Function at 0x1400df7f4
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate processes
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x540
vmovups ymm0, ymmword [0x1401efdf0]
vmovaps xmmword [rax - 0x18], xmm6
lea r9, [rsp + 0x20]
vmovaps xmmword [rax - 0x28], xmm7
xor r15d, r15d
vmovaps xmmword [rax - 0x38], xmm8
mov r8d, r15d
vmovaps xmmword [rax - 0x48], xmm9
mov r10d, 0x29e4129f
mov eax, dword [0x1401efe18]
mov r11w, 0x34
mov dword [rsp + 0x48], eax
movzx eax, word [0x1401efe1c]
vmovups ymmword [rsp + 0x20], ymm0
vmovsd xmm0, qword [0x1401efe10]
mov word [rsp + 0x4c], ax
vmovsd qword [rsp + 0x40], xmm0
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movzx eax, ax
imul ecx, eax, 0x37
movzx eax, r8w
inc r8d
sub ax, cx
add ax, r11w
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 0x17
jl 0x1400df86c
cmp word [0x1401efe36], r15w
lea rax, [rsp + 0x20]
vmovups xmm0, xmmword [0x1401efe20]
vmovups xmmword [rsp + 0x20], xmm0
vmovsd xmm0, qword [str.YE___QW]
vmovsd qword [rsp + 0x30], xmm0
mov qword [rsp + 0x50], rax
mov ebx, 4
je 0x1400df965
vmovdqu xmm7, xmmword [0x1401f27f0]
vmovdqu xmm6, xmmword [0x1401f2880]
vmovdqu xmm8, xmmword [str.7777]
vmovdqu xmm9, xmmword [str.44444444]
mov eax, r15d
lea rcx, [rsp + 0x20]
vmovd xmm0, eax
vpbroadcastd xmm0, xmm0
vpaddd xmm5, xmm0, xmm7
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, 1
vpsrld xmm1, xmm4, 0x1f
vpaddd xmm0, xmm1, xmm4
vmovq xmm1, qword [rcx]
vpmulld xmm2, xmm0, xmm8
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x1401f2890]
vmovq xmm0, xmm9
vpaddw xmm2, xmm4, xmm0
vpxor xmm0, xmm2, xmm1
add eax, ebx
vmovq qword [rcx], xmm0
lea rcx, [rcx + 8]
cmp eax, 0xc
jl 0x1400df901
vmovups xmm0, xmmword [0x1401efe38]
lea rax, [rsp + 0x20]
mov qword [rsp + 0x58], rax
vpextrw eax, xmm0, 7
vmovdqu xmmword [rsp + 0x20], xmm0
test ax, ax
je 0x1400df9c3
mov r8d, r15d
lea r9, [rsp + 0x20]
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movzx eax, ax
imul ecx, eax, 0x37
movzx eax, r8w
inc r8d
sub ax, cx
add ax, r11w
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 8
jl 0x1400df98f
cmp word [0x1401efe5a], r15w
lea rax, [rsp + 0x20]
vmovups xmm0, xmmword [0x1401efe48]
mov qword [rsp + 0x60], rax
mov eax, dword [0x1401efe58]
mov dword [rsp + 0x30], eax
vmovups xmmword [rsp + 0x20], xmm0
je 0x1400dfa2b
mov r8d, r15d
lea r9, [rsp + 0x20]
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movzx eax, ax
imul ecx, eax, 0x37
movzx eax, r8w
inc r8d
sub ax, cx
add ax, r11w
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 0xa
jl 0x1400df9f7
cmp word [0x1401efe76], r15w
lea rax, [rsp + 0x20]
vmovups xmm0, xmmword [str.FTRVJ_b]
vmovups xmmword [rsp + 0x20], xmm0
vmovsd xmm0, qword [str.YE__L]
vmovsd qword [rsp + 0x30], xmm0
mov qword [rsp + 0x68], rax
je 0x1400dfaeb
vmovdqu xmm7, xmmword [0x1401f27f0]
vmovdqu xmm6, xmmword [0x1401f2880]
vmovdqu xmm8, xmmword [str.7777]
vmovdqu xmm9, xmmword [str.44444444]
mov eax, r15d
lea rcx, [rsp + 0x20]
vmovd xmm0, eax
vpbroadcastd xmm0, xmm0
vpaddd xmm5, xmm0, xmm7
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, 1
vpsrld xmm1, xmm4, 0x1f
vpaddd xmm0, xmm1, xmm4
vmovq xmm1, qword [rcx]
vpmulld xmm2, xmm0, xmm8
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x1401f2890]
vmovq xmm0, xmm9
vpaddw xmm2, xmm4, xmm0
vpxor xmm0, xmm2, xmm1
add eax, ebx
vmovq qword [rcx], xmm0
lea rcx, [rcx + 8]
cmp eax, 0xc
jl 0x1400dfa87
vmovups xmm0, xmmword [0x1401efe78]
lea rax, [rsp + 0x20]
mov r8d, r15d
mov qword [rsp + 0x70], rax
lea r9, [rsp + 0x20]
mov eax, dword [0x1401efe88]
mov dword [rsp + 0x30], eax
movzx eax, word [0x1401efe8c]
mov word [rsp + 0x34], ax
vmovups xmmword [rsp + 0x20], xmm0
mov eax, r10d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movzx eax, ax
imul ecx, eax, 0x37
movzx eax, r8w
inc r8d
sub ax, cx
add ax, r11w
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 0xb
jl 0x1400dfb21
lea rax, [rsp + 0x20]
mov edi, 0x234
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x84]
mov r8d, edi
xor edx, edx
vzeroupper
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r8d, edi
mov dword [rsp + 0x2c0], 0x238
xor edx, edx
lea rcx, [rsp + 0x2c4]
mov r14, rax
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x80]
mov edx, 0x80
lea rax, [rsp + 0x2c0]
vmovups ymm0, ymmword [rax]
vmovups xmm1, xmmword [rax + 0x70]
vmovups ymmword [rcx], ymm0
vmovups ymm0, ymmword [rax + 0x20]
vmovups ymmword [rcx + 0x20], ymm0
vmovups ymm0, ymmword [rax + 0x40]
vmovups ymmword [rcx + 0x40], ymm0
vmovups xmm0, xmmword [rax + 0x60]
vmovups xmmword [rcx + 0x60], xmm0
add rcx, rdx
add rax, rdx
vmovups xmmword [rcx - 0x10], xmm1
sub rbx, 1
jne 0x1400dfbb8
vmovups ymm0, ymmword [rax]
vmovups ymmword [rcx], ymm0
vmovups xmm0, xmmword [rax + 0x20]
mov rax, qword [rax + 0x30]
lea rdx, [rsp + 0x80]
vmovups xmmword [rcx + 0x20], xmm0
mov qword [rcx + 0x30], rax
mov rcx, r14
vzeroupper
call sub.KERNEL32.dll_Process32FirstW
jmp 0x1400dfe42
lea rbx, [rsp + 0x50]
mov rcx, qword [rbx]
lea rdx, [rsp + 0xac]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400dfe1d
mov byte [0x1403460f0], 1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x1400dfcc2
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x1400dfcc2
mov esi, dword [r10 + 0x20]
dec r9d
mov r11d, 0x811c9dc5
lea rcx, [rsi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x1400dfcbd
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x1400dfc9e
cmp r11d, 0xcded1a85
je 0x1400dfcc7
test r9d, r9d
jne 0x1400dfc81
mov rax, qword [rax]
jmp 0x1400dfc5c
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r8
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x1400dfd5a
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x1400dfd5a
mov esi, dword [r10 + 0x20]
dec r9d
mov r11d, 0x811c9dc5
lea rcx, [r8 + r9*4]
mov edx, dword [rcx + rsi]
add rdx, r8
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x1400dfd55
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x1400dfd36
cmp r11d, 0xe80fd3a
je 0x1400dfd5f
test r9d, r9d
jne 0x1400dfd1a
mov rax, qword [rax]
jmp 0x1400dfcf5
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r8
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x1400dfdf2
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x1400dfdf2
mov esi, dword [r9 + 0x20]
dec r10d
mov r11d, 0x811c9dc5
lea rcx, [r8 + r10*4]
mov edx, dword [rcx + rsi]
add rdx, r8
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x1400dfded
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x1400dfdce
cmp r11d, 0xa52bcaf9
je 0x1400dfdf7
test r10d, r10d
jne 0x1400dfdb2
mov rax, qword [rax]
jmp 0x1400dfd8d
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov dword [0], 0xdead
add rbx, 8
lea rax, [rsp + 0x80]
cmp rbx, rax
jne 0x1400dfc2b
lea rdx, [rsp + 0x80]
mov rcx, r14
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400dfc26
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x540]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
vmovaps xmm6, xmmword [r11 - 0x10]
vmovaps xmm7, xmmword [r11 - 0x20]
vmovaps xmm8, xmmword [r11 - 0x30]
vmovaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
ret