Function at 0x14020b790
Capabilities:
Encode data using xor
Enumerate processes
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3c40]
mov eax, 0x3d40
call fcn.14027e170
sub rsp, rax
mov rax, qword [0x1402bd028]
xor rax, rsp
mov qword [rbp + 0x3c30], rax
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x40], 0x238
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x1504], 0xffffffff
mov edx, 1
mov dword [rbp + 0x184], eax
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x184], eax
inc rdx
cmp rdx, 0x270
jb 0x14020b800
mov dword [rbp + 0x180], 0x270
mov dword [rsp + 0x20], 0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14020b852
imul rax, rax, 0x64
jmp 0x14020b86d
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
lea r14, [rax + 0x5f5e100]
mov r13d, 0x80000000
mov r12d, 1
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14020b89e
imul rax, rax, 0x64
jmp 0x14020b8b9
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r14
jge 0x14020ba75
mov esi, 0x186a0
nop word [rax + rax]
lea rcx, [rbp + 0x180]
call fcn.140265db0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x63
ja 0x14020b90a
nop word [rax + rax]
lea rcx, [rbp + 0x180]
call fcn.140265db0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x14020b8f0
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
cmp ecx, r13d
lea eax, [rcx + r13]
lea ebx, [rcx - 0x80000000]
cmovae ebx, eax
lea rcx, [rbp + 0x180]
test ebx, ebx
cmove ebx, r12d
call fcn.140265db0
mov ecx, eax
mov edi, ebx
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x14020b96a
cmp eax, 0x64
jae 0x14020b96a
nop dword [rax]
lea rcx, [rbp + 0x180]
call fcn.140265db0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x14020b950
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
lea eax, [rcx + r13]
cmp ecx, r13d
lea edx, [rcx - 0x80000000]
cmovae edx, eax
lea rcx, [rbp + 0x180]
mov eax, dword [rsp + 0x20]
add edx, eax
mov dword [rsp + 0x20], edx
call fcn.140265db0
mov ecx, eax
mov ebx, edi
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x14020b9cb
cmp eax, 0x64
jae 0x14020b9cb
lea rcx, [rbp + 0x180]
call fcn.140265db0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x14020b9b1
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
lea eax, [rcx + r13]
cmp ecx, r13d
lea edx, [rcx - 0x80000000]
cmovae edx, eax
lea rcx, [rbp + 0x180]
mov eax, dword [rsp + 0x20]
imul edx, eax
mov dword [rsp + 0x20], edx
call fcn.140265db0
mov ecx, eax
mov edi, ebx
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x14020ba2d
cmp eax, 0x64
jae 0x14020ba2d
lea rcx, [rbp + 0x180]
call fcn.140265db0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x14020ba13
shr rax, 0x20
lea edx, [rax + 0x7fffff9c]
cmp edx, r13d
lea eax, [rdx + r13]
lea ecx, [rdx - 0x80000000]
cmovae ecx, eax
mov eax, dword [rsp + 0x20]
sub eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cdq
idiv edi
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cdq
idiv edi
mov dword [rsp + 0x20], edx
sub rsi, r12
jne 0x14020b8d0
jmp 0x14020b880
mov eax, dword [rsp + 0x20]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r15, rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x2894], 0xffffffff
mov rdx, r12
mov dword [rbp + 0x1514], eax
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x1514], eax
inc rdx
cmp rdx, 0x270
jb 0x14020bab0
mov dword [rbp + 0x1510], 0x270
mov dword [rsp + 0x20], 0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14020bb02
imul rax, rax, 0x64
jmp 0x14020bb1d
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
lea r14, [rax + 0x5f5e100]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14020bb42
imul rax, rax, 0x64
jmp 0x14020bb5d
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r14
jge 0x14020bd15
mov esi, 0x186a0
nop dword [rax + rax]
lea rcx, [rbp + 0x1510]
call fcn.140265db0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x63
ja 0x14020bbaa
nop word [rax + rax]
lea rcx, [rbp + 0x1510]
call fcn.140265db0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x14020bb90
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
cmp ecx, r13d
lea eax, [rcx + r13]
lea ebx, [rcx - 0x80000000]
cmovae ebx, eax
lea rcx, [rbp + 0x1510]
test ebx, ebx
cmove ebx, r12d
call fcn.140265db0
mov ecx, eax
mov edi, ebx
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x14020bc0a
cmp eax, 0x64
jae 0x14020bc0a
nop dword [rax]
lea rcx, [rbp + 0x1510]
call fcn.140265db0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x14020bbf0
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
lea eax, [rcx + r13]
cmp ecx, r13d
lea edx, [rcx - 0x80000000]
cmovae edx, eax
lea rcx, [rbp + 0x1510]
mov eax, dword [rsp + 0x20]
add edx, eax
mov dword [rsp + 0x20], edx
call fcn.140265db0
mov ecx, eax
mov ebx, edi
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x14020bc6b
cmp eax, 0x64
jae 0x14020bc6b
lea rcx, [rbp + 0x1510]
call fcn.140265db0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x14020bc51
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
lea eax, [rcx + r13]
cmp ecx, r13d
lea edx, [rcx - 0x80000000]
cmovae edx, eax
lea rcx, [rbp + 0x1510]
mov eax, dword [rsp + 0x20]
imul edx, eax
mov dword [rsp + 0x20], edx
call fcn.140265db0
mov ecx, eax
mov edi, ebx
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x14020bccd
cmp eax, 0x64
jae 0x14020bccd
lea rcx, [rbp + 0x1510]
call fcn.140265db0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x14020bcb3
shr rax, 0x20
lea edx, [rax + 0x7fffff9c]
cmp edx, r13d
lea eax, [rdx + r13]
lea ecx, [rdx - 0x80000000]
cmovae ecx, eax
mov eax, dword [rsp + 0x20]
sub eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cdq
idiv edi
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cdq
idiv edi
mov dword [rsp + 0x20], edx
sub rsi, r12
jne 0x14020bb70
jmp 0x14020bb24
mov eax, dword [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, r12d
mov r12, qword [rsp + 0x28]
jne 0x14020bd75
lea rdx, [rsp + 0x40]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x14020bd75
nop dword [rax]
nop dword [rax + rax]
mov rdx, r12
lea rcx, [rsp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, r15
test eax, eax
je 0x14020bde2
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x14020bd50
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x3c24], 0xffffffff
mov edx, 1
mov dword [rbp + 0x28a4], eax
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x28a4], eax
inc rdx
cmp rdx, 0x270
jb 0x14020bd90
mov dword [rbp + 0x28a0], 0x270
mov dword [rsp + 0x20], 0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14020bdf1
imul rax, rax, 0x64
jmp 0x14020be0c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x48]
jmp 0x14020c026
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
lea r14, [rax + 0x5f5e100]
mov r15d, 1
nop dword [rax]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14020be3e
imul rax, rax, 0x64
jmp 0x14020be59
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r14
jge 0x14020c015
mov esi, 0x186a0
nop word [rax + rax]
lea rcx, [rbp + 0x28a0]
call fcn.140265db0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x63
ja 0x14020beaa
nop word [rax + rax]
lea rcx, [rbp + 0x28a0]
call fcn.140265db0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x14020be90
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
cmp ecx, r13d
lea eax, [rcx + r13]
lea ebx, [rcx - 0x80000000]
cmovae ebx, eax
lea rcx, [rbp + 0x28a0]
test ebx, ebx
cmove ebx, r15d
call fcn.140265db0
mov ecx, eax
mov edi, ebx
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x14020bf0a
cmp eax, 0x64
jae 0x14020bf0a
nop dword [rax]
lea rcx, [rbp + 0x28a0]
call fcn.140265db0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x14020bef0
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
lea eax, [rcx + r13]
cmp ecx, r13d
lea edx, [rcx - 0x80000000]
cmovae edx, eax
lea rcx, [rbp + 0x28a0]
mov eax, dword [rsp + 0x20]
add edx, eax
mov dword [rsp + 0x20], edx
call fcn.140265db0
mov ecx, eax
mov ebx, edi
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x14020bf6b
cmp eax, 0x64
jae 0x14020bf6b
lea rcx, [rbp + 0x28a0]
call fcn.140265db0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x14020bf51
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
lea eax, [rcx + r13]
cmp ecx, r13d
lea edx, [rcx - 0x80000000]
cmovae edx, eax
lea rcx, [rbp + 0x28a0]
mov eax, dword [rsp + 0x20]
imul edx, eax
mov dword [rsp + 0x20], edx
call fcn.140265db0
mov ecx, eax
mov edi, ebx
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x14020bfcd
cmp eax, 0x64
jae 0x14020bfcd
lea rcx, [rbp + 0x28a0]
call fcn.140265db0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x14020bfb3
shr rax, 0x20
lea edx, [rax + 0x7fffff9c]
cmp edx, r13d
lea eax, [rdx + r13]
lea ecx, [rdx - 0x80000000]
cmovae ecx, eax
mov eax, dword [rsp + 0x20]
sub eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cdq
idiv edi
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cdq
idiv edi
mov dword [rsp + 0x20], edx
sub rsi, r15
jne 0x14020be70
jmp 0x14020be20
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x3c30]
xor rcx, rsp
call fcn.14027cdd0
lea r11, [rsp + 0x3d40]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret