Function at 0x1401c38e0
Capabilities:
Encode data using xor
Enumerate processes
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3c40]
mov eax, 0x3d40
call fcn.140242000
sub rsp, rax
mov rax, qword [0x140284028]
xor rax, rsp
mov qword [rbp + 0x3c30], rax
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x40], 0x238
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x1504], 0xffffffff
mov edx, 1
mov dword [rbp + 0x184], eax
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x184], eax
inc rdx
cmp rdx, 0x270
jb 0x1401c3950
mov dword [rbp + 0x180], 0x270
mov dword [rsp + 0x20], 0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1401c39a2
imul rax, rax, 0x64
jmp 0x1401c39bd
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
lea r14, [rax + 0x5f5e100]
mov r13d, 0x80000000
mov r12d, 1
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1401c39ee
imul rax, rax, 0x64
jmp 0x1401c3a09
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r14
jge 0x1401c3bc5
mov esi, 0x186a0
nop word [rax + rax]
lea rcx, [rbp + 0x180]
call fcn.140226f00
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x63
ja 0x1401c3a5a
nop word [rax + rax]
lea rcx, [rbp + 0x180]
call fcn.140226f00
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401c3a40
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
cmp ecx, r13d
lea eax, [rcx + r13]
lea ebx, [rcx - 0x80000000]
cmovae ebx, eax
lea rcx, [rbp + 0x180]
test ebx, ebx
cmove ebx, r12d
call fcn.140226f00
mov ecx, eax
mov edi, ebx
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x1401c3aba
cmp eax, 0x64
jae 0x1401c3aba
nop dword [rax]
lea rcx, [rbp + 0x180]
call fcn.140226f00
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401c3aa0
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
lea eax, [rcx + r13]
cmp ecx, r13d
lea edx, [rcx - 0x80000000]
cmovae edx, eax
lea rcx, [rbp + 0x180]
mov eax, dword [rsp + 0x20]
add edx, eax
mov dword [rsp + 0x20], edx
call fcn.140226f00
mov ecx, eax
mov ebx, edi
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x1401c3b1b
cmp eax, 0x64
jae 0x1401c3b1b
lea rcx, [rbp + 0x180]
call fcn.140226f00
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401c3b01
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
lea eax, [rcx + r13]
cmp ecx, r13d
lea edx, [rcx - 0x80000000]
cmovae edx, eax
lea rcx, [rbp + 0x180]
mov eax, dword [rsp + 0x20]
imul edx, eax
mov dword [rsp + 0x20], edx
call fcn.140226f00
mov ecx, eax
mov edi, ebx
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x1401c3b7d
cmp eax, 0x64
jae 0x1401c3b7d
lea rcx, [rbp + 0x180]
call fcn.140226f00
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401c3b63
shr rax, 0x20
lea edx, [rax + 0x7fffff9c]
cmp edx, r13d
lea eax, [rdx + r13]
lea ecx, [rdx - 0x80000000]
cmovae ecx, eax
mov eax, dword [rsp + 0x20]
sub eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cdq
idiv edi
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cdq
idiv edi
mov dword [rsp + 0x20], edx
sub rsi, r12
jne 0x1401c3a20
jmp 0x1401c39d0
mov eax, dword [rsp + 0x20]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r15, rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x2894], 0xffffffff
mov rdx, r12
mov dword [rbp + 0x1514], eax
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x1514], eax
inc rdx
cmp rdx, 0x270
jb 0x1401c3c00
mov dword [rbp + 0x1510], 0x270
mov dword [rsp + 0x20], 0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1401c3c52
imul rax, rax, 0x64
jmp 0x1401c3c6d
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
lea r14, [rax + 0x5f5e100]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1401c3c92
imul rax, rax, 0x64
jmp 0x1401c3cad
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r14
jge 0x1401c3e65
mov esi, 0x186a0
nop dword [rax + rax]
lea rcx, [rbp + 0x1510]
call fcn.140226f00
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x63
ja 0x1401c3cfa
nop word [rax + rax]
lea rcx, [rbp + 0x1510]
call fcn.140226f00
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401c3ce0
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
cmp ecx, r13d
lea eax, [rcx + r13]
lea ebx, [rcx - 0x80000000]
cmovae ebx, eax
lea rcx, [rbp + 0x1510]
test ebx, ebx
cmove ebx, r12d
call fcn.140226f00
mov ecx, eax
mov edi, ebx
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x1401c3d5a
cmp eax, 0x64
jae 0x1401c3d5a
nop dword [rax]
lea rcx, [rbp + 0x1510]
call fcn.140226f00
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401c3d40
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
lea eax, [rcx + r13]
cmp ecx, r13d
lea edx, [rcx - 0x80000000]
cmovae edx, eax
lea rcx, [rbp + 0x1510]
mov eax, dword [rsp + 0x20]
add edx, eax
mov dword [rsp + 0x20], edx
call fcn.140226f00
mov ecx, eax
mov ebx, edi
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x1401c3dbb
cmp eax, 0x64
jae 0x1401c3dbb
lea rcx, [rbp + 0x1510]
call fcn.140226f00
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401c3da1
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
lea eax, [rcx + r13]
cmp ecx, r13d
lea edx, [rcx - 0x80000000]
cmovae edx, eax
lea rcx, [rbp + 0x1510]
mov eax, dword [rsp + 0x20]
imul edx, eax
mov dword [rsp + 0x20], edx
call fcn.140226f00
mov ecx, eax
mov edi, ebx
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x1401c3e1d
cmp eax, 0x64
jae 0x1401c3e1d
lea rcx, [rbp + 0x1510]
call fcn.140226f00
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401c3e03
shr rax, 0x20
lea edx, [rax + 0x7fffff9c]
cmp edx, r13d
lea eax, [rdx + r13]
lea ecx, [rdx - 0x80000000]
cmovae ecx, eax
mov eax, dword [rsp + 0x20]
sub eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cdq
idiv edi
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cdq
idiv edi
mov dword [rsp + 0x20], edx
sub rsi, r12
jne 0x1401c3cc0
jmp 0x1401c3c74
mov eax, dword [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, r12d
mov r12, qword [rsp + 0x28]
jne 0x1401c3ec5
lea rdx, [rsp + 0x40]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x1401c3ec5
nop dword [rax]
nop dword [rax + rax]
mov rdx, r12
lea rcx, [rsp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, r15
test eax, eax
je 0x1401c3f32
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x1401c3ea0
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x3c24], 0xffffffff
mov edx, 1
mov dword [rbp + 0x28a4], eax
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x28a4], eax
inc rdx
cmp rdx, 0x270
jb 0x1401c3ee0
mov dword [rbp + 0x28a0], 0x270
mov dword [rsp + 0x20], 0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1401c3f41
imul rax, rax, 0x64
jmp 0x1401c3f5c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x48]
jmp 0x1401c4176
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
lea r14, [rax + 0x5f5e100]
mov r15d, 1
nop dword [rax]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1401c3f8e
imul rax, rax, 0x64
jmp 0x1401c3fa9
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r14
jge 0x1401c4165
mov esi, 0x186a0
nop word [rax + rax]
lea rcx, [rbp + 0x28a0]
call fcn.140226f00
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x63
ja 0x1401c3ffa
nop word [rax + rax]
lea rcx, [rbp + 0x28a0]
call fcn.140226f00
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401c3fe0
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
cmp ecx, r13d
lea eax, [rcx + r13]
lea ebx, [rcx - 0x80000000]
cmovae ebx, eax
lea rcx, [rbp + 0x28a0]
test ebx, ebx
cmove ebx, r15d
call fcn.140226f00
mov ecx, eax
mov edi, ebx
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x1401c405a
cmp eax, 0x64
jae 0x1401c405a
nop dword [rax]
lea rcx, [rbp + 0x28a0]
call fcn.140226f00
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401c4040
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
lea eax, [rcx + r13]
cmp ecx, r13d
lea edx, [rcx - 0x80000000]
cmovae edx, eax
lea rcx, [rbp + 0x28a0]
mov eax, dword [rsp + 0x20]
add edx, eax
mov dword [rsp + 0x20], edx
call fcn.140226f00
mov ecx, eax
mov ebx, edi
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x1401c40bb
cmp eax, 0x64
jae 0x1401c40bb
lea rcx, [rbp + 0x28a0]
call fcn.140226f00
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401c40a1
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
lea eax, [rcx + r13]
cmp ecx, r13d
lea edx, [rcx - 0x80000000]
cmovae edx, eax
lea rcx, [rbp + 0x28a0]
mov eax, dword [rsp + 0x20]
imul edx, eax
mov dword [rsp + 0x20], edx
call fcn.140226f00
mov ecx, eax
mov edi, ebx
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x1401c411d
cmp eax, 0x64
jae 0x1401c411d
lea rcx, [rbp + 0x28a0]
call fcn.140226f00
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401c4103
shr rax, 0x20
lea edx, [rax + 0x7fffff9c]
cmp edx, r13d
lea eax, [rdx + r13]
lea ecx, [rdx - 0x80000000]
cmovae ecx, eax
mov eax, dword [rsp + 0x20]
sub eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cdq
idiv edi
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cdq
idiv edi
mov dword [rsp + 0x20], edx
sub rsi, r15
jne 0x1401c3fc0
jmp 0x1401c3f70
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x3c30]
xor rcx, rsp
call fcn.140240c60
lea r11, [rsp + 0x3d40]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret