Function at 0x140008770
Capabilities:
Encode data using xor
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x14003c240]
xor rax, rsp
mov qword [rbp + 0x1b8], rax
mov rdi, rdx
mov r13, rcx
mov qword [rsp + 0x40], rdx
cmp dword [rcx + 0x10], 2
jne 0x140008aa3
mov eax, dword [rcx]
mov dword [rsp + 0x50], eax
cmp qword [rdx + 0x18], 0x10
jb 0x1400087ce
mov r12, qword [rdx]
mov rsi, r12
add r12, qword [rdx + 0x10]
jmp 0x1400087d8
mov r12, qword [rdx + 0x10]
add r12, rdi
mov rsi, rdi
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
xor r15d, r15d
mov ebx, 7
mov qword [rbp + 0x1a0], r15
mov qword [rbp + 0x1a8], rbx
cmp rsi, r12
jne 0x14000880a
mov word [rbp + 0x190], r15w
jmp 0x1400088d5
mov rax, r12
sub rax, rsi
mov r14, r15
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x140008b78
cmp rax, 8
jb 0x140008875
mov rbx, rax
or rbx, 7
cmp rbx, rcx
jbe 0x14000883d
mov rbx, rcx
jmp 0x140008849
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
mov rdx, rbx
add rdx, 1
mov rax, 0xffffffffffffffff
cmovb rdx, rax
lea rcx, [rbp + 0x190]
call fcn.140004bb0
mov qword [rbp + 0x190], rax
mov qword [rbp + 0x1a8], rbx
lea rcx, [rbp + 0x190]
cmp rbx, 8
cmovae rcx, qword [rbp + 0x190]
movsx eax, byte [rsi]
mov word [rcx + r14*2], ax
mov r14, qword [rbp + 0x1a0]
inc r14
mov qword [rbp + 0x1a0], r14
inc rsi
cmp rsi, r12
je 0x1400088b2
mov rbx, qword [rbp + 0x1a8]
jmp 0x140008875
lea rax, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 8
cmovae rax, qword [rbp + 0x190]
mov word [rax + r14*2], r15w
mov rbx, qword [rbp + 0x1a8]
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x190]
mov rsi, qword [rbp + 0x190]
cmp rbx, 8
cmovae rcx, rsi
lea rdx, [rsp + 0x60]
sub rdx, rcx
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140008910
mov dword [rbp + 0x1b0], r15d
mov dword [rbp + 0x190], 0x258025f
mov dword [rbp + 0x194], 0x25a022b
mov dword [rbp + 0x198], 0x2310263
mov dword [rbp + 0x19c], 0x23f0239
mov dword [rbp + 0x1a0], 0x23a0269
mov dword [rbp + 0x1a4], 0x23d023a
mov word [rbp + 0x1a8], r15w
mov byte [rbp + 0x1aa], 1
mov rcx, r15
mov edx, 0x203
nop word [rax + rax]
lea eax, [rdx + rcx]
xor word [rbp + rcx*2 + 0x190], ax
inc rcx
cmp rcx, 0xc
jb 0x140008980
mov byte [rbp + 0x1aa], 0
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 3]
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140008a65
mov qword [rsp + 0x38], r15
lea rax, [rbp + 0x1b0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x218
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x218
lea r8, [rsp + 0x50]
mov edx, 0x222410
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x58]
cmp rbx, 8
jb 0x140008a55
lea rbx, [rbx*2 + 2]
mov rdx, rsi
cmp rbx, 0x1000
jb 0x140008a49
add rbx, 0x27
mov rsi, qword [rsi - 8]
sub rdx, rsi
add rdx, 0xfffffffffffffff8
cmp rdx, 0x1f
ja 0x140008a94
mov rdx, rbx
mov rcx, rsi
call fcn.140009ae0
nop
mov rcx, rdi
call fcn.140004840
mov rax, r14
jmp 0x140008b4e
cmp rbx, 8
jb 0x140008aa3
lea rdx, [rbx*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140008a9b
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008a9b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140009ae0
cmp dword [r13 + 0x10], 1
ja 0x140008b44
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x54]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x50], 0x238
mov edx, dword [r13]
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140008b44
lea rdx, [rsp + 0x50]
mov rcx, rax
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x140008b3a
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140008afd
mov rdx, qword [rdi]
lea rcx, [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov rcx, rbx
test eax, eax
je 0x140008b22
mov dword [rsp + 0x50], 0x238
lea rdx, [rsp + 0x50]
call sub.KERNEL32.dll_Module32Next
jmp 0x140008aec
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x78]
mov rcx, rdi
call fcn.140004840
mov rax, rbx
jmp 0x140008b4e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, rdi
call fcn.140004840
xor eax, eax
mov rcx, qword [rbp + 0x1b8]
xor rcx, rsp
call fcn.140009760
mov rbx, qword [rsp + 0x310]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140004530
nop
int3