp], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x140041117
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041112
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140041112
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ccc18
movdqu xmmword [rbp + 0x30], xmm6
mov byte [rbp + 0x20], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movdqa xmm6, xmmword [0x1400fcec0]
movdqu xmmword [rsp + 0x30], xmm6
mov eax, 0x3a43
mov word [rsp + 0x20], ax
mov byte [rsp + 0x22], 0
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x20]
call fcn.140040760
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14004119c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004118f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400412db
call fcn.1400ccc18
movdqa xmm6, xmmword [0x1400fcec0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movdqu xmmword [rsp + 0x30], xmm6
mov eax, 0x3a44
mov word [rsp + 0x20], ax
mov byte [rsp + 0x22], 0
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.140040760
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140041205
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041200
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400412db
call fcn.1400ccc18
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400fcec0]
movdqu xmmword [rsp + 0x30], xmm1
mov eax, 0x3a45
mov word [rsp + 0x20], ax
mov byte [rsp + 0x22], 0
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140040760
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140041272
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004126d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400412db
call fcn.1400ccc18
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400fcec0]
movdqu xmmword [rsp + 0x30], xmm1
mov eax, 0x3a46
mov word [rsp + 0x20], ax
mov byte [rsp + 0x22], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140040760
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1400412e7
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400412e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400412e2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ccc18
lea rdx, str.Volume_ID_commands_executed_with_random_serials.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004d230
lea rdx, [0x14004d470]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.cd_C:WindowsSystem32__del__f__q_Volumeid64.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140041359
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041353
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140041353
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ccc18
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140041398
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041392
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140041392
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ccc18
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x1400413d7
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400413d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400413d1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ccc18
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x14004141b
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041416
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140041416
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ccc18
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret