Function at 0x14003a440
Capabilities:
Encode data using xor
Enumerate processes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x140049040]
xor rax, rsp
mov qword [rbp + 0xa0], rax
xor edi, edi
mov rsi, rdx
mov qword [rsp + 0x48], rdi
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x48]
lea edx, [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14003a710
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea r9d, [rdi + 4]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x50]
mov dword [rsp + 0x40], 4
lea edx, [rdi + 0x14]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x14003a710
mov qword [rsp + 0x1e8], r12
movabs r12, 0x431bde82d7b634db
mov qword [rsp + 0x1f0], r13
movabs r13, 0x7fffffffffffffff
mov qword [rsp + 0x1f8], r15
movabs r15, 0x4e94914f0000
nop word [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x74]
mov r8d, 0x12c
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov dword [rsp + 0x70], 0x130
mov dword [r14 + 0x10], edi
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003a5a6
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14003a59d
nop dword [rax]
nop dword [rax + rax]
lea r8, [rbp - 0x64]
mov rcx, rsi
sub r8, rsi
nop word [rax + rax]
movzx edx, byte [rcx]
movzx eax, byte [rcx + r8]
sub edx, eax
jne 0x14003a583
inc rcx
test eax, eax
jne 0x14003a570
mov rcx, rbx
test edx, edx
je 0x14003a645
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14003a560
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x40]
call fcn.14003a320
mov rbx, qword [rsp + 0x40]
movabs rax, 0x7fffffffc46535ff
cmp rbx, rax
jge 0x14003a5cd
add rbx, 0x3b9aca00
jmp 0x14003a5d0
mov rbx, r13
lea rcx, [rsp + 0x50]
call fcn.14003a320
mov rax, qword [rsp + 0x50]
cmp rax, rbx
jge 0x14003a510
nop dword [rax + rax]
mov rcx, rbx
sub rcx, rax
cmp rcx, r15
jl 0x14003a602
mov ecx, 0x5265c00
jmp 0x14003a627
mov rax, r12
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x14003a625
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rsp + 0x50]
call fcn.14003a320
mov rax, qword [rsp + 0x50]
cmp rax, rbx
jl 0x14003a5f0
jmp 0x14003a510
mov eax, dword [rsp + 0x78]
mov dword [r14 + 0x10], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movdqa xmm0, xmmword [0x140042280]
mov rcx, rdi
mov r15, qword [rsp + 0x1f8]
mov r13, qword [rsp + 0x1f0]
mov r12, qword [rsp + 0x1e8]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x60], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x56]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 0xf
jb 0x14003a690
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
lea rcx, [rsp + 0x50]
mov edx, 0xc0000000
mov byte [rsp + 0x60], dil
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [r14 + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x14003a70c
movdqa xmm0, xmmword [0x1400423e0]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x100d9d9
nop dword [rax]
lea eax, [rdi - 0x54]
xor byte [rsp + rdi + 0x50], al
inc rdi
cmp rdi, 0x12
jb 0x14003a6f0
mov byte [rsp + 0x63], 0
lea rdx, [rsp + 0x50]
jmp 0x14003a74a
mov al, 1
jmp 0x14003a75a
mov dword [rsp + 0x50], 0x8fc0d8fe
mov dword [rsp + 0x54], 0xd292c2d1
mov dword [rsp + 0x58], 0xd9dfd8d0
mov word [rsp + 0x5c], pe_nt_image_headers64
nop
lea eax, [rdi - 0x54]
xor byte [rsp + rdi + 0x50], al
inc rdi
cmp rdi, 0xc
jb 0x14003a730
mov byte [rsp + 0x5d], 0
lea rdx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.14003ac70
add rsp, 0x1b0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret