Function at 0x7ff715067c20
Capabilities:
Encode data using xor
Enumerate processes

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
sub rsp, 0x2e0
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov qword [rsp + 0x60], rsp
xor edx, edx
mov cl, 0x6b
call fcn.7ff71505ecc0
mov byte [rsp + 0x50], al
mov edx, 1
mov cl, 0x65
call fcn.7ff71505ecc0
mov byte [rsp + 0x51], al
mov edx, 2
mov cl, 0x72
call fcn.7ff71505ecc0
mov byte [rsp + 0x52], al
mov edx, 3
mov cl, 0x6e
call fcn.7ff71505ecc0
mov byte [rsp + 0x53], al
mov edx, 4
mov cl, 0x65
call fcn.7ff71505ecc0
mov byte [rsp + 0x54], al
mov edx, 5
mov cl, 0x6c
call fcn.7ff71505ecc0
mov byte [rsp + 0x55], al
mov edx, 6
mov cl, 0x33
call fcn.7ff71505ecc0
mov byte [rsp + 0x56], al
mov edx, 7
mov cl, 0x32
call fcn.7ff71505ecc0
mov byte [rsp + 0x57], al
mov edx, 8
mov cl, 0x2e
call fcn.7ff71505ecc0
mov byte [rsp + 0x58], al
mov edx, 9
mov cl, 0x64
call fcn.7ff71505ecc0
mov byte [rsp + 0x59], al
mov edx, 0xa
mov cl, 0x6c
call fcn.7ff71505ecc0
mov byte [rsp + 0x5a], al
mov edx, 0xb
call fcn.7ff71505ecc0
mov byte [rsp + 0x5b], al
xor eax, eax
mov byte [rsp + 0x5c], al
movdqa xmm7, xmmword [0x7ff7150a3dc0]
xor esi, esi
movdqa xmm0, xmmword [0x7ff7150a3e40]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x50]
mov r8d, dword [rsp + 0x30]
movdqa xmm6, xmmword [0x7ff7150a3e20]
nop dword [rax + rax]
movd xmm1, eax
pshufd xmm1, xmm1, 0
paddd xmm1, xmm7
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd xmm0, r8d
paddb xmm1, xmm0
movd xmm0, dword [rcx]
xorps xmm1, xmm0
movd dword [rcx], xmm1
add eax, 4
lea rcx, [rcx + 4]
cmp eax, 0xc
jb 0x7ff715067d30
mov byte [rsp + 0x5c], sil
lea rcx, [rsp + 0x50]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
mov rbx, rax
xor edx, edx
mov cl, 0x49
call fcn.7ff71505ecc0
mov byte [rsp + 0x30], al
mov edx, 1
mov cl, 0x73
call fcn.7ff71505ecc0
mov byte [rsp + 0x31], al
mov edx, 2
mov cl, 0x44
call fcn.7ff71505ecc0
mov byte [rsp + 0x32], al
mov edx, 3
mov cl, 0x65
call fcn.7ff71505ecc0
mov byte [rsp + 0x33], al
mov edx, 4
mov cl, 0x62
call fcn.7ff71505ecc0
mov byte [rsp + 0x34], al
mov edx, 5
mov cl, 0x75
call fcn.7ff71505ecc0
mov byte [rsp + 0x35], al
mov edx, 6
mov cl, 0x67
call fcn.7ff71505ecc0
mov byte [rsp + 0x36], al
mov edx, 7
call fcn.7ff71505ecc0
mov byte [rsp + 0x37], al
mov edx, 8
mov cl, 0x65
call fcn.7ff71505ecc0
mov byte [rsp + 0x38], al
mov edx, 9
mov cl, 0x72
call fcn.7ff71505ecc0
mov byte [rsp + 0x39], al
mov edx, 0xa
mov cl, 0x50
call fcn.7ff71505ecc0
mov byte [rsp + 0x3a], al
mov edx, 0xb
mov cl, 0x72
call fcn.7ff71505ecc0
mov byte [rsp + 0x3b], al
mov edx, 0xc
mov cl, 0x65
call fcn.7ff71505ecc0
mov byte [rsp + 0x3c], al
mov edx, 0xd
mov cl, 0x73
call fcn.7ff71505ecc0
mov byte [rsp + 0x3d], al
mov edx, 0xe
mov cl, 0x65
call fcn.7ff71505ecc0
mov byte [rsp + 0x3e], al
mov edx, 0xf
mov cl, 0x6e
call fcn.7ff71505ecc0
mov byte [rsp + 0x3f], al
mov edx, 0x10
mov cl, 0x74
call fcn.7ff71505ecc0
mov byte [rsp + 0x40], al
xor eax, eax
mov byte [rsp + 0x41], al
mov r10d, esi
mov r11d, dword [rsp + 0x70]
nop dword [rax]
nop dword [rax + rax]
movsxd r9, r10d
movd xmm1, r10d
pshufd xmm1, xmm1, 0
paddd xmm1, xmm7
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd xmm0, r11d
paddb xmm1, xmm0
movd xmm0, dword [rsp + r9 + 0x30]
xorps xmm1, xmm0
movd dword [rsp + r9 + 0x30], xmm1
lea eax, [r10 + 7]
lea ecx, [r10 + 6]
lea edx, [r10 + 5]
lea r8d, [r10 + 4]
movd xmm1, eax
movd xmm2, ecx
movd xmm0, edx
movd xmm3, r8d
punpckldq xmm2, xmm1
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
andps xmm3, xmm6
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, r11d
paddb xmm3, xmm0
movd xmm0, dword [rsp + r9 + 0x34]
xorps xmm3, xmm0
movd dword [rsp + r9 + 0x34], xmm3
lea eax, [r10 + 0xb]
lea ecx, [r10 + 0xa]
lea edx, [r10 + 9]
lea r8d, [r10 + 8]
movd xmm1, eax
movd xmm2, ecx
movd xmm0, edx
movd xmm3, r8d
punpckldq xmm2, xmm1
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
andps xmm3, xmm6
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, r11d
paddb xmm3, xmm0
movd xmm0, dword [rsp + r9 + 0x38]
xorps xmm3, xmm0
movd dword [rsp + r9 + 0x38], xmm3
lea eax, [r10 + 0xf]
lea ecx, [r10 + 0xe]
lea edx, [r10 + 0xd]
lea r8d, [r10 + 0xc]
movd xmm1, eax
movd xmm2, ecx
movd xmm0, edx
movd xmm3, r8d
punpckldq xmm2, xmm1
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
andps xmm3, xmm6
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, r11d
paddb xmm3, xmm0
movd xmm0, dword [rsp + r9 + 0x3c]
xorps xmm3, xmm0
movd dword [rsp + r9 + 0x3c], xmm3
add r10d, 0x10
cmp r10d, 0x10
jb 0x7ff715067ea0
cmp r10d, 0x11
jae 0x7ff715067ffa
movsxd rax, r10d
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [r10 + 0x72]
xor byte [rcx], al
inc r10d
cmp r10d, 0x11
jb 0x7ff715067fe0
mov byte [rsp + 0x41], sil
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rdi, rax
mov qword [rsp + 0x318], rax
xor edx, edx
mov ecx, 2
call qword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x310], rax
mov dword [rsp + 0x80], 0x238
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.kernel32.dll_Process32FirstW]
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x300], esi
call qword [sym.imp.kernel32.dll_GetCurrentProcessId]
mov dword [rsp + 0x308], eax
mov r8d, dword [rsp + 0x88]
cmp eax, r8d
jne 0x7ff715068080
lea rdx, [0x7ff71506810a]
mov rcx, qword [rsp + 0x60]
call sub.VCRUNTIME140.dll__local_unwind
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.kernel32.dll_OpenProcess]
mov rbx, rax
mov qword [rsp + 0x68], rax
test rax, rax
jne 0x7ff7150680ab
lea rdx, [0x7ff71506810a]
mov rcx, qword [rsp + 0x60]
call sub.VCRUNTIME140.dll__local_unwind
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rsp + 0x300]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
test eax, eax
jne 0x7ff7150680df
lea rdx, [0x7ff71506810a]
mov rcx, qword [rsp + 0x60]
call sub.VCRUNTIME140.dll__local_unwind
mov eax, dword [rdi]
cmp dword [rsp + 0x300], eax
je 0x7ff715068101
call fcn.7ff715065f10
lea rdx, [0x7ff71506813a]
mov rcx, qword [rsp + 0x60]
call sub.VCRUNTIME140.dll__local_unwind
nop
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x310]
call qword [sym.imp.kernel32.dll_Process32NextW]
test eax, eax
je 0x7ff71506813a
xor esi, esi
mov rdi, qword [rsp + 0x318]
mov eax, dword [rsp + 0x308]
jmp 0x7ff715068062
mov rcx, qword [rsp + 0x310]
test rcx, rcx
je 0x7ff71506814d
call qword [sym.imp.kernel32.dll_CloseHandle]
movaps xmm6, xmmword [rsp + 0x2d0]
movaps xmm7, xmmword [rsp + 0x2c0]
add rsp, 0x2e0
pop rdi
pop rsi
pop rbx
ret