x8 pointer to where to write the return value if >128 bits, otherwise scratch register
So it seems x8 is used to pass an address at which the return value will land if it's too big, rather than the return value directly, hence indirect I suppose.
I couldn't find official ...
I am assuming that the malware is already on your disk (not all malware hits the disk!). So keep that in mind when following this answer. If this is not the case, please provide more information.
On Windows many files that are in use and therefore cannot be deleted can be dealt in one of two ways:
rename the file (the ren command on the command prompt ...
I am unsure what you mean by "solving" this, but the meaning of the code is rather obvious and even more so in the screenshot you provided. Simplified version:
add [esp], 5
xor eax, eax
And with annotations:
call $+5 ; call address of next instruction, placing return address on stack (esp)
add [esp], 5 ; add 5 bytes to the ...