Function at 0x140004720
Capabilities:
Encode data using xor
Enumerate processes
Hash data with crc32
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r14
push r15
sub rsp, 0x340
mov rax, qword [0x140040020]
xor rax, rsp
mov qword [rsp + 0x338], rax
movups xmm0, xmmword [str.vmtoolsd.exe]
movups xmmword [r11 - 0x38], xmm0
movsd xmm1, qword [0x14003a588]
movsd qword [r11 - 0x28], xmm1
movzx eax, word [0x14003a590]
mov word [r11 - 0x20], ax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0xd4]
call fcn.14000f290
mov dword [rsp + 0xd0], 0x238
lea rdx, [rsp + 0xd0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov rdi, qword [rsp + 0x320]
mov rsi, qword [rsp + 0x318]
mov r14, qword [rsp + 0x310]
nop dword [rax + rax]
cmp qword [rsp + 0xfc], r14
jne 0x1400047f2
cmp qword [rsp + 0x104], rsi
jne 0x1400047f2
cmp qword [rsp + 0x10c], rdi
je 0x140004a01
lea rdx, [rsp + 0xd0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400047d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
xor edi, edi
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xa0], 0xf
mov byte [rsp + 0x88], dil
call fcn.14000a6b8
mov r10d, dword [0x140047004]
mov r8d, dword [section..xDD]
lea r9, [fcn.14002c000]
add r8, r9
mov edx, 0xffffffff
cmp r9, r8
je 0x140004902
nop dword [rax + rax]
movzx eax, byte [r9]
xor edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
inc r9
cmp r9, r8
jne 0x140004860
not edx
mov eax, dword [0x140042bf0]
mov ebx, 1
cmp edx, r10d
cmovne eax, ebx
mov dword [0x140042bf0], eax
lea rdx, str._NPC__give_me_fish:
lea rcx, [0x140041330]
call fcn.140008c30
call fcn.140001540
lea rdx, [rsp + 0x88]
call fcn.140008f80
call fcn.1400015e0
lea rcx, [rsp + 0x88]
cmp qword [rsp + 0xa0], 0x10
cmovae rcx, qword [rsp + 0x88]
mov edx, dword [rsp + 0x98]
call fcn.1400017b0
test eax, eax
je 0x140004a0d
lea rcx, [rsp + 0x88]
cmp qword [rsp + 0xa0], 0x10
cmovae rcx, qword [rsp + 0x88]
mov edx, dword [rsp + 0x98]
call fcn.140004620
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
mov word [rsp + 0x3c], ax
movdqa xmm0, xmmword [0x14003a890]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x14003a8c0]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm0, xmmword [0x14003a7c0]
movdqa xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], 0x33
lea rcx, [rsp + 0x30]
call fcn.140005a20
mov rdx, rax
lea rcx, [0x140041600]
call fcn.140008c30
mov rcx, rax
call fcn.140008ef0
jmp 0x140004c2d
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword [0x140042bf8]
cmp byte [rax + 2], 0
je 0x140004a23
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x88
call fcn.14000cd8c
mov r15, rax
mov qword [rsp + 0x20], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x310], xmm0
mov qword [rsp + 0x320], rdi
mov qword [rsp + 0x328], rdi
mov rsi, qword [rsp + 0x98]
lea r14, [rsp + 0x88]
cmp qword [rsp + 0xa0], 0x10
cmovae r14, qword [rsp + 0x88]
movabs rbx, 0x7fffffffffffffff
cmp rsi, rbx
ja 0x140004c9c
mov qword [rsp + 0x328], 0xf
cmp rsi, 0x10
jae 0x140004aba
mov qword [rsp + 0x320], rsi
mov r8d, 0x10
mov rdx, r14
lea rcx, [rsp + 0x310]
call fcn.14000ebe0
jmp 0x140004b52
mov rax, rsi
or rax, 0xf
cmp rax, rbx
jbe 0x140004af3
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14000cd8c
test rax, rax
je 0x140004ca8
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140004b2b
mov rbx, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140004b1e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004ca2
jmp 0x140004ad4
test rcx, rcx
je 0x140004b2b
call fcn.14000cd8c
mov rdi, rax
mov qword [rsp + 0x310], rdi
mov qword [rsp + 0x320], rsi
mov qword [rsp + 0x328], rbx
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rdi
call fcn.14000ebe0
lea rdx, [rsp + 0x310]
mov rcx, r15
call fcn.140003ee0
mov qword [rsp + 0x20], rax
call fcn.14000a6b8
lea rcx, [rsp + 0x88]
cmp qword [rsp + 0xa0], 0x10
cmovae rcx, qword [rsp + 0x88]
mov edx, dword [rsp + 0x98]
call fcn.14002c000
test eax, eax
je 0x140004c2d
call fcn.14000a6b8
lea rcx, [rsp + 0x88]
cmp qword [rsp + 0xa0], 0x10
cmovae rcx, qword [rsp + 0x88]
mov edx, dword [rsp + 0x98]
call fcn.1400019e0
test eax, eax
jne 0x140004c11
call fcn.14000a6b8
lea rcx, [rsp + 0x88]
cmp qword [rsp + 0xa0], 0x10
cmovae rcx, qword [rsp + 0x88]
mov edx, dword [rsp + 0x98]
call fcn.140004620
lea rdx, str.flagYou_got_it_____
lea rcx, [0x140041330]
call fcn.140008c30
mov rcx, rax
call fcn.140008ef0
jmp 0x140004c2d
lea rdx, str.nonono
lea rcx, [0x140041330]
call fcn.140008c30
mov rcx, rax
call fcn.140008ef0
nop
mov rdx, qword [rsp + 0xa0]
cmp rdx, 0x10
jb 0x140004c6c
inc rdx
mov rcx, qword [rsp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004c67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004cae
call fcn.14000cd50
xor eax, eax
mov rcx, qword [rsp + 0x338]
xor rcx, rsp
call fcn.14000cd30
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
call fcn.140001d20
nop
call fcn.140001c80
int3
call fcn.140013668
nop
call fcn.140013668
int3